package services

import (
	"errors"
	"strconv"
	"time"

	configs "ares/config"
	utils "ares/pkg/utis"

	"github.com/golang-jwt/jwt/v5"
)

const (
	TokenTypeAccess  = "access"
	TokenTypeRefresh = "refresh"
)

type JWTClaim struct {
	UserID    uint   `json:"user_id"`
	Email     string `json:"email"`
	IsAdmin   bool   `json:"is_admin"`
	FirstName string `json:"first_name"`
	LastName  string `json:"last_name"`
	TokenType string `json:"token_type"`
	jwt.RegisteredClaims
}

type JWTService struct{}

func NewJWTService() *JWTService {
	return &JWTService{}
}

func (s *JWTService) GenerateToken(
	userID uint,
	email string,
	isAdmin bool,
	firstName string,
	lastName string,
	tokenType string,
	expiration time.Duration,
) (string, error) {
	now := time.Now()

	jti, err := utils.GenerateSecureToken(16)
	if err != nil {
		return "", err
	}

	claims := &JWTClaim{
		UserID:    userID,
		Email:     email,
		IsAdmin:   isAdmin,
		FirstName: firstName,
		LastName:  lastName,
		TokenType: tokenType,
		RegisteredClaims: jwt.RegisteredClaims{
			Subject:   strconv.FormatUint(uint64(userID), 10),
			ID:        jti,
			ExpiresAt: jwt.NewNumericDate(now.Add(expiration)),
			IssuedAt:  jwt.NewNumericDate(now),
		},
	}

	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
	return token.SignedString([]byte(configs.AppConfig.JWTSecret))
}

func (s *JWTService) GenerateTokenPair(
	userID uint,
	email string,
	isAdmin bool,
	firstName string,
	lastName string,
) (string, string, error) {
	access, err := s.GenerateToken(
		userID,
		email,
		isAdmin,
		firstName,
		lastName,
		TokenTypeAccess,
		time.Duration(configs.AppConfig.AccessTokenExpireMinutes)*time.Minute,
	)
	if err != nil {
		return "", "", err
	}

	refresh, err := s.GenerateToken(
		userID,
		email,
		isAdmin,
		firstName,
		lastName,
		TokenTypeRefresh,
		time.Duration(configs.AppConfig.RefreshTokenExpireDays)*24*time.Hour,
	)
	if err != nil {
		return "", "", err
	}

	// Log generated tokens only in development and prefer project logger if available
	if configs.AppConfig != nil && configs.AppConfig.Env == "development" {
		msg := "Generated token pair for user=%d email=%s access_exp=%dm refresh_exp=%dd"
		if configs.Logger != nil {
			configs.Logger.Sugar().Debugf(msg, userID, email, configs.AppConfig.AccessTokenExpireMinutes, configs.AppConfig.RefreshTokenExpireDays)
			configs.Logger.Sugar().Debugf("access (masked): %s", maskToken(access))
			configs.Logger.Sugar().Debugf("refresh (masked): %s", maskToken(refresh))
		}
	}

	return access, refresh, nil
}

// maskToken returns a partially masked representation of a token string
// to avoid logging full sensitive values.
func maskToken(token string) string {
	if len(token) <= 10 {
		return "****"
	}
	prefix := token[:6]
	suffix := token[len(token)-4:]
	return prefix + "..." + suffix
}

func (s *JWTService) ValidateToken(signedToken string) (*JWTClaim, error) {
	token, err := jwt.ParseWithClaims(signedToken, &JWTClaim{}, func(token *jwt.Token) (interface{}, error) {
		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
			return nil, errors.New("unexpected signing method")
		}
		return []byte(configs.AppConfig.JWTSecret), nil
	})
	if err != nil {
		return nil, err
	}

	claims, ok := token.Claims.(*JWTClaim)
	if !ok || !token.Valid {
		return nil, errors.New("invalid token claims")
	}

	return claims, nil
}