using Microsoft.AspNetCore.Mvc;
using Campus_live_rewrite.api.dbs;
using Campus_live_rewrite.api.server;
using System.Net.Http.Headers;
using System.Text.Json;

namespace Campus_live_rewrite.Controllers
{
    [ApiController]
    [Route("api/auth")]
    public class DiscordController : Controller
    {
        // ClientId + RedirectUri are shared with the website "Link Discord" flow (SiteController
        // builds the same authorize URL and reuses this SAME callback, branching on state="link:").
        // ClientSecret stays private - only the token exchange here needs it.
        internal const string ClientId = "1537203658725265488";
        private const string ClientSecret = "6JOoRs9-b-B8m8y5t9TnhURs6dOO-P-2";
        internal const string RedirectUri = "https://gameauth.ddns.net/api/auth/discord/callback";

        [HttpGet("discord")]
        public IActionResult DiscordLogin()
        {
            var url =
                "https://discord.com/api/oauth2/authorize" +
                $"?client_id={ClientId}" +
                $"&redirect_uri={Uri.EscapeDataString(RedirectUri)}" +
                "&response_type=code" +
                "&scope=identify email";

            return Redirect(url);
        }

        [HttpGet("discord/callback")]
        public async Task<IActionResult> DiscordCallback([FromQuery] string code, [FromQuery] string? state = null)
        {
            if (string.IsNullOrEmpty(code))
                return BadRequest("Missing OAuth code.");

            using var http = new HttpClient();

            // Exchange code for access token
            var tokenResponse = await http.PostAsync(
                "https://discord.com/api/oauth2/token",
                new FormUrlEncodedContent(new Dictionary<string, string>
                {
                    ["client_id"] = ClientId,
                    ["client_secret"] = ClientSecret,
                    ["grant_type"] = "authorization_code",
                    ["code"] = code,
                    ["redirect_uri"] = RedirectUri
                })
            );

            if (!tokenResponse.IsSuccessStatusCode)
                return Unauthorized("OAuth token exchange failed.");

            var tokenJson = await tokenResponse.Content.ReadAsStringAsync();
            var token = JsonDocument.Parse(tokenJson)
                .RootElement.GetProperty("access_token").GetString();

            http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);

            var userJson = await http.GetStringAsync("https://discord.com/api/users/@me");
            var user = JsonDocument.Parse(userJson).RootElement;

            string discordId = user.GetProperty("id").GetString();
            string username = user.GetProperty("username").GetString();

            // Email may be null
            string? email = null;
            if (user.TryGetProperty("email", out var emailProp))
                email = emailProp.GetString();

            Console.WriteLine($"Discord Login: {username} ({discordId}) | Email: {email ?? "N/A"}");

            // ---- Discord LINK flow (website Settings > Discord "Link Discord") --------------
            // state "link:<code>" means the user started this from Settings while signed in on the
            // website. This is COMPLETELY separate from the admin login below: resolve the code to
            // their Campus account, attach the Discord id, and send them back to /settings. It
            // NEVER issues an admin cookie, NEVER redirects to /admin, and NEVER auto-creates an
            // account - so linking Discord can't accidentally log anyone into the admin panel.
            if (!string.IsNullOrEmpty(state) && state.StartsWith("link:", StringComparison.Ordinal))
            {
                string linkCode = state.Substring("link:".Length);
                if (!DiscordLinkCodes.TryResolve(linkCode, out ulong linkAccId))
                    return Redirect("/settings?discord=expired");
                if (!ulong.TryParse(discordId, out ulong linkDid))
                    return Redirect("/settings?discord=error");

                // One Discord may own only one Campus account.
                ulong otherAcc = PlayerDB.FindPlayerByDiscordId(linkDid, linkAccId);
                if (otherAcc != 0)
                    return Redirect("/settings?discord=inuse");

                PlayerDB.SetDiscordLink(linkAccId, linkDid, username);
                DiscordLinkCodes.Consume(linkCode);
                Console.WriteLine($"[DiscordLink] account {linkAccId} linked to discord {linkDid} ({username}) via OAuth");
                return Redirect("/settings?discord=linked");
            }

            // 🔐 Lookup account (auto-create if this Discord id has never been seen)
            ulong discordIdUlong = ulong.Parse(discordId);
            var accountIds = PlayerDB.GetAccountIdsByDiscordId(discordIdUlong);

            ulong resolvedAccId;
            if (accountIds == null || !accountIds.Any())
            {
                Console.WriteLine($"[DiscordAuth] No account linked to discord_id={discordIdUlong} ({username}) — auto-creating.");
                if (!PlayerDB.CreateAccount(Campus_live_rewrite.api.server.Classes.db_class.Platforms.RecNet, 0UL, "", discordIdUlong, out var newAcc))
                {
                    Console.WriteLine($"[DiscordAuth] CreateAccount FAILED for discord_id={discordIdUlong}");
                    return StatusCode(500, "Failed to create Discord-linked account.");
                }
                Console.WriteLine($"[DiscordAuth] Auto-created account_id={newAcc.accountId} for discord_id={discordIdUlong}");
                resolvedAccId = newAcc.accountId;
            }
            else
            {
                resolvedAccId = accountIds.First();
                Console.WriteLine($"[DiscordAuth] Existing account_id={resolvedAccId} for discord_id={discordIdUlong}");
            }

            var account = PlayerDB.GetFullAccount(resolvedAccId);
            if (account is null)
            {
                Console.WriteLine($"[DiscordAuth] GetFullAccount returned null for accountId={resolvedAccId} (discord_id={discordIdUlong})");
                return Unauthorized("Account not found.");
            }

            // ✅ Issue JWT
            string jwtToken = ClientSecurity.RefreshToken_Web(account.playerid);

            // SameSite=Lax (not Strict): a cookie set on a cross-site redirect from Discord is
            // still allowed AND is sent on the follow-up top-level GET (the /admin/home/v4
            // redirect). With Strict, the browser refuses to send it on that navigation, so the
            // admin page bounces you right back to the login form — which was the symptom.
            Response.Cookies.Append("Authorization", jwtToken, new Microsoft.AspNetCore.Http.CookieOptions
            {
                Expires = DateTime.Now.AddHours(24),
                HttpOnly = true,
                Secure = true,
                SameSite = Microsoft.AspNetCore.Http.SameSiteMode.Lax,
                Path = "/"
            });

            // Discriminate based on `state`. Web-admin login (default / "admin") stays on the
            // original path — cookie is set on gameauth.ddns.net and we redirect to the admin
            // dashboard. Launcher OAuth (state="launcher:<port>") skips the cookie and instead
            // redirects the browser to the launcher's local http listener with the JWT in the
            // query string; the launcher picks it up there and closes the browser tab.
            if (!string.IsNullOrEmpty(state) && state.StartsWith("launcher:", StringComparison.Ordinal))
            {
                string portStr = state.Substring("launcher:".Length);
                if (int.TryParse(portStr, out int port) && port >= 1024 && port <= 65535)
                {
                    string dest = $"http://127.0.0.1:{port}/campus-auth?token={Uri.EscapeDataString(jwtToken)}&account_id={account.playerid}";
                    Console.WriteLine($"[DiscordAuth] launcher flow — redirecting to {dest}");
                    return Redirect(dest);
                }
                Console.WriteLine($"[DiscordAuth] launcher flow — malformed port in state='{state}', falling through to admin redirect");
            }

            Console.WriteLine($"[DiscordAuth] Issued admin JWT for account_id={account.playerid}, redirecting to /admin/home/v4");
            return Redirect("/admin/home/v4");
        }
    }
}