//! auth.v1 的 access key 校验。
//!
//! 明文令牌只出现在请求里，本层立即摘要后丢弃；库内只存 sha256 hex。
//! 调用方：git（HTTP 传输的凭据校验）。

use chrono::{DateTime, Utc};
use internal::Gate;
use internal::server::InternalRouter;
use sea_orm::{ColumnTrait, EntityTrait, QueryFilter};
use tonic::{Request, Response, Status};

use crate::models::users::{user_access_tokens, users};
use crate::protos::auth::common::v1::{AccessKeyInfo, AuthMethod, Code, Principal};
use crate::protos::auth::v1::access_key_service_server::{
    AccessKeyService as AccessKeyTrait, AccessKeyServiceServer,
};
use crate::protos::auth::v1::{
    CreateAccessKeyRequest, CreateAccessKeyResponse, ListAccessKeysRequest, ListAccessKeysResponse,
    RevokeAccessKeyRequest, RevokeAccessKeyResponse, RotateAccessKeyRequest,
    RotateAccessKeyResponse, VerifyAccessKeyRequest, VerifyAccessKeyResponse,
};
use crate::services::AuthService;
use crate::share::crypto::sha256_hex;

pub fn register(router: InternalRouter, service: &AuthService, gate: Gate) -> InternalRouter {
    router.add_service(AccessKeyServiceServer::with_interceptor(
        AccessKeyRpc {
            service: service.clone(),
        },
        gate,
    ))
}

#[derive(Clone)]
struct AccessKeyRpc {
    service: AuthService,
}

#[tonic::async_trait]
impl AccessKeyTrait for AccessKeyRpc {
    async fn verify_access_key(
        &self,
        request: Request<VerifyAccessKeyRequest>,
    ) -> Result<Response<VerifyAccessKeyResponse>, Status> {
        let _meta = internal::interceptor::meta(&request)?;
        let request = request.into_inner();
        let plaintext = request.access_key.trim();
        if plaintext.is_empty() {
            return Err(Status::invalid_argument("access key is required"));
        }

        let db = self.service.db().read();
        let token = user_access_tokens::Entity::find()
            .filter(user_access_tokens::Column::TokenHash.eq(sha256_hex(plaintext.as_bytes())))
            .one(db)
            .await
            .map_err(|error| {
                tracing::error!(%error, "access key lookup failed");
                Status::internal("access key lookup failed")
            })?;

        let Some(token) = token else {
            return Ok(Response::new(rejected(Code::Unauthenticated)));
        };
        if token.revoked_at.is_some() {
            return Ok(Response::new(rejected(Code::TokenRevoked)));
        }
        if token.expires_at.is_some_and(|expiry| expiry <= Utc::now()) {
            return Ok(Response::new(rejected(Code::TokenExpired)));
        }

        let user = users::Entity::find_by_id(token.user_id)
            .one(db)
            .await
            .map_err(|error| {
                tracing::error!(%error, "access key owner lookup failed");
                Status::internal("access key owner lookup failed")
            })?;
        let Some(user) = user else {
            return Ok(Response::new(rejected(Code::UserDisabled)));
        };
        if user.deleted_at.is_some() || !user.allow_use || user.forbid_login {
            return Ok(Response::new(rejected(Code::UserDisabled)));
        }
        // token.version 记录签发时的 users.security_version。
        if token.version < user.security_version {
            return Ok(Response::new(rejected(Code::SecurityVersionStale)));
        }

        let scopes = scopes_of(&token.scopes);
        if !scopes_cover(&scopes, &request.required_scopes) {
            return Ok(Response::new(rejected(Code::ScopeInsufficient)));
        }

        let key = AccessKeyInfo {
            access_key_id: token.id.to_string(),
            name: token.name.clone(),
            description: token.description.clone().unwrap_or_default(),
            fingerprint: token.fingerprint.clone(),
            scopes: scopes.clone(),
            hash_key_id: token.hash_key_id.clone(),
            created_at: Some(timestamp(token.created_at)),
            expires_at: token.expires_at.map(timestamp),
            last_used_at: token.last_used_at.map(timestamp),
            revoked_at: token.revoked_at.map(timestamp),
        };

        Ok(Response::new(VerifyAccessKeyResponse {
            valid: true,
            reason: Code::Unspecified as i32,
            principal: Some(Principal {
                user_id: user.id,
                username: user.username.clone(),
                displayname: user.displayname.clone().unwrap_or_default(),
                is_admin: user.is_admin,
                security_version: user.security_version,
                method: AuthMethod::AccessKey as i32,
                access_key_id: token.id.to_string(),
                scopes: scopes.clone(),
                // 空 scope 等价于不限范围，此时不是有界令牌。
                scopes_bounded: !scopes.is_empty(),
                mfa_verified: false,
                authenticated_at: Some(timestamp(Utc::now())),
                bot: user.bot,
                system: user.system,
                ..Default::default()
            }),
            key: Some(key),
            current_security_version: user.security_version,
        }))
    }

    async fn create_access_key(
        &self,
        _request: Request<CreateAccessKeyRequest>,
    ) -> Result<Response<CreateAccessKeyResponse>, Status> {
        Err(Status::unimplemented(
            "access key issuance is not exposed by this service",
        ))
    }

    async fn rotate_access_key(
        &self,
        _request: Request<RotateAccessKeyRequest>,
    ) -> Result<Response<RotateAccessKeyResponse>, Status> {
        Err(Status::unimplemented(
            "access key rotation is not exposed by this service",
        ))
    }

    async fn list_access_keys(
        &self,
        _request: Request<ListAccessKeysRequest>,
    ) -> Result<Response<ListAccessKeysResponse>, Status> {
        Err(Status::unimplemented(
            "access key listing is not exposed by this service",
        ))
    }

    async fn revoke_access_key(
        &self,
        _request: Request<RevokeAccessKeyRequest>,
    ) -> Result<Response<RevokeAccessKeyResponse>, Status> {
        Err(Status::unimplemented(
            "access key revocation is not exposed by this service",
        ))
    }
}

/// 失败响应只给原因码，不回显令牌或用户是否存在。
fn rejected(reason: Code) -> VerifyAccessKeyResponse {
    VerifyAccessKeyResponse {
        valid: false,
        reason: reason as i32,
        ..Default::default()
    }
}

fn scopes_of(value: &serde_json::Value) -> Vec<i32> {
    value
        .as_array()
        .map(|items| {
            items
                .iter()
                .filter_map(|item| item.as_i64())
                .map(|value| value as i32)
                .collect()
        })
        .unwrap_or_default()
}

/// 调用方未声明范围时放行；令牌本身不限范围时也放行。
fn scopes_cover(granted: &[i32], required: &[i32]) -> bool {
    required.is_empty()
        || granted.is_empty()
        || required.iter().all(|scope| granted.contains(scope))
}

fn timestamp(value: DateTime<Utc>) -> prost_types::Timestamp {
    prost_types::Timestamp {
        seconds: value.timestamp(),
        nanos: value.timestamp_subsec_nanos() as i32,
    }
}