package service

import (
	"errors"
	"strings"

	"affiliate_dash/internal/model"
	"affiliate_dash/internal/pkg/jwt"

	"golang.org/x/crypto/bcrypt"
	"gorm.io/gorm"
)

type AuthService struct {
	db     *gorm.DB
	jwt    *jwt.Manager
	tenant *TenantService
}

func NewAuthService(db *gorm.DB, jm *jwt.Manager, tenant *TenantService) *AuthService {
	return &AuthService{db: db, jwt: jm, tenant: tenant}
}

type LoginResult struct {
	Token string      `json:"token"`
	User  *model.User `json:"user"`
}

type UpdateCurrentAccountInput struct {
	CurrentPassword string
	Username        string
	Nickname        string
	NewPassword     string
}

func (s *AuthService) Login(username, password string) (*LoginResult, error) {
	var user model.User
	if err := s.db.Where("username = ?", username).First(&user).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return nil, errors.New("用户名或密码错误")
		}
		return nil, err
	}
	if user.Status != 1 {
		return nil, errors.New("账号已禁用")
	}
	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
		return nil, errors.New("用户名或密码错误")
	}
	token, err := s.jwt.Generate(user.ID, user.Username, user.Role)
	if err != nil {
		return nil, err
	}
	return &LoginResult{Token: token, User: &user}, nil
}

func (s *AuthService) GetProfile(userID uint) (*model.User, error) {
	var user model.User
	if err := s.db.First(&user, userID).Error; err != nil {
		return nil, err
	}
	return &user, nil
}

// ChangePassword only changes the current account after its existing password is verified.
func (s *AuthService) ChangePassword(userID uint, currentPassword, newPassword string) error {
	if userID == 0 {
		return errors.New("无效的用户身份")
	}
	if len(newPassword) < 8 {
		return errors.New("新密码至少 8 位")
	}
	if strings.TrimSpace(newPassword) == "" {
		return errors.New("新密码不能为空")
	}
	var user model.User
	if err := s.db.First(&user, userID).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return errors.New("用户不存在")
		}
		return err
	}
	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(currentPassword)); err != nil {
		return errors.New("当前密码错误")
	}
	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(newPassword)); err == nil {
		return errors.New("新密码不能与当前密码相同")
	}
	hash, err := bcrypt.GenerateFromPassword([]byte(newPassword), bcrypt.DefaultCost)
	if err != nil {
		return err
	}
	return s.db.Model(&user).Update("password_hash", string(hash)).Error
}

// UpdateCurrentAccount lets a user maintain their own login identity. The
// current password is always required before username, nickname, or password
// changes are accepted.
func (s *AuthService) UpdateCurrentAccount(userID uint, in UpdateCurrentAccountInput) (*model.User, error) {
	if userID == 0 {
		return nil, errors.New("无效的用户身份")
	}
	in.Username = strings.TrimSpace(in.Username)
	if len(in.Username) < 3 || len(in.Username) > 64 {
		return nil, errors.New("用户名长度需为 3 至 64 位")
	}
	if len(in.Nickname) > 64 {
		return nil, errors.New("昵称不能超过 64 位")
	}
	if in.NewPassword != "" && len(in.NewPassword) < 8 {
		return nil, errors.New("新密码至少 8 位")
	}

	updated := &model.User{}
	err := s.db.Transaction(func(tx *gorm.DB) error {
		var user model.User
		if err := tx.First(&user, userID).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				return errors.New("用户不存在")
			}
			return err
		}
		if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(in.CurrentPassword)); err != nil {
			return errors.New("当前密码错误")
		}
		if in.Username != user.Username {
			var count int64
			if err := tx.Model(&model.User{}).Where("username = ? AND id <> ?", in.Username, user.ID).Count(&count).Error; err != nil {
				return err
			}
			if count > 0 {
				return errors.New("用户名已存在")
			}
		}
		updates := map[string]interface{}{"username": in.Username, "nickname": in.Nickname}
		if in.NewPassword != "" {
			if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(in.NewPassword)); err == nil {
				return errors.New("新密码不能与当前密码相同")
			}
			hash, err := bcrypt.GenerateFromPassword([]byte(in.NewPassword), bcrypt.DefaultCost)
			if err != nil {
				return err
			}
			updates["password_hash"] = string(hash)
		}
		if err := tx.Model(&user).Updates(updates).Error; err != nil {
			return err
		}
		return tx.First(updated, user.ID).Error
	})
	if err != nil {
		return nil, err
	}
	return updated, nil
}

// EnsureAdmin creates the first platform administrator for an empty database.
// Existing administrator accounts are never changed by environment variables.
func (s *AuthService) EnsureAdmin(username, password string) error {
	var count int64
	s.db.Model(&model.User{}).Where("role = ?", model.RoleAdmin).Count(&count)
	if count > 0 {
		if s.tenant != nil {
			var admins []model.User
			if err := s.db.Where("role = ?", model.RoleAdmin).Find(&admins).Error; err != nil {
				return err
			}
			for _, admin := range admins {
				if err := s.tenant.EnsureSelfMember(admin.ID, model.MemberRoleOwner, admin.Status); err != nil {
					return err
				}
			}
		}
		return nil
	}
	username = strings.TrimSpace(username)
	if len(username) < 3 {
		return errors.New("空数据库首次启动必须设置 INITIAL_ADMIN_USERNAME（至少 3 位）")
	}
	if len(password) < 8 {
		return errors.New("空数据库首次启动必须设置 INITIAL_ADMIN_PASSWORD（至少 8 位）")
	}
	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
	if err != nil {
		return err
	}
	admin := &model.User{
		Username:     username,
		PasswordHash: string(hash),
		Nickname:     username,
		Role:         model.RoleAdmin,
		Status:       1,
	}
	if err := s.db.Create(admin).Error; err != nil {
		return err
	}
	if s.tenant != nil {
		return s.tenant.EnsureSelfMember(admin.ID, model.MemberRoleOwner, admin.Status)
	}
	return nil
}