// Package system contains data-layer implementations for system runtime
// settings, authentication tokens, and bootstrap definitions.
package system

import (
	"errors"
	"time"

	"kra/internal/conf"
	"kra/internal/modules/system/biz"
	"kra/internal/modules/system/security/adminauth"

	jwt "github.com/golang-jwt/jwt/v5"
)

type runtimeSettings struct{ runtime *conf.Runtime }

func NewRuntimeSettings(runtime *conf.Runtime) biz.RuntimeSettings {
	return &runtimeSettings{runtime: runtime}
}

func (s *runtimeSettings) RouterPrefix() string {
	config := s.runtime.Admin()
	if config == nil {
		return ""
	}
	return config.RouterPrefix
}

func (s *runtimeSettings) JWTSettings() biz.JWTSettings {
	value := biz.JWTSettings{Issuer: "kra", Expires: 7 * 24 * time.Hour, Buffer: 24 * time.Hour}
	config := s.runtime.Admin()
	if config == nil || config.Jwt == nil {
		return value
	}
	value.SigningKey = config.Jwt.SigningKey
	if config.Jwt.Issuer != "" {
		value.Issuer = config.Jwt.Issuer
	}
	if config.Jwt.ExpiresTime != nil {
		value.Expires = config.Jwt.ExpiresTime.AsDuration()
	}
	if config.Jwt.BufferTime != nil {
		value.Buffer = config.Jwt.BufferTime.AsDuration()
	}
	return value
}

func (s *runtimeSettings) CaptchaSettings() biz.CaptchaSettings {
	value := biz.CaptchaSettings{KeyLong: 6, ImageWidth: 240, ImageHeight: 80, StoreExpiration: 3 * time.Minute}
	config := s.runtime.Admin()
	if config == nil || config.Captcha == nil {
		return value
	}
	if config.Captcha.KeyLong > 0 {
		value.KeyLong = int(config.Captcha.KeyLong)
	}
	if config.Captcha.ImgWidth > 0 {
		value.ImageWidth = int(config.Captcha.ImgWidth)
	}
	if config.Captcha.ImgHeight > 0 {
		value.ImageHeight = int(config.Captcha.ImgHeight)
	}
	if config.Captcha.StoreExpiration != nil {
		value.StoreExpiration = config.Captcha.StoreExpiration.AsDuration()
	}
	return value
}

func (s *runtimeSettings) MediaSettings() biz.MediaSettings {
	config := s.runtime.Admin()
	if config == nil || config.Media == nil {
		return biz.MediaSettings{}
	}
	return biz.MediaSettings{SessionTTL: int(config.Media.SessionTtl), MaxFileSize: config.Media.MaxFileSize, ChunkDir: config.Media.ChunkDir}
}

func (s *runtimeSettings) UseMultipoint() bool {
	config := s.runtime.Admin()
	return config != nil && config.System != nil && config.System.UseMultipoint
}

type tokenIssuer struct{ settings biz.RuntimeSettings }

func NewTokenIssuer(settings biz.RuntimeSettings) biz.TokenIssuer {
	return &tokenIssuer{settings: settings}
}

func (i *tokenIssuer) IssueToken(user *biz.User, authorityID uint, mustChangePassword bool, expires time.Duration) (*biz.IssuedToken, error) {
	settings := i.settings.JWTSettings()
	if expires <= 0 {
		expires = settings.Expires
	}
	passwordVersion := int64(0)
	if user.PasswordUpdatedAt != nil {
		passwordVersion = user.PasswordUpdatedAt.UnixNano()
	}
	token, claims, err := adminauth.Generate(settings.SigningKey, settings.Issuer, expires, settings.Buffer, user.ID, authorityID, user.UUID, user.Username, user.NickName, mustChangePassword, passwordVersion)
	if err != nil {
		return nil, err
	}
	return &biz.IssuedToken{Value: token, ExpiresAt: claims.ExpiresAt.Time, TTL: expires}, nil
}

func (i *tokenIssuer) ReissueToken(source *biz.AuthClaims, authorityID uint) (*biz.IssuedToken, error) {
	if source == nil {
		return nil, errors.New("nil JWT claims")
	}
	settings := i.settings.JWTSettings()
	claims := &adminauth.Claims{
		UUID: source.UUID, ID: source.ID, Username: source.Username, NickName: source.NickName,
		AuthorityID: authorityID, BufferTime: int64(source.BufferTime / time.Second), UserType: source.UserType,
		MustChangePwd: source.MustChangePwd, PasswordVersion: source.PasswordVersion,
		RegisteredClaims: jwt.RegisteredClaims{
			Audience: jwt.ClaimStrings(append([]string(nil), source.Audience...)), Issuer: source.Issuer,
			IssuedAt: jwt.NewNumericDate(source.IssuedAt), NotBefore: jwt.NewNumericDate(source.NotBefore), ExpiresAt: jwt.NewNumericDate(source.ExpiresAt),
		},
	}
	token, err := adminauth.Sign(settings.SigningKey, claims)
	if err != nil {
		return nil, err
	}
	return &biz.IssuedToken{Value: token, ExpiresAt: source.ExpiresAt, TTL: time.Until(source.ExpiresAt)}, nil
}

func (i *tokenIssuer) ParseToken(token string) (*biz.AuthClaims, error) {
	claims, err := adminauth.Parse(token, i.settings.JWTSettings().SigningKey)
	if err != nil {
		switch {
		case errors.Is(err, adminauth.ErrTokenExpired):
			return nil, biz.ErrTokenExpired
		case errors.Is(err, adminauth.ErrTokenMalformed):
			return nil, biz.ErrTokenMalformed
		case errors.Is(err, adminauth.ErrTokenSignatureInvalid):
			return nil, biz.ErrTokenSignatureInvalid
		case errors.Is(err, adminauth.ErrTokenNotValidYet):
			return nil, biz.ErrTokenNotValidYet
		default:
			return nil, biz.ErrTokenInvalid
		}
	}
	audience := append([]string(nil), claims.Audience...)
	issuedAt := time.Time{}
	if claims.IssuedAt != nil {
		issuedAt = claims.IssuedAt.Time
	}
	return &biz.AuthClaims{UUID: claims.UUID, ID: claims.ID, Username: claims.Username, NickName: claims.NickName, AuthorityID: claims.AuthorityID, UserType: claims.UserType, BufferTime: time.Duration(claims.BufferTime) * time.Second, MustChangePwd: claims.MustChangePwd, PasswordVersion: claims.PasswordVersion, Issuer: claims.Issuer, Audience: audience, IssuedAt: issuedAt, NotBefore: claims.NotBefore.Time, ExpiresAt: claims.ExpiresAt.Time}, nil
}