package httpapi

import (
	"context"
	"database/sql"
	"errors"
	"fmt"
	"net/http"
	"strings"

	"git.yeij.top/AskaEth/Scoreboard/server/internal/auth"
)

// ---------- 用户管理（仅 admin，见 devdocs/08 第 2 节） ----------

func (s *server) listUsersHandler(w http.ResponseWriter, r *http.Request) (any, error) {
	return s.listUsers(r.Context())
}

func (s *server) createUserHandler(w http.ResponseWriter, r *http.Request) (any, error) {
	var in createUserInput
	if err := decodeJSON(r, &in); err != nil {
		return nil, err
	}
	created, err := s.createUser(r.Context(), in)
	if err != nil {
		return nil, err
	}
	s.audit(r.Context(), "user.create", "user", created.ID, nil, created)
	return created, nil
}

func (s *server) updateUserHandler(w http.ResponseWriter, r *http.Request) (any, error) {
	id, err := pathID(r, "id")
	if err != nil {
		return nil, err
	}
	var in updateUserInput
	if err := decodeJSON(r, &in); err != nil {
		return nil, err
	}
	before, err := s.getUser(r.Context(), id)
	if err != nil {
		return nil, err
	}
	updated, err := s.updateUser(r.Context(), id, in, middlewareUserID(r))
	if err != nil {
		return nil, err
	}
	s.audit(r.Context(), "user.update", "user", id, before, updated)
	return updated, nil
}

func (s *server) resetUserPasswordHandler(w http.ResponseWriter, r *http.Request) (any, error) {
	id, err := pathID(r, "id")
	if err != nil {
		return nil, err
	}
	var in resetUserPasswordInput
	if err := decodeJSON(r, &in); err != nil {
		return nil, err
	}
	result, err := s.resetUserPassword(r.Context(), id, in)
	if err != nil {
		return nil, err
	}
	s.audit(r.Context(), "user.reset_password", "user", id, nil, map[string]any{
		"username":  result.Username,
		"generated": result.Generated,
	})
	return result, nil
}

const userColumns = `id, username, display_name, role, active, must_change_password, last_login_at`

func scanUser(row interface{ Scan(...any) error }) (userListItemDTO, error) {
	var (
		u         userListItemDTO
		lastLogin sql.NullString
	)
	if err := row.Scan(&u.ID, &u.Username, &u.DisplayName, &u.Role, &u.Active, &u.MustChangePassword, &lastLogin); err != nil {
		return u, err
	}
	u.LastLoginAt = strPtr(lastLogin)
	return u, nil
}

func (s *server) listUsers(ctx context.Context) ([]userListItemDTO, error) {
	rows, err := s.sys.QueryContext(ctx, `SELECT `+userColumns+` FROM users ORDER BY id`)
	if err != nil {
		return nil, internal(err)
	}
	defer func() { _ = rows.Close() }()

	items := make([]userListItemDTO, 0)
	for rows.Next() {
		u, err := scanUser(rows)
		if err != nil {
			return nil, internal(err)
		}
		items = append(items, u)
	}
	if err := rows.Err(); err != nil {
		return nil, internal(err)
	}
	return items, nil
}

func (s *server) getUser(ctx context.Context, id int64) (userListItemDTO, error) {
	u, err := scanUser(s.sys.QueryRowContext(ctx, `SELECT `+userColumns+` FROM users WHERE id = ?`, id))
	if errors.Is(err, sql.ErrNoRows) {
		return u, notFound("用户不存在")
	}
	if err != nil {
		return u, internal(err)
	}
	return u, nil
}

// userRole 只接受落库的两种角色；guest 是「未登录」，不能建也不能改出来。
func userRole(raw string) (string, error) {
	switch strings.ToLower(strings.TrimSpace(raw)) {
	case auth.RoleRecorder.String():
		return auth.RoleRecorder.String(), nil
	case auth.RoleAdmin.String():
		return auth.RoleAdmin.String(), nil
	default:
		return "", badRequest("role 只能是 recorder 或 admin", raw)
	}
}

func (s *server) createUser(ctx context.Context, in createUserInput) (userListItemDTO, error) {
	username := strings.TrimSpace(in.Username)
	if username == "" {
		return userListItemDTO{}, badRequest("username 必填", nil)
	}
	role, err := userRole(in.Role)
	if err != nil {
		return userListItemDTO{}, err
	}
	if len(in.Password) < 8 {
		return userListItemDTO{}, badRequest("password 至少 8 位", nil)
	}
	if len(in.Password) > auth.MaxPasswordBytes {
		return userListItemDTO{}, badRequest(fmt.Sprintf("password 不能超过 %d 字节", auth.MaxPasswordBytes), nil)
	}
	displayName := strings.TrimSpace(in.DisplayName)
	if displayName == "" {
		displayName = username
	}

	// 先占位插入再交给认证服务写哈希，避免在 httpapi 里复制 bcrypt 成本配置。
	res, err := s.sys.ExecContext(ctx,
		`INSERT INTO users (username, password_hash, display_name, role, active, must_change_password)
		 VALUES (?, '!', ?, ?, 1, 1)`, username, displayName, role)
	if isUniqueViolation(err) {
		return userListItemDTO{}, conflict("用户名已存在")
	}
	if err != nil {
		return userListItemDTO{}, internal(err)
	}
	id, err := lastInsertID(res)
	if err != nil {
		return userListItemDTO{}, internal(err)
	}
	if err := s.auth.SetPassword(ctx, username, in.Password, true); err != nil {
		// 占位行没有可用哈希，改密失败就删掉，避免留下登不进去的僵尸用户。
		_, _ = s.sys.ExecContext(ctx, `DELETE FROM users WHERE id = ?`, id)
		return userListItemDTO{}, internal(err)
	}
	return s.getUser(ctx, id)
}

func (s *server) updateUser(ctx context.Context, id int64, in updateUserInput, actorID int64) (userListItemDTO, error) {
	before, err := s.getUser(ctx, id)
	if err != nil {
		return before, err
	}

	role := before.Role
	if in.Role != nil {
		role, err = userRole(*in.Role)
		if err != nil {
			return before, err
		}
	}
	displayName := before.DisplayName
	if in.DisplayName != nil {
		displayName = strings.TrimSpace(*in.DisplayName)
		if displayName == "" {
			return before, badRequest("displayName 不能为空", nil)
		}
	}
	active := before.Active
	if in.Active != nil {
		active = *in.Active
	}

	// 管理员把自己降级或停用会当场失去管理入口，无法再改回来，直接拒绝。
	if id == actorID && (role != auth.RoleAdmin.String() || !active) {
		return before, badRequest("不能把自己降级或停用", nil)
	}

	if _, err := s.sys.ExecContext(ctx,
		`UPDATE users SET display_name = ?, role = ?, active = ?, updated_at = datetime('now') WHERE id = ?`,
		displayName, role, active, id); err != nil {
		return before, internal(err)
	}
	if !active {
		// 停用必须连带踢掉已登录会话，否则旧 Cookie 还能继续写。
		if err := s.auth.RevokeUserSessions(ctx, id); err != nil {
			return before, internal(err)
		}
	}
	return s.getUser(ctx, id)
}

func (s *server) resetUserPassword(ctx context.Context, id int64, in resetUserPasswordInput) (resetPasswordResultDTO, error) {
	u, err := s.getUser(ctx, id)
	if err != nil {
		return resetPasswordResultDTO{}, err
	}
	password := in.Password
	generated := false
	if password == "" {
		password, err = auth.RandomPassword(16)
		if err != nil {
			return resetPasswordResultDTO{}, internal(err)
		}
		generated = true
	} else if len(password) < 8 {
		return resetPasswordResultDTO{}, badRequest("password 至少 8 位", nil)
	} else if len(password) > auth.MaxPasswordBytes {
		return resetPasswordResultDTO{}, badRequest(fmt.Sprintf("password 不能超过 %d 字节", auth.MaxPasswordBytes), nil)
	}
	// SetPassword 会作废该用户全部会话，被重置的人必须重新登录。
	if err := s.auth.SetPassword(ctx, u.Username, password, true); err != nil {
		return resetPasswordResultDTO{}, internal(err)
	}
	return resetPasswordResultDTO{
		ID:                 u.ID,
		Username:           u.Username,
		Password:           password,
		Generated:          generated,
		MustChangePassword: true,
	}, nil
}