package httpapi

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"net/http"
	"net/url"
	"strings"
	"sync"
	"time"

	"git.nianxx.cn/wangxuming/NianAIGC/backend/internal/identity"
)

const (
	passwordRateLimitAttempts = 30
	passwordRateLimitWindow   = 15 * time.Minute
)

// PasswordSessionIssuer is the HTTP adapter's consumer-owned Identity seam.
type PasswordSessionIssuer interface {
	Login(context.Context, identity.LoginCommand) (identity.Session, error)
}

// PasswordAuthConfig contains transport configuration for password login.
// CookieSecure retains the legacy string tri-state (recognized true/false or
// empty/unrecognized for URL-based resolution).
type PasswordAuthConfig struct {
	Configured    bool
	SessionSecret string
	CookieSecure  string
	PublicBaseURL string
}

type authPasswordHandler struct {
	config  PasswordAuthConfig
	issuer  PasswordSessionIssuer
	limiter *passwordIPLimiter
}

// NewAuthPasswordHandler builds the standalone password-login HTTP adapter.
func NewAuthPasswordHandler(config PasswordAuthConfig, issuer PasswordSessionIssuer) (http.Handler, error) {
	if config.Configured && issuer == nil {
		return nil, fmt.Errorf("auth/password: configured authentication requires a session issuer")
	}
	return &authPasswordHandler{config: config, issuer: issuer, limiter: newPasswordIPLimiter(time.Now)}, nil
}

func (handler *authPasswordHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	if r.URL.Path != "/api/auth/password" {
		w.WriteHeader(http.StatusNotFound)
		return
	}
	if r.Method == http.MethodOptions {
		w.Header().Set("Allow", "OPTIONS, POST")
		w.WriteHeader(http.StatusNoContent)
		return
	}
	if r.Method != http.MethodPost {
		w.WriteHeader(http.StatusMethodNotAllowed)
		return
	}
	if !handler.config.Configured || strings.TrimSpace(handler.config.SessionSecret) == "" {
		writePasswordJSON(w, http.StatusServiceUnavailable, map[string]any{"error": "账号认证配置不完整：ZHINIAN_AUTH_SESSION_SECRET"})
		return
	}

	ip := passwordRequestIP(r)
	if !handler.limiter.allow(ip) {
		writePasswordJSON(w, http.StatusTooManyRequests, map[string]any{"error": "请求过于频繁，请稍后再试。"})
		return
	}
	command, next := decodePasswordRequest(r)
	session, err := handler.issuer.Login(r.Context(), command)
	if err != nil {
		status, message, known := passwordLoginErrorResponse(err)
		if !known {
			writePasswordJSON(w, http.StatusInternalServerError, map[string]any{"error": "服务器内部错误。"})
			return
		}
		writePasswordJSON(w, status, map[string]any{"error": message})
		return
	}
	// A credential success resets the per-process attempt budget even if later
	// response serialization fails, matching the legacy lifecycle boundary.
	handler.limiter.clear(ip)

	rawSession, err := json.Marshal(session)
	if err != nil {
		writePasswordJSON(w, http.StatusInternalServerError, map[string]any{"error": "服务器内部错误。"})
		return
	}
	signed, err := identity.Sign(rawSession, handler.config.SessionSecret)
	if err != nil {
		writePasswordJSON(w, http.StatusInternalServerError, map[string]any{"error": "服务器内部错误。"})
		return
	}
	secure := identity.ResolveSecureCookie(handler.config.CookieSecure, handler.config.PublicBaseURL, absoluteRequestURL(r))
	writes, err := identity.SetSessionCookies(signed, time.Unix(session.ExpiresAt, 0).UTC(), secure)
	if err != nil {
		writePasswordJSON(w, http.StatusInternalServerError, map[string]any{"error": "服务器内部错误。"})
		return
	}

	// Complete all potentially failing serialization before mutating headers.
	response := map[string]any{
		"ok":         true,
		"redirectTo": safePasswordNext(next),
		"user":       passwordPublicUser(session.User),
		"authMode":   session.AuthMode,
	}
	payload, err := json.Marshal(response)
	if err != nil {
		writePasswordJSON(w, http.StatusInternalServerError, map[string]any{"error": "服务器内部错误。"})
		return
	}
	for _, write := range writes {
		http.SetCookie(w, transportCookie(write))
	}
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(http.StatusOK)
	_, _ = w.Write(payload)
}

type passwordRequest struct {
	Phone    any `json:"phone"`
	Username any `json:"username"`
	Password any `json:"password"`
	Next     any `json:"next"`
}

func decodePasswordRequest(r *http.Request) (identity.LoginCommand, string) {
	var body passwordRequest
	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
		return identity.LoginCommand{}, ""
	}
	phone := stringValue(body.Phone)
	if phone == "" {
		phone = stringValue(body.Username)
	}
	return identity.LoginCommand{Phone: phone, Password: stringValue(body.Password)}, stringValue(body.Next)
}

func stringValue(value any) string {
	text, ok := value.(string)
	if !ok {
		return ""
	}
	return strings.TrimSpace(text)
}

func safePasswordNext(value string) string {
	value = strings.TrimSpace(value)
	if value == "" || !strings.HasPrefix(value, "/") || strings.HasPrefix(value, "//") || strings.Contains(value, "\\") {
		return "/create"
	}
	parsed, err := url.Parse(value)
	if err != nil || parsed.IsAbs() || parsed.Host != "" {
		return "/create"
	}
	// WHATWG URL parsing removes literal and percent-encoded dot segments but
	// otherwise preserves the original path escaping. Go exposes RawPath for
	// that representation, so normalize its segments without decoding %2F.
	canonicalPath := canonicalPasswordPath(parsed.EscapedPath())
	if strings.HasPrefix(canonicalPath, "/api/auth") || strings.HasPrefix(canonicalPath, "/auth/login") || strings.HasPrefix(canonicalPath, "/auth/admin-login") {
		return "/create"
	}
	result := canonicalPath
	if parsed.RawQuery != "" {
		result += "?" + parsed.RawQuery
	}
	if parsed.Fragment != "" {
		result += "#" + parsed.EscapedFragment()
	}
	return result
}

func canonicalPasswordPath(value string) string {
	segments := strings.Split(value, "/")
	canonical := make([]string, 0, len(segments))
	trailingDot := false
	for _, segment := range segments {
		switch {
		case passwordDotSegment(segment) == 1:
			trailingDot = true
			continue
		case passwordDotSegment(segment) == 2:
			if len(canonical) > 1 {
				canonical = canonical[:len(canonical)-1]
			}
			trailingDot = true
		default:
			canonical = append(canonical, segment)
			trailingDot = false
		}
	}
	if trailingDot {
		canonical = append(canonical, "")
	}
	result := strings.Join(canonical, "/")
	if result == "" {
		return "/"
	}
	return result
}

func passwordDotSegment(segment string) int {
	switch strings.ToLower(segment) {
	case ".", "%2e":
		return 1
	case "..", ".%2e", "%2e.", "%2e%2e":
		return 2
	default:
		return 0
	}
}

func passwordPublicUser(user identity.User) publicUser {
	authorities := user.Authorities
	if authorities == nil {
		authorities = []string{}
	}
	scope := user.Scope
	if scope == nil {
		scope = []string{}
	}
	return publicUser{
		ID: user.ID, Subject: user.Subject, Username: user.Username, Phone: user.Phone,
		DisplayName: user.DisplayName, ClientID: user.ClientID, OrganizationID: user.OrganizationID,
		OrganizationName: user.OrganizationName, Role: user.Role, Status: user.Status,
		Authorities: authorities, Scope: scope,
	}
}

func passwordLoginErrorResponse(err error) (int, string, bool) {
	var loginErr *identity.PasswordLoginError
	if !errors.As(err, &loginErr) {
		return 0, "", false
	}
	switch loginErr.Reason {
	case identity.LoginFailureInvalidInput:
		return http.StatusBadRequest, "手机号和密码不能为空。", true
	case identity.LoginFailureInvalidCredentials:
		return http.StatusUnauthorized, "手机号或密码错误。", true
	case identity.LoginFailureAccountDisabled:
		return http.StatusForbidden, "账号已停用，请联系管理员。", true
	case identity.LoginFailureInvalidRole, identity.LoginFailureOrganizationRequired, identity.LoginFailureOrganizationNotActive:
		return http.StatusForbidden, "所属组织已停用，请联系管理员。", true
	case identity.LoginFailureAccountLocked:
		return http.StatusLocked, "登录失败次数过多，请 15 分钟后再试。", true
	default:
		return 0, "", false
	}
}

func writePasswordJSON(w http.ResponseWriter, status int, value any) {
	payload, err := json.Marshal(value)
	if err != nil {
		w.WriteHeader(http.StatusInternalServerError)
		return
	}
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(status)
	_, _ = w.Write(payload)
}

func transportCookie(write identity.CookieWrite) *http.Cookie {
	cookie := &http.Cookie{Name: write.Name, Value: write.Value, Path: write.Attributes.Path, HttpOnly: write.Attributes.HTTPOnly, Secure: write.Attributes.Secure}
	if strings.EqualFold(write.Attributes.SameSite, "lax") {
		cookie.SameSite = http.SameSiteLaxMode
	}
	if write.Attributes.Expires != nil {
		cookie.Expires = *write.Attributes.Expires
	}
	if write.Attributes.MaxAgeSeconds != nil {
		if *write.Attributes.MaxAgeSeconds == 0 {
			cookie.MaxAge = -1
		} else {
			cookie.MaxAge = *write.Attributes.MaxAgeSeconds
		}
	}
	return cookie
}

func absoluteRequestURL(r *http.Request) string {
	if r.URL.IsAbs() {
		return r.URL.String()
	}
	scheme := "http"
	if r.TLS != nil {
		scheme = "https"
	}
	return scheme + "://" + r.Host + r.URL.RequestURI()
}

func passwordRequestIP(r *http.Request) string {
	if forwarded := strings.TrimSpace(strings.Split(r.Header.Get("X-Forwarded-For"), ",")[0]); forwarded != "" {
		return forwarded
	}
	if realIP := strings.TrimSpace(r.Header.Get("X-Real-IP")); realIP != "" {
		return realIP
	}
	return "unknown"
}

type passwordRateLimitEntry struct {
	count     int
	expiresAt time.Time
}
type passwordIPLimiter struct {
	mu      sync.Mutex
	entries map[string]passwordRateLimitEntry
	now     func() time.Time
}

func newPasswordIPLimiter(now func() time.Time) *passwordIPLimiter {
	return &passwordIPLimiter{entries: make(map[string]passwordRateLimitEntry), now: now}
}

func (limiter *passwordIPLimiter) allow(ip string) bool {
	limiter.mu.Lock()
	defer limiter.mu.Unlock()
	now := limiter.now()
	entry, ok := limiter.entries[ip]
	if !ok || !now.Before(entry.expiresAt) {
		entry = passwordRateLimitEntry{expiresAt: now.Add(passwordRateLimitWindow)}
	}
	if entry.count >= passwordRateLimitAttempts {
		limiter.entries[ip] = entry
		return false
	}
	entry.count++
	limiter.entries[ip] = entry
	return true
}

func (limiter *passwordIPLimiter) clear(ip string) {
	limiter.mu.Lock()
	defer limiter.mu.Unlock()
	delete(limiter.entries, ip)
}