//! 认证路由 — 登录/登出/当前用户信息
//!
//! - GET  /api/auth/challenge     — 获取登录 challenge（防暴力破解）
//! - POST /api/auth/login         — 手机号+密码登录，返回 JWT token
//! - POST /api/auth/logout        — 登出（客户端清除 token 即可，服务端无状态）
//! - GET  /api/auth/me            — 获取当前登录用户信息及权限码
//! - POST /api/auth/wx-login      — 微信小程序手机号快速登录
//! - PUT  /api/auth/avatar        — 更新用户头像 URL

use axum::extract::{Multipart, State};
use axum::Json;
use serde::Deserialize;
use serde_json::{json, Value};
use std::io::Write;
use uuid::Uuid;

const AVATAR_DIR: &str = "uploads/avatars";
use reqwest::Client;

use crate::captcha;
use crate::commands::AppState;
use crate::error::AppError;
use crate::middleware::auth::{self, CurrentUser};

/// 登录请求体
#[derive(Debug, Deserialize)]
pub(crate) struct LoginInput {
    phone: String,
    password: String,
    /// 登录 challenge token，从 GET /api/auth/challenge 获取
    #[serde(default)]
    challenge_id: String,
    /// 滑块验证码偏移量（前端拖拽拼图后获得）
    #[serde(default)]
    captcha_x: Option<i32>,
}

/// GET /api/auth/challenge — 获取登录滑块验证码
///
/// 返回背景图（带缺口）和拼图块图，前端拖动对齐后提交偏移量。
pub async fn get_challenge(
    State(state): State<AppState>,
) -> Result<Json<Value>, AppError> {
    let data = captcha::create_challenge(&state.redis_url).await?;

    tracing::debug!("[challenge] 生成 cid={}", data.challenge_id);
    Ok(Json(json!({
        "code": 0,
        "data": {
            "challenge_id": data.challenge_id,
            "bg_image": data.bg_image,
            "piece_image": data.piece_image,
        },
        "message": "ok"
    })))
}

/// POST /api/auth/login — 用户登录
pub async fn login(
    State(state): State<AppState>,
    Json(input): Json<LoginInput>,
) -> Result<Json<Value>, AppError> {
    let pool = &state.mysql;

    if input.phone.is_empty() || input.password.is_empty() {
        return Err(AppError::BadRequest("手机号和密码不能为空".into()));
    }

    // 校验滑块验证码（防暴力破解 + 人机验证）
    if input.challenge_id.is_empty() {
        return Err(AppError::BadRequest("缺少登录验证参数".into()));
    }
    let captcha_x = input.captcha_x.unwrap_or(i32::MAX);
    let valid = captcha::verify_offset(&state.redis_url, &input.challenge_id, captcha_x).await?;
    if !valid {
        return Err(AppError::BadRequest("验证码错误，请刷新页面重试".into()));
    }

    // 查询用户（含角色和组织信息）
    let user_row: Option<(i64, Option<String>, String, String, i32, i32, Option<i64>)> = sqlx::query_as(
        "SELECT id, name, phone, password, status, role, organization_id FROM users WHERE phone = ?",
    )
    .bind(&input.phone)
    .fetch_optional(pool)
    .await?;

    let (id, name, phone, stored_password, status, role_level, organization_id) =
        user_row.ok_or_else(|| AppError::Unauthorized("手机号或密码错误".into()))?;

    // 检查账户状态
    if status == 0 {
        return Err(AppError::Forbidden("账户已被禁用".into()));
    }

    // 密码校验（argon2 哈希比对）
    let valid = auth::verify_password(&input.password, &stored_password)
        .map_err(|_| AppError::Internal("密码验证失败".into()))?;
    if !valid {
        return Err(AppError::Unauthorized("手机号或密码错误".into()));
    }

    // 生成 JWT token
    let token = auth::generate_token(id, &phone, &state.jwt_secret)?;

    // 查询用户权限码
    let permissions = auth::load_user_permissions(pool, id).await?;
    let perm_list: Vec<String> = permissions.into_iter().collect();

    Ok(Json(json!({
        "code": 0,
        "data": {
            "token": token,
            "user": {
                "id": id,
                "name": name,
                "phone": phone,
                "role_level": role_level,
                "organization_id": organization_id,
                "permissions": perm_list,
            }
        },
        "message": "登录成功"
    })))
}

/// POST /api/auth/logout — 用户登出
pub async fn logout() -> Json<Value> {
    // JWT 无状态，客户端清除 token 即可
    Json(json!({ "code": 0, "data": null, "message": "登出成功" }))
}

/// GET /api/auth/me — 获取当前用户信息及权限
#[allow(clippy::type_complexity)]
pub async fn me(
    user: CurrentUser,
    State(state): State<AppState>,
) -> Result<Json<Value>, AppError> {
    let pool = &state.mysql;
    // 查询用户详细信息
    let row: Option<(i64, Option<String>, String, i32, Option<i64>, Option<String>)> = sqlx::query_as(
        "SELECT id, name, phone, role, organization_id, avatar FROM users WHERE id = ?"
    )
    .bind(user.user_id)
    .fetch_optional(pool)
    .await?;

    let (id, name, phone, role, org_id, avatar) =
        row.ok_or_else(|| AppError::NotFound("用户不存在".into()))?;

    let perm_list: Vec<String> = user.permissions.into_iter().collect();

    Ok(Json(json!({
        "code": 0,
        "data": {
            "id": id,
            "name": name,
            "phone": phone,
            "role": role,
            "organization_id": org_id,
            "avatar": avatar,
            "permissions": perm_list,
        },
        "message": "ok"
    })))
}

/// 微信扫码登录请求体
#[derive(Debug, Deserialize)]
pub struct WxLoginInput {
    /// wx.login() 获取的临时 code
    pub code: String,
    /// getPhoneNumber 获取的 phone code
    pub phone_code: String,
}

/// 微信 jscode2session 响应
///
/// 字段与微信开放平台返回体一一对齐（当前仅读取 openid/errmsg，其余为预留能力，
/// 见各字段注释），故整体允许 dead_code，避免误删上游协议字段。
#[derive(Debug, Deserialize)]
#[allow(dead_code)]
struct JsCode2SessionResp {
    #[serde(default)]
    openid: Option<String>,
    /// 会话密钥：预留给敏感数据解密（如 encryptedData/水印校验），当前登录流程不需要
    #[serde(default)]
    session_key: Option<String>,
    /// 微信错误码：预留用于后续按错误码细分排障（当前仅用 errmsg 文案）
    #[serde(default)]
    errcode: Option<i64>,
    #[serde(default)]
    errmsg: Option<String>,
}

/// 微信 access_token 响应
///
/// 字段与微信开放平台返回体一一对齐（当前仅读取 access_token/errmsg，其余为预留能力），
/// 故整体允许 dead_code。
#[derive(Debug, Deserialize)]
#[allow(dead_code)]
struct TokenResp {
    #[serde(default)]
    access_token: Option<String>,
    /// 有效期秒数：预留用于 access_token 本地缓存（当前每次登录都重新获取）
    #[serde(default)]
    expires_in: Option<i64>,
    /// 微信错误码：预留用于后续按错误码细分排障
    #[serde(default)]
    errcode: Option<i64>,
    #[serde(default)]
    errmsg: Option<String>,
}

/// 微信 getuserphonenumber 响应
///
/// 字段与微信开放平台返回体一一对齐（当前仅读取 phone_info/errmsg），故整体允许 dead_code。
#[derive(Debug, Deserialize)]
#[allow(dead_code)]
struct PhoneNumberResp {
    /// 微信错误码：预留用于后续按错误码细分排障
    #[serde(default)]
    errcode: Option<i64>,
    #[serde(default)]
    errmsg: Option<String>,
    #[serde(default)]
    phone_info: Option<PhoneInfo>,
}

/// 微信手机号信息
///
/// 当前业务用 pure_phone_number 匹配用户；带国码的 phone_number 与 country_code
/// 预留用于国际号段/归属地展示，故整体允许 dead_code。
#[derive(Debug, Deserialize)]
#[serde(rename_all = "camelCase")]
#[allow(dead_code)]
struct PhoneInfo {
    /// 带国码手机号（如 8613951516272），预留国际号段场景
    #[serde(default)]
    phone_number: String,
    #[serde(default)]
    pure_phone_number: String,
    /// 国家码（如 86），预留号段归属展示
    #[serde(default)]
    country_code: String,
}

/// 读取微信小程序凭证（环境变量缺失则报内部错误）
fn wechat_credentials() -> Result<(String, String), AppError> {
    let appid = std::env::var("WECHAT_APPID")
        .map_err(|_| AppError::Internal("WECHAT_APPID 未配置".into()))?;
    let secret = std::env::var("WECHAT_APPSECRET")
        .map_err(|_| AppError::Internal("WECHAT_APPSECRET 未配置".into()))?;
    Ok((appid, secret))
}

/// 用 wx.login() 的 code 换取 openid
async fn fetch_openid(client: &Client, appid: &str, secret: &str, code: &str) -> Result<String, AppError> {
    let jscode_url = format!(
        "https://api.weixin.qq.com/sns/jscode2session?appid={}&secret={}&js_code={}&grant_type=authorization_code",
        appid, secret, code
    );
    let js_resp: JsCode2SessionResp = client.get(&jscode_url).send().await
        .map_err(|e| AppError::Internal(format!("jscode2session 请求失败: {}", e)))?
        .json().await
        .map_err(|e| AppError::Internal(format!("jscode2session 解析失败: {}", e)))?;

    js_resp.openid.ok_or_else(|| {
        let err = js_resp.errmsg.unwrap_or_default();
        AppError::Internal(format!("jscode2session 失败: {}", err))
    })
}

/// 获取微信接口调用凭证 access_token
async fn fetch_access_token(client: &Client, appid: &str, secret: &str) -> Result<String, AppError> {
    let token_url = format!(
        "https://api.weixin.qq.com/cgi-bin/token?appid={}&secret={}&grant_type=client_credential",
        appid, secret
    );
    let token_resp: TokenResp = client.get(&token_url).send().await
        .map_err(|e| AppError::Internal(format!("token 请求失败: {}", e)))?
        .json().await
        .map_err(|e| AppError::Internal(format!("token 解析失败: {}", e)))?;

    token_resp.access_token.ok_or_else(|| {
        let err = token_resp.errmsg.unwrap_or_default();
        AppError::Internal(format!("获取 access_token 失败: {}", err))
    })
}

/// 用 phone_code 换取微信绑定的手机号
async fn fetch_phone_number(
    client: &Client,
    access_token: &str,
    phone_code: &str,
) -> Result<String, AppError> {
    let phone_url = format!(
        "https://api.weixin.qq.com/wxa/business/getuserphonenumber?access_token={}",
        access_token
    );
    let phone_resp: PhoneNumberResp = client.post(&phone_url)
        .json(&json!({ "code": phone_code }))
        .send().await
        .map_err(|e| AppError::Internal(format!("getuserphonenumber 请求失败: {}", e)))?
        .json().await
        .map_err(|e| AppError::Internal(format!("getuserphonenumber 解析失败: {}", e)))?;

    let phone = phone_resp.phone_info
        .ok_or_else(|| {
            let err = phone_resp.errmsg.unwrap_or_default();
            AppError::Internal(format!("获取手机号失败: {}", err))
        })?;
    Ok(phone.pure_phone_number)
}

/// 按手机号查找用户（手机号是唯一标识）
async fn find_user_by_phone(
    pool: &sqlx::MySqlPool,
    phone_number: &str,
) -> Result<(i64, Option<String>, String, i32, i32, Option<i64>), AppError> {
    let user_row = sqlx::query_as::<_, (i64, Option<String>, String, i32, i32, Option<i64>)>(
        "SELECT id, name, phone, status, role, organization_id FROM users WHERE phone = ?",
    )
    .bind(phone_number)
    .fetch_optional(pool)
    .await?;

    user_row.ok_or_else(|| {
        tracing::warn!(phone_number = %phone_number, "微信登录: 手机号未匹配到用户");
        AppError::Unauthorized("用户不存在，请联系管理员添加".into())
    })
}

/// POST /api/auth/wx-login — 微信小程序手机号快速登录
///
/// 前端先调用 wx.login() 获取 code，再通过 getPhoneNumber 获取 phone_code，
/// 后端向微信服务器换取 openid 和手机号，匹配用户后签发 JWT。
pub async fn wx_login(
    State(state): State<AppState>,
    Json(input): Json<WxLoginInput>,
) -> Result<Json<Value>, AppError> {
    let (appid, secret) = wechat_credentials()?;
    let client = Client::new();

    // 1. 用 code 换取 openid
    let openid = fetch_openid(&client, &appid, &secret, &input.code).await?;

    // 2. 获取 access_token
    let access_token = fetch_access_token(&client, &appid, &secret).await?;

    // 3. 用 phone_code 换取手机号
    let phone_number = fetch_phone_number(&client, &access_token, &input.phone_code).await?;

    // 4. 按手机号查找用户（手机号是唯一标识）
    tracing::info!(phone_number = %phone_number, "微信登录: 获取到手机号，开始匹配用户");
    let (id, name, _phone, status, role_level, organization_id) =
        find_user_by_phone(&state.mysql, &phone_number).await?;

    // 5. 存 openid（供后续微信接口调用，如订阅消息/获取用户信息）
    sqlx::query("UPDATE users SET openid = ? WHERE id = ?")
        .bind(&openid)
        .bind(id)
        .execute(&state.mysql)
        .await?;

    if status == 0 {
        return Err(AppError::Forbidden("账户已被禁用".into()));
    }

    let token = auth::generate_token(id, &_phone, &state.jwt_secret)?;
    let permissions = auth::load_user_permissions(&state.mysql, id).await?;
    let perm_list: Vec<String> = permissions.into_iter().collect();

    Ok(Json(json!({
        "code": 0,
        "data": {
            "token": token,
            "user": {
                "id": id,
                "name": name,
                "phone": _phone,
                "role_level": role_level,
                "organization_id": organization_id,
                "permissions": perm_list,
            }
        },
        "message": "登录成功"
    })))
}

/// 微信头像更新请求体
#[derive(Debug, Deserialize)]
pub struct AvatarInput {
    pub avatar: String,
}

/// PUT /api/auth/avatar — 更新当前用户头像 URL
pub async fn update_avatar(
    user: CurrentUser,
    State(state): State<AppState>,
    Json(input): Json<AvatarInput>,
) -> Result<Json<Value>, AppError> {
    sqlx::query("UPDATE users SET avatar = ? WHERE id = ?")
        .bind(&input.avatar)
        .bind(user.user_id)
        .execute(&state.mysql)
        .await?;

    Ok(Json(json!({ "code": 0, "data": { "avatar": input.avatar }, "message": "ok" })))
}

/// GET /api/auth/avatar/upload — 头像文件上传
pub async fn upload_avatar(
    user: CurrentUser,
    State(state): State<AppState>,
    mut multipart: Multipart,
) -> Result<Json<Value>, AppError> {
    let mut file_data: Option<Vec<u8>> = None;
    let mut ext = "".to_string();

    while let Some(field) = multipart.next_field().await
        .map_err(|e| AppError::Internal(format!("解析上传文件失败: {}", e)))? {
        let filename = field.file_name().unwrap_or("").to_string();
        let data = field.bytes().await
            .map_err(|e| AppError::Internal(format!("读取文件失败: {}", e)))?;

        // 提取扩展名
        if let Some(pos) = filename.rfind('.') {
            ext = filename[pos..].to_string();
        }
        file_data = Some(data.to_vec());
    }

    let data = file_data.ok_or_else(|| AppError::BadRequest("上传内容为空".into()))?;
    if data.is_empty() {
        return Err(AppError::BadRequest("上传内容为空".into()));
    }

    // 限制大小（2MB）
    if data.len() > 2 * 1024 * 1024 {
        return Err(AppError::BadRequest("头像文件不能超过 2MB".into()));
    }

    // 白名单扩展名
    if ext.is_empty() {
        ext = ".jpg".to_string();
    }
    let allowed = [".jpg", ".jpeg", ".png", ".gif", ".webp", ".svg"];
    if !allowed.contains(&ext.as_str()) {
        ext = ".jpg".to_string();
    }

    // 保存文件
    let dir = std::path::Path::new(AVATAR_DIR);
    std::fs::create_dir_all(dir)
        .map_err(|e| AppError::Internal(format!("创建目录失败: {}", e)))?;

    let filename = format!("{}{}", Uuid::new_v4().simple(), ext);
    let filepath = dir.join(&filename);
    let mut f = std::fs::File::create(&filepath)
        .map_err(|e| AppError::Internal(format!("创建文件失败: {}", e)))?;
    f.write_all(&data)
        .map_err(|e| AppError::Internal(format!("写入文件失败: {}", e)))?;

    // 更新用户头像
    let avatar_url = format!("/uploads/avatars/{}", filename);
    sqlx::query("UPDATE users SET avatar = ? WHERE id = ?")
        .bind(&avatar_url)
        .bind(user.user_id)
        .execute(&state.mysql)
        .await?;

    tracing::info!(user_id = user.user_id, path = %avatar_url, "头像上传成功");

    Ok(Json(json!({
        "code": 0,
        "data": { "avatar": avatar_url },
        "message": "ok"
    })))
}