package service

import (
	"context"
	"crypto/rand"
	"crypto/sha256"
	"encoding/hex"
	"errors"
	"fmt"
	"sync"
	"time"

	"github.com/golang-jwt/jwt/v5"
	"golang.org/x/crypto/bcrypt"
	"gorm.io/gorm"

	"oci-portal/internal/cache"
	"oci-portal/internal/crypto"
	"oci-portal/internal/model"
)

// ErrInvalidCredentials 表示用户名或密码错误；不区分两者以免泄露账号是否存在。
var ErrInvalidCredentials = errors.New("invalid username or password")

// ErrLoginLocked 表示该 IP+用户名组合因连续失败被锁定;不提示剩余次数与时长细节。
var ErrLoginLocked = errors.New("too many failed attempts, try again later")

// tokenTTL 是登录令牌有效期。
const tokenTTL = 24 * time.Hour

// dummyBcryptHash 是恒定失败的占位哈希("dummy-password"),
// 用户不存在分支比对它以对齐耗时,防用户枚举与时序侧信道。
const dummyBcryptHash = "$2a$10$N9qo8uLOickgx2ZMRZoMye3xW1Wq8p1zEIfQpXCXbXyE3xY5C6P6W"

// AuthService 负责账号初始化、登录校验(密码 + 可选 TOTP)和 JWT 签发与验证。
type AuthService struct {
	db        *gorm.DB
	jwtSecret []byte
	guard     *loginGuard
	// revoked 是登出令牌黑名单(哈希→占位),TTL 对齐令牌剩余有效期,过期自动清出
	revoked *cache.Cache

	notifier *Notifier
	settings *SettingService
	cipher   *crypto.Cipher // TOTP 密钥加密落库用,SetCipher 注入

	totpMu      sync.Mutex
	totpPending map[string]pendingTotp // username → setup 暂存密钥
}

// NewAuthService 组装依赖。
func NewAuthService(db *gorm.DB, jwtSecret string) *AuthService {
	return &AuthService{
		db: db, jwtSecret: []byte(jwtSecret),
		guard:       newLoginGuard(),
		revoked:     cache.New(4096),
		totpPending: map[string]pendingTotp{},
	}
}

// SetNotifier 注入锁定告警依赖;不注入(nil)则只锁定不推送。
func (s *AuthService) SetNotifier(n *Notifier, settings *SettingService) {
	s.notifier = n
	s.settings = settings
}

// SetCipher 注入加密组件(TOTP 密钥落库),main 启动时调用。
func (s *AuthService) SetCipher(c *crypto.Cipher) { s.cipher = c }

// EnsureAdmin 保证管理员账号可用：用户不存在时以给定密码创建；
// 已存在则不重置密码。库中无任何用户且未提供密码时报错，避免服务无法登录。
func (s *AuthService) EnsureAdmin(username, password string) error {
	if password == "" {
		var count int64
		if err := s.db.Model(&model.User{}).Count(&count).Error; err != nil {
			return fmt.Errorf("count users: %w", err)
		}
		if count == 0 {
			return fmt.Errorf("ensure admin: no user exists, set ADMIN_PASSWORD to create one")
		}
		return nil
	}
	err := s.db.Where("username = ?", username).First(&model.User{}).Error
	if err == nil {
		return nil
	}
	if !errors.Is(err, gorm.ErrRecordNotFound) {
		return fmt.Errorf("find admin user: %w", err)
	}
	return s.createUser(username, password)
}

func (s *AuthService) createUser(username, password string) error {
	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
	if err != nil {
		return fmt.Errorf("hash password: %w", err)
	}
	user := &model.User{Username: username, PasswordHash: string(hash)}
	if err := s.db.Create(user).Error; err != nil {
		return fmt.Errorf("create user %s: %w", username, err)
	}
	return nil
}

// Login 校验用户名密码与可选 TOTP,成功后签发 JWT;按「IP+用户名」滑动窗口防爆破,
// 锁定期内一律 ErrLoginLocked(正确密码同样拒绝);阈值与时长取安全设置。
// 已启用两步验证时:密码通过但缺验证码返回 ErrTotpRequired(不计失败),验证码错误计入守卫。
func (s *AuthService) Login(ctx context.Context, username, password, clientIP, totpCode string) (string, time.Time, error) {
	key := clientIP + "|" + username
	now := time.Now()
	sec := securityOf(s.settings)
	lockFor := time.Duration(sec.LoginLockMinutes) * time.Minute
	if s.guard.locked(key, now, lockFor) {
		return "", time.Time{}, ErrLoginLocked
	}
	// 禁用密码登录后直接拒绝(不计失败);读取失败按未禁用处理,防配置故障锁死
	if off, err := s.PasswordLoginDisabled(ctx); err == nil && off {
		return "", time.Time{}, ErrPasswordLoginDisabled
	}
	var user model.User
	if err := s.db.WithContext(ctx).Where("username = ?", username).First(&user).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			// 与密码错误分支对齐耗时,防用户枚举
			_ = bcrypt.CompareHashAndPassword([]byte(dummyBcryptHash), []byte(password))
			return "", time.Time{}, s.failLogin(key, now, username, clientIP, sec)
		}
		return "", time.Time{}, fmt.Errorf("find user: %w", err)
	}
	if bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)) != nil {
		return "", time.Time{}, s.failLogin(key, now, username, clientIP, sec)
	}
	if user.TotpSecretEnc != "" {
		if totpCode == "" {
			return "", time.Time{}, ErrTotpRequired
		}
		if !s.verifyTotp(&user, totpCode) {
			return "", time.Time{}, s.failLogin(key, now, username, clientIP, sec)
		}
	}
	s.guard.success(key)
	return s.signToken(user.Username)
}

// failLogin 记失败;达到阈值转锁定并推送告警(开关 login_lock,缺省开)。
func (s *AuthService) failLogin(key string, now time.Time, username, clientIP string, sec SecuritySettings) error {
	if !s.guard.fail(key, now, sec.LoginFailLimit, time.Duration(sec.LoginLockMinutes)*time.Minute) {
		return ErrInvalidCredentials
	}
	s.notifyLock(username, clientIP, sec)
	return ErrLoginLocked
}

// notifyLock 异步推送登录锁定告警;notifier 未注入或开关关闭则跳过。
func (s *AuthService) notifyLock(username, clientIP string, sec SecuritySettings) {
	if s.notifier == nil {
		return
	}
	if s.settings != nil {
		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
		defer cancel()
		if !s.settings.NotifyEventEnabled(ctx, "login_lock") {
			return
		}
	}
	s.notifier.SendTemplateAsync("login_lock", map[string]string{
		"username": username, "ip": clientIP,
		"fail_count":   fmt.Sprintf("%d", sec.LoginFailLimit),
		"lock_minutes": fmt.Sprintf("%d", sec.LoginLockMinutes),
	})
}

func (s *AuthService) signToken(username string) (string, time.Time, error) {
	now := time.Now()
	expires := now.Add(tokenTTL)
	claims := jwt.RegisteredClaims{
		Subject:   username,
		IssuedAt:  jwt.NewNumericDate(now),
		ExpiresAt: jwt.NewNumericDate(expires),
		// jti:同一秒签发的令牌若无唯一 ID 字节全同,登出一个会连坐全部
		ID: newTokenID(),
	}
	token, err := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString(s.jwtSecret)
	if err != nil {
		return "", time.Time{}, fmt.Errorf("sign token: %w", err)
	}
	return token, expires, nil
}

// newTokenID 生成 128 位随机令牌 ID(crypto/rand 自 Go 1.24 起不会失败)。
func newTokenID() string {
	b := make([]byte, 16)
	_, _ = rand.Read(b)
	return hex.EncodeToString(b)
}

// ParseToken 验证 JWT 签名与有效期，返回其中的用户名。
func (s *AuthService) ParseToken(tokenString string) (string, error) {
	claims := &jwt.RegisteredClaims{}
	_, err := jwt.ParseWithClaims(tokenString, claims, func(t *jwt.Token) (any, error) {
		if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
			return nil, fmt.Errorf("unexpected signing method %v", t.Header["alg"])
		}
		return s.jwtSecret, nil
	})
	if err != nil {
		return "", fmt.Errorf("parse token: %w", err)
	}
	if _, hit := s.revoked.Get(tokenHash(tokenString)); hit {
		return "", errors.New("token revoked")
	}
	return claims.Subject, nil
}

// Logout 把令牌拉进黑名单直至其自然过期;无效/已过期令牌直接视为成功(幂等)。
func (s *AuthService) Logout(tokenString string) {
	claims := &jwt.RegisteredClaims{}
	_, err := jwt.ParseWithClaims(tokenString, claims, func(t *jwt.Token) (any, error) {
		return s.jwtSecret, nil
	})
	if err != nil || claims.ExpiresAt == nil {
		return
	}
	ttl := time.Until(claims.ExpiresAt.Time)
	if ttl <= 0 {
		return
	}
	s.revoked.Set(tokenHash(tokenString), struct{}{}, ttl)
}

// tokenHash 取令牌 SHA-256 摘要作黑名单键,不在内存长期保留原令牌串。
func tokenHash(token string) string {
	sum := sha256.Sum256([]byte(token))
	return "revoked|" + hex.EncodeToString(sum[:])
}