package identityprovider

import (
	"gorm.io/gorm/clause"
	"vpn-platform/backend/internal/model"
	"vpn-platform/backend/internal/service"
	"vpn-platform/backend/internal/store"
)

func saveProfile(base string, cfg model.IdentityProvider, user accessData) error {
	return store.DB.Clauses(clause.OnConflict{
		Columns: []clause.Column{{Name: "issuer"}, {Name: "app_id"}, {Name: "subject"}},
		DoUpdates: clause.AssignmentColumns([]string{"name", "updated_at"}),
	}).Create(&model.IdentityProfile{Issuer: base, AppID: cfg.AppID, Subject: user.Subject, Name: user.Name}).Error
}

// ProfileNames returns verified display names only for the current built-in
// application and exact issuer. Never resolve an identity by IP or name.
func ProfileNames(tunnel *model.Tunnel, subjects []string) map[string]string {
	names := map[string]string{}
	if store.DB == nil || len(subjects) == 0 || tunnel.Protocol != "openvpn" {
		return names
	}
	cfg, err := store.TunnelConfig(tunnel)
	if err != nil || service.Str(cfg, "auth_mode") != "oidc" || service.Str(cfg, "oidc_provider") != "builtin" {
		return names
	}
	idp, err := current()
	if err != nil || !idp.Enabled {
		return names
	}
	var profiles []model.IdentityProfile
	if store.DB.Where("issuer = ? AND app_id = ? AND subject IN ?", service.Str(cfg, "oidc_issuer"), idp.AppID, subjects).Find(&profiles).Error != nil {
		return names
	}
	for _, profile := range profiles {
		names[profile.Subject] = profile.Name
	}
	return names
}