@RegisterPlugin(
    name = "failedAuthLogger",
    description = "Logs failed authentication and authorization attempts",
    interceptPoint = InterceptPoint.REQUEST_AFTER_FAILED_AUTH,
    enabledByDefault = true)
public class FailedAuthLoggerInterceptor implements WildcardInterceptor {

    private static final Logger LOGGER = LoggerFactory.getLogger(FailedAuthLoggerInterceptor.class);

    @Override
    public void handle(Request<?> request, Response<?> response) throws Exception {
        var account = request.getAuthenticatedAccount();
        var clientIp = request.getRemoteAddress();
        var path = request.getPath();

        if (account == null) {
            // Authentication failed - no valid credentials provided
            LOGGER.warn("Authentication failed from IP: {} attempting to access: {}",
                clientIp, path);
        } else {
            // Authorization failed - valid credentials but insufficient permissions
            LOGGER.warn("Authorization failed for user: {} from IP: {} attempting to access: {}",
                account.getPrincipal(), clientIp, path);
        }
    }

    @Override
    public boolean resolve(Request<?> request, Response<?> response) {
        return true; // Intercept all failed auth attempts
    }
}

@RegisterPlugin(
    name = "bruteForceProtection",
    description = "Detects and blocks brute force attacks",
    interceptPoint = InterceptPoint.REQUEST_AFTER_FAILED_AUTH,
    enabledByDefault = true)
public class BruteForceProtectionInterceptor implements WildcardInterceptor {

    private static final Logger LOGGER = LoggerFactory.getLogger(BruteForceProtectionInterceptor.class);

    // Track failed attempts per IP
    private final LoadingCache<String, AtomicInteger> failedAttempts = Caffeine.newBuilder()
        .expireAfterWrite(15, TimeUnit.MINUTES)
        .build(key -> new AtomicInteger(0));

    private static final int MAX_ATTEMPTS = 5;
    private static final int LOCKOUT_MINUTES = 15;

    @Override
    public void handle(Request<?> request, Response<?> response) throws Exception {
        var clientIp = request.getRemoteAddress();
        var attempts = failedAttempts.get(clientIp);
        int failedCount = attempts.incrementAndGet();

        if (failedCount >= MAX_ATTEMPTS) {
            LOGGER.error("Brute force attack detected from IP: {}. {} failed attempts. " +
                "Access blocked for {} minutes.",
                clientIp, failedCount, LOCKOUT_MINUTES);

            // Optionally: modify response to indicate account lockout
            response.setStatusCode(429); // Too Many Requests
            response.setContent(BsonDocument.parse(
                "{\"error\": \"Too many failed authentication attempts. " +
                "Account temporarily locked.\"}"
            ));
        } else {
            LOGGER.warn("Failed authentication from IP: {}. Attempt {}/{}",
                clientIp, failedCount, MAX_ATTEMPTS);
        }
    }

    @Override
    public boolean resolve(Request<?> request, Response<?> response) {
        // Only trigger for authentication failures (not authorization)
        return request.getAuthenticatedAccount() == null;
    }
}

@RegisterPlugin(
    name = "friendlyAuthErrorResponder",
    description = "Provides user-friendly error messages for auth failures",
    interceptPoint = InterceptPoint.REQUEST_AFTER_FAILED_AUTH,
    enabledByDefault = true)
public class FriendlyAuthErrorInterceptor implements WildcardInterceptor {

    @Override
    public void handle(Request<?> request, Response<?> response) throws Exception {
        var account = request.getAuthenticatedAccount();

        BsonDocument errorResponse;

        if (account == null) {
            // Authentication failed
            errorResponse = BsonDocument.parse("""
                {
                    "error": "Invalid username or password",
                    "code": "AUTH_FAILED",
                    "message": "Please check your credentials and try again."
                }
                """);
        } else {
            // Authorization failed
            errorResponse = BsonDocument.parse("""
                {
                    "error": "Access denied",
                    "code": "INSUFFICIENT_PERMISSIONS",
                    "message": "You do not have permission to access this resource.",
                    "requiredRole": "admin"
                }
                """);
        }

        response.setContent(errorResponse);
    }

    @Override
    public boolean resolve(Request<?> request, Response<?> response) {
        return true; // Apply to all failed auth attempts
    }
}