use crate::AuthService;
use crate::errors::{AuthError, AuthResult};
use crate::events::{Labels, label};
use crate::handlers::challenge::PowProofRequest;
use crate::models::users::user_events::UserEventType;
use crate::models::users::users;
use crate::session::Session;
use crate::share::codes::{consume_email_code, store_email_code};
use crate::share::password::{hash as hash_password, validate_new_password};
use crate::share::validate::{validate_display_name, validate_email, validate_username};
use crate::share::{crypto, rate};
use chrono::Utc;
use rand::RngExt;
use sea_orm::entity::Set;
use sea_orm::sea_query::{Expr, ExprTrait, Func};
use sea_orm::{ActiveModelTrait, ColumnTrait, Condition, EntityTrait, QueryFilter, SqlErr};
use serde::{Deserialize, Serialize};
use utoipa::ToSchema;

#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
pub struct RegisterCodeRequest {
    pub email: String,
    pub pow_payload: PowProofRequest,
}

#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
pub struct RegisterCodeResponse {
    pub expires_in_secs: u64,
}

#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
pub struct UserRegisterRequest {
    pub username: String,
    pub displayname: Option<String>,
    pub birth_date: String,
    pub email: String,
    pub password_hash: String,
    pub email_code: String,
    pub pow_payload: PowProofRequest,
}

#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
pub struct UserRegisterResponse {
    pub user_id: i64,
    pub username: String,
    pub displayname: Option<String>,
}

pub mod age {
    use chrono::{Datelike, NaiveDate};

    use crate::errors::{AuthError, AuthResult};

    pub const EARLIEST_BIRTH_YEAR: i32 = 1900;

    pub fn parse_birth_date(raw: &str, min_age: u8) -> AuthResult<NaiveDate> {
        let parsed =
            NaiveDate::parse_from_str(raw, "%Y-%m-%d").map_err(|_| AuthError::InvalidBirthDate)?;
        if parsed.format("%Y-%m-%d").to_string() != raw {
            return Err(AuthError::InvalidBirthDate);
        }
        if parsed.year() < EARLIEST_BIRTH_YEAR {
            return Err(AuthError::InvalidBirthDate);
        }
        crate::share::validate::validate_age(Some(parsed), min_age)
    }
}

const REGISTER_CODE_KEY_PREFIX: &str = "auth:code:register:";
const REGISTER_RATE_KEY_PREFIX: &str = "auth:rate:register:";
const USERNAME_MAX_LEN: usize = 32;
const PASSWORD_DIGEST_MAX_LEN: usize = 255;
const ID_INSERT_ATTEMPTS: u32 = 8;

impl AuthService {
    #[tracing::instrument(skip_all, fields(request_id = %request_id, client_ip = ?session.client_ip().ok().flatten()))]
    pub async fn send_register_code(
        &self,
        session: Session,
        request: RegisterCodeRequest,
        request_id: String,
    ) -> AuthResult<RegisterCodeResponse> {
        self.challenge_verify_pow(
            session,
            &request.pow_payload,
            request.email.as_bytes(),
            request_id.clone(),
        )
        .await?;

        let email = validate_email(&request.email)?;

        // 限流必须排在「邮箱是否已注册」之前：否则每次调用都能免费探测一个地址是否注册。
        rate::rate_limit_once(
            self.cache(),
            &format!("{REGISTER_RATE_KEY_PREFIX}{email}"),
            self.auth().email_code_rate_limit_secs,
            Some(request_id.as_str()),
        )
        .await?;
        self.ensure_email_available(&email).await?;

        let code = crypto::random_numeric_code(self.auth().verify_code_len);
        store_email_code(
            self.cache(),
            &format!("{REGISTER_CODE_KEY_PREFIX}{email}"),
            &code,
            self.auth().verify_code_ttl_secs,
            Some(request_id.as_str()),
        )
        .await?;

        let minutes = self.auth().verify_code_ttl_secs / 60;
        let subject = "验证你的账号";
        let text = format!(
            "你的验证码是:{code}，{minutes} 分钟内有效。请勿把验证码告诉任何人；如果这不是你本人的操作，请忽略这封邮件。"
        );
        let html = format!(
            "<p>你的验证码是:<strong>{code}</strong>，{minutes} 分钟内有效。</p><p>请勿把验证码告诉任何人；如果这不是你本人的操作，请忽略这封邮件。</p>"
        );
        self.publish_mail(&email, subject, &text, &html, Some(request_id.as_str()))
            .await?;

        let response = RegisterCodeResponse {
            expires_in_secs: self.auth().verify_code_ttl_secs,
        };
        self.emit_labeled(
            label::AUTH_REGISTER_CREATE,
            Labels::new().with(label::REQUEST_ID, &request_id),
            &response,
            Some(request_id.as_str()),
        )
        .await;
        Ok(response)
    }

    #[tracing::instrument(skip_all, fields(request_id = %request_id, client_ip = ?session.client_ip().ok().flatten()))]
    pub async fn register(
        &self,
        session: Session,
        request: UserRegisterRequest,
        user_agent: Option<String>,
        ip_addr: Option<String>,
        request_id: String,
    ) -> AuthResult<UserRegisterResponse> {
        self.challenge_verify_pow(
            session.clone(),
            &request.pow_payload,
            request.username.as_bytes(),
            request_id.clone(),
        )
        .await?;

        let username = validate_username(&request.username)?;
        if username.chars().count() > USERNAME_MAX_LEN {
            return Err(AuthError::InvalidUsername);
        }
        let displayname = match request.displayname.as_deref() {
            Some(name) if !name.trim().is_empty() => Some(validate_display_name(name)?),
            _ => None,
        };
        let birth_date = age::parse_birth_date(request.birth_date.trim(), self.auth().min_age)?;
        let email = validate_email(&request.email)?;
        if request.password_hash.is_empty() || request.password_hash.len() > PASSWORD_DIGEST_MAX_LEN
        {
            return Err(AuthError::InvalidPassword);
        }
        validate_new_password(&request.password_hash, &self.auth().password_policy)?;

        consume_email_code(
            self.cache(),
            &format!("{REGISTER_CODE_KEY_PREFIX}{email}"),
            &request.email_code,
            self.auth().max_verify_attempts as i64,
            Some(request_id.as_str()),
        )
        .await?;

        let password_hash =
            hash_password(request.password_hash.clone(), Some(request_id.as_str())).await?;
        let lowername = username.to_lowercase();
        let now = Utc::now();

        let mut attempt = 0u32;
        loop {
            attempt += 1;
            self.ensure_username_available(&username, &lowername)
                .await?;
            self.ensure_email_available(&email).await?;

            let inserted = users::ActiveModel {
                id: Set({
                    let mut rng = rand::rng();
                    let digits = rng.random_range(5u32..=10);
                    let upper = 10i64.pow(digits);
                    rng.random_range((upper / 10)..upper)
                }),
                username: Set(username.clone()),
                lowername: Set(lowername.clone()),
                displayname: Set(displayname.clone()),
                birth_date: Set(Some(birth_date)),
                email: Set(email.clone()),
                email_verified_at: Set(Some(now)),
                password_hash: Set(password_hash.clone()),
                password_updated_at: Set(Some(now)),
                created_at: Set(now),
                ..Default::default()
            }
            .insert(self.db().write())
            .await;

            let user = match inserted {
                Ok(user) => user,
                Err(error) => {
                    let unique =
                        matches!(error.sql_err(), Some(SqlErr::UniqueConstraintViolation(_)));
                    if !unique {
                        return Err(AuthError::Database(crate::db::DbError::from(error)));
                    }
                    if attempt >= ID_INSERT_ATTEMPTS {
                        // 重试耗尽仍撞唯一约束：说明预检查看到的名字/邮箱已被别人占住。
                        return Err(AuthError::UsernameTaken);
                    }
                    continue;
                }
            };

            session.set_user_id(user.id)?;
            session.set_security_version(user.security_version)?;
            session.renew();
            self.bind_auth_session(&session, &user, false, Some(request_id.as_str()))
                .await?;

            crate::share::audit::entry(
                self.db(),
                user.id,
                Some(user.id),
                UserEventType::Register,
                Some(serde_json::json!({
                    "username": user.username.clone(),
                    "email": user.email.clone(),
                })),
                Some(&request_id),
                ip_addr,
                user_agent,
            )
            .await?;

            let response = UserRegisterResponse {
                user_id: user.id,
                username: user.username,
                displayname: user.displayname,
            };
            self.emit_labeled(
                label::AUTH_REGISTER_CREATE,
                Labels::new()
                    .with(label::USER_ID, response.user_id)
                    .with(label::REQUEST_ID, &request_id),
                &response,
                Some(request_id.as_str()),
            )
            .await;
            return Ok(response);
        }
    }

    async fn ensure_username_available(&self, username: &str, lowername: &str) -> AuthResult<()> {
        let taken = users::Entity::find()
            .filter(
                Condition::any()
                    .add(users::Column::Username.eq(username.to_owned()))
                    .add(users::Column::Lowername.eq(lowername.to_owned())),
            )
            .one(self.db().write())
            .await?;
        if taken.is_some() {
            return Err(AuthError::UsernameTaken);
        }
        Ok(())
    }

    async fn ensure_email_available(&self, email: &str) -> AuthResult<()> {
        let taken = users::Entity::find()
            .filter(Expr::expr(Func::lower(Expr::col(users::Column::Email))).eq(email.to_owned()))
            .one(self.db().write())
            .await?;
        if taken.is_some() {
            return Err(AuthError::EmailTaken);
        }
        Ok(())
    }
}