export function getPrimaryKeyField(model: IModel): string {
  const pkConstraint = model.spec.db!.constrain.find(
    constraint => constraint.type === ConstraintType.Primary,
  )!

  assert.ok(pkConstraint, 'missing primary key constraint')
  assert.ok(pkConstraint.properties.length === 1, 'multi-column primary key not supported')
  const propertyPath = pkConstraint.properties[0]
  assert.ok(propertyPath.length === 1, 'primary key cannot be nested')
  return propertyPath[0]
}

function assertValidCriteria(criteria: string | ICriteriaDefinition): void {
  if (criteria === '*') return
  assert.ok(
    typeof criteria === 'object' && !Array.isArray(criteria) && Object.keys(criteria).length,
    'invalid criteria',
  )
}

export async function doPasswordsMatch(
  plaintext: string,
  hashedPasswordWithSalt: string,
  options: IPasswordOptions,
): Promise<boolean> {
  const [hash, salt] = hashedPasswordWithSalt.split(SALT_DELIMITER)
  assert.ok(hash.length === options.hashedPasswordLength, 'incompatible hash length')
  return hash === (await hashPasswordAsync(plaintext, salt, options))
}

export function forEachColumn(model: IModel, onEach: ColumnIterator, prefix: string[] = []): void {
  const children = model.spec.children as IModelChild[]
  assert.ok(
    model.spec.type === 'object' && model.spec.strict,
    'can only create datatypes for strict objects',
  )
  assert.ok(children && children.length, 'can only create datatypes for objects with children')

  for (const child of children) {
    const spec = child.model.spec
    const fullPath = prefix.concat(child.path)
    if (spec.type === 'object' && spec.strict) {
      forEachColumn(child.model, onEach, fullPath)
    } else {
      onEach(child.model, fullPath, getFlattenedPath(fullPath))
    }
  }
}

  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {
    if (!req.grants) return next(new Error('Cannot validate grants without grant middleware'))
    if (!req.grants.userContext) return next(new AuthenticationError())

    try {
      const currentPassword = defaultGetCurrentPassword(req)
      assert.ok(currentPassword, 'did not send current password')

      const isValid = await doPasswordsMatch(
        currentPassword!,
        req.grants.userContext[passwordField],
        passwordOptions,
      )

      assert.ok(isValid, 'current password invalid')
      next()
    } catch (err) {
      next(err)
    }
  }

export function hashPassword(plaintext: string, salt: string, options: IPasswordOptions): string {
  assert.ok(salt.length === options.saltLength, 'incompatible salt length')

  return crypto
    .pbkdf2Sync(
      plaintext,
      salt + options.secret,
      options.iterations,
      options.hashedPasswordLength / 2,
      options.algorithm,
    )
    .toString('hex')
}

  const customQueries = customConstraints.map(constraint => {
    assert.ok(constraint.meta.evaluate, 'custom constraint missing evaluation function')

    return constraint.meta!.evaluate!({
      record,
      existing,
      model,
      executor,
      extras,
      event,
      constraint,
    })
  })

export async function hashPasswordAsync(
  plaintext: string,
  salt: string,
  options: IPasswordOptions,
): Promise<string> {
  assert.ok(salt.length === options.saltLength, 'incompatible salt length')

  const hash = await pbkdf2Async(
    plaintext,
    salt + options.secret,
    options.iterations,
    options.hashedPasswordLength / 2,
    options.algorithm,
  )

  return hash.toString('hex')
}

export function computeAllPermissions(permission: string, conf: IAuthConfiguration): string[] {
  const permissions: string[] = []
  const queue = [permission]
  while (queue.length) {
    const permission = queue.shift()!
    const nextpermissions = conf.permissions[permission]
    assert.ok(nextpermissions, `invalid permission: ${permission}`)

    for (const nextpermission of nextpermissions) {
      if (includes(queue, nextpermission) || includes(permissions, nextpermission)) continue
      queue.push(nextpermission)
    }

    permissions.push(permission)
  }

  return permissions
}

export function addForeignKeys(
  modelInProgress: Sequelize.DefineAttributes,
  model: IModel,
  kiln: IKiln,
): void {
  const constraints = model.spec.db!.constrain
  for (const constraint of constraints) {
    if (constraint.type !== ConstraintType.Reference) {
      continue
    }

    assert.ok(constraint.properties.length === 1, 'foreign key must be single field')
    const fkName = getFlattenedPath(constraint.properties[0])
    const fkDefinition = modelInProgress[fkName] as Sequelize.DefineAttributeColumnOptions
    const sqlExecutor = kiln.build<ISQLExecutor>(constraint.meta.referencedModel!, SQL_EXECUTOR)
    fkDefinition.references = {
      key: getPrimaryKeyField(sqlExecutor.kilnModel.model),
      model: sqlExecutor.sequelizeModel,
    }
  }
}