package handlers

import (
	"errors"
	"net/http"

	"github.com/gin-gonic/gin"

	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
	"git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
)

// UsersHandler exposes:
//
//	GET    /api/v1/users           — list all users
//	POST   /api/v1/users           — create user
//	PUT    /api/v1/users/:id       — update email/role/active (not password)
//	POST   /api/v1/users/:id/password — set new password
//	DELETE /api/v1/users/:id       — delete user
type UsersHandler struct {
	Repo   *users.Repo
	Audit  *audit.Repo
	NodeID string
}

func NewUsersHandler(repo *users.Repo, a *audit.Repo, nodeID string) *UsersHandler {
	return &UsersHandler{Repo: repo, Audit: a, NodeID: nodeID}
}

func (h *UsersHandler) Register(rg *gin.RouterGroup) {
	g := rg.Group("/users")
	g.GET("", h.List)
	g.POST("", h.Create)
	g.PUT("/:id", h.Update)
	g.POST("/:id/password", h.SetPassword)
	g.DELETE("/:id", h.Delete)
	g.DELETE("/:id/totp", h.DisableTOTP)
}

func (h *UsersHandler) List(c *gin.Context) {
	out, err := h.Repo.List(c.Request.Context())
	if err != nil {
		response.Internal(c, err)
		return
	}
	if out == nil {
		out = []users.User{}
	}
	response.OK(c, gin.H{"users": out})
}

type createUserReq struct {
	Email    string `json:"email"    binding:"required,email"`
	Password string `json:"password" binding:"required,min=12"`
	Role     string `json:"role"     binding:"required,oneof=admin viewer"`
	Active   bool   `json:"active"`
}

func (h *UsersHandler) Create(c *gin.Context) {
	var req createUserReq
	if err := c.ShouldBindJSON(&req); err != nil {
		response.BadRequest(c, err)
		return
	}
	u, err := h.Repo.Create(c.Request.Context(), req.Email, req.Password, req.Role, req.Active)
	if errors.Is(err, users.ErrEmailTaken) {
		response.Err(c, http.StatusConflict, err)
		return
	}
	if err != nil {
		response.Internal(c, err)
		return
	}
	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "user.create", u.Email,
		gin.H{"role": u.Role, "active": u.Active}, h.NodeID)
	response.Created(c, u)
}

type updateUserReq struct {
	Email  string `json:"email"  binding:"required,email"`
	Role   string `json:"role"   binding:"required,oneof=admin viewer"`
	Active bool   `json:"active"`
}

func (h *UsersHandler) Update(c *gin.Context) {
	id, ok := parseID(c)
	if !ok {
		return
	}
	var req updateUserReq
	if err := c.ShouldBindJSON(&req); err != nil {
		response.BadRequest(c, err)
		return
	}
	u, err := h.Repo.Update(c.Request.Context(), id, req.Email, req.Role, req.Active)
	if errors.Is(err, users.ErrNotFound) {
		response.NotFound(c, err)
		return
	}
	if errors.Is(err, users.ErrEmailTaken) {
		response.Err(c, http.StatusConflict, err)
		return
	}
	if err != nil {
		response.Internal(c, err)
		return
	}
	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "user.update", u.Email,
		gin.H{"role": u.Role, "active": u.Active}, h.NodeID)
	response.OK(c, u)
}

type setPasswordReq struct {
	Password string `json:"password" binding:"required,min=12"`
}

func (h *UsersHandler) SetPassword(c *gin.Context) {
	id, ok := parseID(c)
	if !ok {
		return
	}
	var req setPasswordReq
	if err := c.ShouldBindJSON(&req); err != nil {
		response.BadRequest(c, err)
		return
	}
	if err := h.Repo.SetPassword(c.Request.Context(), id, req.Password); err != nil {
		if errors.Is(err, users.ErrNotFound) {
			response.NotFound(c, err)
			return
		}
		response.Internal(c, err)
		return
	}
	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "user.password.set",
		c.Param("id"), nil, h.NodeID)
	response.OK(c, gin.H{"ok": true})
}

func (h *UsersHandler) Delete(c *gin.Context) {
	id, ok := parseID(c)
	if !ok {
		return
	}
	// Prevent deleting the own account.
	tok := CurrentToken(c)
	if tok != nil {
		if u, _, err := h.Repo.FindByEmail(c.Request.Context(), tok.Actor); err == nil {
			if u.ID == id {
				response.Err(c, http.StatusBadRequest, errors.New("cannot delete own account"))
				return
			}
		}
	}
	if err := h.Repo.Delete(c.Request.Context(), id); err != nil {
		if errors.Is(err, users.ErrNotFound) {
			response.NotFound(c, err)
			return
		}
		response.Internal(c, err)
		return
	}
	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "user.delete",
		c.Param("id"), nil, h.NodeID)
	response.OK(c, gin.H{"ok": true})
}

// DisableTOTP allows an admin to disable 2FA for any user.
func (h *UsersHandler) DisableTOTP(c *gin.Context) {
	id, ok := parseID(c)
	if !ok {
		return
	}
	if err := h.Repo.DisableTOTP(c.Request.Context(), id); err != nil {
		if errors.Is(err, users.ErrNotFound) {
			response.NotFound(c, err)
			return
		}
		response.Internal(c, err)
		return
	}
	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "user.totp.disabled",
		c.Param("id"), nil, h.NodeID)
	response.OK(c, gin.H{"ok": true})
}