class SessionsController < ApplicationController
  before_action :check_accounts_enabled

  def create
    if logged_in?
      redirect_to default_redirect_path
      return
    end

    redirect_if_not_test Services.oidc.auth_uri(redirect_path: params["redirect_path"])[:uri]
  end

  def callback
    unless params[:code]
      redirect_to default_redirect_path
      return
    end

    state = params.require(:state)

    callback = Services.oidc.callback(
      params.require(:code),
      state,
    )

    tokens = callback[:access_token].token_response
    set_account_session_cookie(
      sub: callback[:sub],
      access_token: tokens[:access_token],
      refresh_token: tokens[:refresh_token],
    )

    if callback[:cookie_consent] && cookies[:cookies_policy]
      cookies_policy = JSON.parse(cookies[:cookies_policy]).symbolize_keys
      cookies[:cookies_policy] = cookies_policy.merge(usage: true).to_json
    end

    redirect_if_not_test(callback[:redirect_path] || default_redirect_path)
  end

  def delete
    logout!
    redirect_if_not_test Plek.new.website_root
  end

protected

  def redirect_if_not_test(url)
    if Rails.env.test?
      render plain: "Redirecting to #{url}"
    else
      redirect_to url
    end
  end

  def default_redirect_path
    Plek.find("account-manager")
  end
end

class SessionsController < ApplicationController
  before_action :check_accounts_enabled

  def create
    redirect_to Plek.find("account-manager") and return if logged_in?

    redirect_if_not_test Services.oidc.auth_uri(redirect_path: params["redirect_path"])[:uri]
  end

  def callback
    redirect_to Plek.new.website_root and return unless params[:code]

    state = params.require(:state)

    callback = Services.oidc.callback(
      params.require(:code),
      state,
    )

    tokens = callback[:access_token].token_response
    set_account_session_cookie(
      sub: callback[:sub],
      access_token: tokens[:access_token],
      refresh_token: tokens[:refresh_token],
    )

    if callback[:cookie_consent] && cookies[:cookies_policy]
      cookies_policy = JSON.parse(cookies[:cookies_policy]).symbolize_keys
      cookies[:cookies_policy] = cookies_policy.merge(usage: true).to_json
    end

    redirect_if_not_test(callback[:redirect_path] || Plek.find("account-manager"))
  end

  def delete
    if params[:continue]
      logout!
      redirect_if_not_test URI.join(Plek.find("account-manager"), "logout", "?done=1")
    elsif params[:done]
      logout!
      redirect_if_not_test Plek.new.website_root
    else
      redirect_if_not_test URI.join(Plek.find("account-manager"), "logout", "?continue=1")
    end
  end

protected

  def redirect_if_not_test(url)
    if Rails.env.test?
      render plain: "Redirecting to #{url}"
    else
      redirect_to url
    end
  end
end

Implement finder-frontend side of single-sign-out
Implement finder-frontend side of single-sign-out

We want signing out of finder-frontend to sign out of the account
manager, and vice versa, for this initial experiment.  This is a bit
unusual for a federated accounts system like this, but for now we are
presenting the GOV.UK account as more of a Transition Checker account.
We will work on the larger design problem of making users understand
that the account is a distinct thing later.

Here's how it'll work.  It works the same on both sides, so I'll just
call the two endpoints "logoutA" and "logoutB".

1. User visits logoutA
2. User is 302-redirected to logoutB?continue=1
3. User's B session cookie is deleted
4. User is redirected to logoutA?done=1
5. User's A session cookie is deleted
6. The post-logout screen or redirect is shown

Redirecting through every signed-in service won't scale beyond 1
service, but for this first experiment, we do only have 1.
