use base64::Engine;
use db::conn::sea_orm::{ActiveModelTrait, EntityTrait, QueryFilter, Set};
use rand::TryRng;
use sha2::{Digest, Sha256};
use uuid::Uuid;

use crate::error::{UserError, UserResult};
use crate::features::UserService;
use crate::metrics::{self, SecurityResource, SecurityResourceOp, record_security_operation};

use super::{
    AccessKeyScope, AccessKeyView, AddSshKeyCmd, CreateAccessKeyCmd, CreateAccessKeyResp,
    PushPlatform, PushSubscriptionView, RecoveryCodeView, RegenerateRecoveryResp, SshKeyType,
    SshKeyView, UpsertPushCmd,
};

fn random_token(bytes: usize) -> String {
    let mut buf = vec![0u8; bytes];
    rand::rng().try_fill_bytes(&mut buf).expect("rng");
    base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(&buf)
}

fn sha256_hex(data: &[u8]) -> String {
    let mut h = Sha256::new();
    h.update(data);
    let out = h.finalize();
    out.iter().map(|b| format!("{:02x}", b)).collect()
}

pub async fn list_recovery(svc: &UserService, caller: Uuid) -> UserResult<Vec<RecoveryCodeView>> {
    let _timer = metrics::Timer::start(metrics::FEATURE_RECOVERY_CODES_LIST);
    let result: UserResult<Vec<RecoveryCodeView>> = async {
        let db = svc.db.reader();
        let rows = db::user::user_recovery_codes::Entity::find()
            .filter(db::user::user_recovery_codes::COLUMN.user_id.eq(caller))
            .all(&db)
            .await?;
        Ok(rows.into_iter().map(RecoveryCodeView::from).collect())
    }
    .await;
    metrics::record_outcome(metrics::FEATURE_RECOVERY_CODES_LIST, &result);
    result
}

pub async fn regenerate_recovery(
    svc: &UserService,
    caller: Uuid,
) -> UserResult<RegenerateRecoveryResp> {
    let _timer = metrics::Timer::start(metrics::FEATURE_RECOVERY_CODES_REGENERATE);
    let result: UserResult<RegenerateRecoveryResp> = async {
        let writer = svc.db.writer();
        db::user::user_recovery_codes::Entity::delete_many()
            .filter(db::user::user_recovery_codes::COLUMN.user_id.eq(caller))
            .exec(&writer)
            .await?;

        let max = svc.config.max_recovery_codes;
        let mut codes: Vec<String> = Vec::with_capacity(max);
        let now = time::OffsetDateTime::now_utc();
        for _ in 0..max {
            let raw = format!("{}-{}", random_token(4), random_token(4),);
            let raw = raw
                .replace('-', "")
                .chars()
                .take(10)
                .collect::<String>()
                .to_uppercase();
            let hash = sha256_hex(raw.as_bytes());
            let active: db::user::user_recovery_codes::ActiveModel =
                db::user::user_recovery_codes::ActiveModel::builder()
                    .set_id(Uuid::new_v4())
                    .set_user_id(caller)
                    .set_code_hash(hash)
                    .set_used_at(None)
                    .set_expires_at(None)
                    .set_created_at(now)
                    .into();
            active.insert(&writer).await?;
            codes.push(raw);
        }
        Ok(RegenerateRecoveryResp { codes })
    }
    .await;
    metrics::record_outcome(metrics::FEATURE_RECOVERY_CODES_REGENERATE, &result);
    if result.is_ok() {
        record_security_operation(
            SecurityResource::RecoveryCode,
            SecurityResourceOp::Regenerate,
            metrics::OUTCOME_SUCCESS,
        );
    }
    result
}

pub async fn list_access_keys(svc: &UserService, caller: Uuid) -> UserResult<Vec<AccessKeyView>> {
    let _timer = metrics::Timer::start(metrics::FEATURE_ACCESS_KEYS_LIST);
    let result: UserResult<Vec<AccessKeyView>> = async {
        let db = svc.db.reader();
        let rows = db::user::user_access_keys::Entity::find()
            .filter(db::user::user_access_keys::COLUMN.user_id.eq(caller))
            .all(&db)
            .await?;
        Ok(rows.into_iter().map(AccessKeyView::from).collect())
    }
    .await;
    metrics::record_outcome(metrics::FEATURE_ACCESS_KEYS_LIST, &result);
    result
}

pub async fn create_access_key(
    svc: &UserService,
    caller: Uuid,
    cmd: CreateAccessKeyCmd,
) -> UserResult<CreateAccessKeyResp> {
    let _timer = metrics::Timer::start(metrics::FEATURE_ACCESS_KEYS_CREATE);
    let result: UserResult<CreateAccessKeyResp> = async {
        let bytes = svc.config.access_key_token_bytes;
        let raw = random_token(bytes);
        let salt = random_token(16);
        let hash = sha256_hex(format!("{}{}", raw, salt).as_bytes());
        let last_eight: String = raw
            .chars()
            .rev()
            .take(8)
            .collect::<String>()
            .chars()
            .rev()
            .collect();
        let now = time::OffsetDateTime::now_utc();
        let writer = svc.db.writer();
        let active: db::user::user_access_keys::ActiveModel =
            db::user::user_access_keys::ActiveModel::builder()
                .set_id(Uuid::new_v4())
                .set_user_id(caller)
                .set_name(cmd.name)
                .set_token_hash(hash)
                .set_token_salt(salt)
                .set_token_last_eight(last_eight)
                .set_scope(cmd.scope)
                .set_version(1)
                .set_created_at(now)
                .set_updated_at(now)
                .into();
        let saved = active.insert(&writer).await?;
        Ok(CreateAccessKeyResp {
            key: AccessKeyView::from(saved),
            token: raw,
        })
    }
    .await;
    metrics::record_outcome(metrics::FEATURE_ACCESS_KEYS_CREATE, &result);
    if result.is_ok() {
        record_security_operation(
            SecurityResource::AccessKey,
            SecurityResourceOp::Create,
            metrics::OUTCOME_SUCCESS,
        );
    }
    result
}

pub async fn delete_access_key(svc: &UserService, caller: Uuid, key_id: Uuid) -> UserResult<()> {
    let _timer = metrics::Timer::start(metrics::FEATURE_ACCESS_KEYS_DELETE);
    let result: UserResult<()> = async {
        let writer = svc.db.writer();
        let row = db::user::user_access_keys::Entity::find_by_id(key_id)
            .one(&writer)
            .await?
            .ok_or_else(|| UserError::NotFound(format!("access key {key_id}")))?;
        if row.user_id != caller {
            return Err(UserError::Forbidden(
                "cannot delete other user's key".into(),
            ));
        }
        db::user::user_access_keys::Entity::delete_by_id(key_id)
            .exec(&writer)
            .await?;
        Ok(())
    }
    .await;
    metrics::record_outcome(metrics::FEATURE_ACCESS_KEYS_DELETE, &result);
    match &result {
        Ok(_) => record_security_operation(
            SecurityResource::AccessKey,
            SecurityResourceOp::Delete,
            metrics::OUTCOME_SUCCESS,
        ),
        Err(UserError::Forbidden(_)) => record_security_operation(
            SecurityResource::AccessKey,
            SecurityResourceOp::Delete,
            "forbidden",
        ),
        Err(UserError::NotFound(_)) => record_security_operation(
            SecurityResource::AccessKey,
            SecurityResourceOp::Delete,
            "not_found",
        ),
        Err(_) => {}
    }
    result
}

pub async fn list_ssh_keys(svc: &UserService, caller: Uuid) -> UserResult<Vec<SshKeyView>> {
    let _timer = metrics::Timer::start(metrics::FEATURE_SSH_KEYS_LIST);
    let result: UserResult<Vec<SshKeyView>> = async {
        let db = svc.db.reader();
        let rows = db::user::user_ssh_keys::Entity::find()
            .filter(db::user::user_ssh_keys::COLUMN.user_id.eq(caller))
            .all(&db)
            .await?;
        Ok(rows.into_iter().map(SshKeyView::from).collect())
    }
    .await;
    metrics::record_outcome(metrics::FEATURE_SSH_KEYS_LIST, &result);
    result
}

pub async fn add_ssh_key(
    svc: &UserService,
    caller: Uuid,
    cmd: AddSshKeyCmd,
) -> UserResult<SshKeyView> {
    let _timer = metrics::Timer::start(metrics::FEATURE_SSH_KEYS_ADD);
    let result: UserResult<SshKeyView> = async {
        if cmd.name.is_empty() || cmd.name.len() > 64 {
            return Err(UserError::BadRequest(
                "ssh key name length must be 1..=64".into(),
            ));
        }
        let detected = detect_ssh_key_type(&cmd.content).ok_or_else(|| {
            UserError::BadRequest("ssh key content malformed or unsupported".into())
        })?;
        let key_type = cmd.key_type.map(Into::into).unwrap_or(detected);
        let fingerprint = sha256_hex(cmd.content.as_bytes());

        let writer = svc.db.writer();
        let now = time::OffsetDateTime::now_utc();
        let active: db::user::user_ssh_keys::ActiveModel =
            db::user::user_ssh_keys::ActiveModel::builder()
                .set_id(Uuid::new_v4())
                .set_user_id(caller)
                .set_key_type(key_type)
                .set_fingerprint(fingerprint.clone())
                .set_name(cmd.name)
                .set_content(cmd.content)
                .set_created_at(now)
                .set_updated_at(now)
                .set_last_used_at(None)
                .into();
        let saved = active.insert(&writer).await?;
        Ok(SshKeyView::from(saved))
    }
    .await;
    metrics::record_outcome(metrics::FEATURE_SSH_KEYS_ADD, &result);
    match &result {
        Ok(_) => record_security_operation(
            SecurityResource::SshKey,
            SecurityResourceOp::Add,
            metrics::OUTCOME_SUCCESS,
        ),
        Err(UserError::BadRequest(_)) => record_security_operation(
            SecurityResource::SshKey,
            SecurityResourceOp::Add,
            "bad_request",
        ),
        Err(_) => {}
    }
    result
}

pub async fn delete_ssh_key(svc: &UserService, caller: Uuid, key_id: Uuid) -> UserResult<()> {
    let _timer = metrics::Timer::start(metrics::FEATURE_SSH_KEYS_DELETE);
    let result: UserResult<()> = async {
        let writer = svc.db.writer();
        let row = db::user::user_ssh_keys::Entity::find_by_id(key_id)
            .one(&writer)
            .await?
            .ok_or_else(|| UserError::NotFound(format!("ssh key {key_id}")))?;
        if row.user_id != caller {
            return Err(UserError::Forbidden(
                "cannot delete other user's ssh key".into(),
            ));
        }
        db::user::user_ssh_keys::Entity::delete_by_id(key_id)
            .exec(&writer)
            .await?;
        Ok(())
    }
    .await;
    metrics::record_outcome(metrics::FEATURE_SSH_KEYS_DELETE, &result);
    match &result {
        Ok(_) => record_security_operation(
            SecurityResource::SshKey,
            SecurityResourceOp::Delete,
            metrics::OUTCOME_SUCCESS,
        ),
        Err(UserError::Forbidden(_)) => record_security_operation(
            SecurityResource::SshKey,
            SecurityResourceOp::Delete,
            "forbidden",
        ),
        Err(UserError::NotFound(_)) => record_security_operation(
            SecurityResource::SshKey,
            SecurityResourceOp::Delete,
            "not_found",
        ),
        Err(_) => {}
    }
    result
}

fn detect_ssh_key_type(content: &str) -> Option<db::user::user_ssh_keys::SshKeyType> {
    use db::user::user_ssh_keys::SshKeyType as K;
    if content.starts_with("ssh-rsa") {
        Some(K::SshRsa)
    } else if content.starts_with("ssh-ed25519") {
        Some(K::SshEd25519)
    } else if content.starts_with("ecdsa-sha2-nistp256") {
        Some(K::EcdsaSha2Nistp256)
    } else {
        None
    }
}

pub async fn list_push(svc: &UserService, caller: Uuid) -> UserResult<Vec<PushSubscriptionView>> {
    let _timer = metrics::Timer::start(metrics::FEATURE_PUSH_SUBS_LIST);
    let result: UserResult<Vec<PushSubscriptionView>> = async {
        let db = svc.db.reader();
        let rows = db::user::user_push_subscriptions::Entity::find()
            .filter(db::user::user_push_subscriptions::COLUMN.user_id.eq(caller))
            .all(&db)
            .await?;
        Ok(rows.into_iter().map(PushSubscriptionView::from).collect())
    }
    .await;
    metrics::record_outcome(metrics::FEATURE_PUSH_SUBS_LIST, &result);
    result
}

pub async fn upsert_push(
    svc: &UserService,
    caller: Uuid,
    cmd: UpsertPushCmd,
) -> UserResult<PushSubscriptionView> {
    let _timer = metrics::Timer::start(metrics::FEATURE_PUSH_SUBS_UPSERT);
    let result: UserResult<PushSubscriptionView> = async {
        if cmd.endpoint.is_empty() || cmd.endpoint.len() > 2048 {
            return Err(UserError::BadRequest("endpoint invalid".into()));
        }
        let writer = svc.db.writer();
        let now = time::OffsetDateTime::now_utc();
        let existing = db::user::user_push_subscriptions::Entity::find()
            .filter(db::user::user_push_subscriptions::COLUMN.user_id.eq(caller))
            .filter(
                db::user::user_push_subscriptions::COLUMN
                    .endpoint
                    .eq(&cmd.endpoint),
            )
            .one(&writer)
            .await?;
        let saved = if let Some(row) = existing {
            let mut am: db::user::user_push_subscriptions::ActiveModel = row.into();
            am.p256dh_key = Set(cmd.p256dh_key);
            am.auth_key = Set(cmd.auth_key);
            am.platform = Set(cmd.platform.into());
            am.user_agent = Set(cmd.user_agent);
            am.updated_at = Set(Some(now));
            am.update(&writer).await?
        } else {
            let active: db::user::user_push_subscriptions::ActiveModel =
                db::user::user_push_subscriptions::ActiveModel::builder()
                    .set_id(Uuid::new_v4())
                    .set_user_id(caller)
                    .set_endpoint(cmd.endpoint)
                    .set_p256dh_key(cmd.p256dh_key)
                    .set_auth_key(cmd.auth_key)
                    .set_platform(cmd.platform)
                    .set_user_agent(cmd.user_agent)
                    .set_created_at(now)
                    .set_updated_at(Some(now))
                    .into();
            active.insert(&writer).await?
        };
        Ok(PushSubscriptionView::from(saved))
    }
    .await;
    metrics::record_outcome(metrics::FEATURE_PUSH_SUBS_UPSERT, &result);
    if result.is_ok() {
        record_security_operation(
            SecurityResource::PushSubscription,
            SecurityResourceOp::Upsert,
            metrics::OUTCOME_SUCCESS,
        );
    }
    result
}

pub async fn delete_push(svc: &UserService, caller: Uuid, push_id: Uuid) -> UserResult<()> {
    let _timer = metrics::Timer::start(metrics::FEATURE_PUSH_SUBS_DELETE);
    let result: UserResult<()> = async {
        let writer = svc.db.writer();
        let row = db::user::user_push_subscriptions::Entity::find_by_id(push_id)
            .one(&writer)
            .await?
            .ok_or_else(|| UserError::NotFound(format!("push subscription {push_id}")))?;
        if row.user_id != caller {
            return Err(UserError::Forbidden(
                "cannot delete other user's push subscription".into(),
            ));
        }
        db::user::user_push_subscriptions::Entity::delete_by_id(push_id)
            .exec(&writer)
            .await?;
        Ok(())
    }
    .await;
    metrics::record_outcome(metrics::FEATURE_PUSH_SUBS_DELETE, &result);
    match &result {
        Ok(_) => record_security_operation(
            SecurityResource::PushSubscription,
            SecurityResourceOp::Delete,
            metrics::OUTCOME_SUCCESS,
        ),
        Err(UserError::Forbidden(_)) => record_security_operation(
            SecurityResource::PushSubscription,
            SecurityResourceOp::Delete,
            "forbidden",
        ),
        Err(UserError::NotFound(_)) => record_security_operation(
            SecurityResource::PushSubscription,
            SecurityResourceOp::Delete,
            "not_found",
        ),
        Err(_) => {}
    }
    result
}

#[allow(dead_code)]
fn _use_unused(_: &AccessKeyScope, _: &SshKeyType, _: &PushPlatform) {}