package store

import (
	"database/sql"
	"time"

	"golang.org/x/oauth2"
)

// GetOAuthToken returns the stored token for a source (e.g. "google_tasks"),
// or nil if none has been saved yet (integration not connected).
func (s *Store) GetOAuthToken(source string) (*oauth2.Token, error) {
	var accessToken, refreshToken, tokenType string
	var expiry sql.NullTime
	err := s.db.QueryRow(`
		SELECT access_token, refresh_token, token_type, expiry FROM oauth_tokens WHERE source = ?
	`, source).Scan(&accessToken, &refreshToken, &tokenType, &expiry)
	if err == sql.ErrNoRows {
		return nil, nil
	}
	if err != nil {
		return nil, err
	}
	tok := &oauth2.Token{
		AccessToken:  accessToken,
		RefreshToken: refreshToken,
		TokenType:    tokenType,
	}
	if expiry.Valid {
		tok.Expiry = expiry.Time
	}
	return tok, nil
}

// SaveOAuthToken upserts the token for a source. A refreshed token from
// oauth2.TokenSource sometimes omits RefreshToken (Google only returns it
// on the initial grant) -- callers must pass the original refresh token
// through if the new one is empty, since ON CONFLICT here always
// overwrites rather than preserving the old value.
func (s *Store) SaveOAuthToken(source string, tok *oauth2.Token) error {
	var expiry *time.Time
	if !tok.Expiry.IsZero() {
		expiry = &tok.Expiry
	}
	_, err := s.db.Exec(`
		INSERT INTO oauth_tokens (source, access_token, refresh_token, token_type, expiry, updated_at)
		VALUES (?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
		ON CONFLICT(source) DO UPDATE SET
			access_token = excluded.access_token,
			refresh_token = excluded.refresh_token,
			token_type = excluded.token_type,
			expiry = excluded.expiry,
			updated_at = CURRENT_TIMESTAMP
	`, source, tok.AccessToken, tok.RefreshToken, tok.TokenType, expiry)
	return err
}

// DeleteOAuthToken removes a source's stored token (disconnect).
func (s *Store) DeleteOAuthToken(source string) error {
	_, err := s.db.Exec(`DELETE FROM oauth_tokens WHERE source = ?`, source)
	return err
}