"""
OIDC-Authentifizierung via Authlib und Zitadel.

Konfiguriert den OAuth2-Client und stellt ``login_required`` sowie
``role_required`` als Route-Guard-Dekoratoren bereit.

:author:  <Vorname Nachname>
:date:    2026-06-17
:version: 0.1
"""

import logging
from functools import wraps
from authlib.integrations.flask_client import OAuth
from flask import session, redirect, url_for

logger = logging.getLogger(__name__)
oauth = OAuth()


def init_oauth(app):
    oauth.init_app(app)
    oauth.register(
        name="zitadel",
        server_metadata_url=app.config["ZITADEL_SERVER_METADATA_URL"],
        client_id=app.config["ZITADEL_CLIENT_ID"],
        client_secret=app.config["ZITADEL_CLIENT_SECRET"],
        client_kwargs={"scope": "openid profile email"},
    )


def get_current_user():
    return session.get("user")


def login_required(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        if not session.get("user"):
            return redirect(url_for("main.login"))
        return f(*args, **kwargs)
    return decorated


def role_required(*roles):
    def decorator(f):
        @wraps(f)
        def decorated(*args, **kwargs):
            user = session.get("user")
            if not user:
                return redirect(url_for("main.login"))
            if user.get("role") not in roles:
                return redirect(url_for("main.error"))
            return f(*args, **kwargs)
        return decorated
    return decorator