package handler

import (
	"crypto/subtle"
	"log"
	"os"

	"github.com/gin-gonic/gin"

	"git.sundynix.cn/Blizzard/sundynix-site/server/internal/pkg/auth"
	"git.sundynix.cn/Blizzard/sundynix-site/server/internal/pkg/resp"
)

// AdminAuthHandler 管理端登录。
// 账号密码走环境变量 SUNDYNIX_ADMIN_USER / SUNDYNIX_ADMIN_PASS。
type AdminAuthHandler struct {
	username string
	password string
}

func NewAdminAuthHandler() *AdminAuthHandler {
	u := os.Getenv("SUNDYNIX_ADMIN_USER")
	p := os.Getenv("SUNDYNIX_ADMIN_PASS")
	if u == "" {
		u = "admin"
	}
	if p == "" {
		p = "admin123"
		log.Println("[WARN] SUNDYNIX_ADMIN_PASS 未设置，使用开发默认密码 admin123，生产环境务必配置")
	}
	return &AdminAuthHandler{username: u, password: p}
}

type loginReq struct {
	Username string `json:"username" binding:"required"`
	Password string `json:"password" binding:"required"`
}

// Login POST /api/admin/login
func (h *AdminAuthHandler) Login(c *gin.Context) {
	var body loginReq
	if err := c.ShouldBindJSON(&body); err != nil {
		resp.BadRequest(c, "用户名和密码不能为空")
		return
	}
	userOK := subtle.ConstantTimeCompare([]byte(body.Username), []byte(h.username)) == 1
	passOK := subtle.ConstantTimeCompare([]byte(body.Password), []byte(h.password)) == 1
	if !userOK || !passOK {
		resp.Unauthorized(c, "用户名或密码错误")
		return
	}
	token, err := auth.Sign(body.Username)
	if err != nil {
		resp.ServerError(c, "签发 token 失败")
		return
	}
	resp.OK(c, gin.H{"token": token, "username": body.Username})
}