package service

import (
	"errors"
	"strings"

	"affiliate_dash/internal/model"
	"affiliate_dash/internal/pkg/jwt"

	"golang.org/x/crypto/bcrypt"
	"gorm.io/gorm"
)

type AuthService struct {
	db     *gorm.DB
	jwt    *jwt.Manager
	tenant *TenantService
	sms    *LoginSMSService
	device *DCAuthService
}

type AuthServiceOption func(*AuthService)

// WithLoginSecurity 注入短信与设备认证依赖；未注入时仅保留旧密码登录。
func WithLoginSecurity(sms *LoginSMSService, device *DCAuthService) AuthServiceOption {
	return func(s *AuthService) {
		s.sms = sms
		s.device = device
	}
}

func NewAuthService(db *gorm.DB, jm *jwt.Manager, tenant *TenantService, opts ...AuthServiceOption) *AuthService {
	svc := &AuthService{db: db, jwt: jm, tenant: tenant}
	for _, opt := range opts {
		if opt != nil {
			opt(svc)
		}
	}
	return svc
}

type LoginResult struct {
	Token string      `json:"token"`
	User  *model.User `json:"user"`
}

type UpdateCurrentAccountInput struct {
	CurrentPassword string
	Username        string
	Nickname        string
	NewPassword     string
}

func (s *AuthService) Login(username, password string) (*LoginResult, error) {
	user, err := s.authenticatePassword(username, password)
	if err != nil {
		return nil, err
	}
	// 已绑定手机号的账号必须走安全登录，避免短信 + 设备绑定被旧入口绕过。
	if strings.TrimSpace(user.Phone) != "" {
		return nil, newAuthError(403, "device_auth_required", "该账号已启用安全登录，请使用账号密码 + 短信验证码 + 本机验证")
	}
	return s.issueLogin(user)
}

// authenticatePassword 统一处理账号状态与 bcrypt 校验。
func (s *AuthService) authenticatePassword(username, password string) (*model.User, error) {
	username = strings.TrimSpace(username)
	if username == "" || password == "" {
		return nil, newAuthError(400, "credentials_required", "请输入用户名和密码")
	}
	var user model.User
	if err := s.db.Where("username = ?", username).First(&user).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return nil, newAuthError(401, "login_failed", "用户名或密码错误")
		}
		return nil, err
	}
	if user.Status != 1 {
		return nil, newAuthError(403, "account_disabled", "账号已禁用")
	}
	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
		return nil, newAuthError(401, "login_failed", "用户名或密码错误")
	}
	return &user, nil
}

func (s *AuthService) issueLogin(user *model.User) (*LoginResult, error) {
	token, err := s.jwt.Generate(user.ID, user.Username, user.Role)
	if err != nil {
		return nil, err
	}
	return &LoginResult{Token: token, User: user}, nil
}

// SendLoginSMSCode 校验密码后向账号绑定手机号发送验证码。
func (s *AuthService) SendLoginSMSCode(username, password, requestIP string) (*SendLoginCodeResult, error) {
	if s.sms == nil {
		return nil, newAuthError(503, "sms_unavailable", "短信服务未配置")
	}
	user, err := s.authenticatePassword(username, password)
	if err != nil {
		return nil, err
	}
	if strings.TrimSpace(user.Phone) == "" {
		return nil, newAuthError(409, "phone_unbound", "该账号尚未绑定手机号，请联系管理员")
	}
	return s.sms.SendLoginCode(user, requestIP)
}

// PrepareLogin 校验密码与短信验证码后创建 DCAuth challenge。
func (s *AuthService) PrepareLogin(username, password, smsCode, apiBase string) (*PreparedDeviceLogin, error) {
	if s.sms == nil || s.device == nil {
		return nil, newAuthError(503, "device_auth_unavailable", "安全登录服务未配置")
	}
	user, err := s.authenticatePassword(username, password)
	if err != nil {
		return nil, err
	}
	if strings.TrimSpace(user.Phone) == "" {
		return nil, newAuthError(409, "phone_unbound", "该账号尚未绑定手机号，请联系管理员")
	}
	if err := s.sms.VerifyLoginCode(user.ID, smsCode); err != nil {
		return nil, err
	}
	prepared, err := s.device.CreateChallenge(user.ID, apiBase)
	if err != nil {
		return nil, err
	}
	prepared.PhoneMasked = MaskPhone(user.Phone)
	return prepared, nil
}

// CompleteLogin 消费一次性 ticket、校验设备绑定并复用现有 JWT 签发会话。
func (s *AuthService) CompleteLogin(challengeID, pollToken, deviceTicket string) (*LoginResult, error) {
	if s.device == nil {
		return nil, newAuthError(503, "device_auth_unavailable", "安全登录服务未配置")
	}
	challenge, err := s.device.ConsumeTicket(challengeID, pollToken, deviceTicket)
	if err != nil {
		return nil, err
	}
	if challenge.App != DCAuthApp || challenge.Purpose != DCAuthPurposeLogin ||
		challenge.DeviceID == "" || challenge.PublicKey == "" {
		return nil, newAuthError(401, "ticket_invalid", "设备认证票据无效或已使用，请重新登录")
	}
	if challenge.UserID == nil {
		return nil, newAuthError(401, "auth_user_invalid", "登录账号已不可用，请重新登录")
	}
	var user model.User
	if err := s.db.First(&user, *challenge.UserID).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return nil, newAuthError(401, "auth_user_invalid", "登录账号已不可用，请重新登录")
		}
		return nil, err
	}
	if user.Status != 1 {
		return nil, newAuthError(401, "auth_user_invalid", "登录账号已不可用，请重新登录")
	}
	if err := s.device.EnsureDeviceBinding(user.ID, challenge); err != nil {
		return nil, err
	}
	return s.issueLogin(&user)
}

func (s *AuthService) GetProfile(userID uint) (*model.User, error) {
	var user model.User
	if err := s.db.First(&user, userID).Error; err != nil {
		return nil, err
	}
	return &user, nil
}

// ChangePassword only changes the current account after its existing password is verified.
func (s *AuthService) ChangePassword(userID uint, currentPassword, newPassword string) error {
	if userID == 0 {
		return errors.New("无效的用户身份")
	}
	if len(newPassword) < 8 {
		return errors.New("新密码至少 8 位")
	}
	if strings.TrimSpace(newPassword) == "" {
		return errors.New("新密码不能为空")
	}
	var user model.User
	if err := s.db.First(&user, userID).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return errors.New("用户不存在")
		}
		return err
	}
	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(currentPassword)); err != nil {
		return errors.New("当前密码错误")
	}
	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(newPassword)); err == nil {
		return errors.New("新密码不能与当前密码相同")
	}
	hash, err := bcrypt.GenerateFromPassword([]byte(newPassword), bcrypt.DefaultCost)
	if err != nil {
		return err
	}
	return s.db.Model(&user).Update("password_hash", string(hash)).Error
}

// UpdateCurrentAccount lets a user maintain their own login identity. The
// current password is always required before username, nickname, or password
// changes are accepted.
func (s *AuthService) UpdateCurrentAccount(userID uint, in UpdateCurrentAccountInput) (*model.User, error) {
	if userID == 0 {
		return nil, errors.New("无效的用户身份")
	}
	in.Username = strings.TrimSpace(in.Username)
	if len(in.Username) < 3 || len(in.Username) > 64 {
		return nil, errors.New("用户名长度需为 3 至 64 位")
	}
	if len(in.Nickname) > 64 {
		return nil, errors.New("昵称不能超过 64 位")
	}
	if in.NewPassword != "" && len(in.NewPassword) < 8 {
		return nil, errors.New("新密码至少 8 位")
	}

	updated := &model.User{}
	err := s.db.Transaction(func(tx *gorm.DB) error {
		var user model.User
		if err := tx.First(&user, userID).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				return errors.New("用户不存在")
			}
			return err
		}
		if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(in.CurrentPassword)); err != nil {
			return errors.New("当前密码错误")
		}
		if in.Username != user.Username {
			var count int64
			if err := tx.Model(&model.User{}).Where("username = ? AND id <> ?", in.Username, user.ID).Count(&count).Error; err != nil {
				return err
			}
			if count > 0 {
				return errors.New("用户名已存在")
			}
		}
		updates := map[string]interface{}{"username": in.Username, "nickname": in.Nickname}
		if in.NewPassword != "" {
			if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(in.NewPassword)); err == nil {
				return errors.New("新密码不能与当前密码相同")
			}
			hash, err := bcrypt.GenerateFromPassword([]byte(in.NewPassword), bcrypt.DefaultCost)
			if err != nil {
				return err
			}
			updates["password_hash"] = string(hash)
		}
		if err := tx.Model(&user).Updates(updates).Error; err != nil {
			return err
		}
		return tx.First(updated, user.ID).Error
	})
	if err != nil {
		return nil, err
	}
	return updated, nil
}