using System.Security.Cryptography;
using System.Text;
using Media.JoshHeaps.Net;
using Media.JoshHeaps.Net.Models;

namespace Media.JoshHeaps.Net.Services;

public class AuthService(DbExecutor db)
{
    // Hash a password using BCrypt
    public string HashPassword(string password)
    {
        return BCrypt.Net.BCrypt.HashPassword(password);
    }

    // Verify a password against a hash
    public bool VerifyPassword(string password, string hash)
    {
        try
        {
            return BCrypt.Net.BCrypt.Verify(password, hash);
        }
        catch
        {
            return false;
        }
    }

    // Register a new user
    public async Task<(bool Success, string? Error, string? VerificationToken)> RegisterUserAsync(string email, string username, string password)
    {
        try
        {
            // Check if email already exists
            var emailExists = await db.ExecuteAsync<long>(
                "SELECT COUNT(*) FROM app.users WHERE email = @email",
                new { email }
            );

            if (emailExists > 0)
            {
                return (false, "Email is already registered", null);
            }

            // Check if username already exists
            var usernameExists = await db.ExecuteAsync<long>(
                "SELECT COUNT(*) FROM app.users WHERE username = @username",
                new { username }
            );

            if (usernameExists > 0)
            {
                return (false, "Username is already taken", null);
            }

            // Hash the password
            var passwordHash = HashPassword(password);

            // Insert new user and get the user ID
            var userId = await db.ExecuteAsync<long>(
                @"INSERT INTO app.users (email, username, password_hash, is_active, email_verified, failed_login_attempts)
                  VALUES (@email, @username, @passwordHash, true, false, 0)
                  RETURNING id",
                new { email, username, passwordHash }
            );

            // Generate verification token
            var verificationToken = GenerateVerificationToken();
            var expiresAt = DateTime.UtcNow.AddHours(24);

            // Store verification token
            await db.ExecuteAsync<object>(
                @"INSERT INTO app.email_verification_tokens (user_id, token, expires_at)
                  VALUES (@userId, @verificationToken, @expiresAt)",
                new { userId, verificationToken, expiresAt }
            );

            return (true, null, verificationToken);
        }
        catch (Exception ex)
        {
            return (false, $"Registration failed: {ex.Message}", null);
        }
    }

    // Generate verification token
    private string GenerateVerificationToken()
    {
        return Guid.NewGuid().ToString("N");
    }

    // Verify email with token
    public async Task<(bool Success, string? Error)> VerifyEmailAsync(string token)
    {
        try
        {
            // Get token info
            var tokenRow = await db.ExecuteReaderAsync(
                @"SELECT user_id, expires_at, verified_at
                  FROM app.email_verification_tokens
                  WHERE token = @token",
                reader =>
                {
                    return new
                    {
                        UserId = reader.GetInt64(0),
                        ExpiresAt = reader.GetDateTime(1),
                        VerifiedAt = reader.IsDBNull(2) ? (DateTime?)null : reader.GetDateTime(2)
                    };
                },
                new { token }
            );

            if (tokenRow == null)
            {
                return (false, "Invalid verification token");
            }

            if (tokenRow.VerifiedAt.HasValue)
            {
                return (false, "Email has already been verified");
            }

            if (tokenRow.ExpiresAt < DateTime.UtcNow)
            {
                return (false, "Verification token has expired");
            }

            // Mark token as verified
            await db.ExecuteAsync<object>(
                "UPDATE app.email_verification_tokens SET verified_at = @verifiedAt WHERE token = @token",
                new { verifiedAt = DateTime.UtcNow, token }
            );

            // Mark user email as verified
            await db.ExecuteAsync<object>(
                "UPDATE app.users SET email_verified = true WHERE id = @userId",
                new { userId = tokenRow.UserId }
            );

            return (true, null);
        }
        catch (Exception ex)
        {
            return (false, $"Verification failed: {ex.Message}");
        }
    }

    // Resend verification email
    public async Task<(bool Success, string? Error, string? VerificationToken)> ResendVerificationTokenAsync(string email)
    {
        try
        {
            // Get user by email
            var userRow = await db.ExecuteReaderAsync(
                "SELECT id, email_verified FROM app.users WHERE email = @email",
                reader =>
                {
                    return new
                    {
                        UserId = reader.GetInt64(0),
                        EmailVerified = reader.GetBoolean(1)
                    };
                },
                new { email }
            );

            if (userRow == null)
            {
                return (false, "Email not found", null);
            }

            if (userRow.EmailVerified)
            {
                return (false, "Email is already verified", null);
            }

            // Invalidate old tokens (set verified_at to prevent reuse)
            await db.ExecuteAsync<object>(
                "UPDATE app.email_verification_tokens SET verified_at = @verifiedAt WHERE user_id = @userId AND verified_at IS NULL",
                new { verifiedAt = DateTime.UtcNow, userId = userRow.UserId }
            );

            // Generate new verification token
            var verificationToken = GenerateVerificationToken();
            var expiresAt = DateTime.UtcNow.AddHours(24);

            // Store new verification token
            await db.ExecuteAsync<object>(
                @"INSERT INTO app.email_verification_tokens (user_id, token, expires_at)
                  VALUES (@userId, @verificationToken, @expiresAt)",
                new { userId = userRow.UserId, verificationToken, expiresAt }
            );

            return (true, null, verificationToken);
        }
        catch (Exception ex)
        {
            return (false, $"Failed to resend verification: {ex.Message}", null);
        }
    }

    // Login user
    public async Task<(bool Success, string? Error, UserLoginInfo? User)> LoginAsync(string emailOrUsername, string password)
    {
        try
        {
            // Get user by email or username
            var query = @"
                SELECT id, email, username, password_hash, is_active, email_verified,
                       failed_login_attempts, locked_until, last_login
                FROM app.users
                WHERE email = @emailOrUsername OR username = @emailOrUsername";

            var userRow = await db.ExecuteReaderAsync(query, reader =>
            {
                return new UserRow
                {
                    Id = reader.GetInt64(0),
                    Email = reader.GetString(1),
                    Username = reader.GetString(2),
                    PasswordHash = reader.GetString(3),
                    IsActive = reader.GetBoolean(4),
                    EmailVerified = reader.GetBoolean(5),
                    FailedAttempts = reader.GetInt32(6),
                    LockedUntil = reader.IsDBNull(7) ? (DateTime?)null : reader.GetDateTime(7)
                };
            }, new { emailOrUsername });

            if (userRow == null)
            {
                return (false, "Invalid email/username or password", null);
            }

            // Check if account is locked
            if (userRow.LockedUntil.HasValue && userRow.LockedUntil.Value > DateTime.UtcNow)
            {
                var remainingMinutes = (int)(userRow.LockedUntil.Value - DateTime.UtcNow).TotalMinutes;
                return (false, $"Account is locked. Try again in {remainingMinutes} minute(s)", null);
            }

            // Check if account is active
            if (!userRow.IsActive)
            {
                return (false, "Account is deactivated", null);
            }

            // Verify password
            if (!VerifyPassword(password, userRow.PasswordHash))
            {
                // Increment failed attempts
                await IncrementFailedLoginAttemptsAsync(userRow.Id, userRow.FailedAttempts);
                return (false, "Invalid email/username or password", null);
            }

            // Successful login - reset failed attempts and update last login
            await ResetFailedLoginAttemptsAsync(userRow.Id);

            var userInfo = new UserLoginInfo
            {
                Id = userRow.Id,
                Email = userRow.Email,
                Username = userRow.Username,
                IsActive = userRow.IsActive,
                EmailVerified = userRow.EmailVerified
            };

            return (true, null, userInfo);
        }
        catch (Exception ex)
        {
            return (false, $"Login failed: {ex.Message}", null);
        }
    }

    // Increment failed login attempts
    private async Task IncrementFailedLoginAttemptsAsync(long userId, int currentAttempts)
    {
        var newAttempts = currentAttempts + 1;

        // Lock account for 15 minutes after 5 failed attempts
        if (newAttempts >= 5)
        {
            var lockUntil = DateTime.UtcNow.AddMinutes(15);
            await db.ExecuteAsync<object>(
                "UPDATE app.users SET failed_login_attempts = @newAttempts, locked_until = @lockUntil WHERE id = @userId",
                new { userId, newAttempts, lockUntil }
            );
        }
        else
        {
            await db.ExecuteAsync<object>(
                "UPDATE app.users SET failed_login_attempts = @newAttempts WHERE id = @userId",
                new { userId, newAttempts }
            );
        }
    }

    // Reset failed login attempts
    private async Task ResetFailedLoginAttemptsAsync(long userId)
    {
        await db.ExecuteAsync<object>(
            "UPDATE app.users SET failed_login_attempts = 0, locked_until = NULL, last_login = @lastLogin WHERE id = @userId",
            new { userId, lastLogin = DateTime.UtcNow }
        );
    }

    public static string GenerateSecureToken()
    {
        var bytes = RandomNumberGenerator.GetBytes(32);
        return Convert.ToBase64String(bytes)
            .Replace("+", "-")
            .Replace("/", "_")
            .TrimEnd('=');
    }

    public static string HashToken(string token)
    {
        var bytes = SHA256.HashData(Encoding.UTF8.GetBytes(token));
        return Convert.ToHexString(bytes).ToLowerInvariant();
    }

    public async Task<(bool Success, string? Error, string? Token, string? Username)> RequestPasswordResetAsync(string email)
    {
        try
        {
            var userRow = await db.ExecuteReaderAsync(
                "SELECT id, username, is_active, locked_until FROM app.users WHERE email = @email",
                reader => new
                {
                    UserId = reader.GetInt64(0),
                    Username = reader.GetString(1),
                    IsActive = reader.GetBoolean(2),
                    LockedUntil = reader.IsDBNull(3) ? (DateTime?)null : reader.GetDateTime(3)
                },
                new { email }
            );

            if (userRow == null)
            {
                // Artificial delay to prevent timing-based email enumeration
                await Task.Delay(Random.Shared.Next(100, 300));
                return (true, null, null, null);
            }

            // Silently succeed for inactive/locked accounts (don't reveal state)
            if (!userRow.IsActive ||
                (userRow.LockedUntil.HasValue && userRow.LockedUntil.Value > DateTime.UtcNow))
            {
                return (true, null, null, null);
            }

            // Rate limit: max 3 requests per hour
            var recentCount = await db.ExecuteAsync<long>(
                @"SELECT COUNT(*) FROM app.password_reset_tokens
                  WHERE user_id = @userId AND created_at > @cutoff",
                new { userId = userRow.UserId, cutoff = DateTimeOffset.UtcNow.AddHours(-1) }
            );

            if (recentCount >= 3)
            {
                return (true, null, null, null);
            }

            // Invalidate all existing unused tokens for this user
            await db.ExecuteNonQueryAsync(
                @"UPDATE app.password_reset_tokens
                  SET used_at = @now
                  WHERE user_id = @userId AND used_at IS NULL",
                new { userId = userRow.UserId, now = DateTimeOffset.UtcNow }
            );

            // Generate and store new token
            var token = GenerateSecureToken();
            var tokenHash = HashToken(token);
            var expiresAt = DateTimeOffset.UtcNow.AddHours(1);

            await db.ExecuteNonQueryAsync(
                @"INSERT INTO app.password_reset_tokens (user_id, token_hash, expires_at)
                  VALUES (@userId, @tokenHash, @expiresAt)",
                new { userId = userRow.UserId, tokenHash, expiresAt }
            );

            return (true, null, token, userRow.Username);
        }
        catch (Exception ex)
        {
            return (false, $"Password reset request failed: {ex.Message}", null, null);
        }
    }

    public async Task<(bool Valid, string? Error)> ValidatePasswordResetTokenAsync(string token)
    {
        try
        {
            var tokenHash = HashToken(token);

            var tokenRow = await db.ExecuteReaderAsync(
                @"SELECT expires_at, used_at FROM app.password_reset_tokens
                  WHERE token_hash = @tokenHash",
                reader => new
                {
                    ExpiresAt = reader.GetFieldValue<DateTimeOffset>(0),
                    UsedAt = reader.IsDBNull(1) ? (DateTimeOffset?)null : reader.GetFieldValue<DateTimeOffset>(1)
                },
                new { tokenHash }
            );

            if (tokenRow == null)
                return (false, "Invalid or expired reset link. Please request a new one.");

            if (tokenRow.UsedAt.HasValue)
                return (false, "This reset link has already been used. Please request a new one.");

            if (tokenRow.ExpiresAt < DateTimeOffset.UtcNow)
                return (false, "This reset link has expired. Please request a new one.");

            return (true, null);
        }
        catch (Exception ex)
        {
            return (false, $"Token validation failed: {ex.Message}");
        }
    }

    public async Task<(bool Success, string? Error)> ResetPasswordAsync(string token, string newPassword)
    {
        try
        {
            var tokenHash = HashToken(token);

            var tokenRow = await db.ExecuteReaderAsync(
                @"SELECT id, user_id, expires_at, used_at FROM app.password_reset_tokens
                  WHERE token_hash = @tokenHash",
                reader => new
                {
                    Id = reader.GetInt64(0),
                    UserId = reader.GetInt64(1),
                    ExpiresAt = reader.GetFieldValue<DateTimeOffset>(2),
                    UsedAt = reader.IsDBNull(3) ? (DateTimeOffset?)null : reader.GetFieldValue<DateTimeOffset>(3)
                },
                new { tokenHash }
            );

            if (tokenRow == null)
                return (false, "Invalid or expired reset link. Please request a new one.");

            if (tokenRow.UsedAt.HasValue)
                return (false, "This reset link has already been used. Please request a new one.");

            if (tokenRow.ExpiresAt < DateTimeOffset.UtcNow)
                return (false, "This reset link has expired. Please request a new one.");

            // Hash new password and update user
            var passwordHash = HashPassword(newPassword);
            await db.ExecuteNonQueryAsync(
                @"UPDATE app.users
                  SET password_hash = @passwordHash, failed_login_attempts = 0, locked_until = NULL
                  WHERE id = @userId",
                new { userId = tokenRow.UserId, passwordHash }
            );

            // Mark token as used
            await db.ExecuteNonQueryAsync(
                "UPDATE app.password_reset_tokens SET used_at = @now WHERE id = @tokenId",
                new { tokenId = tokenRow.Id, now = DateTimeOffset.UtcNow }
            );

            return (true, null);
        }
        catch (Exception ex)
        {
            return (false, $"Password reset failed: {ex.Message}");
        }
    }
}