use jwt::handlers::TokenPairResponse;
use jwt::rotation::{RotationContext, issue_login_pair};
use time::OffsetDateTime;

use db::conn::sea_orm::{
    ActiveModelTrait, DatabaseConnection, EntityTrait, QueryFilter, Set,
};
use db::user::user_emails::Entity as EmailEntity;
use db::user::users::{ActiveModel as UserActiveModel, Entity as UserEntity};

use crate::error::AuthError;
use crate::features::AuthService;
use crate::features::password_hash;
use crate::features::register::PowProof;
use crate::pow::PowService;

use super::types::{LoginCmd, LoginResp, UserPublic};

async fn verify_pow(pow: &PowService, proof: &PowProof, expected_cid: Option<&str>) -> Result<(), AuthError> {
    let result = pow
        .verify_solution_once(&proof.challenge, &proof.solution, expected_cid)
        .await?;
    if !result.verified {
        return Err(AuthError::PowFailed("PoW solution not accepted".into()));
    }
    Ok(())
}

async fn find_user_by_identifier(
    db: &DatabaseConnection,
    identifier: &str,
) -> Result<Option<db::user::users::Model>, AuthError> {
    let ident = identifier.trim();
    if ident.is_empty() {
        return Ok(None);
    }
    let lower = ident.to_ascii_lowercase();
    if ident.contains('@') {
        // Try email table first.
        let by_email = EmailEntity::find()
            .filter(EmailEntity::COLUMN.lower_email.eq(lower.clone()))
            // VULN-011: exclude soft-deleted emails so a removed handle
            // cannot still be used to authenticate.
            .filter(EmailEntity::COLUMN.deleted_at.is_null())
            .find_also_related(UserEntity)
            .one(db)
            .await?;
        if let Some((_em, user)) = by_email {
            return Ok(user);
        }
    }
    let by_name = UserEntity::find()
        .filter(UserEntity::COLUMN.lower_name.eq(lower))
        .one(db)
        .await?;
    Ok(by_name)
}

fn build_resp(pair: TokenPairResponse, user: db::user::users::Model) -> LoginResp {
    LoginResp {
        access_token: pair.access_token,
        refresh_token: pair.refresh_token,
        token_type: pair.token_type,
        expires_in: pair.expires_in,
        user: UserPublic::from(user),
    }
}

/// Authenticate an existing user with email/username + password.
///
/// Security guards:
/// - PoW required (anti-bruteforce on the endpoint).
/// - Unknown identifier → `InvalidCredentials` (no user enumeration).
/// - Inactive, restricted, prohibit_login users are rejected.
/// - Passwordless accounts (`passwd_hash` empty) MUST NOT sign in via password
///   and are told to use a third-party provider.
pub async fn login(
    cmd: LoginCmd,
    svc: &AuthService,
    expected_cid: Option<&str>,
) -> Result<LoginResp, AuthError> {
    verify_pow(&svc.pow, &cmd.pow, expected_cid).await?;
    let db = svc.db.writer();

    let user = find_user_by_identifier(&db, &cmd.identifier)
        .await?
        .ok_or(AuthError::InvalidCredentials)?;

    if user.prohibit_login {
        return Err(AuthError::Forbidden("login prohibited".into()));
    }
    if user.is_restricted {
        return Err(AuthError::Forbidden("account restricted".into()));
    }
    if !user.is_active {
        return Err(AuthError::Forbidden(
            "account inactive, please verify your email".into(),
        ));
    }

    let hash = user
        .passwd_hash
        .clone()
        .ok_or_else(|| AuthError::BadRequest("this account is registered via a third-party provider; please sign in with that provider".into()))?;

    let valid = password_hash::usecase::verify_password(
        password_hash::PasswordInput {
            password: &cmd.password,
        },
        &password_hash::PasswordHashString(hash),
    )?;
    if !valid {
        return Err(AuthError::InvalidCredentials);
    }

    // Issue the token pair via jwt rotation.
    let cache = svc.jwt.cache.read().await;
    let ctx = RotationContext {
        db: &db,
        settings: &svc.jwt.settings,
        cache: &cache,
    };
    let pair = issue_login_pair(
        &ctx,
        user.uid,
        user.username.clone(),
        user.is_admin,
        user.is_restricted,
        user.passwd_version.unwrap_or(0),
        cmd.app_id.clone(),
    )
    .await?;

    // Update last_login_at.
    let mut am: UserActiveModel = user.clone().into();
    am.last_login_at = Set(Some(OffsetDateTime::now_utc()));
    am.updated_at = Set(OffsetDateTime::now_utc());
    let _ = am.update(&db).await; // best-effort

    Ok(build_resp(pair.into(), user))
}