package httpapi

import (
	"net/http"
	"net/url"
)

// NewAuthCompatibilityHandler preserves the legacy external-login endpoints
// after platform password login became the only supported authentication flow.
func NewAuthCompatibilityHandler() http.Handler { return authCompatibilityHandler{} }

type authCompatibilityHandler struct{}

func (authCompatibilityHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	if r.URL.Path != "/api/auth/login" && r.URL.Path != "/api/auth/callback" && r.URL.Path != "/api/auth/captcha" {
		http.NotFound(w, r)
		return
	}
	if r.Method != http.MethodGet {
		w.Header().Set("Allow", http.MethodGet)
		w.WriteHeader(http.StatusMethodNotAllowed)
		return
	}
	if r.URL.Path == "/api/auth/captcha" {
		writeJSON(w, http.StatusOK, map[string]any{"enabled": false, "message": "平台账号登录不使用外部验证码。"})
		return
	}
	location := "/auth/login"
	if r.URL.Path == "/api/auth/callback" {
		location += "?error=callback_failed"
	}
	if base, err := url.Parse(absoluteRequestURL(r)); err == nil && base.IsAbs() {
		base.Path, base.RawPath, base.RawQuery, base.Fragment = "/auth/login", "", "", ""
		if r.URL.Path == "/api/auth/callback" {
			base.RawQuery = "error=callback_failed"
		}
		location = base.String()
	}
	w.Header().Set("Location", location)
	w.WriteHeader(http.StatusTemporaryRedirect)
}