package oauth2

import (
	"context"
	"errors"
	"log/slog"
	"net/http"
	"net/url"
	"strings"
	"time"

	"giter.top/smart/internal/auth/session"
	"giter.top/smart/pkg/config"
	"giter.top/smart/pkg/security"
	"github.com/gin-gonic/gin"
)

// Service OAuth2 授权码 + PKCE + opaque token。
type Service struct {
	cfg   *config.Config
	store *Store
	sess  *session.Store
}

// NewService 构造。
func NewService(cfg *config.Config, store *Store, sess *session.Store) *Service {
	return &Service{cfg: cfg, store: store, sess: sess}
}

func (s *Service) durations() (authCode, access, refresh time.Duration) {
	authCode = s.cfg.Auth.OAuth2.AuthCodeTTL
	if authCode == 0 {
		authCode = 120 * time.Second
	}
	access = s.cfg.Auth.OAuth2.AccessTokenTTL
	if access == 0 {
		access = 15 * time.Minute
	}
	refresh = s.cfg.Auth.OAuth2.RefreshTokenTTL
	if refresh == 0 {
		refresh = 720 * time.Hour
	}
	return authCode, access, refresh
}

// IssueAuthorizationCodeAfterPasswordAuth 在已通过用户名密码校验的上下文中签发 PKCE 绑定授权码（与 Authorize 中 CreateAuthorizationCode 一致）。
func (s *Service) IssueAuthorizationCodeAfterPasswordAuth(ctx context.Context, clientID, redirectURI, userID, tenantID, scope, codeChallenge, challengeMethod string) (codePlain string, err error) {
	if scope == "" {
		scope = "openid"
	}
	method := NormalizeCodeChallengeMethod(challengeMethod)
	if codeChallenge == "" || method != "s256" {
		return "", ErrPKCERequired
	}
	cli, err := s.store.GetClientByClientID(ctx, clientID)
	if err != nil {
		if errors.Is(err, ErrNotFound) {
			return "", ErrInvalidClient
		}
		return "", err
	}
	uris, err := ParseRedirectURIs(cli.RedirectURIsJSON)
	if err != nil || !RedirectURIMatch(uris, redirectURI) {
		return "", ErrInvalidRedirectURI
	}
	codePlain, err = security.RandomURLSafe(32)
	if err != nil {
		return "", err
	}
	codeTTL, _, _ := s.durations()
	exp := time.Now().Add(codeTTL)
	if err := s.store.CreateAuthorizationCode(ctx, codePlain, clientID, redirectURI, userID, tenantID, scope, codeChallenge, "S256", exp); err != nil {
		return "", err
	}
	return codePlain, nil
}

func (s *Service) publicAuthorizeURL(c *gin.Context) string {
	base := strings.TrimRight(s.cfg.Auth.PublicBaseURL, "/")
	if base == "" {
		scheme := "http"
		if c.Request.TLS != nil {
			scheme = "https"
		}
		if xf := c.GetHeader("X-Forwarded-Proto"); xf == "https" {
			scheme = "https"
		}
		base = scheme + "://" + c.Request.Host
	}
	return base + "/oauth/authorize?" + c.Request.URL.RawQuery
}

// Authorize GET /oauth/authorize
func (s *Service) Authorize(c *gin.Context) {
	q := c.Request.URL.Query()
	if q.Get("response_type") != "code" {
		c.JSON(http.StatusBadRequest, gin.H{"error": "unsupported_response_type"})
		return
	}
	clientID := q.Get("client_id")
	redirectURI := q.Get("redirect_uri")
	state := q.Get("state")
	scope := q.Get("scope")
	if scope == "" {
		scope = "openid"
	}
	challenge := q.Get("code_challenge")
	method := NormalizeCodeChallengeMethod(q.Get("code_challenge_method"))
	if challenge == "" || method != "s256" {
		s.redirectOAuthError(c, redirectURI, state, "invalid_request", "code_challenge and code_challenge_method=S256 required")
		return
	}

	cli, err := s.store.GetClientByClientID(c.Request.Context(), clientID)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid_client"})
		return
	}
	uris, err := ParseRedirectURIs(cli.RedirectURIsJSON)
	if err != nil || !RedirectURIMatch(uris, redirectURI) {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid_redirect_uri"})
		return
	}

	sid, err := c.Cookie(s.cfg.Auth.Session.CookieName)
	if err != nil || sid == "" {
		login := strings.TrimRight(s.cfg.Auth.OAuth2.FrontendLoginURL, "?")
		ret := s.publicAuthorizeURL(c)
		u, _ := url.Parse(login)
		q2 := u.Query()
		q2.Set("return_to", ret)
		u.RawQuery = q2.Encode()
		c.Redirect(http.StatusFound, u.String())
		return
	}
	userID, tenantID, err := s.sess.Get(c.Request.Context(), sid)
	if err != nil {
		login := strings.TrimRight(s.cfg.Auth.OAuth2.FrontendLoginURL, "?")
		ret := s.publicAuthorizeURL(c)
		u, _ := url.Parse(login)
		q2 := u.Query()
		q2.Set("return_to", ret)
		u.RawQuery = q2.Encode()
		c.Redirect(http.StatusFound, u.String())
		return
	}

	codePlain, err := security.RandomURLSafe(32)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "server_error"})
		return
	}
	codeTTL, _, _ := s.durations()
	exp := time.Now().Add(codeTTL)
	if err := s.store.CreateAuthorizationCode(c.Request.Context(), codePlain, clientID, redirectURI, userID, tenantID, scope, challenge, "S256", exp); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "server_error"})
		return
	}
	redir, err := url.Parse(redirectURI)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid_redirect_uri"})
		return
	}
	rq := redir.Query()
	rq.Set("code", codePlain)
	if state != "" {
		rq.Set("state", state)
	}
	redir.RawQuery = rq.Encode()
	c.Redirect(http.StatusFound, redir.String())
}

func (s *Service) redirectOAuthError(c *gin.Context, redirectURI, state, errCode, desc string) {
	if redirectURI == "" {
		c.JSON(http.StatusBadRequest, gin.H{"error": errCode, "error_description": desc})
		return
	}
	u, e := url.Parse(redirectURI)
	if e != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": errCode})
		return
	}
	q := u.Query()
	q.Set("error", errCode)
	q.Set("error_description", desc)
	if state != "" {
		q.Set("state", state)
	}
	u.RawQuery = q.Encode()
	c.Redirect(http.StatusFound, u.String())
}

// Token POST /oauth/token
func (s *Service) Token(c *gin.Context) {
	if err := c.Request.ParseForm(); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid_request"})
		return
	}
	gt := c.PostForm("grant_type")
	switch gt {
	case "authorization_code":
		s.tokenAuthorizationCode(c)
	case "refresh_token":
		s.tokenRefresh(c)
	default:
		c.JSON(http.StatusBadRequest, gin.H{"error": "unsupported_grant_type"})
	}
}

func (s *Service) tokenAuthorizationCode(c *gin.Context) {
	code := c.PostForm("code")
	redirectURI := c.PostForm("redirect_uri")
	clientID := c.PostForm("client_id")
	verifier := c.PostForm("code_verifier")
	if code == "" || redirectURI == "" || clientID == "" || verifier == "" {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid_request"})
		return
	}
	row, err := s.store.ConsumeAuthorizationCode(c.Request.Context(), code, clientID, redirectURI)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid_grant"})
		return
	}
	if !VerifyPKCES256(verifier, row.CodeChallenge) {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid_grant", "error_description": "pkce verification failed"})
		return
	}
	_, accessTTL, refreshTTL := s.durations()
	accessPlain, err := security.RandomURLSafe(32)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "server_error"})
		return
	}
	refreshPlain, err := security.RandomURLSafe(48)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "server_error"})
		return
	}
	if err := s.store.IssueAccessAndRefresh(c.Request.Context(), accessPlain, refreshPlain, clientID, row.UserID, row.TenantID, row.Scope, accessTTL, refreshTTL); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "server_error"})
		return
	}
	slog.Info("oauth2_token_issued", "grant_type", "authorization_code", "client_id", clientID, "user_id", row.UserID, "tenant_id", row.TenantID, "client_ip", c.ClientIP())
	s.jsonAccessToken(c, accessPlain, refreshPlain, accessTTL)
}

func (s *Service) tokenRefresh(c *gin.Context) {
	refresh := c.PostForm("refresh_token")
	clientID := c.PostForm("client_id")
	if refresh == "" || clientID == "" {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid_request"})
		return
	}
	_, accessTTL, refreshTTL := s.durations()
	newAccess, err := security.RandomURLSafe(32)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "server_error"})
		return
	}
	newRefresh, err := security.RandomURLSafe(48)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "server_error"})
		return
	}
	if err := s.store.RotateByRefreshToken(c.Request.Context(), clientID, refresh, newAccess, newRefresh, accessTTL, refreshTTL); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid_grant"})
		return
	}
	slog.Info("oauth2_token_issued", "grant_type", "refresh_token", "client_id", clientID, "client_ip", c.ClientIP())
	s.jsonAccessToken(c, newAccess, newRefresh, accessTTL)
}

func (s *Service) jsonAccessToken(c *gin.Context, access, refresh string, accessTTL time.Duration) {
	c.JSON(http.StatusOK, gin.H{
		"access_token":  access,
		"token_type":    "Bearer",
		"expires_in":    int(accessTTL.Seconds()),
		"refresh_token": refresh,
	})
}

// Introspect POST /oauth/introspect（RFC 7662），与 opaque 查表语义一致。
func (s *Service) Introspect(c *gin.Context) {
	if err := c.Request.ParseForm(); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"active": false})
		return
	}
	tok := c.PostForm("token")
	hint := strings.TrimSpace(c.PostForm("token_type_hint"))
	if tok == "" {
		c.JSON(http.StatusOK, gin.H{"active": false})
		return
	}
	ctx := c.Request.Context()

	tryRefreshFirst := hint == "refresh_token"
	if tryRefreshFirst {
		if row, err := s.store.LookupRefreshTokenRow(ctx, tok); err == nil {
			slog.Info("oauth2_introspect", "active", true, "token_type", "refresh_token", "client_id", row.ClientID, "sub", row.UserID)
			c.JSON(http.StatusOK, gin.H{
				"active":     true,
				"scope":      row.Scope,
				"client_id":  row.ClientID,
				"token_type": "refresh_token",
				"sub":        row.UserID,
				"exp":        row.ExpiresAt.Unix(),
			})
			return
		}
		c.JSON(http.StatusOK, gin.H{"active": false})
		return
	}

	if row, err := s.store.LookupAccessTokenRow(ctx, tok); err == nil {
		slog.Info("oauth2_introspect", "active", true, "token_type", "access_token", "client_id", row.ClientID, "sub", row.UserID)
		c.JSON(http.StatusOK, gin.H{
			"active":     true,
			"scope":      row.Scope,
			"client_id":  row.ClientID,
			"token_type": "access_token",
			"sub":        row.UserID,
			"exp":        row.ExpiresAt.Unix(),
		})
		return
	}

	if row, err := s.store.LookupRefreshTokenRow(ctx, tok); err == nil {
		slog.Info("oauth2_introspect", "active", true, "token_type", "refresh_token", "client_id", row.ClientID, "sub", row.UserID)
		c.JSON(http.StatusOK, gin.H{
			"active":     true,
			"scope":      row.Scope,
			"client_id":  row.ClientID,
			"token_type": "refresh_token",
			"sub":        row.UserID,
			"exp":        row.ExpiresAt.Unix(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{"active": false})
}