namespace FundLab.Api

open System
open System.Security.Cryptography
open System.Text

type AuthDecision =
    | Authorized
    | Unauthorized

module Authentication =
    let authorize (expectedToken: string) (authorizationHeader: string) : AuthDecision =
        if String.IsNullOrWhiteSpace expectedToken
           || String.IsNullOrWhiteSpace authorizationHeader
           || not (authorizationHeader.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase)) then
            AuthDecision.Unauthorized
        else
            let presentedToken = authorizationHeader.Substring("Bearer ".Length)
            let expectedBytes = Encoding.UTF8.GetBytes expectedToken
            let presentedBytes = Encoding.UTF8.GetBytes presentedToken

            if CryptographicOperations.FixedTimeEquals(expectedBytes, presentedBytes) then
                AuthDecision.Authorized
            else
                AuthDecision.Unauthorized