use axum::http::header::SET_COOKIE;
use axum::http::{HeaderMap, HeaderValue};
use axum::response::{IntoResponse, Redirect, Response};
use serde::{Deserialize, Serialize};

use config::oauth::OAuthConfig;

use crate::errors::AuthError;
use crate::services::AuthService;

pub mod callback;
pub mod login;
pub mod logout;
pub mod project;
pub mod refresh;
pub mod revalidate;
pub mod state;

pub const STATE_TTL_SECS: u64 = 600;
pub const REFRESH_LOCK_TTL_SECS: u64 = 10;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct LoginState {
    pub redirect: String,
    pub verifier: String,
    pub nonce: String,
    /// 本次握手实际发给 KenOAuth 的 redirect_uri。
    ///
    /// 换码时必须原样回传（OAuth 要求两者完全一致），所以随 state 一起存。
    /// `#[serde(default)]` 保证旧 state 仍能解析。
    #[serde(default)]
    pub redirect_uri: Option<String>,
}

#[derive(Debug, Deserialize)]
pub struct TokenResponse {
    pub access_token: String,
    #[serde(default)]
    pub refresh_token: Option<String>,
    #[serde(default)]
    pub id_token: Option<String>,
    #[serde(default)]
    pub expires_in: i64,
}

pub fn random_token(bytes: usize) -> String {
    use base64::Engine as _;
    let mut buffer = vec![0u8; bytes];
    rand::Rng::fill(&mut rand::thread_rng(), buffer.as_mut_slice());
    base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(buffer)
}

pub fn pkce_challenge(verifier: &str) -> String {
    use base64::Engine as _;
    use sha2::{Digest, Sha256};
    let digest = Sha256::digest(verifier.as_bytes());
    base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(digest)
}

pub fn read_cookie_header<'a>(headers: &'a HeaderMap, name: &str) -> Option<&'a str> {
    let value = headers.get(axum::http::header::COOKIE)?.to_str().ok()?;
    jwt::read_cookie(value, name)
}

pub fn append_cookie(response: &mut Response, cookie: &str) {
    if let Ok(value) = HeaderValue::from_str(cookie) {
        response.headers_mut().append(SET_COOKIE, value);
    }
}

pub fn redirect_with_cookies(
    location: &str,
    cookies: &[String],
) -> Response {
    let mut response = Redirect::to(location).into_response();
    for cookie in cookies {
        append_cookie(&mut response, cookie);
    }
    response
}

pub async fn exchange_code(
    service: &AuthService,
    code: &str,
    verifier: &str,
    redirect_uri: &str,
) -> Result<TokenResponse, AuthError> {
    let config = &service.config().oauth;
    let form = [
        ("grant_type", "authorization_code"),
        ("code", code),
        ("redirect_uri", redirect_uri),
        ("client_id", config.client_id.as_str()),
        ("code_verifier", verifier),
    ];
    let response = reqwest::Client::new()
        .post(config.token_endpoint())
        .form(&form)
        .send()
        .await
        .map_err(|error| AuthError::Internal(format!("token endpoint request failed: {error}")))?;
    if !response.status().is_success() {
        let status = response.status();
        let body = response.text().await.unwrap_or_default();
        return Err(AuthError::BadRequest(format!(
            "token endpoint rejected the grant ({status}): {body}"
        )));
    }
    response
        .json::<TokenResponse>()
        .await
        .map_err(|error| AuthError::Internal(format!("invalid token response: {error}")))
}

pub async fn refresh_grant(
    service: &AuthService,
    refresh_token: &str,
) -> Result<TokenResponse, AuthError> {
    let config = &service.config().oauth;
    let form = [
        ("grant_type", "refresh_token"),
        ("refresh_token", refresh_token),
        ("client_id", config.client_id.as_str()),
    ];
    let response = reqwest::Client::new()
        .post(config.token_endpoint())
        .form(&form)
        .send()
        .await
        .map_err(|error| AuthError::Internal(format!("token endpoint request failed: {error}")))?;
    if !response.status().is_success() {
        let body = response.text().await.unwrap_or_default();
        return Err(AuthError::BadRequest(format!(
            "refresh token rejected: {body}"
        )));
    }
    response
        .json::<TokenResponse>()
        .await
        .map_err(|error| AuthError::Internal(format!("invalid token response: {error}")))
}
/// 本次请求应该用哪个 `redirect_uri`。
///
/// 取 `x-forwarded-host`（vite / 网关都会带），退化为 `host`；
/// 只有命中 `oauth.redirect_uri_hosts` 白名单才按该主机改写，路径沿用配置里的。
pub fn resolve_redirect_uri(config: &OAuthConfig, headers: &HeaderMap) -> String {
    let host = headers
        .get("x-forwarded-host")
        .and_then(|value| value.to_str().ok())
        .or_else(|| {
            headers
                .get(axum::http::header::HOST)
                .and_then(|value| value.to_str().ok())
        })
        // 代理链可能给逗号分隔的列表，取第一跳。
        .map(|value| value.split(',').next().unwrap_or(value).trim().to_ascii_lowercase());

    let Some(host) = host else {
        return config.redirect_uri.clone();
    };
    if host.is_empty()
        || !config
            .redirect_uri_hosts
            .iter()
            .any(|allowed| allowed.trim().eq_ignore_ascii_case(&host))
    {
        return config.redirect_uri.clone();
    }

    let path = url::Url::parse(&config.redirect_uri)
        .map(|url| url.path().to_string())
        .unwrap_or_else(|_| "/api/v1/auth/callback".to_string());
    format!("http://{host}{path}")
}