/**
 * Handler that will be called during the execution of a PostLogin flow.
 *
 * @param {Event} event - Details about the user and the context in which they are logging in.
 * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.
 */
const axios = require('axios');

exports.onExecutePostLogin = async (event, api) => {
  // Filter refresh token event to not send these events to Athos
  if (event.request.query?.prompt === 'none' || event.transaction?.protocol === 'oauth2-refresh-token') {
    return;
  }

  const strategy = event.connection?.strategy;
  const isLocalAuth = strategy === 'auth0';
  const authType = isLocalAuth ? 'local' : 'social';
  let socialProvider = undefined;
  if (strategy && !isLocalAuth) {
    switch (strategy) {
      case "facebook":
      case "apple":
      case "twitter":
      case "linkedin":
      case "github":
      case "yahoo":
      case "amazon":
        socialProvider = strategy;
        break;
      case "google-oauth2":
      case "google-apps":
        socialProvider = "google";
        break;
      case "waad":
      case "ad":
      case "adfs":
      case "office365":
      case "windowslive":
      case "yammer":
      case "sharepoint":
        socialProvider = "microsoft";
        break;
      default:
        socialProvider = "other";
        break;
    }
  }

  // Derive the first-factor authentication mode from event.authentication.methods
  const authMethods = event.authentication?.methods ?? [];
  const firstFactor = authMethods.find(m => m.name !== 'mfa');
  let authMode = "other";
  if (firstFactor?.name === 'pwd' || firstFactor?.name == 'passkey') {
    authMode = "password";
  } else if (firstFactor?.name === 'email') {
    authMode = "mail";
  }

  const session = {};
  if (event.session) {
    session.id = event.session.id,
    session.createdAt = event.session.created_at;
  };

  const payload = {
    account: event.user.email ?? event.user.user_id,
    status: "succeeded",
    module: {
      requestTimeMicros: new Date().getTime()*1000,
      name: "Fraud SDK Auth0",
      version: "1.0.0"
    },
    header: {
      addr: event.request.ip,
      method: event.request.method,
      host: event.request.hostname,
      port: 443,
      protocol: "https",
      userAgent: event.request.user_agent,
    },
    user: {
      id: event.user.user_id
    },
    authentication: {
      type: authType,
      ...(socialProvider && { socialProvider }),
      ...(authMode && { mode: authMode }),
    },
    accountCreationDate: event.user.created_at,
    session
  };

  const config = {
    headers: {
      'x-api-key': event.secrets.FRAUD_API_KEY,
      'Content-type': 'application/json'
    },
    timeout: 1500,
  };

  try {
    const res = await axios.post('https://account-api.datadome.co/v1/validate/login', payload, config);
    if (res.status === 200 && res.data?.action === 'deny') { // deny login only if return 200 & action = deny.
      // Custom actions
    }
  } catch (error) {
    console.log(error);
  }
};

/**
* Handler that will be called during the execution of a PreUserRegistration flow.
*
* @param {Event} event - Details about the context and user that is attempting to register.
* @param {PreUserRegistrationAPI} api - Interface whose methods can be used to change the behavior of the signup.
*/
const axios = require("axios");

exports.onExecutePreUserRegistration = async (event, api) => {
 const strategy = event.connection?.strategy;
  const isLocalAuth = strategy === 'auth0';
  const authType = isLocalAuth ? 'local' : 'social';
  let socialProvider = undefined;
  if (strategy && !isLocalAuth) {
    switch (strategy) {
      case "facebook":
      case "apple":
      case "twitter":
      case "linkedin":
      case "github":
      case "yahoo":
      case "amazon":
        socialProvider = strategy;
        break;
      case "google-oauth2":
      case "google-apps":
        socialProvider = "google";
        break;
      case "waad":
      case "ad":
      case "adfs":
      case "office365":
      case "windowslive":
      case "yammer":
      case "sharepoint":
        socialProvider = "microsoft";
        break;
      default:
        socialProvider = "other";
        break;
    }
  }

  // Derive the first-factor authentication mode from event.authentication.methods
  const authMethods = event.authentication?.methods ?? [];
  const firstFactor = authMethods.find(m => m.name !== 'mfa');
  let authMode = "other";
  if (firstFactor?.name === 'pwd' || firstFactor?.name == 'passkey') {
    authMode = "password";
  } else if (firstFactor?.name === 'email') {
    authMode = "mail";
  }

  const payload = {
    account: event.user.email,
    status: "succeeded",
    module: {
      requestTimeMicros: new Date().getTime()*1000,
      name: "Fraud SDK Auth0",
      version: "1.0.0"
    },
    header: {
      addr: event.request.ip,
      method: event.request.method,
      host: event.request.hostname,
      port: 443,
      protocol: "https",
      userAgent: event.request.user_agent,
    },
    user: {
      id: event.user.email,
      email: event.user.email,
      lastName: event.user.family_name,
      firstName: event.user.given_name,
      displayName: event.user.name,
      phone: event.user.phone_number,
      pictureUrls: [event.user.picture],
    },
    authentication: {
      type: authType,
      ...(socialProvider && { socialProvider }),
      ...(authMode && { mode: authMode }),
    }
  };

  const config = {
    headers: {
      'x-api-key': event.secrets.FRAUD_API_KEY,
      'Content-type': 'application/json'
    },
    timeout: 1500,
  };

  try {
    const res = await axios.post('https://account-api.datadome.co/v1/validate/registration', payload, config);
    if (res.status === 200 && res.data?.action === 'deny') { // deny login only if return 200 & action = deny.
      // Custom actions
    }
  } catch (error) {
    console.log(error);
  }
};

/**
 * Handler that will be called during the execution of a Password Reset / Post Challenge Flow.
 *
 * @param {Event} event - Details about the post challenge request.
 * @param {PasswordResetPostChallengeAPI} api - Interface whose methods can be used to change the behavior of the post challenge flow.
 */
const axios = require("axios");

exports.onExecutePostChallenge = async (event, api) => {
  const strategy = event.connection?.strategy;
  const isLocalAuth = strategy === 'auth0';
  const authType = isLocalAuth ? 'local' : 'social';
  let socialProvider = undefined;
  if (strategy && !isLocalAuth) {
    switch (strategy) {
      case "facebook":
      case "apple":
      case "twitter":
      case "linkedin":
      case "github":
      case "yahoo":
      case "amazon":
        socialProvider = strategy;
        break;
      case "google-oauth2":
      case "google-apps":
        socialProvider = "google";
        break;
      case "waad":
      case "ad":
      case "adfs":
      case "office365":
      case "windowslive":
      case "yammer":
      case "sharepoint":
        socialProvider = "microsoft";
        break;
      default:
        socialProvider = "other";
        break;
    }
  }

  // Derive the first-factor authentication mode from event.authentication.methods
  const authMethods = event.authentication?.methods ?? [];
  const firstFactor = authMethods.find(m => m.name !== 'mfa');
  let authMode = "other";
  if (firstFactor?.name === 'pwd' || firstFactor?.name == 'passkey') {
    authMode = "password";
  } else if (firstFactor?.name === 'email') {
    authMode = "mail";
  }

  const payload = {
    account: event.user.email,
    reason: "forgotPassword",
    status: "attempted",
    module: {
      requestTimeMicros: new Date().getTime()*1000,
      name: "Fraud SDK Auth0",
      version: "1.0.0"
    },
    header: {
      addr: event.request.ip,
      method: event.request.method,
      host: event.request.hostname,
      port: 443,
      protocol: "https",
      userAgent: event.request.user_agent
    },
    user: {
      id: event.user.email,
    },
    accountCreationDate: event.user.created_at,
    authentication: {
      type: authType,
      ...(socialProvider && { socialProvider }),
      ...(authMode && { mode: authMode }),
    }
  };

  const config = {
    headers: {
      'x-api-key': event.secrets.FRAUD_API_KEY,
      'Content-type': 'application/json'
    },
    timeout: 1500,
  };

  try {
    const res = await axios.post('https://account-api.datadome.co/v1/validate/password/update', payload, config);
    if (res.status === 200 && res.data?.action === 'deny') { // deny login only if return 200 & action = deny.
      // Custom actions
    }
  } catch (error) {
    console.log(error);
  }
};


/**
 * Handler that will be invoked when this action is resuming after an external redirect. If your
 * onExecutePostChallenge function does not perform a redirect, this function can be safely ignored.
 *
 * @param {Event} event - Details about the user and the context in which they are logging in.
 * @param {PasswordResetPostChallengeAPI} api - Interface whose methods can be used to change the behavior of the post challenge flow.
 */
// exports.onContinuePostChallenge = async (event, api) => {
// };