package authflowv2

import (
	"context"
	"math"
	"net/http"

	"net/url"

	"github.com/authgear/authgear-server/pkg/api/model"
	handlerwebapp "github.com/authgear/authgear-server/pkg/auth/handler/webapp"
	"github.com/authgear/authgear-server/pkg/auth/handler/webapp/viewmodels"
	"github.com/authgear/authgear-server/pkg/auth/webapp"
	"github.com/authgear/authgear-server/pkg/lib/accountmanagement"
	"github.com/authgear/authgear-server/pkg/lib/authn/otp"
	"github.com/authgear/authgear-server/pkg/lib/config"
	"github.com/authgear/authgear-server/pkg/lib/infra/db/appdb"
	"github.com/authgear/authgear-server/pkg/lib/infra/mail"
	"github.com/authgear/authgear-server/pkg/lib/session"
	"github.com/authgear/authgear-server/pkg/util/clock"
	"github.com/authgear/authgear-server/pkg/util/httproute"
	"github.com/authgear/authgear-server/pkg/util/template"
	"github.com/authgear/authgear-server/pkg/util/validation"
)

var TemplateWebSettingsIdentityVerifyEmailHTML = template.RegisterHTML(
	"web/authflowv2/settings_identity_verify_email.html",
	handlerwebapp.SettingsComponents...,
)

var AuthflowV2SettingsIdentityVerifyEmailSchema = validation.NewSimpleSchema(`
	{
		"type": "object",
		"properties": {
			"x_login_id_key": { "type": "string" },
			"q_token": { "type": "string" },
			"x_code": { "type": "string" }
		},
		"required": ["x_login_id_key", "q_token", "x_code"]
	}
`)

var AuthflowV2SettingsIdentityResendEmailSchema = validation.NewSimpleSchema(`
	{
		"type": "object",
		"properties": {
			"q_token": { "type": "string" }
		},
		"required": ["q_token"]
	}
`)

func ConfigureAuthflowV2SettingsIdentityVerifyEmailRoute(route httproute.Route) httproute.Route {
	return route.
		WithMethods("OPTIONS", "POST", "GET").
		WithPathPattern(AuthflowV2RouteSettingsIdentityVerifyEmail)
}

type AuthflowV2SettingsIdentityVerifyEmailViewModel struct {
	LoginIDKey string
	LoginID    string
	IdentityID string
	Token      string

	CodeLength                     int
	MaskedClaimValue               string
	ResendCooldown                 int
	FailedAttemptRateLimitExceeded bool
}

type AuthflowV2SettingsIdentityVerifyEmailHandler struct {
	Database            *appdb.Handle
	ControllerFactory   handlerwebapp.ControllerFactory
	BaseViewModel       *viewmodels.BaseViewModeler
	OTPCodeService      handlerwebapp.OTPCodeService
	Renderer            handlerwebapp.Renderer
	AccountManagement   accountmanagement.Service
	Clock               clock.Clock
	Config              *config.AppConfig
	AuthenticatorConfig *config.AuthenticatorConfig
}

func (h *AuthflowV2SettingsIdentityVerifyEmailHandler) GetData(ctx context.Context, r *http.Request, rw http.ResponseWriter) (map[string]interface{}, error) {
	data := map[string]interface{}{}

	loginIDKey := r.Form.Get("q_login_id_key")
	tokenString := r.Form.Get("q_token")

	baseViewModel := h.BaseViewModel.ViewModel(r, rw)
	viewmodels.Embed(data, baseViewModel)

	s := session.GetSession(ctx)
	token, err := h.AccountManagement.GetToken(ctx, s, tokenString)
	if err != nil {
		return nil, err
	}

	vm := AuthflowV2SettingsIdentityVerifyEmailViewModel{
		LoginIDKey: loginIDKey,
		LoginID:    token.Identity.Email,
		IdentityID: token.Identity.IdentityID,
		Token:      tokenString,

		CodeLength:       6,
		MaskedClaimValue: mail.MaskAddress(token.Identity.Email),
	}

	state, err := h.OTPCodeService.InspectState(ctx, otp.KindVerification(h.Config, model.AuthenticatorOOBChannelEmail), token.Identity.Email)
	if err != nil {
		return nil, err
	}
	cooldown := int(math.Ceil(state.CanResendAt.Sub(h.Clock.NowUTC()).Seconds())) // Use ceil, because int conversion truncates decimal and can lead to Please Wait Before Resending error.
	if cooldown < 0 {
		vm.ResendCooldown = 0
	} else {
		vm.ResendCooldown = cooldown
	}

	vm.FailedAttemptRateLimitExceeded = state.TooManyAttempts

	viewmodels.Embed(data, vm)

	return data, nil
}

func (h *AuthflowV2SettingsIdentityVerifyEmailHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	ctrl, err := h.ControllerFactory.New(r, w)
	if err != nil {
		http.Error(w, err.Error(), http.StatusBadRequest)
		return
	}
	defer ctrl.ServeWithoutDBTx(r.Context())

	ctrl.GetWithSettingsActionWebSession(r, func(ctx context.Context, _ *webapp.Session) error {
		data, err := h.GetData(ctx, r, w)
		if err != nil {
			return err
		}

		h.Renderer.RenderHTML(w, r, TemplateWebSettingsIdentityVerifyEmailHTML, data)
		return nil
	})

	ctrl.PostActionWithSettingsActionWebSession("submit", r, func(ctx context.Context, webappSession *webapp.Session) error {
		err := AuthflowV2SettingsIdentityVerifyEmailSchema.Validator().ValidateValue(ctx, handlerwebapp.FormToJSON(r.Form))
		if err != nil {
			return err
		}

		loginIDKey := r.Form.Get("x_login_id_key")
		tokenString := r.Form.Get("q_token")

		code := r.Form.Get("x_code")

		s := session.GetSession(ctx)
		_, err = h.AccountManagement.ResumeAddOrUpdateIdentityEmail(ctx, s, tokenString, &accountmanagement.ResumeAddOrUpdateIdentityEmailInput{
			LoginIDKey: loginIDKey,
			Code:       code,
		})
		if err != nil {
			return err
		}
		if ctrl.IsInSettingsAction(s, webappSession) {
			settingsActionResult, err := ctrl.FinishSettingsActionWithResult(ctx, s, webappSession)
			if err != nil {
				return err
			}
			settingsActionResult.WriteResponse(w, r)
			return nil
		}

		redirectURI, err := url.Parse(AuthflowV2RouteSettingsIdentityListEmail)
		if err != nil {
			return err
		}
		q := redirectURI.Query()
		q.Set("q_login_id_key", loginIDKey)
		redirectURI.RawQuery = q.Encode()

		result := webapp.Result{RedirectURI: redirectURI.String()}
		result.WriteResponse(w, r)
		return nil
	})

	ctrl.PostAction("resend", func(ctx context.Context) error {
		err := AuthflowV2SettingsIdentityResendEmailSchema.Validator().ValidateValue(ctx, handlerwebapp.FormToJSON(r.Form))
		if err != nil {
			return err
		}

		tokenString := r.Form.Get("q_token")
		err = h.AccountManagement.ResendOTPCode(ctx, session.GetSession(ctx), tokenString)
		if err != nil {
			return err
		}

		result := webapp.Result{}
		result.WriteResponse(w, r)
		return nil
	})
}
