package handlers

import (
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"strconv"

	"gobeyhan/app/account/services"
	settingsServices "gobeyhan/app/settings/services"
	"gobeyhan/config"
	"gobeyhan/database/models"

	"github.com/gin-gonic/gin"
)

type AuthHandler struct {
	userService *services.UserService
	jwtService  *settingsServices.JWTService
}

func NewAuthHandler(userService *services.UserService, jwtService *settingsServices.JWTService) *AuthHandler {
	return &AuthHandler{
		userService: userService,
		jwtService:  jwtService,
	}
}

// Register godoc
// @Summary Register a new user
// @Description Create a new user account with email and password
// @Tags auth
// @Accept json
// @Produce json
// @Param request body object{email=string,password=string,username=string} true "Registration data"
// @Success 201 {object} object{token=string,user=models.User}
// @Failure 400 {object} object{error=string}
// @Router /api/v1/auth/register [post]
func (h *AuthHandler) Register(c *gin.Context) {
	var input struct {
		Email    string `json:"email" binding:"required,email"`
		Password string `json:"password" binding:"required,min=6"`
		Username string `json:"username" binding:"required,min=3"`
	}

	if err := c.ShouldBindJSON(&input); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	// Create user (password will be hashed by UserService)
	user := &models.User{
		Email:    input.Email,
		UserName: input.Username,
	}

	// Password is passed separately to be hashed
	if err := h.userService.CreateUser(user, input.Password); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	// Assign default role
	if err := h.userService.AssignDefaultRole(user.ID); err != nil {
		// Log error but don't fail registration
		// log.Printf("Failed to assign default role: %v", err)
	}

	// Generate JWT tokens
	accessToken, refreshToken, err := h.jwtService.GenerateTokenPair(*user)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to generate tokens"})
		return
	}

	// Return tokens and user (without password)
	user.Password = ""
	c.JSON(http.StatusCreated, gin.H{
		"access_token":  accessToken,
		"refresh_token": refreshToken,
		"user":          user,
	})
}

// Login godoc
// @Summary Login user
// @Description Login with email and password
// @Tags auth
// @Accept json
// @Produce json
// @Param request body object{email=string,password=string} true "Login credentials"
// @Success 200 {object} object{token=string,user=models.User}
// @Failure 400 {object} object{error=string}
// @Failure 401 {object} object{error=string}
// @Router /api/v1/auth/login [post]
func (h *AuthHandler) Login(c *gin.Context) {
	var input struct {
		Email          string `json:"email" binding:"required,email"`
		Password       string `json:"password" binding:"required"`
		TurnstileToken string `json:"turnstile_token"`
	}

	if err := c.ShouldBindJSON(&input); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	// Verify Turnstile
	if !verifyTurnstile(input.TurnstileToken) {
		c.JSON(http.StatusBadRequest, gin.H{"error": "Turnstile doğrulaması başarısız"})
		return
	}

	// Get user by email
	user, err := h.userService.GetUserByEmail(input.Email)
	if err != nil || user == nil {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid credentials"})
		return
	}

	// Verify password
	if !h.userService.VerifyPassword(user.Password, input.Password) {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid credentials"})
		return
	}

	// Generate JWT tokens
	accessToken, refreshToken, err := h.jwtService.GenerateTokenPair(*user)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to generate tokens"})
		return
	}

	// Set refresh token as HttpOnly cookie (secure, XSS-safe)
	cookie := &http.Cookie{
		Name:     "refresh_token",
		Value:    refreshToken,
		Path:     "/",
		Domain:   "localhost",          // Explicitly set for local dev
		MaxAge:   7 * 24 * 60 * 60,     // 7 days
		Secure:   false,                // Set true for HTTPS in production
		HttpOnly: true,                 // Cannot be accessed by JavaScript
		SameSite: http.SameSiteLaxMode, // Lax is better for local dev
	}
	http.SetCookie(c.Writer, cookie)
	fmt.Printf("[DEBUG] Login - Set-Cookie Raw: %s\n", cookie.String())

	// Return tokens and user (without password)
	user.Password = ""
	c.JSON(http.StatusOK, gin.H{
		"access_token":  accessToken,
		"refresh_token": refreshToken, // Also in response  for fallback
		"user":          user,
	})
}

// GetCurrentUser godoc
// @Summary Get current user
// @Description Get current authenticated user information
// @Tags auth
// @Accept json
// @Produce json
// @Security BearerAuth
// @Success 200 {object} models.User
// @Failure 401 {object} object{error=string}
// @Router /api/v1/auth/me [get]
func (h *AuthHandler) GetCurrentUser(c *gin.Context) {
	// Get user ID from context (set by auth middleware)
	userIDStr, exists := c.Get("user_id")
	if !exists {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
		return
	}

	// Convert to uint64
	var userID uint64
	switch v := userIDStr.(type) {
	case string:
		parsed, _ := strconv.ParseUint(v, 10, 64)
		userID = parsed
	case uint64:
		userID = v
	case int:
		userID = uint64(v)
	case float64:
		userID = uint64(v)
	}

	// Get user from database
	user, err := h.userService.GetUserByID(userID)
	if err != nil || user == nil {
		c.JSON(http.StatusNotFound, gin.H{"error": "User not found"})
		return
	}

	// Return user (without password)
	user.Password = ""
	c.JSON(http.StatusOK, user)
}

// Logout godoc
// @Summary Logout user
// @Description Logout (client-side token removal)
// @Tags auth
// @Accept json
// @Produce json
// @Success 200 {object} object{message=string}
// @Router /api/v1/auth/logout [post]
func (h *AuthHandler) Logout(c *gin.Context) {
	// Clear refresh token cookie
	cookie := &http.Cookie{
		Name:     "refresh_token",
		Value:    "",
		Path:     "/",
		Domain:   "localhost",
		MaxAge:   -1, // Delete cookie
		HttpOnly: true,
		SameSite: http.SameSiteLaxMode,
	}
	http.SetCookie(c.Writer, cookie)
	fmt.Printf("[DEBUG] Logout - Set-Cookie Raw: %s\n", cookie.String())

	// For JWT, logout is typically handled client-side
	// Server can implement token blacklisting if needed
	c.JSON(http.StatusOK, gin.H{"message": "Logged out successfully"})
}

// RefreshToken godoc
// @Summary Refresh access token
// @Description Get a new access token using refresh token from HttpOnly cookie
// @Tags auth
// @Accept json
// @Produce json
// @Success 200 {object} object{access_token=string,refresh_token=string}
// @Failure 401 {object} object{error=string}
// @Router /api/v1/auth/refresh [post]
func (h *AuthHandler) RefreshToken(c *gin.Context) {
	// Get refresh token from HttpOnly cookie
	refreshToken, err := c.Cookie("refresh_token")
	if err != nil {
		fmt.Printf("[DEBUG] RefreshToken - Cookie Error: %v\n", err)
	} else {
		fmt.Printf("[DEBUG] RefreshToken - Cookie Found: %s...\n", refreshToken[:10])
	}

	if err != nil || refreshToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "Refresh token not found"})
		return
	}

	// Validate refresh token and get user ID
	claims, err := h.jwtService.ValidateToken(refreshToken)
	if err != nil {
		fmt.Printf("[DEBUG] RefreshToken - ValidateToken Error: %v\n", err)
		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid or expired refresh token"})
		return
	}

	// Get user ID from claims
	userID, err := claims.GetSubject()
	if err != nil {
		fmt.Printf("[DEBUG] RefreshToken - GetSubject Error: %v\n", err)
		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid token claims"})
		return
	}

	// Parse user ID to uint64
	// Sscan bazen boşluk vs. yüzünden hata verebilir, strconv daha güvenli
	parsedUint, err := strconv.ParseUint(userID, 10, 64)
	if err != nil {
		fmt.Printf("[DEBUG] RefreshToken - ParseUint Error: %v (userID=%s)\n", err, userID)
		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid user ID format"})
		return
	}
	uid := parsedUint

	// Get user from database
	user, err := h.userService.GetUserByID(uid)
	if err != nil {
		fmt.Printf("[DEBUG] RefreshToken - GetUserByID FAILED: %v\n", err)
		c.JSON(http.StatusUnauthorized, gin.H{"error": "Database error"})
		return
	}
	if user == nil {
		fmt.Printf("[DEBUG] RefreshToken - User not found in DB for ID: %d\n", uid)
		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not found"})
		return
	}
	fmt.Printf("[DEBUG] RefreshToken - User found: %s\n", user.Email)

	// Generate new token pair
	newAccessToken, newRefreshToken, err := h.jwtService.GenerateTokenPair(*user)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to generate tokens"})
		return
	}

	// Update refresh token cookie (token rotation)
	cookie := &http.Cookie{
		Name:     "refresh_token",
		Value:    newRefreshToken,
		Path:     "/",
		Domain:   "localhost",
		MaxAge:   7 * 24 * 60 * 60, // 7 days
		Secure:   false,
		HttpOnly: true,
		SameSite: http.SameSiteLaxMode,
	}
	http.SetCookie(c.Writer, cookie)

	// Return new access token and user info
	user.Password = "" // Ensure password is not sent
	c.JSON(http.StatusOK, gin.H{
		"access_token":  newAccessToken,
		"refresh_token": newRefreshToken,
		"user":          user, // Critical for frontend session restore
	})
}

// Helper: Verify Turnstile Token
func verifyTurnstile(token string) bool {
	secret := config.AppConfig.TurnstileSecretKey
	if secret == "" {
		fmt.Println("[WARNING] Turnstile Secret Key not configured, skipping validation")
		return true // Skip validation if not configured
	}
	if token == "" {
		// If secret is configured, token is mandatory
		return false
	}

	formData := url.Values{
		"secret":   {secret},
		"response": {token},
	}

	resp, err := http.PostForm("https://challenges.cloudflare.com/turnstile/v0/siteverify", formData)
	if err != nil {
		fmt.Printf("[ERROR] Turnstile request failed: %v\n", err)
		return false
	}
	defer resp.Body.Close()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		fmt.Printf("[ERROR] Failed to read Turnstile response: %v\n", err)
		return false
	}

	var result struct {
		Success bool `json:"success"`
	}
	if err := json.Unmarshal(body, &result); err != nil {
		fmt.Printf("[ERROR] Failed to parse Turnstile response: %v\n", err)
		return false
	}

	return result.Success
}