package imapserver

import (
	"crypto/tls"
	"net"

	goimapserver "github.com/emersion/go-imap/v2/imapserver"
)

func newSessionFunc(backend *Backend) func(*goimapserver.Conn) (goimapserver.Session, *goimapserver.GreetingData, error) {
	return func(c *goimapserver.Conn) (goimapserver.Session, *goimapserver.GreetingData, error) {
		host, _, err := net.SplitHostPort(c.NetConn().RemoteAddr().String())
		if err != nil {
			host = c.NetConn().RemoteAddr().String()
		}
		return backend.NewSession(host), nil, nil
	}
}

// NewPlainServer mirrors smtpserver.NewPlainServer: no TLS at all, so STARTTLS is
// never offered. InsecureAuth is required here or LOGIN would always fail with
// [PRIVACYREQUIRED] on this listener.
func NewPlainServer(backend *Backend) *goimapserver.Server {
	return goimapserver.New(&goimapserver.Options{
		NewSession:   newSessionFunc(backend),
		InsecureAuth: true,
	})
}

// NewTLSServer mirrors smtpserver.NewTLSServer: implicit TLS, the whole connection is
// encrypted from the first byte. Call ListenAndServeTLS (not ListenAndServe) to run
// it — TLSConfig here only takes effect for that method.
func NewTLSServer(backend *Backend, tlsConfig *tls.Config) *goimapserver.Server {
	return goimapserver.New(&goimapserver.Options{
		NewSession: newSessionFunc(backend),
		TLSConfig:  tlsConfig,
	})
}