package webapp

import (
	"context"
	"encoding/json"
	"fmt"
	"net/http"
	"net/url"

	"github.com/authgear/oauthrelyingparty/pkg/api/oauthrelyingparty"

	"github.com/authgear/authgear-server/pkg/auth/handler/webapp/viewmodels"
	"github.com/authgear/authgear-server/pkg/auth/webapp"
	authflow "github.com/authgear/authgear-server/pkg/lib/authenticationflow"
	"github.com/authgear/authgear-server/pkg/lib/meter"
	"github.com/authgear/authgear-server/pkg/util/httproute"
	"github.com/authgear/authgear-server/pkg/util/httputil"
	"github.com/authgear/authgear-server/pkg/util/template"
	"github.com/authgear/authgear-server/pkg/util/validation"
)

var TemplateWebAuthflowLoginHTML = template.RegisterHTML(
	"web/authflow_login.html",
	Components...,
)

var AuthflowLoginLoginIDSchema = validation.NewSimpleSchema(`
	{
		"type": "object",
		"properties": {
			"x_login_id": { "type": "string" },
			"x_login_id_input_type": { "type": "string" }
		},
		"required": ["x_login_id", "x_login_id_input_type"]
	}
`)

func ConfigureAuthflowLoginRoute(route httproute.Route) httproute.Route {
	return route.
		WithMethods("OPTIONS", "POST", "GET").
		WithPathPattern(webapp.AuthflowRouteLogin)
}

type AuthflowLoginEndpointsProvider interface {
	SSOCallbackURL(alias string) *url.URL
	SharedSSOCallbackURL() *url.URL
}

type AuthflowLoginViewModel struct {
	AllowLoginOnly bool
}

func NewAuthflowLoginViewModel(allowLoginOnly bool) AuthflowLoginViewModel {
	return AuthflowLoginViewModel{
		AllowLoginOnly: allowLoginOnly,
	}
}

type AuthflowLoginHandler struct {
	Controller        *AuthflowController
	BaseViewModel     *viewmodels.BaseViewModeler
	AuthflowViewModel *viewmodels.AuthflowViewModeler
	Renderer          Renderer
	MeterService      MeterService
	TutorialCookie    TutorialCookie
	ErrorService      ErrorService
	Endpoints         AuthflowLoginEndpointsProvider
}

func (h *AuthflowLoginHandler) GetData(
	w http.ResponseWriter,
	r *http.Request,
	s *webapp.Session,
	screen *webapp.AuthflowScreenWithFlowResponse,
	allowLoginOnly bool,
) (map[string]interface{}, error) {
	data := make(map[string]interface{})
	baseViewModel := h.BaseViewModel.ViewModelForAuthFlow(r, w)
	if h.TutorialCookie.Pop(r, w, httputil.SignupLoginTutorialCookieName) {
		baseViewModel.SetTutorial(httputil.SignupLoginTutorialCookieName)
	}
	viewmodels.Embed(data, baseViewModel)
	authflowViewModel := h.AuthflowViewModel.NewWithAuthflow(s, screen.StateTokenFlowResponse, r)
	viewmodels.Embed(data, authflowViewModel)
	viewmodels.Embed(data, NewAuthflowLoginViewModel(allowLoginOnly))
	return data, nil
}

func (h *AuthflowLoginHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	opts := webapp.SessionOptions{
		RedirectURI: h.Controller.RedirectURI(r),
	}

	oauthPostAction := func(ctx context.Context, s *webapp.Session, providerAlias string) error {
		callbackURL := h.Endpoints.SSOCallbackURL(providerAlias).String()
		input := map[string]interface{}{
			"identification": "oauth",
			"alias":          providerAlias,
			"redirect_uri":   callbackURL,
			"response_mode":  oauthrelyingparty.ResponseModeFormPost,
		}

		result, err := h.Controller.ReplaceScreen(ctx, r, s, authflow.FlowTypeSignupLogin, input)
		if err != nil {
			return err
		}

		result.WriteResponse(w, r)
		return nil
	}

	var handlers AuthflowControllerHandlers
	handlers.Get(func(ctx context.Context, s *webapp.Session, screen *webapp.AuthflowScreenWithFlowResponse) error {
		oauthProviderAlias := s.OAuthProviderAlias
		allowLoginOnly := s.UserIDHint != ""

		visitorID := webapp.GetVisitorID(ctx)
		if visitorID == "" {
			// visitor id should be generated by VisitorIDMiddleware
			return fmt.Errorf("webapp: missing visitor id")
		}

		err := h.MeterService.TrackPageView(ctx, visitorID, meter.PageTypeLogin)
		if err != nil {
			return err
		}

		hasErr := h.ErrorService.HasError(ctx, r)
		// If x_oauth_provider_alias is provided via authz endpoint
		// redirect the user to the oauth provider
		// If there is error in the ErrorCookie, the user will stay in the login
		// page to see the error message and the redirection won't be performed
		if !hasErr && oauthProviderAlias != "" {
			return oauthPostAction(ctx, s, oauthProviderAlias)
		}

		data, err := h.GetData(w, r, s, screen, allowLoginOnly)
		if err != nil {
			return err
		}

		h.Renderer.RenderHTML(w, r, TemplateWebAuthflowLoginHTML, data)
		return nil
	})

	handlers.PostAction("oauth", func(ctx context.Context, s *webapp.Session, _ *webapp.AuthflowScreenWithFlowResponse) error {
		providerAlias := r.Form.Get("x_provider_alias")
		return oauthPostAction(ctx, s, providerAlias)
	})

	handlers.PostAction("login_id", func(ctx context.Context, s *webapp.Session, screen *webapp.AuthflowScreenWithFlowResponse) error {
		err := AuthflowLoginLoginIDSchema.Validator().ValidateValue(ctx, FormToJSON(r.Form))
		if err != nil {
			return err
		}

		loginID := r.Form.Get("x_login_id")
		loginIDInputType := r.Form.Get("x_login_id_input_type")
		identification := webapp.GetMostAppropriateIdentification(ctx, screen.StateTokenFlowResponse, loginID, loginIDInputType)
		input := map[string]interface{}{
			"identification": identification,
			"login_id":       loginID,
		}

		result, err := h.Controller.AdvanceWithInput(ctx, r, s, screen, input, nil)
		if err != nil {
			return err
		}

		result.WriteResponse(w, r)
		return nil
	})

	handlers.PostAction("passkey", func(ctx context.Context, s *webapp.Session, screen *webapp.AuthflowScreenWithFlowResponse) error {
		assertionResponseStr := r.Form.Get("x_assertion_response")

		var assertionResponseJSON interface{}
		err := json.Unmarshal([]byte(assertionResponseStr), &assertionResponseJSON)
		if err != nil {
			return err
		}

		input := map[string]interface{}{
			"identification":     "passkey",
			"assertion_response": assertionResponseJSON,
		}

		result, err := h.Controller.AdvanceWithInput(ctx, r, s, screen, input, nil)
		if err != nil {
			return err
		}

		result.WriteResponse(w, r)
		return nil
	})

	h.Controller.HandleStartOfFlow(r.Context(), w, r, opts, authflow.FlowTypeLogin, &handlers, nil)
}
