package httpapi

import (
	"context"
	"crypto/rand"
	"encoding/json"
	"errors"
	"fmt"
	"math/big"
	"net/http"
	"net/url"
	"strings"
	"time"

	"github.com/gin-gonic/gin"
	"golang.org/x/crypto/bcrypt"
	"gorm.io/gorm"

	"github.com/sundynix/pets-be/internal/model"
)

func (a *API) SeedAdmin() error {
	if a.cfg.Admin.Password == "" {
		if a.cfg.Server.Mode == "release" {
			return errors.New("admin password is required in release mode")
		}
		return nil
	}
	var admin model.Admin
	err := a.db.Where("username = ?", a.cfg.Admin.Username).First(&admin).Error
	missing := errors.Is(err, gorm.ErrRecordNotFound)
	if err != nil && !missing {
		return err
	}
	if !missing && bcrypt.CompareHashAndPassword([]byte(admin.PasswordHash), []byte(a.cfg.Admin.Password)) == nil {
		return nil
	}
	hash, err := bcrypt.GenerateFromPassword([]byte(a.cfg.Admin.Password), bcrypt.DefaultCost)
	if err != nil {
		return err
	}
	if missing {
		return a.db.Create(&model.Admin{Username: a.cfg.Admin.Username, PasswordHash: string(hash)}).Error
	}
	return a.db.Model(&admin).Update("password_hash", string(hash)).Error
}

func (a *API) adminLogin(c *gin.Context) {
	var in struct {
		Username string `json:"username" binding:"required"`
		Password string `json:"password" binding:"required"`
	}
	if err := c.ShouldBindJSON(&in); err != nil {
		fail(c, http.StatusBadRequest, "请输入用户名和密码")
		return
	}
	var admin model.Admin
	if err := a.db.Where("username = ?", in.Username).First(&admin).Error; err != nil || bcrypt.CompareHashAndPassword([]byte(admin.PasswordHash), []byte(in.Password)) != nil {
		fail(c, http.StatusUnauthorized, "用户名或密码错误")
		return
	}
	pair, err := a.newSession(admin.ID, "admin")
	if err != nil {
		fail(c, http.StatusInternalServerError, "签发令牌失败")
		return
	}
	pair["admin"] = gin.H{"id": admin.ID, "username": admin.Username}
	ok(c, pair)
}

func (a *API) devLogin(c *gin.Context) {
	if !a.cfg.Auth.DevLogin || a.cfg.Server.Mode == "release" {
		fail(c, http.StatusNotFound, "接口不存在")
		return
	}
	var in struct {
		Key      string `json:"key" binding:"required"`
		Nickname string `json:"nickname"`
	}
	if err := c.ShouldBindJSON(&in); err != nil || len(in.Key) > 64 {
		fail(c, http.StatusBadRequest, "开发登录参数无效")
		return
	}
	name := strings.TrimSpace(in.Nickname)
	if len([]rune(name)) > 64 {
		fail(c, http.StatusBadRequest, "昵称不能超过 64 字")
		return
	}
	user, err := a.findOrCreateUser("dev:"+in.Key, name)
	if err != nil {
		fail(c, http.StatusInternalServerError, "登录失败")
		return
	}
	a.loginUser(c, user)
}

func (a *API) login(c *gin.Context) {
	var in struct {
		Code string `json:"code" binding:"required"`
	}
	if err := c.ShouldBindJSON(&in); err != nil || a.cfg.WeChat.AppID == "" || a.cfg.WeChat.AppSecret == "" {
		fail(c, http.StatusBadRequest, "微信登录配置或参数无效")
		return
	}
	ctx, cancel := context.WithTimeout(c.Request.Context(), 6*time.Second)
	defer cancel()
	endpoint := "https://api.weixin.qq.com/sns/jscode2session?" + url.Values{
		"appid": {a.cfg.WeChat.AppID}, "secret": {a.cfg.WeChat.AppSecret},
		"js_code": {in.Code}, "grant_type": {"authorization_code"},
	}.Encode()
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
	if err != nil {
		fail(c, http.StatusInternalServerError, "微信登录失败")
		return
	}
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		fail(c, http.StatusBadGateway, "微信登录暂不可用")
		return
	}
	defer resp.Body.Close()
	var wx struct {
		OpenID  string `json:"openid"`
		ErrCode int    `json:"errcode"`
	}
	if resp.StatusCode != http.StatusOK || json.NewDecoder(resp.Body).Decode(&wx) != nil || wx.ErrCode != 0 || wx.OpenID == "" {
		fail(c, http.StatusUnauthorized, "微信登录凭证无效")
		return
	}
	user, err := a.findOrCreateUser(wx.OpenID, "")
	if err != nil {
		fail(c, http.StatusInternalServerError, "登录失败")
		return
	}
	a.loginUser(c, user)
}

func (a *API) findOrCreateUser(openID, nickname string) (model.User, error) {
	var user model.User
	err := a.db.Where("open_id = ?", openID).First(&user).Error
	if err == nil {
		return user, nil
	}
	if !errors.Is(err, gorm.ErrRecordNotFound) {
		return user, err
	}
	// Serialize new-user naming across server instances without requiring custom nicknames to be unique.
	err = a.db.Transaction(func(tx *gorm.DB) error {
		if err := tx.Exec("SELECT pg_advisory_xact_lock(?)", int64(7270139527)).Error; err != nil {
			return err
		}
		// Another login for this open ID may have completed while waiting for the lock.
		if err := tx.Where("open_id = ?", openID).First(&user).Error; err == nil {
			return nil
		} else if !errors.Is(err, gorm.ErrRecordNotFound) {
			return err
		}
		name := strings.TrimSpace(nickname)
		if name == "" {
			generated, err := defaultNickname(tx)
			if err != nil {
				return err
			}
			name = generated
		}
		user = model.User{OpenID: openID, Nickname: name}
		return tx.Create(&user).Error
	})
	if err != nil {
		return user, fmt.Errorf("create user: %w", err)
	}
	return user, nil
}

func defaultNickname(tx *gorm.DB) (string, error) {
	// Prefer four digits. Expand when occupied names make retries frequent.
	for digits := 4; digits <= 6; digits++ {
		limit := int64(10000)
		if digits == 5 {
			limit = 100000
		} else if digits == 6 {
			limit = 1000000
		}
		for attempt := 0; attempt < 20; attempt++ {
			number, err := rand.Int(rand.Reader, big.NewInt(limit))
			if err != nil {
				return "", fmt.Errorf("generate nickname: %w", err)
			}
			name := fmt.Sprintf("毛孩家长%0*d", digits, number.Int64())
			var count int64
			if err := tx.Model(&model.User{}).Where("nickname = ?", name).Count(&count).Error; err != nil {
				return "", err
			}
			if count == 0 {
				return name, nil
			}
		}
	}
	return "", errors.New("default nickname allocation failed")
}

func (a *API) loginUser(c *gin.Context, user model.User) {
	if user.Disabled {
		fail(c, http.StatusForbidden, "账号已停用")
		return
	}
	pair, err := a.newSession(user.ID, "user")
	if err != nil {
		fail(c, http.StatusInternalServerError, "签发令牌失败")
		return
	}
	pair["user"] = a.userView(user)
	ok(c, pair)
}

func (a *API) me(c *gin.Context) {
	var user model.User
	if err := a.db.First(&user, "id = ?", actor(c)).Error; err != nil {
		fail(c, http.StatusNotFound, "用户不存在")
		return
	}
	ok(c, a.userView(user))
}