use axum::{
    extract::{OriginalUri, Request, State},
    middleware::Next,
    response::Response,
};
use axum_extra::extract::cookie::{Cookie, CookieJar};
use crank_community_auth::{
    cleared_session_cookie as build_cleared_session_cookie,
    create_session_cookie as build_session_cookie, hash_password as community_hash_password,
    session_cookie as build_session_cookie_header,
};
use crank_core::{User, UserSessionId, WorkspaceId};
use crank_registry::WorkspaceMembershipRecord;
use serde::Serialize;

use crate::{error::ApiError, state::AppState};

pub use crank_community_auth::{
    SESSION_COOKIE_NAME, SessionCookie, extract_session_token, hash_session_secret, verify_password,
};

#[derive(Clone)]
pub struct BootstrapAdminConfig {
    pub email: String,
    pub password: String,
    pub display_name: String,
}

#[derive(Clone)]
pub struct AuthSettings {
    pub session_secret: String,
    pub password_pepper: String,
    pub session_ttl_hours: i64,
    pub cookie_secure: bool,
    pub bootstrap_admin: BootstrapAdminConfig,
}

#[derive(Clone, Debug, Serialize)]
pub struct AuthenticatedSession {
    pub session_id: UserSessionId,
    pub user: User,
    pub memberships: Vec<WorkspaceMembershipRecord>,
    pub current_workspace_id: Option<WorkspaceId>,
}

pub fn hash_password(password: &str, pepper: &str) -> Result<String, ApiError> {
    community_hash_password(password, pepper)
        .map_err(|error| ApiError::internal(format!("failed to hash password: {error}")))
}

pub fn create_session_cookie(settings: &AuthSettings) -> Result<SessionCookie, ApiError> {
    build_session_cookie(settings.session_ttl_hours)
        .map_err(|error| ApiError::internal(format!("failed to create session cookie: {error}")))
}

pub fn session_cookie(settings: &AuthSettings, token: &str) -> Cookie<'static> {
    build_session_cookie_header(token, settings.cookie_secure, settings.session_ttl_hours)
}

pub fn cleared_session_cookie(settings: &AuthSettings) -> Cookie<'static> {
    build_cleared_session_cookie(settings.cookie_secure)
}

pub async fn require_session(
    State(state): State<AppState>,
    jar: CookieJar,
    mut request: Request,
    next: Next,
) -> Result<Response, ApiError> {
    let session = resolve_authenticated_session(state.clone(), &jar).await?;
    request.extensions_mut().insert(session);
    Ok(next.run(request).await)
}

pub async fn require_workspace_session(
    State(state): State<AppState>,
    jar: CookieJar,
    original_uri: OriginalUri,
    mut request: Request,
    next: Next,
) -> Result<Response, ApiError> {
    let session = resolve_authenticated_session(state.clone(), &jar).await?;
    let workspace_id = workspace_id_from_path(original_uri.path())
        .ok_or_else(|| ApiError::internal("workspace middleware was applied to an invalid path"))?;

    let has_access = state
        .service
        .user_has_workspace_access(&session.user.id, &workspace_id)
        .await?;
    if !has_access {
        return Err(ApiError::forbidden("workspace access denied"));
    }

    request.extensions_mut().insert(session);
    Ok(next.run(request).await)
}

async fn resolve_authenticated_session(
    state: AppState,
    jar: &CookieJar,
) -> Result<AuthenticatedSession, ApiError> {
    let (session_id, session_value) = extract_session_token(jar)
        .ok_or_else(|| ApiError::unauthorized("authentication required"))?;
    let session = state
        .service
        .get_session(&session_id, &session_value)
        .await?
        .ok_or_else(|| ApiError::unauthorized("session is invalid or expired"))?;

    state.service.touch_session(&session_id).await?;

    Ok(session)
}

fn workspace_id_from_path(path: &str) -> Option<WorkspaceId> {
    let marker = "/api/admin/workspaces/";
    let (_, suffix) = path.split_once(marker)?;
    let workspace_id = suffix.split('/').next()?;
    if workspace_id.is_empty() {
        return None;
    }

    Some(WorkspaceId::new(workspace_id))
}