// Auth returns a valid Auth object for access to openstack services, or
// an error if the authentication couldn't be resolved.
func (c *AccessConfig) Auth() (gophercloud.AccessProvider, error) {
	username := c.Username
	password := c.Password
	project := c.Project
	provider := c.Provider

	if username == "" {
		username = os.Getenv("SDK_USERNAME")
	}
	if password == "" {
		password = os.Getenv("SDK_PASSWORD")
	}
	if project == "" {
		project = os.Getenv("SDK_PROJECT")
	}
	if provider == "" {
		provider = os.Getenv("SDK_PROVIDER")
	}

	authoptions := gophercloud.AuthOptions{
		Username:    username,
		Password:    password,
		AllowReauth: true,
	}

	if project != "" {
		authoptions.TenantName = project
	}

	return gophercloud.Authenticate(provider, authoptions)
}

func v3auth(client *gophercloud.ProviderClient, endpoint string, options gophercloud.AuthOptions) error {
	// Override the generated service endpoint with the one returned by the version endpoint.
	v3Client := NewIdentityV3(client)
	if endpoint != "" {
		v3Client.Endpoint = endpoint
	}

	var scope *tokens3.Scope
	if options.TenantID != "" {
		scope = &tokens3.Scope{
			ProjectID: options.TenantID,
		}
		options.TenantID = ""
		options.TenantName = ""
	} else {
		if options.TenantName != "" {
			scope = &tokens3.Scope{
				ProjectName: options.TenantName,
				DomainID:    options.DomainID,
				DomainName:  options.DomainName,
			}
			options.TenantName = ""
		}
	}

	result := tokens3.Create(v3Client, options, scope)

	token, err := result.ExtractToken()
	if err != nil {
		return err
	}

	catalog, err := result.ExtractServiceCatalog()
	if err != nil {
		return err
	}

	client.TokenID = token.ID

	if options.AllowReauth {
		client.ReauthFunc = func() error {
			client.TokenID = ""
			return AuthenticateV3(client, options)
		}
	}
	client.EndpointLocator = func(opts gophercloud.EndpointOpts) (string, error) {
		return V3EndpointURL(catalog, opts)
	}

	return nil
}

func New(cfgFile string) CinderDriver {
	conf, err := processConfig(cfgFile)
	isV3 := strings.Contains(conf.Endpoint, "v3")
	if err != nil {
		log.Fatal("Error processing cinder driver config file: ", err)
	}

	_, err = os.Lstat(conf.MountPoint)
	if os.IsNotExist(err) {
		if err := os.MkdirAll(conf.MountPoint, 0755); err != nil {
			log.Fatal("Failed to create Mount directory during driver init: %v", err)
		}
	}

	auth := gophercloud.AuthOptions{
		IdentityEndpoint: conf.Endpoint,
		Username:         conf.Username,
		Password:         conf.Password,
		TenantID:         conf.TenantID,
		AllowReauth:      true,
	}

	if isV3 == true && conf.DomainName == "" {
		log.Warning("V3 endpoint specified, but DomainName not set!")
		log.Warning("Setting to \"Default\", maybe it'll work.")
		auth.DomainName = "Default"
	}

	if conf.DomainName != "" && isV3 == true {
		log.Info("Authorizing to a V3 Endpoint")
		auth.DomainName = conf.DomainName
	}

	providerClient, err := openstack.AuthenticatedClient(auth)
	if err != nil {
		log.Fatal("Error initiating gophercloud provider client: ", err)
	}

	client, err := openstack.NewBlockStorageV2(providerClient,
		gophercloud.EndpointOpts{Region: "RegionOne"})
	if err != nil {
		log.Fatal("Error initiating gophercloud cinder client: ", err)
	}

	d := CinderDriver{
		Conf:   &conf,
		Mutex:  &sync.Mutex{},
		Client: client,
	}
	return d
}

// OnlyRS overrides the default Gophercloud behavior of using OS_-prefixed environment variables
// if RS_ variables aren't present. Otherwise, they'll stomp over each other here in the acceptance
// tests, where you need to have both defined.
func OnlyRS(original gophercloud.AuthOptions) gophercloud.AuthOptions {
	if os.Getenv("RS_AUTH_URL") == "" {
		original.IdentityEndpoint = ""
	}
	if os.Getenv("RS_USERNAME") == "" {
		original.Username = ""
	}
	if os.Getenv("RS_PASSWORD") == "" {
		original.Password = ""
	}
	if os.Getenv("RS_API_KEY") == "" {
		original.APIKey = ""
	}
	return original
}

// Auth returns a valid Auth object for access to openstack services, or
// an error if the authentication couldn't be resolved.
func (c *AccessConfig) Auth() (gophercloud.AccessProvider, error) {
	username := c.Username
	password := c.Password
	project := c.Project
	provider := c.Provider
	proxy := c.ProxyUrl

	if username == "" {
		username = os.Getenv("SDK_USERNAME")
	}
	if password == "" {
		password = os.Getenv("SDK_PASSWORD")
	}
	if project == "" {
		project = os.Getenv("SDK_PROJECT")
	}
	if provider == "" {
		provider = os.Getenv("SDK_PROVIDER")
	}

	authoptions := gophercloud.AuthOptions{
		Username:    username,
		Password:    password,
		AllowReauth: true,
	}

	if project != "" {
		authoptions.TenantName = project
	}

	// For corporate networks it may be the case where we want our API calls
	// to be sent through a separate HTTP proxy than external traffic.
	if proxy != "" {
		url, err := url.Parse(proxy)
		if err != nil {
			return nil, err
		}

		// The gophercloud.Context has a UseCustomClient method which
		// would allow us to override with a new instance of http.Client.
		http.DefaultTransport = &http.Transport{Proxy: http.ProxyURL(url)}
	}

	return gophercloud.Authenticate(provider, authoptions)
}

// Auth returns a valid Auth object for access to openstack services, or
// an error if the authentication couldn't be resolved.
func (c *AccessConfig) Auth() (gophercloud.AccessProvider, error) {
	c.Username = common.ChooseString(c.Username, os.Getenv("SDK_USERNAME"), os.Getenv("OS_USERNAME"))
	c.Password = common.ChooseString(c.Password, os.Getenv("SDK_PASSWORD"), os.Getenv("OS_PASSWORD"))
	c.ApiKey = common.ChooseString(c.ApiKey, os.Getenv("SDK_API_KEY"))
	c.Project = common.ChooseString(c.Project, os.Getenv("SDK_PROJECT"), os.Getenv("OS_TENANT_NAME"))
	c.Provider = common.ChooseString(c.Provider, os.Getenv("SDK_PROVIDER"), os.Getenv("OS_AUTH_URL"))
	c.RawRegion = common.ChooseString(c.RawRegion, os.Getenv("SDK_REGION"), os.Getenv("OS_REGION_NAME"))

	// OpenStack's auto-generated openrc.sh files do not append the suffix
	// /tokens to the authentication URL. This ensures it is present when
	// specifying the URL.
	if strings.Contains(c.Provider, "://") && !strings.HasSuffix(c.Provider, "/tokens") {
		c.Provider += "/tokens"
	}

	authoptions := gophercloud.AuthOptions{
		Username:    c.Username,
		Password:    c.Password,
		ApiKey:      c.ApiKey,
		AllowReauth: true,
	}

	if c.Project != "" {
		authoptions.TenantName = c.Project
	}

	// For corporate networks it may be the case where we want our API calls
	// to be sent through a separate HTTP proxy than external traffic.
	if c.ProxyUrl != "" {
		url, err := url.Parse(c.ProxyUrl)
		if err != nil {
			return nil, err
		}

		// The gophercloud.Context has a UseCustomClient method which
		// would allow us to override with a new instance of http.Client.
		http.DefaultTransport = &http.Transport{Proxy: http.ProxyURL(url)}
	}

	return gophercloud.Authenticate(c.Provider, authoptions)
}