package controllers

import (
	"cmp"
	"crypto/rand"
	"encoding/hex"
	"fmt"
	"log"
	"net/http"
	"os"
	"strings"
	"sync"
	"time"

	"github.com/golang-jwt/jwt/v5"
	"golang.org/x/crypto/bcrypt"

	"congo.gg/pkg/application"
	"congo.gg/pkg/database"
	"congo.gg/dev/internal"
	"congo.gg/dev/models"
)

var (
	jwtSecret     = []byte(cmp.Or(os.Getenv("AUTH_SECRET"), "dev-secret"))
	LoginRedirect = "/"
	users         *database.Collection[models.User]
	loginLimiter  = newRateLimiter(5, time.Minute)
)

func Auth() (string, *AuthController) {
	users = models.Users
	return "auth", &AuthController{}
}

type AuthController struct {
	application.BaseController
}

func (c *AuthController) Setup(app *application.App) {
	c.BaseController.Setup(app)

	http.Handle("GET /login", app.Serve("login.html", nil))
	http.Handle("POST /login", app.Method(c, "Login", nil))
	http.HandleFunc("GET /setup", func(w http.ResponseWriter, r *http.Request) {
		if count, _ := users.Count(""); count > 0 {
			http.Redirect(w, r, "/login", http.StatusSeeOther)
			return
		}
		app.Serve("setup.html", nil).ServeHTTP(w, r)
	})
	http.Handle("POST /setup", app.Method(c, "CreateAccount", nil))
	http.Handle("POST /logout", app.Method(c, "Logout", nil))
}

func (c AuthController) Handle(r *http.Request) application.Controller {
	c.Request = r
	return &c
}

// RequireAuth returns a bouncer that redirects unauthenticated requests.
func RequireAuth() application.Bouncer {
	return func(app *application.App, w http.ResponseWriter, r *http.Request) bool {
		count, _ := users.Count("")
		if count == 0 {
			http.Redirect(w, r, "/setup", http.StatusSeeOther)
			return false
		}
		if GetUser(r) == nil {
			http.Redirect(w, r, "/login", http.StatusSeeOther)
			return false
		}
		return true
	}
}

// AuthMiddleware wraps an http.Handler with auth checking.
func AuthMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if GetUser(r) == nil {
			http.Redirect(w, r, "/login", http.StatusSeeOther)
			return
		}
		next.ServeHTTP(w, r)
	})
}

// GetUser extracts the authenticated user from the request's session cookie.
func GetUser(r *http.Request) *models.User {
	cookie, err := r.Cookie("session")
	if err != nil || cookie.Value == "" {
		return nil
	}

	token, err := jwt.Parse(cookie.Value, func(t *jwt.Token) (any, error) {
		return jwtSecret, nil
	})
	if err != nil || !token.Valid {
		return nil
	}

	claims, ok := token.Claims.(jwt.MapClaims)
	if !ok {
		return nil
	}

	userID, _ := claims["user_id"].(string)
	if userID == "" {
		return nil
	}

	user, err := users.Get(userID)
	if err != nil {
		return nil
	}
	return user
}

func setSessionCookie(w http.ResponseWriter, r *http.Request, userID string) error {
	jti := make([]byte, 16)
	if _, err := rand.Read(jti); err != nil {
		return fmt.Errorf("generating token ID: %w", err)
	}
	token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
		"user_id": userID,
		"exp":     time.Now().Add(30 * 24 * time.Hour).Unix(),
		"iat":     time.Now().Unix(),
		"jti":     hex.EncodeToString(jti),
	})
	tokenString, err := token.SignedString(jwtSecret)
	if err != nil {
		return fmt.Errorf("signing token: %w", err)
	}

	secure := r.TLS != nil || r.Header.Get("X-Forwarded-Proto") == "https"
	http.SetCookie(w, &http.Cookie{
		Name:     "session",
		Value:    tokenString,
		Path:     "/",
		HttpOnly: true,
		Secure:   secure,
		SameSite: http.SameSiteLaxMode,
		MaxAge:   30 * 24 * 60 * 60,
	})
	return nil
}

func clearSessionCookie(w http.ResponseWriter) {
	http.SetCookie(w, &http.Cookie{
		Name:     "session",
		Value:    "",
		Path:     "/",
		HttpOnly: true,
		MaxAge:   -1,
	})
}

// Template methods

func (c *AuthController) NeedsSetup() bool {
	count, _ := users.Count("")
	return count == 0
}

func (c *AuthController) HasError() bool {
	return c.QueryParam("error", "") != ""
}

func (c *AuthController) CurrentUser() *models.User {
	return GetUser(c.Request)
}

// Handlers

func (c *AuthController) Login(w http.ResponseWriter, r *http.Request) {
	count, _ := users.Count("")
	if count == 0 {
		http.Redirect(w, r, "/setup", http.StatusSeeOther)
		return
	}

	ip := r.RemoteAddr
	if !loginLimiter.allow(ip) {
		go models.Activities.Insert(&models.Activity{Action: "signin_rate_limited", Detail: "Rate limited login from " + ip})
		http.Redirect(w, r, "/login?error=1", http.StatusSeeOther)
		return
	}

	username := r.FormValue("username")
	password := r.FormValue("password")

	user, err := users.First("WHERE Username = ?", username)
	if err != nil || user == nil {
		http.Redirect(w, r, "/login?error=1", http.StatusSeeOther)
		return
	}

	if bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)) != nil {
		http.Redirect(w, r, "/login?error=1", http.StatusSeeOther)
		return
	}

	if err := setSessionCookie(w, r, user.ID); err != nil {
		c.RenderError(w, r, err)
		return
	}
	go models.Activities.Insert(&models.Activity{Action: "signin", Detail: "Signed in as " + username})
	http.Redirect(w, r, LoginRedirect, http.StatusSeeOther)
}

func (c *AuthController) CreateAccount(w http.ResponseWriter, r *http.Request) {
	count, _ := users.Count("")
	if count > 0 {
		http.Redirect(w, r, "/login", http.StatusSeeOther)
		return
	}

	// Validate setup token if it exists
	if tokenData, err := os.ReadFile("/opt/congo-dev-setup-token"); err == nil {
		expected := strings.TrimSpace(string(tokenData))
		provided := strings.TrimSpace(r.FormValue("token"))
		if expected != "" && provided != expected {
			c.RenderError(w, r, fmt.Errorf("invalid setup token"))
			return
		}
	}

	username := r.FormValue("username")
	password := r.FormValue("password")
	confirm := r.FormValue("confirm")
	if username == "" || password == "" {
		c.RenderError(w, r, fmt.Errorf("username and password are required"))
		return
	}
	if password != confirm {
		c.RenderError(w, r, fmt.Errorf("passwords do not match"))
		return
	}

	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
	if err != nil {
		c.RenderError(w, r, err)
		return
	}

	user := &models.User{
		Username:     username,
		PasswordHash: string(hash),
	}
	id, err := users.Insert(user)
	if err != nil {
		c.RenderError(w, r, err)
		return
	}

	if err := setSessionCookie(w, r, id); err != nil {
		c.RenderError(w, r, err)
		return
	}

	// Invalidate setup token now that account exists
	os.Remove("/opt/congo-dev-setup-token")

	// Set up domain if provided (basic validation)

	if domain := strings.TrimSpace(r.FormValue("domain")); domain != "" && strings.Contains(domain, ".") && !strings.ContainsAny(domain, " /\\@") {
		go func() {
			if err := internal.SetupDomain(domain); err != nil {
				log.Printf("domain setup: %v", err)
			}
		}()
	}

	go models.Activities.Insert(&models.Activity{Action: "signup", Detail: "Created account " + username})
	http.Redirect(w, r, LoginRedirect, http.StatusSeeOther)
}

func (c *AuthController) Logout(w http.ResponseWriter, r *http.Request) {
	clearSessionCookie(w)
	http.Redirect(w, r, "/login", http.StatusSeeOther)
}

// rateLimiter tracks attempts per key within a time window.
type rateLimiter struct {
	mu       sync.Mutex
	attempts map[string][]time.Time
	limit    int
	window   time.Duration
}

func newRateLimiter(limit int, window time.Duration) *rateLimiter {
	rl := &rateLimiter{
		attempts: make(map[string][]time.Time),
		limit:    limit,
		window:   window,
	}
	go func() {
		for range time.Tick(5 * time.Minute) {
			rl.mu.Lock()
			cutoff := time.Now().Add(-rl.window)
			for k, times := range rl.attempts {
				var valid []time.Time
				for _, t := range times {
					if t.After(cutoff) {
						valid = append(valid, t)
					}
				}
				if len(valid) == 0 {
					delete(rl.attempts, k)
				} else {
					rl.attempts[k] = valid
				}
			}
			rl.mu.Unlock()
		}
	}()
	return rl
}

func (rl *rateLimiter) allow(key string) bool {
	rl.mu.Lock()
	defer rl.mu.Unlock()

	now := time.Now()
	cutoff := now.Add(-rl.window)

	var valid []time.Time
	for _, t := range rl.attempts[key] {
		if t.After(cutoff) {
			valid = append(valid, t)
		}
	}

	if len(valid) >= rl.limit {
		rl.attempts[key] = valid
		return false
	}

	// Cap total tracked keys to prevent memory growth under DDoS
	if len(rl.attempts) > 10000 {
		return false
	}

	rl.attempts[key] = append(valid, now)
	return true
}