package adminauth

import (
	"context"
	"errors"
	"strings"

	"hfb_sys/backend/internal/modules/auth"
)

var (
	ErrDependencyUnavailable = errors.New("dependency unavailable")
	ErrInvalidCredential     = errors.New("invalid credential")
	ErrCaptchaInvalid        = errors.New("captcha invalid")
	ErrAdminDisabled         = errors.New("admin disabled")
	ErrInvalidRefreshToken   = errors.New("invalid refresh token")
	ErrLoginLocked           = errors.New("login locked")
	ErrAdminNotFound         = errors.New("admin not found")
	ErrTokenVersionMismatch  = errors.New("admin token version mismatch")
)

// TokenValidationError 为后台会话失败保留安全的诊断类别，响应仍使用统一文案。
type TokenValidationError struct {
	Reason         string
	TokenVersion   int64
	CurrentVersion int64
	Detail         string
	Unavailable    bool
	err            error
}

func (e *TokenValidationError) Error() string {
	return "admin token validation failed: " + e.Reason
}

func (e *TokenValidationError) Unwrap() error {
	return e.err
}

// AuthFailureReason 供中间件读取失败类别并写入结构化日志。
func (e *TokenValidationError) AuthFailureReason() string {
	return e.Reason
}

// AuthFailureVersions 返回令牌声明版本和数据库当前版本；非版本不匹配时均为 0。
func (e *TokenValidationError) AuthFailureVersions() (int64, int64) {
	return e.TokenVersion, e.CurrentVersion
}

// AuthFailureDetail 返回仅供服务端日志使用的依赖错误摘要，不包含令牌内容。
func (e *TokenValidationError) AuthFailureDetail() string {
	return e.Detail
}

// AuthFailureUnavailable 标识当前失败是否由临时依赖故障引起。
func (e *TokenValidationError) AuthFailureUnavailable() bool {
	return e.Unavailable
}

func newTokenValidationError(reason string, err error) error {
	return &TokenValidationError{Reason: reason, err: err}
}

func newTokenDependencyError(err error) error {
	detail := strings.Join(strings.Fields(err.Error()), " ")
	if len(detail) > 240 {
		detail = detail[:240]
	}
	return &TokenValidationError{
		Reason:      "admin_db_query_failed",
		Detail:      detail,
		Unavailable: true,
		err:         errors.Join(ErrDependencyUnavailable, err),
	}
}

func newTokenVersionMismatchError(tokenVersion, currentVersion int64) error {
	return &TokenValidationError{
		Reason:         "token_version_mismatch",
		TokenVersion:   tokenVersion,
		CurrentVersion: currentVersion,
		err:            ErrTokenVersionMismatch,
	}
}

type Service struct {
	repo *Repository
	jwt  *auth.JWTManager
}

func NewService(repo *Repository, jwt *auth.JWTManager) *Service {
	return &Service{repo: repo, jwt: jwt}
}

func (s *Service) Refresh(ctx context.Context, refreshToken string) (*auth.TokenPair, error) {
	if s.jwt == nil {
		return nil, ErrDependencyUnavailable
	}
	claims, err := s.jwt.ParseSubject(refreshToken, "refresh", "admin")
	if err != nil {
		return nil, newTokenValidationError(auth.TokenFailureReason(err), ErrInvalidRefreshToken)
	}
	if s.repo == nil {
		return nil, ErrDependencyUnavailable
	}
	admin, err := s.repo.FindActiveForToken(ctx, claims.UserID, claims.TokenVersion)
	if err != nil {
		if errors.Is(err, ErrDependencyUnavailable) {
			return nil, err
		}
		if errors.Is(err, ErrAdminDisabled) {
			return nil, ErrAdminDisabled
		}
		return nil, invalidRefreshTokenError(err)
	}
	pair, err := s.jwt.GenerateSubjectPairWithVersion(admin.ID, admin.Username, "admin", admin.TokenVersion)
	if err != nil {
		return nil, err
	}
	return &pair, nil
}

func invalidRefreshTokenError(err error) error {
	reason := "invalid"
	var tokenErr *TokenValidationError
	if errors.As(err, &tokenErr) {
		reason = tokenErr.Reason
		return &TokenValidationError{
			Reason:         reason,
			TokenVersion:   tokenErr.TokenVersion,
			CurrentVersion: tokenErr.CurrentVersion,
			err:            ErrInvalidRefreshToken,
		}
	}
	return newTokenValidationError(reason, ErrInvalidRefreshToken)
}

func (s *Service) Captcha(ctx context.Context) (*CaptchaDTO, error) {
	if s.repo == nil {
		return nil, ErrDependencyUnavailable
	}
	return s.repo.Captcha(ctx)
}

func (s *Service) Login(ctx context.Context, username string, password string, captchaID string, captchaCode string, clientIP string) (LoginResult, error) {
	if s.repo == nil {
		return LoginResult{}, ErrDependencyUnavailable
	}
	if username == "" || password == "" || captchaID == "" || captchaCode == "" {
		return LoginResult{}, ErrInvalidCredential
	}
	return s.repo.Login(ctx, username, password, captchaID, captchaCode, clientIP)
}

func (s *Service) Me(ctx context.Context, adminID uint64) (*AdminDTO, error) {
	if s.repo == nil {
		return nil, ErrDependencyUnavailable
	}
	return s.repo.FindByID(ctx, adminID)
}

func (s *Service) UpdateSupportStatus(ctx context.Context, adminID uint64, status string) error {
	if s.repo == nil {
		return ErrDependencyUnavailable
	}
	return s.repo.UpdateSupportStatus(ctx, adminID, status)
}

func (s *Service) Logout(ctx context.Context, adminID uint64) error {
	if s.repo == nil {
		return ErrDependencyUnavailable
	}
	return s.repo.RevokeTokens(ctx, adminID)
}