using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.RateLimiting;
using Tiku.Api.Contracts;
using Tiku.Api.Options;
using Tiku.Application.Auth;
using Tiku.Application.Content;
using Tiku.Application.Security;
using Tiku.Application.Tenancy;
using Tiku.Domain.Tenancy;

namespace Tiku.Api.Controllers;

[ApiController]
[Tags("租户端-认证")]
[Route("api/platform/auth")]
[Route("api/tenant/auth")]
[Route("api/student/auth")]
[Produces("application/json")]
public sealed class AuthController(
    AuthCapabilitySet authCapabilities,
    IOwnerActivationService ownerActivationService,
    ISmsVerificationService smsVerificationService,
    AuthRequestContextResolver requestContextResolver,
    ICurrentUser currentUser) : ControllerBase
{
    [AllowAnonymous]
    [EnableRateLimiting(AuthRateLimitPolicies.Password)]
    [HttpPost("activation/complete")]
    [EndpointSummary("完成租户负责人一次性激活")]
    [EndpointDescription("使用平台开通时签发的一次性令牌设置初始密码；令牌仅可消费一次。")]
    [ProducesResponseType(StatusCodes.Status204NoContent)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status400BadRequest)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status409Conflict)]
    public async Task<IActionResult> CompleteOwnerActivation(
        CompleteOwnerActivationDto request,
        CancellationToken cancellationToken)
    {
        await ownerActivationService.CompleteAsync(request.ToRequest(), cancellationToken);
        return NoContent();
    }

    [AllowAnonymous]
    [EnableRateLimiting(AuthRateLimitPolicies.Sms)]
    [HttpPost("sms/send")]
    [EndpointSummary("发送短信验证码")]
    [EndpointDescription("发送登录用途短信验证码，并应用租户级短信限流。")]
    [ProducesResponseType<SmsSendResult>(StatusCodes.Status202Accepted)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status400BadRequest)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status429TooManyRequests)]
    public async Task<ActionResult<SmsSendResult>> SendSmsCode(
        [FromBody] SendSmsCodeDto request,
        CancellationToken cancellationToken)
    {
        var realm = request.Realm!.Value;
        requestContextResolver.EnsureRouteRealm(realm, Request);
        if (realm != AuthRealm.Tenant)
            throw new RequiredFieldException("SMS authentication is only available in the tenant realm.");

        var tenantId = await requestContextResolver.ResolveRealmTenantIdAsync(realm, request.TenantCode, Request,
                           cancellationToken)
                       ?? throw new RequiredFieldException("tenantCode is required for SMS authentication.");
        var result = await smsVerificationService.CreateCodeAsync(
            new SendSmsCodeRequest(
                tenantId,
                request.Phone,
                SmsPurpose.Login,
                GetIpAddress(),
                Request.Headers.UserAgent.ToString(),
                request.DeviceId),
            cancellationToken);
        return Accepted(result);
    }

    [AllowAnonymous]
    [EnableRateLimiting(AuthRateLimitPolicies.Password)]
    [HttpPost("login/password")]
    [EndpointSummary("手机号密码登录")]
    [EndpointDescription("使用本地手机号和密码登录，签发 JWT access token 与数据库 refresh/session。")]
    [ProducesResponseType<AuthenticationResultDto>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status401Unauthorized)]
    public async Task<ActionResult<AuthenticationResultDto>> LoginWithPassword(
        [FromBody] PasswordLoginDto request,
        CancellationToken cancellationToken)
    {
        var realm = request.Realm!.Value;
        requestContextResolver.EnsureRouteRealm(realm, Request);
        var identifier = request.Identifier ?? request.Phone;
        if (string.IsNullOrWhiteSpace(identifier)) throw new RequiredFieldException("identifier is required.");
        var result = await authCapabilities.PasswordLogin.LoginWithPasswordAsync(
            new PasswordLoginRequest(
                realm,
                await requestContextResolver.ResolveRealmTenantIdAsync(realm, request.TenantCode, Request,
                    cancellationToken),
                identifier,
                request.Password,
                GetIpAddress(),
                Request.Headers.UserAgent.ToString()),
            cancellationToken);

        return Ok(AuthenticationResultDto.FromApplication(result));
    }

    [AllowAnonymous]
    [EnableRateLimiting(AuthRateLimitPolicies.Sms)]
    [HttpPost("login/sms")]
    [EndpointSummary("短信验证码登录")]
    [EndpointDescription("校验已发送的登录用途短信验证码，成功后签发 JWT access token 与数据库 refresh/session。")]
    [ProducesResponseType<AuthenticationResultDto>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status401Unauthorized)]
    public async Task<ActionResult<AuthenticationResultDto>> LoginWithSms(
        [FromBody] SmsLoginDto request,
        CancellationToken cancellationToken)
    {
        var realm = request.Realm!.Value;
        requestContextResolver.EnsureRouteRealm(realm, Request);
        var result = await authCapabilities.SmsLogin.LoginWithSmsAsync(
            new SmsLoginRequest(
                realm,
                await requestContextResolver.ResolveRealmTenantIdAsync(realm, request.TenantCode, Request,
                    cancellationToken),
                request.Phone,
                request.Code,
                GetIpAddress(),
                Request.Headers.UserAgent.ToString()),
            cancellationToken);

        return Ok(AuthenticationResultDto.FromApplication(result));
    }

    [AllowAnonymous]
    [HttpPost("oauth/wechat")]
    [EndpointSummary("微信网页 OAuth 登录")]
    [EndpointDescription("使用微信网页授权 code 换取 openid/unionid，upsert 用户身份并创建应用会话。")]
    [ProducesResponseType<AuthenticationResultDto>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status401Unauthorized)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status503ServiceUnavailable)]
    public async Task<ActionResult<AuthenticationResultDto>> LoginWithWechatWeb(
        [FromBody] OAuthCodeDto request,
        CancellationToken cancellationToken)
    {
        var realm = request.Realm!.Value;
        requestContextResolver.EnsureRouteRealm(realm, Request);
        var result = await authCapabilities.WechatLogin.LoginWithWechatWebAsync(
            new WechatLoginRequest(
                realm,
                await requestContextResolver.ResolveRealmTenantIdAsync(realm, request.TenantCode, Request,
                    cancellationToken),
                request.Code,
                GetIpAddress(),
                Request.Headers.UserAgent.ToString()),
            cancellationToken);

        return Ok(AuthenticationResultDto.FromApplication(result));
    }

    [AllowAnonymous]
    [HttpPost("oauth/wechat-miniapp")]
    [EndpointSummary("微信小程序登录")]
    [EndpointDescription("使用小程序 wx.login 返回的 code 换取 openid/session_key，upsert 用户身份并创建应用会话。")]
    [ProducesResponseType<AuthenticationResultDto>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status401Unauthorized)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status503ServiceUnavailable)]
    public async Task<ActionResult<AuthenticationResultDto>> LoginWithWechatMiniApp(
        [FromBody] OAuthCodeDto request,
        CancellationToken cancellationToken)
    {
        var realm = request.Realm!.Value;
        requestContextResolver.EnsureRouteRealm(realm, Request);
        var result = await authCapabilities.WechatLogin.LoginWithWechatMiniAppAsync(
            new WechatLoginRequest(
                realm,
                await requestContextResolver.ResolveRealmTenantIdAsync(realm, request.TenantCode, Request,
                    cancellationToken),
                request.Code,
                GetIpAddress(),
                Request.Headers.UserAgent.ToString()),
            cancellationToken);

        return Ok(AuthenticationResultDto.FromApplication(result));
    }

    [AllowAnonymous]
    [HttpPost("refresh")]
    [EndpointSummary("刷新登录会话")]
    [EndpointDescription("使用 refresh token 轮换数据库 session，并签发新的 access/refresh token。")]
    public async Task<ActionResult<AuthTokenPair>> Refresh(
        [FromBody] RefreshSessionDto request,
        CancellationToken cancellationToken)
    {
        requestContextResolver.ResolveRefreshTokenTenant(request.RefreshToken, Request);
        var result = await authCapabilities.Sessions.RefreshAsync(
            new RefreshSessionRequest(
                request.RefreshToken,
                GetIpAddress(),
                Request.Headers.UserAgent.ToString()),
            cancellationToken);

        return Ok(result);
    }

    [AllowAnonymous]
    [HttpPost("logout")]
    [EndpointSummary("退出登录")]
    [EndpointDescription("撤销 refresh token 对应的数据库 session；session 校验开启时，旧 access token 也会被拒绝。")]
    [ProducesResponseType(StatusCodes.Status204NoContent)]
    public async Task<IActionResult> Logout(
        [FromBody] RefreshSessionDto request,
        CancellationToken cancellationToken)
    {
        requestContextResolver.ResolveRefreshTokenTenant(request.RefreshToken, Request);
        await authCapabilities.Sessions.LogoutAsync(
            new LogoutSessionRequest(request.RefreshToken),
            cancellationToken);

        return NoContent();
    }

    [HttpPost("logout-all")]
    [Authorize]
    [EndpointSummary("退出全部登录会话")]
    [EndpointDescription("撤销当前用户全部 refresh/session，会话校验开启时旧 access token 也会被拒绝。")]
    [ProducesResponseType(StatusCodes.Status204NoContent)]
    public async Task<IActionResult> LogoutAll(CancellationToken cancellationToken)
    {
        if (currentUser.UserId is not { } userId) return Unauthorized();

        await authCapabilities.Sessions.LogoutAllAsync(userId, cancellationToken);
        return NoContent();
    }

    [AllowAnonymous]
    [HttpPost("password/change-required")]
    [EnableRateLimiting(AuthRateLimitPolicies.Password)]
    [EndpointSummary("修改首次登录必改密码")]
    [EndpointDescription("校验密码变更挑战令牌并设置新密码，成功后签发新的登录会话。")]
    public async Task<ActionResult<AuthenticationResultDto>> ChangeRequiredPassword(
        [FromBody] RequiredPasswordChangeDto request,
        CancellationToken cancellationToken)
    {
        requestContextResolver.ResolveAuthChallengeTenant(request.ChallengeToken, Request);
        var result = await authCapabilities.PasswordLifecycle.ChangeRequiredPasswordAsync(
            new PasswordChangeChallengeRequest(
                request.ChallengeToken, request.NewPassword, GetIpAddress(), Request.Headers.UserAgent.ToString()),
            cancellationToken);
        return Ok(AuthenticationResultDto.FromApplication(result));
    }

    [AllowAnonymous]
    [EnableRateLimiting(AuthRateLimitPolicies.Sms)]
    [HttpPost("password/reset/sms/send")]
    [EndpointSummary("发送密码重置短信验证码")]
    [EndpointDescription("仅适用于租户授权域；无论手机号是否存在均返回相同接受响应。")]
    [ProducesResponseType<SmsSendResult>(StatusCodes.Status202Accepted)]
    public async Task<ActionResult<SmsSendResult>> SendPasswordResetCode(
        PasswordResetSmsSendDto request,
        CancellationToken cancellationToken)
    {
        var tenantId = await requestContextResolver.ResolveRealmTenantIdAsync(AuthRealm.Tenant, request.TenantCode,
                           Request, cancellationToken)
                       ?? throw new RequiredFieldException("tenantCode is required for password reset.");
        var result = await authCapabilities.PasswordLifecycle.RequestPasswordResetAsync(
            new PasswordResetCodeRequest(
                tenantId,
                request.Phone,
                GetIpAddress(),
                Request.Headers.UserAgent.ToString(),
                request.DeviceId),
            cancellationToken);
        return Accepted(result);
    }

    [AllowAnonymous]
    [EnableRateLimiting(AuthRateLimitPolicies.Password)]
    [HttpPost("password/reset")]
    [EndpointSummary("使用短信验证码重置密码")]
    [ProducesResponseType(StatusCodes.Status204NoContent)]
    public async Task<IActionResult> ResetPassword(
        PasswordResetDto request,
        CancellationToken cancellationToken)
    {
        var tenantId = await requestContextResolver.ResolveRealmTenantIdAsync(AuthRealm.Tenant, request.TenantCode,
                           Request, cancellationToken)
                       ?? throw new RequiredFieldException("tenantCode is required for password reset.");
        await authCapabilities.PasswordLifecycle.ResetPasswordAsync(
            new PasswordResetRequest(
                tenantId,
                request.Phone,
                request.Code,
                request.NewPassword,
                GetIpAddress(),
                Request.Headers.UserAgent.ToString()),
            cancellationToken);
        return NoContent();
    }

    [Authorize]
    [EnableRateLimiting(AuthRateLimitPolicies.Password)]
    [HttpPost("password/change")]
    [EndpointSummary("已登录用户修改密码")]
    [EndpointDescription("修改成功后撤销旧会话并返回新的令牌对。")]
    public async Task<ActionResult<AuthenticationResultDto>> ChangePassword(
        AuthenticatedPasswordChangeDto request,
        CancellationToken cancellationToken)
    {
        if (currentUser.UserId is not { } userId || currentUser.SessionId is not { } sessionId) return Unauthorized();

        var result = await authCapabilities.PasswordLifecycle.ChangePasswordAsync(
            new AuthenticatedPasswordChangeRequest(
                userId,
                sessionId,
                request.CurrentPassword,
                request.NewPassword,
                GetIpAddress(),
                Request.Headers.UserAgent.ToString()),
            cancellationToken);
        return Ok(AuthenticationResultDto.FromApplication(result));
    }

    private string? GetIpAddress()
    {
        return HttpContext.Connection.RemoteIpAddress?.ToString();
    }

}