package main

import (
	"context"
	"encoding/json"
	"fmt"
	"html/template"
	"net/http"
	"net/url"
	"strings"
	"time"

	"github.com/haileyok/atproto-oauth-golang/helpers"
)

var allowedHandles = map[string]bool{
	"1440.news":        true,
	"wehrv.bsky.social": true,
}

// HandleClientMetadata serves the OAuth client metadata
func (m *OAuthManager) HandleClientMetadata(w http.ResponseWriter, r *http.Request) {
	// Get the JWKS URI from the same host
	scheme := "https"
	if r.TLS == nil && (r.Host == "localhost" || r.Host == "127.0.0.1" || r.Host == "app.1440.localhost:4321") {
		scheme = "http"
	}
	baseURL := scheme + "://" + r.Host

	metadata := map[string]interface{}{
		"client_id":                       m.clientID,
		"client_name":                     "1440.news Dashboard",
		"client_uri":                      baseURL,
		"redirect_uris":                   []string{m.redirectURI},
		"grant_types":                     []string{"authorization_code", "refresh_token"},
		"response_types":                  []string{"code"},
		"scope":                           "atproto",
		"token_endpoint_auth_method":      "private_key_jwt",
		"token_endpoint_auth_signing_alg": "ES256",
		"dpop_bound_access_tokens":        true,
		"jwks_uri":                        baseURL + "/.well-known/jwks.json",
		"application_type":                "web",
		"subject_type":                    "public",
	}

	w.Header().Set("Content-Type", "application/json")
	json.NewEncoder(w).Encode(metadata)
}

// HandleJWKS serves the public JWK set
func (m *OAuthManager) HandleJWKS(w http.ResponseWriter, r *http.Request) {
	jwks := helpers.CreateJwksResponseObject(m.publicJWK)
	w.Header().Set("Content-Type", "application/json")
	json.NewEncoder(w).Encode(jwks)
}

// HandleLogin serves the login page or initiates OAuth flow
func (m *OAuthManager) HandleLogin(w http.ResponseWriter, r *http.Request) {
	// Check if already logged in
	if session := m.GetSessionFromCookie(r); session != nil {
		http.Redirect(w, r, "/dashboard", http.StatusFound)
		return
	}

	// If handle is provided, start OAuth flow
	handle := r.URL.Query().Get("handle")
	if handle != "" {
		// Save handle to cookie for prefill on next visit
		http.SetCookie(w, &http.Cookie{
			Name:     "last_handle",
			Value:    handle,
			Path:     "/",
			MaxAge:   86400 * 365, // 1 year
			HttpOnly: true,
			SameSite: http.SameSiteLaxMode,
		})
		m.startOAuthFlow(w, r, handle)
		return
	}

	// Get last handle from cookie for prefill
	lastHandle := ""
	if cookie, err := r.Cookie("last_handle"); err == nil {
		lastHandle = cookie.Value
	}

	// Serve login page
	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	tmpl := template.Must(template.New("login").Parse(loginPageHTML))
	tmpl.Execute(w, map[string]string{"LastHandle": lastHandle})
}

// startOAuthFlow initiates the OAuth flow for a given handle
func (m *OAuthManager) startOAuthFlow(w http.ResponseWriter, r *http.Request, handle string) {
	ctx, cancel := context.WithTimeout(r.Context(), 30*time.Second)
	defer cancel()

	// Auto-append .bsky.social if handle has no dots
	if !strings.Contains(handle, ".") {
		handle = handle + ".bsky.social"
	}

	fmt.Printf("OAuth: starting flow for handle: %s\n", handle)

	// Resolve handle to DID
	did, err := resolveHandle(ctx, handle)
	if err != nil {
		http.Error(w, fmt.Sprintf("Failed to resolve handle: %v", err), http.StatusBadRequest)
		return
	}
	fmt.Printf("OAuth: resolved DID: %s\n", did)

	// Resolve DID to PDS service URL
	pdsURL, err := resolveDIDToService(ctx, did)
	if err != nil {
		http.Error(w, fmt.Sprintf("Failed to resolve PDS: %v", err), http.StatusBadRequest)
		return
	}
	fmt.Printf("OAuth: PDS URL: %s\n", pdsURL)

	// Get auth server from PDS
	authServerURL, err := m.client.ResolvePdsAuthServer(ctx, pdsURL)
	if err != nil {
		http.Error(w, fmt.Sprintf("Failed to resolve auth server: %v", err), http.StatusBadRequest)
		return
	}
	fmt.Printf("OAuth: auth server: %s\n", authServerURL)

	// Fetch auth server metadata
	authMeta, err := m.client.FetchAuthServerMetadata(ctx, authServerURL)
	if err != nil {
		http.Error(w, fmt.Sprintf("Failed to fetch auth metadata: %v", err), http.StatusBadRequest)
		return
	}
	fmt.Printf("OAuth: auth endpoint: %s\n", authMeta.AuthorizationEndpoint)

	// Generate DPoP private key for this auth flow
	dpopKey, err := helpers.GenerateKey(nil)
	if err != nil {
		http.Error(w, fmt.Sprintf("Failed to generate DPoP key: %v", err), http.StatusInternalServerError)
		return
	}
	dpopKeyBytes, err := json.Marshal(dpopKey)
	if err != nil {
		http.Error(w, fmt.Sprintf("Failed to marshal DPoP key: %v", err), http.StatusInternalServerError)
		return
	}

	// Send PAR (Pushed Authorization Request)
	fmt.Printf("OAuth: sending PAR to %s\n", authServerURL)
	parResp, err := m.client.SendParAuthRequest(
		ctx,
		authServerURL,
		authMeta,
		handle,
		m.allowedScope,
		dpopKey,
	)
	if err != nil {
		fmt.Printf("OAuth: PAR failed: %v\n", err)
		http.Error(w, fmt.Sprintf("PAR request failed: %v", err), http.StatusBadRequest)
		return
	}
	fmt.Printf("OAuth: PAR success, request_uri: %s\n", parResp.RequestUri)

	// Save pending auth state
	pending := &PendingAuth{
		State:          parResp.State,
		PkceVerifier:   parResp.PkceVerifier,
		DpopPrivateJWK: string(dpopKeyBytes),
		DpopNonce:      parResp.DpopAuthserverNonce,
		DID:            did,
		PdsURL:         pdsURL,
		AuthserverIss:  authMeta.Issuer,
	}
	m.sessions.SavePending(parResp.State, pending)

	// Build authorization URL
	authURL, err := url.Parse(authMeta.AuthorizationEndpoint)
	if err != nil {
		http.Error(w, fmt.Sprintf("Invalid auth endpoint: %v", err), http.StatusInternalServerError)
		return
	}

	q := authURL.Query()
	q.Set("client_id", m.clientID)
	q.Set("request_uri", parResp.RequestUri)
	authURL.RawQuery = q.Encode()

	fmt.Printf("OAuth: redirecting to: %s\n", authURL.String())

	http.Redirect(w, r, authURL.String(), http.StatusFound)
}

// HandleCallback handles the OAuth callback
func (m *OAuthManager) HandleCallback(w http.ResponseWriter, r *http.Request) {
	ctx, cancel := context.WithTimeout(r.Context(), 30*time.Second)
	defer cancel()

	// Get callback parameters
	code := r.URL.Query().Get("code")
	state := r.URL.Query().Get("state")
	iss := r.URL.Query().Get("iss")
	errorParam := r.URL.Query().Get("error")
	errorDesc := r.URL.Query().Get("error_description")

	// Check for errors from auth server
	if errorParam != "" {
		http.Error(w, fmt.Sprintf("Authorization error: %s - %s", errorParam, errorDesc), http.StatusBadRequest)
		return
	}

	if code == "" || state == "" {
		http.Error(w, "Missing code or state parameter", http.StatusBadRequest)
		return
	}

	// Retrieve pending auth state
	pending := m.sessions.GetPending(state)
	if pending == nil {
		http.Error(w, "Invalid or expired state", http.StatusBadRequest)
		return
	}

	// Verify issuer matches
	if iss != "" && iss != pending.AuthserverIss {
		http.Error(w, "Issuer mismatch", http.StatusBadRequest)
		return
	}

	// Parse DPoP private key
	dpopKey, err := helpers.ParseJWKFromBytes([]byte(pending.DpopPrivateJWK))
	if err != nil {
		http.Error(w, fmt.Sprintf("Failed to parse DPoP key: %v", err), http.StatusInternalServerError)
		return
	}

	// Exchange code for tokens
	tokenResp, err := m.client.InitialTokenRequest(
		ctx,
		code,
		pending.AuthserverIss,
		pending.PkceVerifier,
		pending.DpopNonce,
		dpopKey,
	)
	if err != nil {
		http.Error(w, fmt.Sprintf("Token exchange failed: %v", err), http.StatusBadRequest)
		return
	}

	// Verify scope
	if tokenResp.Scope != m.allowedScope {
		http.Error(w, fmt.Sprintf("Invalid scope: expected %s, got %s", m.allowedScope, tokenResp.Scope), http.StatusForbidden)
		return
	}

	// Resolve DID to handle
	handle, err := resolveDIDToHandle(ctx, tokenResp.Sub)
	if err != nil {
		http.Error(w, fmt.Sprintf("Failed to resolve handle: %v", err), http.StatusInternalServerError)
		return
	}

	// CRITICAL: Verify user is allowed
	if !allowedHandles[handle] {
		fmt.Printf("OAuth: access denied for handle: %s\n", handle)
		http.Error(w, "Access denied.", http.StatusForbidden)
		return
	}

	// Create session
	session, err := m.sessions.CreateSession(tokenResp.Sub, handle)
	if err != nil {
		http.Error(w, fmt.Sprintf("Failed to create session: %v", err), http.StatusInternalServerError)
		return
	}

	// Store token info in session
	session.AccessToken = tokenResp.AccessToken
	session.RefreshToken = tokenResp.RefreshToken
	session.TokenExpiry = time.Now().Add(time.Duration(tokenResp.ExpiresIn) * time.Second)
	session.DpopPrivateJWK = pending.DpopPrivateJWK
	session.DpopAuthserverNonce = tokenResp.DpopAuthserverNonce
	session.PdsURL = pending.PdsURL
	session.AuthserverIss = pending.AuthserverIss
	m.sessions.UpdateSession(session)

	// Set session cookie
	if err := m.SetSessionCookie(w, r, session.ID); err != nil {
		http.Error(w, fmt.Sprintf("Failed to set cookie: %v", err), http.StatusInternalServerError)
		return
	}

	// Redirect to dashboard
	http.Redirect(w, r, "/dashboard", http.StatusFound)
}

// HandleLogout clears the session and redirects to login
func (m *OAuthManager) HandleLogout(w http.ResponseWriter, r *http.Request) {
	// Get current session
	session := m.GetSessionFromCookie(r)
	if session != nil {
		// Delete session from store
		m.sessions.DeleteSession(session.ID)
	}

	// Clear cookie
	m.ClearSessionCookie(w)

	// Handle API vs browser request
	if r.Method == http.MethodPost || isAPIRequest(r) {
		w.Header().Set("Content-Type", "application/json")
		json.NewEncoder(w).Encode(map[string]string{
			"status": "logged out",
		})
		return
	}

	// Redirect to login for browser requests
	http.Redirect(w, r, "/auth/login", http.StatusFound)
}

// HandleSessionInfo returns current session info (for API calls)
func (m *OAuthManager) HandleSessionInfo(w http.ResponseWriter, r *http.Request) {
	session := m.GetSessionFromCookie(r)
	if session == nil {
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusUnauthorized)
		json.NewEncoder(w).Encode(map[string]string{
			"error": "not authenticated",
		})
		return
	}

	info := &SessionInfo{
		DID:       session.DID,
		Handle:    session.Handle,
		ExpiresAt: session.ExpiresAt,
	}

	w.Header().Set("Content-Type", "application/json")
	json.NewEncoder(w).Encode(info)
}

const loginPageHTML = `<!DOCTYPE html>
<html>
<head>
    <title>Sign In - 1440.news Dashboard</title>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <style>
        * { box-sizing: border-box; margin: 0; padding: 0; }
        body {
            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
            background: #0a0a0a;
            color: #e0e0e0;
            min-height: 100vh;
            display: flex;
            align-items: center;
            justify-content: center;
            padding: 20px;
        }
        .container {
            max-width: 400px;
            width: 100%;
            text-align: center;
        }
        .logo {
            font-size: 3em;
            color: #fff;
            margin-bottom: 10px;
        }
        .tagline {
            color: #888;
            margin-bottom: 40px;
        }
        .login-card {
            background: #151515;
            border: 1px solid #252525;
            border-radius: 12px;
            padding: 30px;
        }
        h2 {
            color: #fff;
            margin-bottom: 20px;
        }
        .form-group {
            margin-bottom: 20px;
            text-align: left;
        }
        label {
            display: block;
            color: #888;
            font-size: 0.9em;
            margin-bottom: 5px;
        }
        input[type="text"] {
            width: 100%;
            padding: 12px;
            background: #0a0a0a;
            border: 1px solid #333;
            border-radius: 6px;
            color: #fff;
            font-size: 1em;
        }
        input[type="text"]:focus {
            outline: none;
            border-color: #0af;
        }
        input[type="text"]::placeholder {
            color: #555;
        }
        .login-btn {
            width: 100%;
            padding: 14px;
            background: #0af;
            color: #000;
            border: none;
            border-radius: 6px;
            font-size: 1em;
            font-weight: 600;
            cursor: pointer;
            transition: background 0.2s;
        }
        .login-btn:hover {
            background: #0cf;
        }
        .login-btn:disabled {
            background: #555;
            cursor: not-allowed;
        }
        .error {
            background: #2a1515;
            border: 1px solid #533;
            color: #f88;
            padding: 10px;
            border-radius: 6px;
            margin-bottom: 15px;
            display: none;
        }
        .bluesky-icon {
            display: inline-block;
            width: 20px;
            height: 20px;
            margin-right: 8px;
            vertical-align: middle;
        }
    </style>
</head>
<body>
    <div class="container">
        <div class="logo">1440.news</div>
        <p class="tagline">Dashboard Authentication</p>

        <div class="login-card">
            <h2>Sign In with Bluesky</h2>

            <div class="error" id="error"></div>

            <form id="loginForm" action="/auth/login" method="get">
                <div class="form-group">
                    <label for="handle">Bluesky Handle</label>
                    <input type="text" id="handle" name="handle" placeholder="username or full.handle" value="{{.LastHandle}}" required autofocus>
                </div>

                <button type="submit" class="login-btn" id="loginBtn">
                    <svg class="bluesky-icon" viewBox="0 0 568 501" fill="currentColor">
                        <path d="M123.121 33.6637C188.241 82.5526 258.281 181.681 284 234.873C309.719 181.681 379.759 82.5526 444.879 33.6637C491.866 -1.61183 568 -28.9064 568 57.9464C568 75.2916 558.055 203.659 552.222 224.501C531.947 296.954 458.067 315.434 392.347 304.249C507.222 323.8 536.444 388.56 473.333 453.32C353.473 576.312 301.061 422.461 287.631 googling=383.039C286.251 378.892 284.991 374.834 284 371.019C283.009 374.834 281.749 378.892 280.369 383.039C266.939 422.461 214.527 576.312 94.6667 453.32C31.5556 388.56 60.7778 323.8 175.653 304.249C109.933 315.434 36.0533 296.954 15.7778 224.501C9.94533 203.659 0 75.2916 0 57.9464C0 -28.9064 76.1345 -1.61183 123.121 33.6637Z"/>
                    </svg>
                    Sign In with Bluesky
                </button>
            </form>
        </div>
    </div>

    <script>
        document.getElementById('loginForm').addEventListener('submit', function(e) {
            const handle = document.getElementById('handle').value.trim();
            if (!handle) {
                e.preventDefault();
                document.getElementById('error').style.display = 'block';
                document.getElementById('error').textContent = 'Please enter your handle';
                return;
            }
            document.getElementById('loginBtn').disabled = true;
            document.getElementById('loginBtn').textContent = 'Redirecting...';
        });
    </script>
</body>
</html>
`
