import { injectable } from "@codemation/core";
import type { MiddlewareHandler } from "hono";

@injectable()
export class ManagedCorsMiddleware {
  private readonly allowedOrigins: ReadonlySet<string>;

  constructor(allowedOrigin: string) {
    this.allowedOrigins = new Set(
      allowedOrigin
        .split(",")
        .map((o) => o.trim())
        .filter(Boolean),
    );
  }

  private isAllowed(origin: string | undefined): origin is string {
    return origin !== undefined && this.allowedOrigins.has(origin);
  }

  handle(): MiddlewareHandler {
    return async (c, next) => {
      const origin = c.req.header("origin");

      if (c.req.method === "OPTIONS") {
        if (this.isAllowed(origin)) {
          c.header("access-control-allow-origin", origin);
          c.header("access-control-allow-methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
          c.header("access-control-allow-headers", "content-type, authorization");
          c.header("access-control-allow-credentials", "true");
          c.header("vary", "Origin");
          return c.body(null, 204);
        }
        return c.body(null, 403);
      }

      if (this.isAllowed(origin)) {
        await next();
        c.header("access-control-allow-origin", origin);
        c.header("access-control-allow-credentials", "true");
        c.header("vary", "Origin");
        return;
      }

      await next();
    };
  }
}