package middleware

import (
	"net/http"

	"github.com/gin-gonic/gin"

	"github.com/gochat/gochat/internal/auth"
	"github.com/gochat/gochat/pkg/response"
)

// WebhookAuth validates webhook tokens for channel callback routes.
// Reference: P2E §4 — webhook authentication per channel type
func WebhookAuth(registry *auth.WebhookTokenRegistry) gin.HandlerFunc {
	return func(c *gin.Context) {
		if registry == nil {
			response.AbortWithStatusError(c, http.StatusUnauthorized, response.ErrUnauthorized, "Webhook registry not configured")
			return
		}

		channelType := c.Param("channel_type")
		identifier := c.Param("identifier")

		valid, err := registry.Validate(channelType, identifier, c.Request)
		if err != nil || !valid {
			response.AbortWithStatusError(c, http.StatusUnauthorized, response.ErrUnauthorized, "Invalid webhook token")
			return
		}
		c.Next()
	}
}