package accountserviceimp

import (
	"context"
	"errors"
	"fmt"
	"slices"
	"time"
	"unicode"

	"git.sendico.io/tech/sxchnge/bff/edge/shared/interface/middleware"
	edgestorage "git.sendico.io/tech/sxchnge/bff/edge/shared/storage/mongo"
	"git.sendico.io/tech/sxchnge/bff/edge/shared/storage/organization"
	"git.sendico.io/tech/sxchnge/bff/edge/shared/storage/verification"
	"git.sendico.io/tech/sxchnge/bff/pkg/auth"
	"git.sendico.io/tech/sxchnge/bff/pkg/auth/management"
	"git.sendico.io/tech/sxchnge/bff/pkg/db"
	"git.sendico.io/tech/sxchnge/bff/pkg/db/account"
	"git.sendico.io/tech/sxchnge/bff/pkg/db/policy"
	"git.sendico.io/tech/sxchnge/bff/pkg/merrors"
	"git.sendico.io/tech/sxchnge/bff/pkg/mlogger"
	"git.sendico.io/tech/sxchnge/bff/pkg/model"
	"git.sendico.io/tech/sxchnge/bff/pkg/mutil/mzap"
	"go.mongodb.org/mongo-driver/v2/bson"
	"go.uber.org/zap"
)

type service struct {
	logger      mlogger.Logger
	accountDB   account.DB
	orgDB       organization.DB
	enforcer    auth.Enforcer
	roleManager management.Role
	config      *middleware.PasswordConfig

	policyDB policy.DB
	vdb      verification.DB
}

func validateUserRequest(u *model.Account) error {
	if u.Name == "" {
		return merrors.InvalidArgument("Name must not be empty")
	}
	if u.Login == "" {
		return merrors.InvalidArgument("Login must not be empty")
	}
	if u.Password == "" {
		return merrors.InvalidArgument("Password must not be empty")
	}
	return nil
}

func (s *service) ValidatePassword(
	password string,
	oldPassword *string,
) error {
	var hasDigit, hasUpper, hasLower, hasSpecial bool

	if oldPassword != nil {
		if *oldPassword == password {
			return merrors.InvalidArgument("New password cannot be the same as the old password")
		}
	}

	if len(password) < s.config.Check.MinLength {
		return merrors.InvalidArgument(fmt.Sprintf("Password must be at least %d characters long", s.config.Check.MinLength))
	}

	// Check for digit, uppercase, lowercase, and special character
	for _, char := range password {
		switch {
		case unicode.IsDigit(char):
			hasDigit = true
		case unicode.IsUpper(char):
			hasUpper = true
		case unicode.IsLower(char):
			hasLower = true
		case unicode.IsPunct(char) || unicode.IsSymbol(char):
			hasSpecial = true
		}
	}

	if s.config.Check.Digit && !hasDigit {
		return merrors.InvalidArgument("Password must contain at least one digit")
	}
	if s.config.Check.Upper && !hasUpper {
		return merrors.InvalidArgument("Password must contain at least one uppercase letter")
	}
	if s.config.Check.Lower && !hasLower {
		return merrors.InvalidArgument("Password must contain at least one lowercase letter")
	}
	if s.config.Check.Special && !hasSpecial {
		return merrors.InvalidArgument("Password must contain at least one special character")
	}

	// If all checks pass, return nil (no error)
	return nil
}

func (s *service) ValidateAccount(acct *model.Account) error {
	if err := validateUserRequest(acct); err != nil {
		s.logger.Warn("Invalid signup acccount received", zap.Error(err), zap.String("account", acct.Login))
		return err
	}

	if err := s.ValidatePassword(acct.Password, nil); err != nil {
		s.logger.Warn("Password validation failed", zap.Error(err), zap.String("account", acct.Login))
		return err
	}

	if err := acct.HashPassword(); err != nil {
		s.logger.Warn("Failed to hash password", zap.Error(err), zap.String("account", acct.Login))
		return err
	}

	return nil
}

func (s *service) CreateAccount(
	ctx context.Context,
	org *model.Organization,
	acct *model.Account,
	roleDescID bson.ObjectID,
) (string, error) {
	if org == nil {
		return "", merrors.InvalidArgument("Organization must not be nil")
	}
	if acct == nil || len(acct.Login) == 0 {
		return "", merrors.InvalidArgument("Account must have a non-empty login")
	}
	if roleDescID == bson.NilObjectID {
		return "", merrors.InvalidArgument("Role description must be provided")
	}

	// 1) Create the account
	acct.Status = model.AccountPendingVerification
	if err := s.accountDB.Create(ctx, acct); err != nil {
		if errors.Is(err, merrors.ErrDataConflict) {
			s.logger.Info("Username is already taken", zap.String("login", acct.Login))
		} else {
			s.logger.Warn("Failed to signup a user", zap.Error(err), zap.String("login", acct.Login))
		}
		return "", err
	}

	// 2) Add to organization
	if err := s.JoinOrganization(ctx, org, acct, roleDescID); err != nil {
		s.logger.Warn("Failed to register new organization member", zap.Error(err), mzap.StorableRef(acct))
		return "", err
	}

	// 3) Issue verification token
	return s.VerifyAccount(ctx, acct)
}

func (s *service) VerifyAccount(
	ctx context.Context,
	acct *model.Account,
) (string, error) {
	token, err := s.vdb.Create(
		ctx,
		verification.NewLinkRequest(*acct.GetID(), model.PurposeAccountActivation, "").
			WithTTL(time.Hour*24),
	)
	if err != nil {
		s.logger.Warn("Failed to create verification token for new account", zap.Error(err), mzap.StorableRef(acct))
		return "", err
	}

	return token, nil

}

func (s *service) DeleteAccount(
	ctx context.Context,
	org *model.Organization,
	accountRef bson.ObjectID,
) error {
	// Check if this is the only member in the organization
	if len(org.Members) <= 1 {
		s.logger.Warn("Cannot delete account - it's the only member in the organization",
			mzap.AccRef(accountRef), mzap.StorableRef(org))
		return merrors.InvalidArgument("Cannot delete the only member of an organization")
	}

	// 1) Remove from organization
	if err := s.RemoveAccountFromOrganization(ctx, org, accountRef); err != nil {
		s.logger.Warn("Failed to revoke account role", zap.Error(err), mzap.AccRef(accountRef))
		return err
	}

	// 2) Delete the account document
	if err := s.accountDB.Delete(ctx, accountRef); err != nil {
		s.logger.Warn("Failed to delete account", zap.Error(err), mzap.AccRef(accountRef))
		return err
	}
	return nil
}

func (s *service) RemoveAccountFromOrganization(
	ctx context.Context,
	org *model.Organization,
	accountRef bson.ObjectID,
) error {
	if org == nil {
		return merrors.InvalidArgument("Organization must not be nil")
	}
	roles, err := s.enforcer.GetRoles(ctx, accountRef, org.ID)
	if err != nil {
		s.logger.Warn("Failed to fetch account permissions", zap.Error(err), mzap.StorableRef(org),
			mzap.AccRef(accountRef))
		return err
	}
	for _, role := range roles {
		if err := s.roleManager.Revoke(ctx, role.DescriptionRef, accountRef, org.ID); err != nil {
			s.logger.Warn("Failed to revoke account role", zap.Error(err),
				mzap.AccRef(accountRef), mzap.ObjRef("role_ref", role.DescriptionRef))
			return err
		}
	}
	for i, member := range org.Members {
		if member == accountRef {
			// Remove the member by slicing it out
			org.Members = append(org.Members[:i], org.Members[i+1:]...)
			if err := s.orgDB.Update(ctx, accountRef, org); err != nil {
				s.logger.Warn("Failed to remove member from organization", zap.Error(err), mzap.AccRef(accountRef))
				return err
			}
			break
		}
	}
	return nil
}

func (s *service) ResetPassword(
	ctx context.Context,
	acct *model.Account,
) (string, error) {
	return s.vdb.Create(
		ctx,
		verification.NewOTPRequest(*acct.GetID(), model.PurposePasswordReset, "").
			WithTTL(time.Hour),
	)
}

func (s *service) UpdateLogin(
	ctx context.Context,
	acct *model.Account,
	newLogin string,
) (string, error) {
	return s.vdb.Create(
		ctx,
		verification.NewOTPRequest(*acct.GetID(), model.PurposeEmailChange, newLogin).
			WithTTL(time.Hour),
	)
}

func (s *service) JoinOrganization(
	ctx context.Context,
	org *model.Organization,
	account *model.Account,
	roleDescID bson.ObjectID,
) error {
	// Membership is decided by the database, not the in-memory copy: this method
	// runs inside provisioning transactions whose retries replay the callback,
	// and a stale in-memory list would silently skip the role assignment.
	member, err := s.orgDB.IsMember(ctx, org.ID, account.ID)
	if err != nil {
		return err
	}
	if member {
		s.logger.Debug("Account is already a member", mzap.StorableRef(org), mzap.StorableRef(account))
		return nil
	}

	role := &model.Role{
		DescriptionRef:  roleDescID,
		OrganizationRef: org.ID,
		AccountRef:      account.ID,
	}
	if err := s.roleManager.Assign(ctx, role); err != nil {
		s.logger.Warn("Failed to assign role to account", zap.Error(err), mzap.StorableRef(account),
			mzap.StorableRef(org), mzap.ObjRef("role_description_ref", roleDescID))
		return err
	}

	// A point patch on purpose: replacing the whole document would clobber
	// concurrent writes, most notably the provisioning lease that guards
	// finalization against attempts whose lease was taken over.
	if _, err := s.orgDB.AddMember(ctx, org.ID, account.ID); err != nil {
		s.logger.Warn("Failed to update organization members list",
			zap.Error(err), mzap.StorableRef(account), mzap.StorableRef(org))
		return err
	}
	if !slices.Contains(org.Members, account.ID) {
		org.Members = append(org.Members, account.ID)
	}
	return nil
}

func (s *service) deleteOrganizationRoles(ctx context.Context, orgRef bson.ObjectID) error {
	return s.deleteOrganizationEntities(ctx, orgRef, "roles", "role", "role_ref", func(ctx context.Context, orgRef bson.ObjectID) ([]bson.ObjectID, error) {
		roles, err := s.roleManager.List(ctx, orgRef)
		if err != nil {
			return nil, err
		}
		roleIDs := make([]bson.ObjectID, 0, len(roles))
		for _, role := range roles {
			roleIDs = append(roleIDs, role.ID)
		}
		return roleIDs, nil
	}, s.roleManager.Delete)
}

func (s *service) deleteOrganizationPolicies(ctx context.Context, orgRef bson.ObjectID) error {
	return s.deleteOrganizationEntities(ctx, orgRef, "policies", "policy", "policy_ref", func(ctx context.Context, orgRef bson.ObjectID) ([]bson.ObjectID, error) {
		policies, err := s.policyDB.All(ctx, orgRef)
		if err != nil {
			return nil, err
		}
		policyIDs := make([]bson.ObjectID, 0, len(policies))
		for _, policy := range policies {
			policyIDs = append(policyIDs, policy.ID)
		}
		return policyIDs, nil
	}, s.policyDB.Delete)
}

func (s *service) deleteOrganizationEntities(
	ctx context.Context,
	orgRef bson.ObjectID,
	entityName string,
	entityLabel string,
	entityRefField string,
	load func(context.Context, bson.ObjectID) ([]bson.ObjectID, error),
	deleteFn func(context.Context, bson.ObjectID) error,
) error {
	s.logger.Info(fmt.Sprintf("Deleting %s for organization", entityName), mzap.OrgRef(orgRef))

	entityIDs, err := load(ctx, orgRef)
	if err != nil && !errors.Is(err, merrors.ErrNoData) {
		s.logger.Warn(fmt.Sprintf("Failed to fetch %s for deletion", entityName), zap.Error(err), mzap.OrgRef(orgRef))
		return err
	}

	for _, entityID := range entityIDs {
		if err := deleteFn(ctx, entityID); err != nil {
			s.logger.Warn(fmt.Sprintf("Failed to delete %s", entityLabel), zap.Error(err), mzap.ObjRef(entityRefField, entityID))
			return err
		}
	}

	s.logger.Info(fmt.Sprintf("Successfully deleted %s", entityName), zap.Int("count", len(entityIDs)), mzap.OrgRef(orgRef))
	return nil
}

func (s *service) DeleteOrganization(
	ctx context.Context,
	org *model.Organization,
) error {
	s.logger.Info("Starting organization deletion", mzap.StorableRef(org))

	// Use transaction to ensure atomicity
	// 8. Delete all roles and role descriptions in the organization
	if err := s.deleteOrganizationRoles(ctx, org.ID); err != nil {
		return err
	}

	// 9. Delete all policies in the organization
	if err := s.deleteOrganizationPolicies(ctx, org.ID); err != nil {
		return err
	}

	// 10. Finally, delete the organization itself
	if err := s.orgDB.Delete(ctx, bson.NilObjectID, org.ID); err != nil {
		s.logger.Warn("Failed to delete organization", zap.Error(err), mzap.StorableRef(org))
		return err
	}

	s.logger.Info("Organization deleted successfully", mzap.StorableRef(org))
	return nil
}

func (s *service) DeleteAll(
	ctx context.Context,
	org *model.Organization,
	accountRef bson.ObjectID,
) error {
	s.logger.Info("Starting complete deletion (organization + account)",
		mzap.StorableRef(org), mzap.AccRef(accountRef))

	// 1. First delete the organization and all its data
	if err := s.DeleteOrganization(ctx, org); err != nil {
		return err
	}

	// 2. Then delete the account
	if err := s.accountDB.Delete(ctx, accountRef); err != nil {
		s.logger.Warn("Failed to delete account", zap.Error(err), mzap.AccRef(accountRef))
		return err
	}

	s.logger.Info("Complete deletion successful", mzap.StorableRef(org), mzap.AccRef(accountRef))
	return nil
}

// NewAccountService wires in your logger plus the three dependencies.
func NewAccountService(
	l mlogger.Logger,
	dbf db.Factory,
	enforcer auth.Enforcer,
	ra management.Role,
	config *middleware.PasswordConfig,
) (*service, error) {
	logger := l.Named("account_service")

	if config == nil {
		return nil, merrors.Internal("Invalid account service configuration provides")
	}

	res := &service{
		logger:      logger,
		enforcer:    enforcer,
		roleManager: ra,
		config:      config,
	}
	deps, err := edgestorage.ResolveDependencies(dbf)
	if err != nil {
		return nil, err
	}
	if res.accountDB, err = dbf.NewAccountDB(); err != nil {
		logger.Error("Failed to create accounts database", zap.Error(err))
		return nil, err
	}
	if res.orgDB, err = organization.Create(context.Background(), logger, deps.Enforcer, deps.Policies, deps.Database); err != nil {
		logger.Error("Failed to create organizations database", zap.Error(err))
		return nil, err
	}

	// Initialize database dependencies for cascade deletion
	if res.policyDB, err = dbf.NewPoliciesDB(); err != nil {
		logger.Error("Failed to create policies database", zap.Error(err))
		return nil, err
	}
	if res.vdb, err = verification.Create(logger, deps.Database, deps.Transactions); err != nil {
		logger.Error("Failed to create verification database", zap.Error(err))
		return nil, err
	}
	return res, nil
}