using GameAuthApi.Models;
using GameAuthApi.Services;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Configuration;
using Microsoft.IdentityModel.Tokens;
using Microsoft.AspNetCore.RateLimiting;
using System;
using System.IdentityModel.Tokens.Jwt;
using System.Linq;
using System.Security.Claims;
using System.Text;
using System.Threading.Tasks;

namespace GameAuthApi.Controllers;

[ApiController]
[Route("api/[controller]")]
public class AuthController : ControllerBase
{
    private readonly UserService _userService;
    private readonly IConfiguration _config;
    private readonly BlacklistService _blacklistService;
    private readonly PasswordResetService _passwordResetService;
    private readonly EmailService _emailService;
    private readonly SteamAuthService _steamAuthService;

    public AuthController(UserService userService, IConfiguration config, BlacklistService blacklistService,
        PasswordResetService passwordResetService = null, EmailService emailService = null,
        SteamAuthService steamAuthService = null)
    {
        _userService = userService;
        _config = config;
        _blacklistService = blacklistService;
        _passwordResetService = passwordResetService;
        _emailService = emailService;
        _steamAuthService = steamAuthService;
    }

    [HttpPost("register")]
    public async Task<IActionResult> Register([FromBody] RegisterRequest credentials)
    {
        if (await _userService.GetByLoginAsync(credentials.Username) != null ||
            (!string.IsNullOrWhiteSpace(credentials.Email) && await _userService.GetByLoginAsync(credentials.Email) != null))
            return BadRequest("User already exists");

        if (!IsValidUsername(credentials.Username) || !IsValidEmail(credentials.Email) || !IsValidPassword(credentials.Password))
            return BadRequest("Username, email, or password is invalid");

        var hash = BCrypt.Net.BCrypt.HashPassword(credentials.Password);

        var user = new User
        {
            Username = credentials.Username,
            PasswordHash = hash,
            Role = "USER",
            Email = credentials.Email
        };

        await _userService.CreateAsync(user);
        return Ok("User created");
    }

    [HttpPost("login")]
    public async Task<IActionResult> Login([FromBody] LoginRequest credentials)
    {
        var user = await _userService.GetByLoginAsync(credentials.Username);
        if (user == null || !BCrypt.Net.BCrypt.Verify(credentials.Password, user.PasswordHash))
            return Unauthorized();

        var accessToken = GenerateJwtToken(user);
        var refreshToken = Guid.NewGuid().ToString();
        var refreshExpiry = DateTime.UtcNow.AddDays(7);

        user.RefreshToken = refreshToken;
        user.RefreshTokenExpiry = refreshExpiry;
        await _userService.UpdateAsync(user);

        return Ok(new { accessToken, refreshToken, user.Username, user.Role });
    }

    [HttpPost("password-reset/request")]
    [EnableRateLimiting("password-reset")]
    public async Task<IActionResult> RequestPasswordReset([FromBody] PasswordResetRequest request)
    {
        if (_passwordResetService == null || _emailService == null)
            return StatusCode(503, "Password recovery is not configured");
        var user = await _userService.GetByLoginAsync(request.Login ?? string.Empty);
        if (user != null && !string.IsNullOrWhiteSpace(user.Email))
        {
            var code = await _passwordResetService.CreateAsync(user.Id);
            await _emailService.SendPasswordResetCodeAsync(user.Email, code);
        }
        return Accepted(new { message = "If the account exists, a verification code has been sent." });
    }

    [HttpPost("password-reset/confirm")]
    [EnableRateLimiting("password-reset")]
    public async Task<IActionResult> ConfirmPasswordReset([FromBody] PasswordResetConfirmRequest request)
    {
        if (_passwordResetService == null) return StatusCode(503, "Password recovery is not configured");
        if (!IsValidPassword(request.NewPassword)) return BadRequest("Password must be at least 8 characters");
        var user = await _userService.GetByLoginAsync(request.Login ?? string.Empty);
        if (user == null || !await _passwordResetService.ConsumeAsync(user.Id, request.Code ?? string.Empty))
            return BadRequest("The verification code is invalid or expired");
        user.PasswordHash = BCrypt.Net.BCrypt.HashPassword(request.NewPassword);
        user.RefreshToken = null;
        user.RefreshTokenExpiry = DateTime.MinValue;
        await _userService.UpdateAsync(user);
        return Ok(new { message = "Password updated" });
    }

    [HttpPost("steam/start")]
    public async Task<IActionResult> StartSteamLogin()
    {
        if (_steamAuthService == null) return StatusCode(503, "Steam authentication is not configured");
        var started = await _steamAuthService.StartAsync();
        return Ok(new { transactionId = started.Transaction.Id, authUrl = started.AuthUrl, expiresUtc = started.Transaction.ExpiresUtc });
    }

    [HttpGet("steam/callback")]
    public async Task<IActionResult> SteamCallback([FromQuery] string transactionId)
    {
        if (_steamAuthService == null || !await _steamAuthService.VerifyCallbackAsync(transactionId, Request.Query))
            return StatusCode(400, "Steam sign-in could not be verified. You may close this window.");
        return Content("Steam sign-in verified. Return to MedMind to finish signing in.", "text/plain", Encoding.UTF8);
    }

    [HttpGet("steam/status/{transactionId}")]
    public async Task<IActionResult> SteamStatus(string transactionId)
    {
        if (_steamAuthService == null) return StatusCode(503, "Steam authentication is not configured");
        var transaction = await _steamAuthService.GetAsync(transactionId);
        if (transaction == null) return NotFound(new { status = "expired" });
        if (transaction.Status == "authenticated" && !string.IsNullOrWhiteSpace(transaction.UserId))
        {
            var user = await _userService.GetByIdAsync(transaction.UserId);
            if (user == null) return BadRequest("Linked account no longer exists");
            var tokens = await IssueTokensAsync(user);
            await _steamAuthService.CompleteAsync(transactionId, user, tokens.AccessToken, tokens.RefreshToken);
            transaction = await _steamAuthService.GetAsync(transactionId);
        }
        return Ok(new
        {
            transaction.Status, transaction.Username, transaction.Role,
            transaction.AccessToken, transaction.RefreshToken
        });
    }

    [HttpPost("steam/complete")]
    public async Task<IActionResult> CompleteSteamLogin([FromBody] SteamCompleteRequest request)
    {
        if (_steamAuthService == null) return StatusCode(503, "Steam authentication is not configured");
        User user;
        if (string.Equals(request.Action, "link", StringComparison.OrdinalIgnoreCase))
        {
            user = await _userService.GetByLoginAsync(request.Username ?? string.Empty);
            if (user == null || !BCrypt.Net.BCrypt.Verify(request.Password ?? string.Empty, user.PasswordHash))
                return Unauthorized();
        }
        else if (string.Equals(request.Action, "create", StringComparison.OrdinalIgnoreCase))
        {
            if (!IsValidUsername(request.Username) || !IsValidEmail(request.Email) || !IsValidPassword(request.Password))
                return BadRequest("Username, email, or password is invalid");
            if (await _userService.GetByLoginAsync(request.Username) != null || await _userService.GetByLoginAsync(request.Email) != null)
                return Conflict("Username or email is already in use");
            user = new User
            {
                Username = request.Username.Trim(), Email = request.Email.Trim(),
                PasswordHash = BCrypt.Net.BCrypt.HashPassword(request.Password), Role = "USER"
            };
            await _userService.CreateAsync(user);
        }
        else return BadRequest("Action must be create or link");

        try { await _steamAuthService.LinkAsync(request.TransactionId, user.Id); }
        catch (MongoDB.Driver.MongoWriteException) { return Conflict("This Steam account is already linked"); }
        return Ok(new { status = "linked" });
    }

    [HttpPost("refresh")]
    public async Task<IActionResult> Refresh([FromBody] RefreshRequest req)
    {
        var user = await _userService.GetByUsernameAsync(req.Username);
        if (user == null || user.RefreshToken != req.RefreshToken || user.RefreshTokenExpiry < DateTime.UtcNow)
            return Unauthorized("Invalid or expired refresh token");

        var newAccessToken = GenerateJwtToken(user);
        return Ok(new { accessToken = newAccessToken });
    }

    [HttpPost("logout")]
    [Authorize(Roles = "USER,SUPER")]
    public async Task<IActionResult> Logout()
    {
        var token = HttpContext.Request.Headers["Authorization"].FirstOrDefault()?.Replace("Bearer ", "");
        if (string.IsNullOrWhiteSpace(token))
            return BadRequest("Token missing");

        var jwtToken = new JwtSecurityTokenHandler().ReadToken(token) as JwtSecurityToken;
        var expiry = jwtToken.ValidTo;

        await _blacklistService.AddToBlacklistAsync(token, expiry);
        return Ok("Token blacklisted, user logged out.");
    }

    [HttpPost("role")]
    [Authorize(Roles = "SUPER")]
    public async Task<IActionResult> ChangeUserRole([FromBody] ChangeRoleRequest request)
    {
        if (request.NewRole != "USER" && request.NewRole != "SUPER")
            return BadRequest("Role must be 'USER' or 'SUPER'");

        var user = await _userService.GetByUsernameAsync(request.Username);
        if (user == null)
            return NotFound("User not found");

        user.Role = request.NewRole;
        await _userService.UpdateAsync(user);

        return Ok($"{request.Username}'s role updated to {request.NewRole}");
    }

    [HttpGet("users")]
    [Authorize(Roles = "SUPER")]
    public async Task<IActionResult> GetAllUsers()
    {
        var users = await _userService.GetAllAsync();
        return Ok(users);
    }


    private string GenerateJwtToken(User user)
    {
        var key = Encoding.UTF8.GetBytes(_config["Jwt:Key"]);
        var creds = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256);

        var claims = new[]
        {
            new Claim(ClaimTypes.Name, user.Username),
            new Claim(ClaimTypes.NameIdentifier, user.Id),
            new Claim(ClaimTypes.Role, user.Role)
        };

        var token = new JwtSecurityToken(
            _config["Jwt:Issuer"],
            _config["Jwt:Issuer"],
            claims,
            expires: DateTime.UtcNow.AddMinutes(15),
            signingCredentials: creds);

        return new JwtSecurityTokenHandler().WriteToken(token);
    }

    private async Task<(string AccessToken, string RefreshToken)> IssueTokensAsync(User user)
    {
        var accessToken = GenerateJwtToken(user);
        var refreshToken = Guid.NewGuid().ToString();
        user.RefreshToken = refreshToken;
        user.RefreshTokenExpiry = DateTime.UtcNow.AddDays(7);
        await _userService.UpdateAsync(user);
        return (accessToken, refreshToken);
    }

    private static bool IsValidUsername(string value) =>
        !string.IsNullOrWhiteSpace(value) && value.Length is >= 3 and <= 24 && value.All(c => char.IsLetterOrDigit(c) || c == '_');
    private static bool IsValidEmail(string value) =>
        !string.IsNullOrWhiteSpace(value) && value.Contains('@') && value.Length <= 254;
    private static bool IsValidPassword(string value) => !string.IsNullOrEmpty(value) && value.Length >= 8;

    public class RefreshRequest
    {
        public string Username { get; set; }
        public string RefreshToken { get; set; }
    }
}