<?php

namespace App\Services\OpenStack;

use Illuminate\Support\Facades\Cache;
use Illuminate\Support\Facades\Http;
use RuntimeException;

/**
 * Authentification OpenStack partagée par NovaClient (étape 9) et HeatClient
 * (étape 10), pour le compte de service `paillasse-service` (étape 6).
 *
 * Par mot de passe, pas par application credential : voir config/openstack.php
 * pour pourquoi (Heat a besoin de créer un trust Keystone, ce qu'une
 * application credential ne peut jamais faire).
 */
class KeystoneAuth
{
    public function jeton(): string
    {
        return $this->authentifier()['jeton'];
    }

    public function projetId(): string
    {
        return $this->authentifier()['projet_id'];
    }

    /**
     * @return array{jeton: string, projet_id: string}
     */
    private function authentifier(): array
    {
        return Cache::remember('openstack.authentification', now()->addMinutes(50), function () {
            $reponse = Http::post(config('openstack.auth_url').'/v3/auth/tokens', [
                'auth' => [
                    'identity' => [
                        'methods' => ['password'],
                        'password' => [
                            'user' => [
                                'name' => config('openstack.username'),
                                'domain' => ['id' => 'default'],
                                'password' => config('openstack.password'),
                            ],
                        ],
                    ],
                    'scope' => [
                        'project' => [
                            'name' => config('openstack.project_name'),
                            'domain' => ['id' => 'default'],
                        ],
                    ],
                ],
            ]);

            if ($reponse->failed()) {
                throw new RuntimeException('Authentification OpenStack refusée : '.$reponse->body());
            }

            return [
                'jeton' => $reponse->header('X-Subject-Token'),
                'projet_id' => $reponse->json('token.project.id'),
            ];
        });
    }
}