"""Setzen und Löschen der Authentifizierungs-Cookies."""

from datetime import UTC, datetime

from fastapi import Response

from app.core.config import settings

ACCESS_COOKIE = "moneyfy_access"
REFRESH_COOKIE = "moneyfy_refresh"

# Der Refresh-Cookie wird nur an die Endpunkte geschickt, die ihn wirklich brauchen.
REFRESH_COOKIE_PATH = "/api/auth"


def set_auth_cookies(
    response: Response,
    access_token: str,
    access_expires_at: datetime,
    refresh_token: str,
    refresh_expires_at: datetime,
) -> None:
    """Legt beide Cookies als httpOnly/SameSite=Lax ab."""
    now = datetime.now(UTC)
    response.set_cookie(
        ACCESS_COOKIE,
        access_token,
        max_age=max(int((access_expires_at - now).total_seconds()), 0),
        httponly=True,
        secure=settings.cookie_secure,
        samesite="lax",
        path="/",
        domain=settings.cookie_domain,
    )
    response.set_cookie(
        REFRESH_COOKIE,
        refresh_token,
        max_age=max(int((refresh_expires_at - now).total_seconds()), 0),
        httponly=True,
        secure=settings.cookie_secure,
        samesite="lax",
        path=REFRESH_COOKIE_PATH,
        domain=settings.cookie_domain,
    )


def clear_auth_cookies(response: Response) -> None:
    """Entfernt beide Cookies – muss dieselben Attribute wie beim Setzen verwenden."""
    response.delete_cookie(
        ACCESS_COOKIE,
        path="/",
        domain=settings.cookie_domain,
        httponly=True,
        secure=settings.cookie_secure,
        samesite="lax",
    )
    response.delete_cookie(
        REFRESH_COOKIE,
        path=REFRESH_COOKIE_PATH,
        domain=settings.cookie_domain,
        httponly=True,
        secure=settings.cookie_secure,
        samesite="lax",
    )