using System.Collections.Generic;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http;

namespace AyaNova.Api.ControllerHelpers
{
    /// <summary>
    /// case 4725: with a purchased licence, a SuperUser still using the default password may only change it:
    /// these are the routes the change password page and the app shell need. Everything else answers 403
    /// until the password is changed.
    /// See devdocs/modernization/SECURITY-REVIEW.md, F9.
    /// </summary>
    internal static class SuperUserDefaultPasswordRoutes
    {
        //"METHOD route template" with the API prefix removed, exactly as in the controllers' attributes
        private static readonly HashSet<string> Allowed = new HashSet<string>
        {
            "POST auth/change-password",
            "GET user-option/{id}",
            "GET global-biz-setting/client",
            "GET enum-list/list/{enumkey}",
            "GET form-custom/{formkey}",
            "GET translation/list",
            "POST translation/subset",
            "GET server-info",
            "GET notify/new-count",
            "GET notify/app-notifications",
        };

        internal static bool IsAllowed(HttpContext context)
        {
            var endpoint = context.GetEndpoint();
            if (endpoint == null)
                return true;//not routed to anything: the request ends in a 404 regardless
            if (endpoint.Metadata.GetMetadata<IAllowAnonymous>() != null)
                return true;
            var key = CustomerContactRoutes.RouteKey(context);
            return key != null && Allowed.Contains(key);
        }
    }
}