using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.EntityFrameworkCore;
using Microsoft.IdentityModel.Tokens;
using Scalar.AspNetCore;
using System.Text;
using System.Text.Json.Serialization;
using Tiku.Api.Middleware;
using Tiku.Api.Security;
using Tiku.Application;
using Tiku.Application.Security;
using Tiku.Infrastructure;
using Tiku.Infrastructure.Persistence;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddControllers()
    .AddJsonOptions(options =>
    {
        options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter());
    });
builder.Services.AddOpenApi();
builder.Services.AddProblemDetails();
builder.Services.AddApplication();

var connectionString =
    builder.Configuration.GetConnectionString("Database") ??
    builder.Configuration["DATABASE_URL"] ??
    "Host=localhost;Database=tiku;Username=postgres";

builder.Services.AddInfrastructure(connectionString);

builder.Services.Configure<JwtOptions>(builder.Configuration.GetSection("Security:Jwt"));
var jwtOptions = builder.Configuration
    .GetSection("Security:Jwt")
    .Get<JwtOptions>() ?? new JwtOptions();

builder.Services
    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidIssuer = jwtOptions.Issuer,
            ValidateAudience = true,
            ValidAudience = jwtOptions.Audience,
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtOptions.SigningKey)),
            ValidateLifetime = true,
            ClockSkew = TimeSpan.FromMinutes(1)
        };
        options.Events = new JwtBearerEvents
        {
            OnTokenValidated = async context =>
            {
                if (!jwtOptions.ValidateSessions)
                {
                    return;
                }

                var sessionIdValue = context.Principal?.FindFirst(TikuClaimTypes.SessionId)?.Value;
                if (!Guid.TryParse(sessionIdValue, out var sessionId))
                {
                    context.Fail("Missing session claim.");
                    return;
                }

                var dbContext = context.HttpContext.RequestServices.GetRequiredService<TikuDbContext>();
                var now = DateTimeOffset.UtcNow;
                var isSessionActive = await dbContext.AuthSessions.AnyAsync(
                    session =>
                        session.Id == sessionId &&
                        session.RevokedAt == null &&
                        session.ExpiresAt > now);

                if (!isSessionActive)
                {
                    context.Fail("Session has been revoked or expired.");
                }
            }
        };
    });

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy(
        TikuPolicies.AuthenticatedUser,
        policy => policy.RequireAuthenticatedUser());
    options.AddPolicy(
        TikuPolicies.CurrentTenantMember,
        policy => policy
            .RequireAuthenticatedUser()
            .RequireAssertion(context => TenantRoleAuthorization.IsTenantMember(context.User)));
    options.AddPolicy(
        TikuPolicies.TenantAdmin,
        policy => policy
            .RequireAuthenticatedUser()
            .RequireAssertion(context => TenantRoleAuthorization.IsTenantAdmin(context.User)));
});

var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.MapOpenApi();
    app.MapScalarApiReference();
}

app.UseMiddleware<ExceptionHandlingMiddleware>();
app.UseHttpsRedirection();
app.UseAuthentication();
app.UseMiddleware<CurrentPrincipalMiddleware>();
app.UseAuthorization();

app.MapControllers();

app.Run();

public partial class Program;

record WeatherForecast(DateOnly Date, int TemperatureC, string? Summary)
{
    public int TemperatureF => 32 + (int)(TemperatureC / 0.5556);
}