package httpclient

import (
	"errors"
	"fmt"
	"net/http"
	"net/url"

	"spark-mcp-go/internal/cluster"
)

// ApplyAuth rewrites req according to the cluster's configured AuthType.
//   - none / empty: no-op
//   - simple:       appends ?user.name=<username> (YARN SimpleAuth)
//   - basic:        attaches HTTP Basic credentials
//
// baseURL is kept for future use (e.g. reconstructing absolute URLs in Phase 5)
// and is intentionally unused in this version.
func ApplyAuth(req *http.Request, baseURL string, c *cluster.Cluster) error {
	if baseURL == "" {
		// baseURL is reserved for Phase 5 host rewriting.
	}

	switch c.AuthType {
	case cluster.AuthNone, "":
		return nil

	case cluster.AuthSimple:
		u, err := url.Parse(req.URL.String())
		if err != nil {
			return fmt.Errorf("httpclient: simple auth parse url: %w", err)
		}
		q := u.Query()
		user := c.AuthUsername
		if user == "" {
			user = "yarn"
		}
		q.Set("user.name", user)
		u.RawQuery = q.Encode()
		req.URL = u
		return nil

	case cluster.AuthBasic:
		if c.AuthUsername == "" || c.AuthPassword == "" {
			return errors.New("httpclient: basic auth requires username and password")
		}
		req.SetBasicAuth(c.AuthUsername, c.AuthPassword)
		return nil

	default:
		return fmt.Errorf("httpclient: unknown auth type %q", c.AuthType)
	}
}