import 'dart:convert';

import 'package:crypto/crypto.dart';

import 'nextcloud_credentials.dart';

/// The signed-in account. Exactly one session is active at a time; features
/// check for the backend identities they need ([nextcloud]) instead of
/// assuming every account has all of them.
sealed class Session {
  /// Local demo session: every backend is served from fixtures (see DemoMode).
  final bool isDemo;

  const Session({this.isDemo = false});

  /// Nextcloud identity, or null for accounts without one (guardians).
  NextcloudCredentials? get nextcloud;
}

/// Student, teacher or staff account: username + password, backed by
/// MarianumConnect and Nextcloud (with the same username and password).
final class CredentialSession extends Session {
  @override
  final NextcloudCredentials nextcloud;

  CredentialSession({
    required String username,
    required String password,
    String? appPassword,
    String? appPasswordTalk,
    bool usesLoginFlow = false,
    super.isDemo,
  }) : nextcloud = NextcloudCredentials(
         username: username,
         password: password,
         appPassword: appPassword,
         appPasswordTalk: appPasswordTalk,
         usesLoginFlow: usesLoginFlow,
       );

  const CredentialSession._(this.nextcloud, {super.isDemo});

  String get username => nextcloud.username;

  String get password => nextcloud.password;

  CredentialSession withNextcloud(NextcloudCredentials nextcloud) =>
      CredentialSession._(nextcloud, isDemo: isDemo);

  /// Legacy MHSL identity (`sha512(user:pass)`), only for the one-off custom
  /// events migration.
  String get legacyUserSecret =>
      sha512.convert(utf8.encode('$username:$password')).toString();
}

/// Parent/guardian account: passwordless e-mail login, MarianumConnect only.
final class GuardianSession extends Session {
  final String email;

  const GuardianSession({required this.email, super.isDemo});

  @override
  NextcloudCredentials? get nextcloud => null;
}

/// Thrown when a Nextcloud-only feature is reached with a session that has no
/// Nextcloud identity. Indicates a missing gate, not a user error.
class NextcloudUnavailableException implements Exception {
  const NextcloudUnavailableException();

  @override
  String toString() =>
      'NextcloudUnavailableException: session has no Nextcloud account';
}