use chrono::{DateTime, Utc};
use mongodb::bson::oid::ObjectId;
use serde::{Deserialize, Serialize};
use std::collections::HashMap;

// ---------------------------------------------------------------------------
// Role & capability enums
// ---------------------------------------------------------------------------

/// App-scoped role assigned via membership. Ordered by ascending privilege so
/// that comparison operators express "at least this role" checks.
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum Role {
    User = 0,
    Reviewer = 1,
    ConfigManager = 2,
    AppAdmin = 3,
}

impl Role {
    /// Returns true when `self` is equal to or higher than `required`.
    pub fn satisfies(&self, required: Role) -> bool {
        *self >= required
    }
}

impl std::fmt::Display for Role {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Role::User => write!(f, "user"),
            Role::Reviewer => write!(f, "reviewer"),
            Role::ConfigManager => write!(f, "config_manager"),
            Role::AppAdmin => write!(f, "app_admin"),
        }
    }
}

/// Every guarded operation in the system. Handlers call
/// `auth_user.require_capability(app_id, Capability::X)?` before proceeding.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub enum Capability {
    /// Read app/repo metadata, list workspaces, view changesets, etc.
    ReadApp,
    /// Create or edit the caller's own workspace.
    EditOwnWorkspace,
    /// Create or modify the caller's own changeset.
    EditOwnChangeset,
    /// Submit a changeset for review.
    SubmitChangeset,
    /// Post a comment on a changeset review thread.
    CommentInReview,
    /// Approve, request changes, or reject a changeset.
    ReviewChangeset,
    /// Move any user's conflicted/needs_revalidation changeset back to draft.
    MoveToDraftAny,
    /// Move only the caller's own conflicted/needs_revalidation changeset to
    /// draft (User and Reviewer get this, not MoveToDraftAny).
    MoveToDraftOwn,
    /// Assemble a release from the queue.
    AssembleRelease,
    /// Publish a release (tag + update integration branch).
    PublishRelease,
    /// Deploy or promote a release to an environment.
    DeployRelease,
    /// Approve a skip-stage or concurrent multi-env deployment.
    ApproveSkipStage,
    /// Invite new users to the app.
    InviteUsers,
    /// Manage app settings, roles, and environment metadata.
    ManageApp,
}

impl Capability {
    /// Minimum role required to exercise this capability.
    pub fn min_role(&self) -> Role {
        match self {
            Capability::ReadApp
            | Capability::EditOwnWorkspace
            | Capability::EditOwnChangeset
            | Capability::SubmitChangeset
            | Capability::CommentInReview
            | Capability::MoveToDraftOwn => Role::User,

            Capability::ReviewChangeset
            | Capability::ApproveSkipStage => Role::Reviewer,

            Capability::MoveToDraftAny
            | Capability::AssembleRelease
            | Capability::PublishRelease
            | Capability::DeployRelease => Role::ConfigManager,

            Capability::InviteUsers
            | Capability::ManageApp => Role::AppAdmin,
        }
    }
}

// ---------------------------------------------------------------------------
// User
// ---------------------------------------------------------------------------

/// Stored in the `users` MongoDB collection. Password hash is never sent over
/// the API; the corresponding API response type omits it.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct User {
    #[serde(rename = "_id")]
    pub id: ObjectId,
    pub email: String,
    /// Argon2id hash. Never exposed outside conman-auth.
    pub password_hash: String,
    pub name: String,
    pub created_at: DateTime<Utc>,
    pub updated_at: DateTime<Utc>,
}

// ---------------------------------------------------------------------------
// App membership
// ---------------------------------------------------------------------------

/// One record per (user, app) pair. Stored in `app_memberships`.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AppMembership {
    #[serde(rename = "_id")]
    pub id: ObjectId,
    pub user_id: ObjectId,
    pub app_id: ObjectId,
    pub role: Role,
    pub created_at: DateTime<Utc>,
}

// ---------------------------------------------------------------------------
// Invite
// ---------------------------------------------------------------------------

/// Pending or accepted invitation. Stored in `invites`.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Invite {
    #[serde(rename = "_id")]
    pub id: ObjectId,
    pub app_id: ObjectId,
    /// Email of the person being invited.
    pub email: String,
    /// Role granted upon acceptance.
    pub role: Role,
    /// Opaque URL-safe token (base64url-encoded 32 random bytes).
    pub token: String,
    /// User ID of the admin who created this invite.
    pub invited_by: ObjectId,
    pub expires_at: DateTime<Utc>,
    /// Set when the invite is accepted; None while pending.
    pub accepted_at: Option<DateTime<Utc>>,
    pub created_at: DateTime<Utc>,
}

// ---------------------------------------------------------------------------
// Password reset token
// ---------------------------------------------------------------------------

/// Stored in `password_reset_tokens`. Short-lived, single-use.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PasswordResetToken {
    #[serde(rename = "_id")]
    pub id: ObjectId,
    pub user_id: ObjectId,
    /// Opaque URL-safe token (base64url-encoded 32 random bytes).
    pub token: String,
    pub expires_at: DateTime<Utc>,
    /// Set when the token is consumed; None while unused.
    pub used_at: Option<DateTime<Utc>>,
    pub created_at: DateTime<Utc>,
}

use chrono::{DateTime, Utc};
use mongodb::bson::oid::ObjectId;
use serde::{Deserialize, Serialize};
use std::collections::HashMap;

use conman_core::{Capability, ConmanError, Role};

// ---------------------------------------------------------------------------
// JWT claims
// ---------------------------------------------------------------------------

/// Payload encoded in the JWT. Kept minimal — memberships are loaded from
/// the database on each request so that role changes take effect immediately.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Claims {
    /// Subject: user ID as hex string.
    pub sub: String,
    /// User email (convenience; not used for authz).
    pub email: String,
    /// Issued-at (seconds since epoch).
    pub iat: i64,
    /// Expiration (seconds since epoch).
    pub exp: i64,
}

// ---------------------------------------------------------------------------
// AuthUser (request-scoped, populated by middleware)
// ---------------------------------------------------------------------------

/// Extracted from the JWT and enriched with live membership data. Stored in
/// Axum request extensions so handlers can access it via
/// `Extension<AuthUser>`.
#[derive(Debug, Clone)]
pub struct AuthUser {
    pub user_id: ObjectId,
    pub email: String,
    /// Mapping of app_id -> role for every app this user is a member of.
    /// Loaded from `app_memberships` on every request.
    pub roles: HashMap<ObjectId, Role>,
}

impl AuthUser {
    /// Require the user to have at least `required` role for the given app.
    /// Returns `ConmanError::Forbidden` on failure.
    pub fn require_role(&self, app_id: &ObjectId, required: Role) -> Result<(), ConmanError> {
        match self.roles.get(app_id) {
            Some(role) if role.satisfies(required) => Ok(()),
            _ => Err(ConmanError::Forbidden {
                message: format!(
                    "requires role {} on app {}",
                    required,
                    app_id.to_hex()
                ),
            }),
        }
    }

    /// Require the user to have a capability for the given app. Uses the
    /// capability's `min_role()` to determine the threshold.
    pub fn require_capability(
        &self,
        app_id: &ObjectId,
        capability: Capability,
    ) -> Result<(), ConmanError> {
        self.require_role(app_id, capability.min_role())
    }

    /// Returns the user's role for an app, if any.
    pub fn role_for(&self, app_id: &ObjectId) -> Option<Role> {
        self.roles.get(app_id).copied()
    }
}

// ---------------------------------------------------------------------------
// Password policy
// ---------------------------------------------------------------------------

/// Minimum password requirements enforced on registration and reset.
pub struct PasswordPolicy;

impl PasswordPolicy {
    pub const MIN_LENGTH: usize = 8;
    pub const MAX_LENGTH: usize = 128;

    /// Validate a plaintext password against the policy. Returns a
    /// human-readable error message on failure.
    pub fn validate(password: &str) -> Result<(), ConmanError> {
        if password.len() < Self::MIN_LENGTH {
            return Err(ConmanError::Validation {
                message: format!(
                    "password must be at least {} characters",
                    Self::MIN_LENGTH
                ),
            });
        }
        if password.len() > Self::MAX_LENGTH {
            return Err(ConmanError::Validation {
                message: format!(
                    "password must be at most {} characters",
                    Self::MAX_LENGTH
                ),
            });
        }
        Ok(())
    }
}

use mongodb::bson::oid::ObjectId;
use serde::{Deserialize, Serialize};

use conman_core::Role;

// ---------------------------------------------------------------------------
// Auth endpoints
// ---------------------------------------------------------------------------

#[derive(Debug, Deserialize)]
pub struct LoginRequest {
    pub email: String,
    pub password: String,
}

#[derive(Debug, Serialize)]
pub struct LoginResponse {
    pub token: String,
    pub user: UserSummary,
}

#[derive(Debug, Serialize)]
pub struct UserSummary {
    pub id: String,
    pub email: String,
    pub name: String,
}

#[derive(Debug, Deserialize)]
pub struct ForgotPasswordRequest {
    pub email: String,
}

#[derive(Debug, Deserialize)]
pub struct ResetPasswordRequest {
    pub token: String,
    pub new_password: String,
}

// ---------------------------------------------------------------------------
// Invite endpoints
// ---------------------------------------------------------------------------

#[derive(Debug, Deserialize)]
pub struct InviteRequest {
    pub email: String,
    pub role: Role,
}

#[derive(Debug, Serialize)]
pub struct InviteResponse {
    pub id: String,
    pub app_id: String,
    pub email: String,
    pub role: Role,
    pub expires_at: String,
    pub created_at: String,
}

#[derive(Debug, Deserialize)]
pub struct AcceptInviteRequest {
    pub token: String,
    pub name: String,
    pub password: String,
}

#[derive(Debug, Serialize)]
pub struct AcceptInviteResponse {
    pub token: String,
    pub user: UserSummary,
}

// ---------------------------------------------------------------------------
// Membership endpoints
// ---------------------------------------------------------------------------

#[derive(Debug, Serialize)]
pub struct MemberResponse {
    pub user_id: String,
    pub email: String,
    pub name: String,
    pub role: Role,
    pub joined_at: String,
}

// ---------------------------------------------------------------------------
// Notification preferences
// ---------------------------------------------------------------------------

#[derive(Debug, Serialize, Deserialize)]
pub struct NotificationPreferences {
    pub email_enabled: bool,
}

// Unique email for login lookups and duplicate prevention
{ "email": 1 }  // unique: true

{
  "_id": { "$oid": "665a1b2c3d4e5f6a7b8c9d0e" },
  "email": "alice@example.com",
  "password_hash": "$argon2id$v=19$m=19456,t=2,p=1$...",
  "name": "Alice Chen",
  "created_at": { "$date": "2025-06-01T10:00:00Z" },
  "updated_at": { "$date": "2025-06-01T10:00:00Z" }
}

// Unique pair: one role per user per app
{ "user_id": 1, "app_id": 1 }  // unique: true

// List all members of an app (used by GET /api/apps/:appId/members)
{ "app_id": 1 }

// Load all memberships for a user (used by auth middleware on every request)
{ "user_id": 1 }

{
  "_id": { "$oid": "665a1c0000000000000000a1" },
  "user_id": { "$oid": "665a1b2c3d4e5f6a7b8c9d0e" },
  "app_id": { "$oid": "665a1a0000000000000000b1" },
  "role": "config_manager",
  "created_at": { "$date": "2025-06-01T10:05:00Z" }
}

// Token lookup for accept-invite endpoint
{ "token": 1 }  // unique: true

// List pending invites for an app
{ "app_id": 1, "accepted_at": 1 }

// Prevent duplicate pending invites to the same email for the same app
{ "app_id": 1, "email": 1, "accepted_at": 1 }  // unique: true, partialFilterExpression: { "accepted_at": null }

{
  "_id": { "$oid": "665a1d0000000000000000c1" },
  "app_id": { "$oid": "665a1a0000000000000000b1" },
  "email": "bob@example.com",
  "role": "reviewer",
  "token": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2",
  "invited_by": { "$oid": "665a1b2c3d4e5f6a7b8c9d0e" },
  "expires_at": { "$date": "2025-06-08T10:00:00Z" },
  "accepted_at": null,
  "created_at": { "$date": "2025-06-01T10:00:00Z" }
}

// Token lookup for reset-password endpoint
{ "token": 1 }  // unique: true

// TTL index: automatically delete expired+used tokens after 24 hours
// Keeps the collection small without manual cleanup
{ "expires_at": 1 }  // expireAfterSeconds: 86400

{
  "_id": { "$oid": "665a1e0000000000000000d1" },
  "user_id": { "$oid": "665a1b2c3d4e5f6a7b8c9d0e" },
  "token": "x9y8z7w6v5u4t3s2r1q0p9o8n7m6l5k4j3i2h1g0f9e8",
  "expires_at": { "$date": "2025-06-01T11:00:00Z" },
  "used_at": null,
  "created_at": { "$date": "2025-06-01T10:00:00Z" }
}

// One preference document per user
{ "user_id": 1 }  // unique: true

{
  "_id": { "$oid": "665a1f0000000000000000e1" },
  "user_id": { "$oid": "665a1b2c3d4e5f6a7b8c9d0e" },
  "email_enabled": true,
  "updated_at": { "$date": "2025-06-01T10:00:00Z" }
}

{
  "email": "alice@example.com",
  "password": "s3cure-password"
}

{
  "data": {
    "token": "eyJhbGciOi...",
    "user": {
      "id": "665a1b2c3d4e5f6a7b8c9d0e",
      "email": "alice@example.com",
      "name": "Alice Chen"
    }
  }
}

{
  "data": { "message": "logged out" }
}

{
  "email": "alice@example.com"
}

{
  "data": { "message": "if an account exists, a reset email has been sent" }
}

{
  "token": "x9y8z7w6v5u4t3s2r1q0...",
  "new_password": "n3w-s3cure-password"
}

{
  "data": { "message": "password updated" }
}

{
  "token": "a1b2c3d4e5f6g7h8...",
  "name": "Bob Smith",
  "password": "b0b-s3cure-password"
}

{
  "data": {
    "token": "eyJhbGciOi...",
    "user": {
      "id": "665a1b2c000000000000f001",
      "email": "bob@example.com",
      "name": "Bob Smith"
    }
  }
}

{
  "data": [
    {
      "user_id": "665a1b2c3d4e5f6a7b8c9d0e",
      "email": "alice@example.com",
      "name": "Alice Chen",
      "role": "app_admin",
      "joined_at": "2025-06-01T10:05:00Z"
    }
  ],
  "pagination": { "page": 1, "limit": 20, "total": 3 }
}

{
  "email": "carol@example.com",
  "role": "reviewer"
}

{
  "data": {
    "id": "665a1d0000000000000000c2",
    "app_id": "665a1a0000000000000000b1",
    "email": "carol@example.com",
    "role": "reviewer",
    "expires_at": "2025-06-08T10:00:00Z",
    "created_at": "2025-06-01T10:00:00Z"
  }
}

{
  "data": {
    "id": "665a1d0000000000000000c2",
    "app_id": "665a1a0000000000000000b1",
    "email": "carol@example.com",
    "role": "reviewer",
    "expires_at": "2025-06-08T12:30:00Z",
    "created_at": "2025-06-01T10:00:00Z"
  }
}

{
  "data": { "message": "invite revoked" }
}

{
  "data": {
    "email_enabled": true
  }
}

{
  "email_enabled": false
}

{
  "data": {
    "email_enabled": false
  }
}

use argon2::{
    password_hash::{rand_core::OsRng, PasswordHash, PasswordHasher, PasswordVerifier, SaltString},
    Argon2, Algorithm, Params, Version,
};

/// Build the Argon2id hasher with production cost parameters.
/// OWASP 2024 recommendation: m=19456 KiB (19 MiB), t=2, p=1.
fn build_argon2() -> Argon2<'static> {
    let params = Params::new(19456, 2, 1, None)
        .expect("valid argon2 params");
    Argon2::new(Algorithm::Argon2id, Version::V0x13, params)
}

/// Hash a plaintext password. Returns the PHC-format hash string.
pub fn hash_password(password: &str) -> Result<String, ConmanError> {
    let salt = SaltString::generate(&mut OsRng);
    let argon2 = build_argon2();
    let hash = argon2
        .hash_password(password.as_bytes(), &salt)
        .map_err(|e| ConmanError::Internal {
            message: format!("password hashing failed: {e}"),
        })?;
    Ok(hash.to_string())
}

/// Verify a plaintext password against a stored PHC-format hash.
pub fn verify_password(password: &str, hash: &str) -> Result<bool, ConmanError> {
    let parsed_hash = PasswordHash::new(hash).map_err(|e| ConmanError::Internal {
        message: format!("invalid stored password hash: {e}"),
    })?;
    let argon2 = build_argon2();
    Ok(argon2.verify_password(password.as_bytes(), &parsed_hash).is_ok())
}

use chrono::{Duration, Utc};
use jsonwebtoken::{decode, encode, DecodingKey, EncodingKey, Header, Validation};

pub struct JwtConfig {
    pub secret: String,
    pub expiry_hours: i64,
}

/// Issue a JWT for a successfully authenticated user.
pub fn issue_token(
    user_id: &ObjectId,
    email: &str,
    config: &JwtConfig,
) -> Result<String, ConmanError> {
    let now = Utc::now();
    let claims = Claims {
        sub: user_id.to_hex(),
        email: email.to_string(),
        iat: now.timestamp(),
        exp: (now + Duration::hours(config.expiry_hours)).timestamp(),
    };
    encode(
        &Header::default(),
        &claims,
        &EncodingKey::from_secret(config.secret.as_bytes()),
    )
    .map_err(|e| ConmanError::Internal {
        message: format!("JWT encoding failed: {e}"),
    })
}

/// Decode and validate a JWT. Returns the claims on success.
pub fn validate_token(token: &str, config: &JwtConfig) -> Result<Claims, ConmanError> {
    let token_data = decode::<Claims>(
        token,
        &DecodingKey::from_secret(config.secret.as_bytes()),
        &Validation::default(),
    )
    .map_err(|e| ConmanError::Forbidden {
        message: format!("invalid token: {e}"),
    })?;
    Ok(token_data.claims)
}

// In the move-to-draft handler:
let user_role = auth_user.role_for(&app_id);
let is_owner = changeset.author_user_id == auth_user.user_id;

match (user_role, is_owner) {
    // ConfigManager and above can move any changeset to draft
    (Some(role), _) if role.satisfies(Role::ConfigManager) => Ok(()),
    // User and Reviewer can only move their own
    (Some(_), true) => Ok(()),
    _ => Err(ConmanError::Forbidden {
        message: "only the author or a config_manager+ can move to draft".into(),
    }),
}

use axum::{
    extract::{Request, State},
    middleware::Next,
    response::Response,
};

/// Axum middleware that extracts and validates the JWT from the Authorization
/// header, loads the user's app memberships, and populates AuthUser in
/// request extensions.
pub async fn auth_middleware(
    State(state): State<AppState>,
    mut request: Request,
    next: Next,
) -> Result<Response, ConmanError> {
    // Extract the Bearer token from the Authorization header
    let token = request
        .headers()
        .get("authorization")
        .and_then(|v| v.to_str().ok())
        .and_then(|v| v.strip_prefix("Bearer "))
        .ok_or_else(|| ConmanError::Forbidden {
            message: "missing or malformed authorization header".into(),
        })?;

    // Validate the JWT and extract claims
    let claims = validate_token(token, &state.jwt_config)?;

    // Parse the user ID from the subject claim
    let user_id = ObjectId::parse_str(&claims.sub).map_err(|_| ConmanError::Forbidden {
        message: "invalid user ID in token".into(),
    })?;

    // Load all app memberships for this user from MongoDB
    let memberships = state
        .membership_repo
        .find_by_user_id(&user_id)
        .await
        .map_err(|e| ConmanError::Internal {
            message: format!("failed to load memberships: {e}"),
        })?;

    // Build the roles map: app_id -> role
    let roles: HashMap<ObjectId, Role> = memberships
        .into_iter()
        .map(|m| (m.app_id, m.role))
        .collect();

    // Populate the AuthUser in request extensions
    let auth_user = AuthUser {
        user_id,
        email: claims.email,
        roles,
    };
    request.extensions_mut().insert(auth_user);

    Ok(next.run(request).await)
}