Plan: API Idempotency Audit & Implementation

use axum::{extract::Request, middleware::Next, response::Response};
use dashmap::DashMap;
use std::sync::Arc;
use std::time::{Duration, Instant};

const CACHE_TTL: Duration = Duration::from_secs(86400); // 24 hours
const HEADER_NAME: &str = "idempotency-key";

#[derive(Clone)]
pub struct IdempotencyCache {
    cache: Arc<DashMap<String, CachedResponse>>,
}

struct CachedResponse {
    status: u16,
    headers: Vec<(String, String)>,
    body: bytes::Bytes,
    created_at: Instant,
}

impl IdempotencyCache {
    pub fn new() -> Self {
        Self { cache: Arc::new(DashMap::new()) }
    }
}

pub async fn idempotency_middleware(
    cache: axum::Extension<IdempotencyCache>,
    request: Request,
    next: Next,
) -> Response {
    // Only apply to POST requests
    if request.method() != axum::http::Method::POST {
        return next.run(request).await;
    }

    // Extract idempotency key from header
    let key = match request.headers().get(HEADER_NAME) {
        Some(v) => v.to_str().unwrap_or("").to_string(),
        None => return next.run(request).await, // No key = no dedup
    };

    // Scope by user (claims.sub) if available
    let user_id = request.extensions()
        .get::<craig_auth::Claims>()
        .map(|c| c.sub.clone())
        .unwrap_or_default();
    let cache_key = format!("{user_id}:{key}");

    // Check cache
    if let Some(cached) = cache.cache.get(&cache_key) {
        if cached.created_at.elapsed() < CACHE_TTL {
            // Return cached response (replay)
            return rebuild_response(&cached);
        }
        // Expired — remove and proceed
        drop(cached);
        cache.cache.remove(&cache_key);
    }

    // Process request
    let response = next.run(request).await;

    // Cache the response
    // ... (extract status, headers, body, store in cache)

    response
}