# test
# @requires connect.cookieParser
# @requires connect.query
# @requires connect.session
url = require 'url'

module.exports = class

	# routing

	paths_signup: '/signup'
	paths_login: '/login'
	paths_logout: '/logout'
	paths_redirect: '/'

	# access

	access_whitelist: []
	access_blacklist: []

	# actions

	do_signup: (req, res, cb) ->
			@users ?= []
			if req.body
				cb @users.push
					username: req.body.username
					password: req.body.password
			else
				cb false

	do_login: (req, res) ->
			req.session.username = req.query.username

	do_logout: (req, res) ->
			req.session.destroy()

	# verification

	verify_credentials: (req, res, cb) ->
			if Object.keys(req.query).length and @users
				for u in @users
					if u.username == req.query.username and u.password == req.query.password
						return cb u
			cb false

	verify_authorized: (req, res) ->
			req.session?.username

	# render

	render_unauthorized: (req, res, next) ->
		res.writeHead 403, 'Content-Type': 'text/html'
		res.end 'unauthorized yano? <a href="' + @paths_login + '">login</a>'

	render_login: (req, res, next) ->
		res.writeHead 200, 'Content-Type': 'text/html'
		res.end 'login <form method="GET" action="' + @paths_login + '">
			<input name="username" /><input type="password" name="password" />
			<input type="submit" name="submit" /></form>'

	render_signup: (req, res, next) ->
		res.writeHead 200, 'Content-Type': 'text/html'
		res.end 'login <form method="POST" action="' + @paths_signup + '">
			<input name="username" /><input type="password" name="password" />
			<input type="submit" name="submit" /></form>'

	# middleware

	connect: ->

		return (req, res, next) =>

			parsed_url = url.parse req.url, true
			path = parsed_url.pathname

			# logout takes priority over other actions because otherwise
			# whitelist may pass on it or authorized check may override it
			if path == @paths_logout
				@do_logout req, res
				res.writeHead 302, 'Location': @paths_login
				return res.end()

			# if it's in whitelist, we will move on regardless
			if @access_whitelist.indexOf(path) > -1
				return next()

			# if user is already verified, we will move on regardless
			if @verify_authorized req, res
				return next()

			# if they are trying to access login, we will move on regardless
			if path == @paths_login
				return @verify_credentials req, res, (verified) =>
					if verified
						@do_login req, res
						res.writeHead 302, 'Location': @paths_redirect
						res.end()
					else
						return @render_login req, res, next

			# if they are trying to access signup, we will move on regardless
			if path == @paths_signup
				return @do_signup req, res, (created) =>
					if created
						res.writeHead 302, 'Location': @paths_redirect
						res.end()
					else
						return @render_signup req, res, next

			# if there is no blacklist, we auth every request
			# if there is a blacklist, we only auth requests in the list
			if not @access_blacklist.length or @access_blacklist.indexOf(path) > -1
				return @render_unauthorized req, res, next

			# weird config if this happens, it probably shouldn't
			return next()