"""
Cookie Utilities for Authentication

Handles HttpOnly cookie creation for JWT tokens.
Supports both access and refresh tokens with appropriate security settings.

Author: Claude (Jarvis)
Date: 2025-11-27
"""

from fastapi import Response

from app.config import get_settings

settings = get_settings()

# Cookie configuration
ACCESS_TOKEN_COOKIE = "pd_access_token"
REFRESH_TOKEN_COOKIE = "pd_refresh_token"
ACCESS_TOKEN_MAX_AGE = 60 * 60 * 24  # 24 hours
REFRESH_TOKEN_MAX_AGE = 60 * 60 * 24 * 7  # 7 days


def is_secure_context() -> bool:
    """
    Check if cookies should use Secure flag.

    Returns True ONLY if APP_ENV is 'production'.

    In development, we don't set Secure flag even if FRONTEND_URL is HTTPS,
    because the WebSocket may connect to localhost (HTTP) and secure cookies
    won't be sent over HTTP connections.

    For production deployments behind HTTPS reverse proxy, set APP_ENV=production.
    """
    return getattr(settings, "app_env", "development") == "production"


def set_auth_cookies(
    response: Response,
    access_token: str,
    refresh_token: str,
) -> None:
    """
    Set both access and refresh token cookies on response.

    Security settings:
    - HttpOnly: Prevents XSS access to tokens
    - Secure: Respects APP_ENV (false in dev, true in prod)
    - SameSite: "lax" in dev (localhost), "none" in prod (cross-origin)
    - Path: Limits cookie scope

    Note: In production with SameSite=None, Secure=true is required.
    In development (localhost), we use SameSite=Lax which doesn't require Secure.

    Args:
        response: FastAPI Response object
        access_token: JWT access token
        refresh_token: JWT refresh token
    """
    secure = is_secure_context()
    samesite = "none" if secure else "lax"

    # Access token - short-lived, sent to all requests (needed for SSR cookie forwarding)
    response.set_cookie(
        key=ACCESS_TOKEN_COOKIE,
        value=access_token,
        max_age=ACCESS_TOKEN_MAX_AGE,
        httponly=True,
        secure=secure,
        samesite=samesite,
        path="/",
    )

    # Refresh token - long-lived, restricted to auth endpoints only
    response.set_cookie(
        key=REFRESH_TOKEN_COOKIE,
        value=refresh_token,
        max_age=REFRESH_TOKEN_MAX_AGE,
        httponly=True,
        secure=secure,
        samesite=samesite,
        path="/api/auth",
    )


def clear_auth_cookies(response: Response) -> None:
    """
    Clear all auth cookies (logout).

    Args:
        response: FastAPI Response object
    """
    response.delete_cookie(key=ACCESS_TOKEN_COOKIE, path="/")
    response.delete_cookie(key=REFRESH_TOKEN_COOKIE, path="/api/auth")
