use crate::models::users::{user_mfa, user_mfa_backup_codes};
use sea_orm::sea_query::{Expr, ExprTrait};
use sea_orm::{ColumnTrait, Condition, EntityTrait, QueryFilter};

use crate::{AuthError, AuthResult};

#[tracing::instrument(skip_all, fields(request_id = %envelope::context::resolve_request_id(_request_id)))]
pub async fn consume_totp(
    db: &crate::db::DbConn,
    factor: &user_mfa::Model,
    key: Option<&str>,
    code: &str,
    _request_id: Option<&str>,
) -> AuthResult<u64> {
    let ciphertext = factor
        .secret_ciphertext
        .as_deref()
        .ok_or(AuthError::MfaRequired)?;
    let secret = super::totp::decrypt_secret(key, ciphertext)?;
    let (step, value) = super::totp::verify_totp_code(&secret, code, factor.last_totp_step)?;
    let now = chrono::Utc::now();
    let updated = user_mfa::Entity::update_many()
        .col_expr(user_mfa::Column::LastTotpStep, Expr::value(value))
        .col_expr(user_mfa::Column::MfaLastUsedAt, Expr::value(now))
        .col_expr(
            user_mfa::Column::Version,
            Expr::col(user_mfa::Column::Version).add(1),
        )
        .col_expr(user_mfa::Column::UpdatedAt, Expr::value(now))
        .filter(user_mfa::Column::Id.eq(factor.id))
        .filter(user_mfa::Column::Version.eq(factor.version))
        .filter(user_mfa::Column::MfaStatus.eq(user_mfa::MfaStatus::Enabled))
        .filter(user_mfa::Column::RevokedAt.is_null())
        .filter(
            Condition::any()
                .add(user_mfa::Column::LastTotpStep.is_null())
                .add(user_mfa::Column::LastTotpStep.lt(value)),
        )
        .exec(db.write())
        .await?;
    if updated.rows_affected != 1 {
        return Err(AuthError::TotpStepReused);
    }
    Ok(step)
}

#[tracing::instrument(skip_all, fields(user_id = user_id, request_id = %envelope::context::resolve_request_id(_request_id)))]
pub async fn consume_recovery(
    db: &crate::db::DbConn,
    user_id: i64,
    code: &str,
    _request_id: Option<&str>,
) -> AuthResult<()> {
    let normalized: String = code
        .trim()
        .to_uppercase()
        .chars()
        .filter(|value| *value != '-')
        .collect();
    if normalized.is_empty() {
        return Err(AuthError::RecoveryCodeInvalid);
    }
    let hash = super::crypto::sha256_hex(normalized.as_bytes());
    let now = chrono::Utc::now();
    let updated = user_mfa_backup_codes::Entity::update_many()
        .col_expr(user_mfa_backup_codes::Column::ConsumedAt, Expr::value(now))
        .col_expr(
            user_mfa_backup_codes::Column::Version,
            Expr::col(user_mfa_backup_codes::Column::Version).add(1),
        )
        .filter(user_mfa_backup_codes::Column::UserId.eq(user_id))
        .filter(user_mfa_backup_codes::Column::CodeHash.eq(hash))
        .filter(user_mfa_backup_codes::Column::HashKeyId.eq("sha256-v1"))
        .filter(user_mfa_backup_codes::Column::ConsumedAt.is_null())
        .filter(user_mfa_backup_codes::Column::RevokedAt.is_null())
        .filter(
            Condition::any()
                .add(user_mfa_backup_codes::Column::ExpiresAt.is_null())
                .add(user_mfa_backup_codes::Column::ExpiresAt.gt(now)),
        )
        .exec(db.write())
        .await?;
    if updated.rows_affected != 1 {
        return Err(AuthError::RecoveryCodeInvalid);
    }
    Ok(())
}