// Copyright 2022 E99p1ant. All rights reserved.
// Use of this source code is governed by a MIT-style
// license that can be found in the LICENSE file.

package auth

import (
	"fmt"
	"os"
	"time"

	"github.com/flamego/cache"
	"github.com/flamego/recaptcha"
	"github.com/pkg/errors"
	"github.com/sirupsen/logrus"
	"github.com/thanhpk/randstr"

	"github.com/tamakyi/TamaBox/internal/captcha"
	"github.com/tamakyi/TamaBox/internal/context"
	"github.com/tamakyi/TamaBox/internal/db"
	"github.com/tamakyi/TamaBox/internal/form"
	"github.com/tamakyi/TamaBox/internal/i18n"
	"github.com/tamakyi/TamaBox/internal/mail"
	"github.com/tamakyi/TamaBox/internal/shared"
)

func ForgotPassword(ctx context.Context) {
	ctx.Success("auth/forgot-password")
}

func ForgotPasswordAction(ctx context.Context, f form.ForgotPassword, cache cache.Cache, recaptcha recaptcha.RecaptchaV3) {
	if ctx.HasError() {
		ctx.Success("auth/forgot-password")
		return
	}

	// Check captcha code (unified: recaptcha, turnstile, or math).
	ok, err := captcha.Verify(f.Recaptcha, shared.ResolveClientIP(ctx.Request().Request), ctx.Session, recaptcha, ctx.Lang())
	if err != nil {
		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to check captcha")
		ctx.SetErrorFlash(err.Error())
		ctx.Redirect("/forgot-password")
		return
	}
	if !ok {
		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "captcha.error"))
		ctx.Redirect("/forgot-password")
		return
	}

	user, err := db.Users.GetByEmail(ctx.Request().Context(), f.Email)
	if err != nil {
		if errors.Is(err, db.ErrUserNotExists) {
			// 防邮箱枚举：不区分邮箱是否存在，统一渲染"已发送"提示页（不实际发信）。
			ctx.Data["email"] = f.Email
			ctx.Success("auth/forgot-password-sent")
			return
		}
		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get user by email")
		ctx.SetInternalErrorFlash()
		ctx.Redirect("/forgot-password")
		return
	}

	emailSentCacheKey := "forgot-password-email-sent:" + user.Email
	_, err = cache.Get(ctx.Request().Context(), emailSentCacheKey)
	if err != nil {
		if !errors.Is(err, os.ErrNotExist) {
			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to read password recovery email sent cache")
		}
	} else {
		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "auth.errEmailFrequent"))
		ctx.Redirect("/forgot-password")
		return
	}

	// SEC-05：签发新令牌前，先尝试删除该用户上一次的找回令牌。
	// 用 userID → code 反查键实现：新令牌签发后旧令牌的反查键被覆盖，
	// 旧 code 在 24h 内虽然物理上还在缓存里，但已经不在用户的"当前令牌"集合中，
	// checkRecoverPasswordCode 会拒绝使用。
	userCodeKey := "forgot-password-user-code:" + fmt.Sprint(user.ID)
	if oldCodeItf, err := cache.Get(ctx.Request().Context(), userCodeKey); err == nil {
		if oldCode, ok := oldCodeItf.(string); ok && oldCode != "" {
			oldCodeKey := "forgot-password-recovery-code:" + oldCode
			if err := cache.Delete(ctx.Request().Context(), oldCodeKey); err != nil {
				logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to delete old recovery code")
			}
		}
	}

	code := randstr.String(64)
	recoveryCodeCacheKey := "forgot-password-recovery-code:" + code
	if err := cache.Set(ctx.Request().Context(), recoveryCodeCacheKey, user.ID, 24*time.Hour); err != nil {
		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to set password recovery code cache")
		ctx.SetInternalErrorFlash()
		ctx.Redirect("/forgot-password")
		return
	}

	// 记录该用户当前的找回令牌 code，供下次签发时撤销。
	if err := cache.Set(ctx.Request().Context(), userCodeKey, code, 24*time.Hour); err != nil {
		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to set user recovery code cache")
		// 尽力回滚刚写入的令牌，避免孤儿
		_ = cache.Delete(ctx.Request().Context(), recoveryCodeCacheKey)
		ctx.SetInternalErrorFlash()
		ctx.Redirect("/forgot-password")
		return
	}

	if err := mail.SendPasswordRecoveryMail(user.Email, code); err != nil {
		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to send password recovery mail")
		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "auth.errEmailFailed"))
		ctx.Redirect("/forgot-password")
		return
	}

	if err := cache.Set(ctx.Request().Context(), emailSentCacheKey, time.Now(), 2*time.Minute); err != nil {
		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to set password recovery email cache")
	}

	ctx.Data["email"] = user.Email
	ctx.Success("auth/forgot-password-sent")
}

func checkRecoverPasswordCode(ctx context.Context, cache cache.Cache) (*db.User, bool) {
	code := ctx.Query("code")
	recoveryCodeCacheKey := "forgot-password-recovery-code:" + code
	userIDItf, err := cache.Get(ctx.Request().Context(), recoveryCodeCacheKey)
	if err != nil {
		if errors.Is(err, os.ErrNotExist) {
			ctx.SetErrorFlash(i18n.T(ctx.Lang(), "auth.errCodeExpired"))
		} else {
			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to read password recovery code cache")
			ctx.SetInternalErrorFlash()
		}
		ctx.Redirect("/login")
		return nil, false
	}

	userID, ok := userIDItf.(uint)
	if !ok {
		logrus.WithContext(ctx.Request().Context()).WithField("user_id_itf", userIDItf).Error("Failed to convert user id interface to uint")
		ctx.SetInternalErrorFlash()
		ctx.Redirect("/login")
		return nil, false
	}

	user, err := db.Users.GetByID(ctx.Request().Context(), userID)
	if err != nil {
		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "auth.errUserNotFound"))
		ctx.Redirect("/login")
		return nil, false
	}

	return user, true
}

func RecoverPassword(ctx context.Context, cache cache.Cache) {
	user, ok := checkRecoverPasswordCode(ctx, cache)
	if !ok {
		return
	}

	ctx.Data["User"] = user
	ctx.Success("auth/password-recovery")
}

func RecoverPasswordAction(ctx context.Context, cache cache.Cache, f form.RecoverPassword) {
	user, ok := checkRecoverPasswordCode(ctx, cache)
	if !ok {
		return
	}
	if ctx.HasError() {
		ctx.Data["User"] = user
		ctx.Success("auth/password-recovery")
		return
	}

	// SEC-05：先更新密码，成功后再删除令牌。
	// 旧实现先删令牌再改密码：若密码更新失败，用户必须重新申请。
	// 现在密码更新成功才删令牌；即使删令牌失败，密码已改，
	// 旧令牌也不再有用（重新登录需要新密码）。
	if err := db.Users.UpdatePassword(ctx.Request().Context(), user.ID, f.NewPassword); err != nil {
		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to update user password")
		ctx.SetInternalErrorFlash()
		ctx.Refresh()
		return
	}

	code := ctx.Query("code")
	recoveryCodeCacheKey := "forgot-password-recovery-code:" + code
	if err := cache.Delete(ctx.Request().Context(), recoveryCodeCacheKey); err != nil {
		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to delete password recovery code cache")
		// 令牌删除失败不阻断流程：密码已改，旧令牌已经无法用于登录。
		// 但记录日志便于排查缓存异常。
	}

	// 同时清理 user → code 反查键，避免下次申请时尝试删除已不存在的旧 code。
	userCodeKey := "forgot-password-user-code:" + fmt.Sprint(user.ID)
	if err := cache.Delete(ctx.Request().Context(), userCodeKey); err != nil {
		logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to delete user recovery code mapping")
	}

	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "auth.errPasswordChanged"))
	ctx.Redirect("/login")
}