package cli

import (
	"context"
	"fmt"
	"os"

	"github.com/urfave/cli/v3"

	"git.morlana.online/f.weber/vault-tui/internal/token"
)

func logoutCommand() *cli.Command {
	return &cli.Command{
		Name:  "logout",
		Usage: "forget the saved token (does not revoke it in Vault unless -revoke is given)",
		Flags: []cli.Flag{
			&cli.BoolFlag{Name: "revoke", Usage: "also revoke the token in Vault"},
		},
		Action: func(ctx context.Context, cmd *cli.Command) error {
			a, err := appFrom(ctx)
			if err != nil {
				return err
			}
			revoke := cmd.Bool("revoke")
			if p := a.File.Profiles[a.Settings.Profile]; p != nil && p.Token.RevokeOnLogout != nil {
				revoke = revoke || *p.Token.RevokeOnLogout
			}
			if revoke {
				if _, err := a.EnsureLoggedIn(ctx, cmd.String("token")); err != nil {
					fmt.Fprintf(os.Stderr, "warning: could not verify token before revoking: %v\n", err)
				}
				if err := token.RevokeSelf(ctx, a.Client, a.Store); err != nil {
					return fmt.Errorf("revoking token: %w", err)
				}
				fmt.Println("Token revoked and forgotten.")
				return nil
			}
			if err := a.Store.Erase(ctx); err != nil {
				return fmt.Errorf("erasing token from %s: %w", a.Store.Location(), err)
			}
			fmt.Println("Token forgotten (not revoked in Vault).")
			return nil
		},
	}
}