Authentication

// One token per booking flow; one cached token for everything else.
import { NavaApiError } from './nava-client'; // see Requests and responses

const BASE = process.env.NAVA_BASE_URL!;
const FLOW_MIN_MINUTES = 60;

export type Token = { value: string; expiresAt: number }; // expiresAt: epoch ms

let cached: Token | undefined;

async function authenticate(): Promise<Token> {
  const res = await fetch(`${BASE}/authentication/authenticate`, {
    method: 'POST',
    headers: { 'Accept-Encoding': 'gzip', 'Content-Type': 'application/json' },
    body: JSON.stringify({
      username: process.env.NAVA_USERNAME,
      password: process.env.NAVA_PASSWORD,
      micrositeId: process.env.NAVA_MICROSITE_ID,
    }),
    signal: AbortSignal.timeout(20_000),
  });
  if (!res.ok) {
    // 401: wrong password OR deleted API user (identical responses). 400: missing micrositeId.
    throw new NavaApiError('authenticate', res.status, res.headers.get('Travelc-Trace-Id') ?? undefined,
      res.headers.get('x-request-id') ?? undefined, await res.text());
  }
  const { token, expirationInSeconds } = await res.json();
  // Keep a 60 s safety margin on the stated lifetime.
  return { value: token, expiresAt: Date.now() + (expirationInSeconds - 60) * 1000 };
}

const minutesLeft = (t: Token) => (t.expiresAt - Date.now()) / 60_000;

/** Cached token for static content, booking reads and back-office jobs. */
export async function getToken(minMinutesLeft = 5): Promise<Token> {
  if (!cached || minutesLeft(cached) < minMinutesLeft) cached = await authenticate();
  return cached;
}

/**
 * Token for ONE booking flow. Pass it to every step from Quote to Book and never refresh it.
 * If it expires mid-flow, start a new flow from Quote.
 */
export async function startFlow(): Promise<Token> {
  const token = await getToken(FLOW_MIN_MINUTES);
  if (minutesLeft(token) < FLOW_MIN_MINUTES) {
    throw new Error(`Token has ${Math.floor(minutesLeft(token))} min left; a booking flow needs ${FLOW_MIN_MINUTES}`);
  }
  return token;
}

/** Outside a booking flow: one forced re-auth on 401/403, then alert and fail. */
export async function withCachedToken<T>(run: (token: string) => Promise<T>): Promise<T> {
  try {
    return await run((await getToken()).value);
  } catch (err) {
    if (!isAuthError(err)) throw err;
    cached = undefined; // force one re-authentication
    try {
      return await run((await getToken()).value);
    } catch (again) {
      if (isAuthError(again)) await alertOps('Nava API returns 401/403 after re-auth: check the API user', again);
      throw again;
    }
  }
}

const isAuthError = (e: unknown) => e instanceof NavaApiError && (e.status === 401 || e.status === 403);