import Foundation
import WebKit

/// The web view signs in; everything else rides on what that left behind.
///
/// ipx authenticates a request by cookie -- `ipx_session` from its own sign-in form, and
/// `CF_Authorization` from Cloudflare Access in front of the tunnel. The auth layer was built that
/// way so a plain `<audio src>` would work, and it is why the native player needs no API of its
/// own. But `AVPlayer` and `URLSession` read `HTTPCookieStorage.shared`, and `WKWebView` keeps its
/// own store, so the two have to be kept in step.
final class CookieBridge: NSObject, WKHTTPCookieStoreObserver {
    private let store: WKHTTPCookieStore
    private(set) var cookies: [HTTPCookie] = []

    init(store: WKHTTPCookieStore) {
        self.store = store
        super.init()
        store.add(self)
        sync()
    }

    func cookiesDidChange(in cookieStore: WKHTTPCookieStore) { sync() }

    /// Copy everything across. Cheap, and it runs only when the web view's store changes --
    /// a sign-in, or Access handing out a fresh token.
    func sync(then done: (() -> Void)? = nil) {
        store.getAllCookies { [weak self] all in
            guard let self else { return }
            self.cookies = all
            for c in all { HTTPCookieStorage.shared.setCookie(c) }
            done?()
        }
    }

    /// The cookies for one request, as `AVURLAsset` wants them.
    func cookies(for url: URL) -> [HTTPCookie] {
        cookies.filter { c in
            guard let host = url.host else { return false }
            let domain = c.domain.hasPrefix(".") ? String(c.domain.dropFirst()) : c.domain
            guard host == domain || host.hasSuffix("." + domain) else { return false }
            // A Secure cookie over plain HTTP is not sent, which is the whole point of the flag.
            if c.isSecure && url.scheme != "https" { return false }
            return url.path.hasPrefix(c.path) || c.path == "/"
        }
    }
}