//go:build linux || freebsd
// +build linux freebsd

package auth

import (
	"encoding/base64"
	"net/http"
	"net/url"
	"strings"
)

// BasicAuth adds Basic Authentication header to the request
func BasicAuth(req *http.Request, username, password string) {
	if username == "" {
		return
	}
	auth := username + ":" + password
	encoded := base64.StdEncoding.EncodeToString([]byte(auth))
	req.Header.Set("Authorization", "Basic "+encoded)
}

// ParseURLAuth extracts username/password from URL (https://user:pass@host)
func ParseURLAuth(u *url.URL) (username, password string, hasAuth bool) {
	if u == nil || u.User == nil {
		return "", "", false
	}
	username = u.User.Username()
	if username == "" {
		return "", "", false
	}
	password, hasAuth = u.User.Password()
	return username, password, true
}

// StripAuthFromURL removes credentials from URL for safe logging
func StripAuthFromURL(u *url.URL) *url.URL {
	if u == nil {
		return nil
	}
	// Clone URL to avoid modifying original
	clean := *u
	clean.User = nil
	return &clean
}

// MaskPassword returns a masked version of the password for logging
func MaskPassword(password string) string {
	if password == "" {
		return ""
	}
	if len(password) <= 4 {
		return "****"
	}
	return password[:2] + strings.Repeat("*", len(password)-2)
}

// GetAuthForURL gets credentials for a given URL (priority: CLI > URL > config)
func GetAuthForURL(cliUsername, cliPassword, configUsername, configPassword string, u *url.URL) (username, password string) {
	// 1. CLI flags have highest priority
	if cliUsername != "" {
		return cliUsername, cliPassword
	}

	// 2. URL-embedded credentials
	if urlUser, urlPass, ok := ParseURLAuth(u); ok {
		return urlUser, urlPass
	}

	// 3. Config file credentials
	if configUsername != "" {
		return configUsername, configPassword
	}

	return "", ""
}