const crypto = require("crypto");
const db = require("../../models");
const { checkPassword } = require("../../utils/hashPassword.util");
const { generateToken } = require("../../utils/jwt.util");
const { generateUserId, generateId } = require("../../utils/idGen.util");
const { ACCOUNT_TYPES, PRIVILEGED_ACCOUNT_TYPES } = require("../../constants/accountTypes");
const { createLoginChallenge, verifyLoginChallenge } = require("./otp.service");
const { createSession, rotateSession } = require("./session.service");
const { sendLoginOtp } = require("./email.service");
const oauth = require("./oauth.service");

const authError = (code = "INVALID_CREDENTIALS", status = 401) => Object.assign(new Error(code === "ACCOUNT_NOT_ACTIVE" ? "Account is not active" : "Authentication failed"), { code, status });
const contextFromRequest = (req, deviceName) => ({ deviceName, userAgent: req.get("user-agent")?.slice(0, 500), ipAddress: req.ip });
const tokenPair = (user, session, refreshToken) => ({ accessToken: generateToken({ userId: user.id, sessionId: session.id, tokenVersion: user.tokenVersion }), refreshToken, refreshExpiresAt: session.expires_at });

const beginPasswordLogin = async ({ email, password, rememberMe, deviceName }, req, allowedTypes) => {
  const user = await db.User.findOne({ where: { email: email.toLowerCase() } });
  const valid = user?.password && await checkPassword(password, user.password);
  if (!user || !valid || (allowedTypes && !allowedTypes.includes(user.accountType))) throw authError();
  if (user.accountStatus !== "ACTIVE") throw authError("ACCOUNT_NOT_ACTIVE", 403);
  const context = contextFromRequest(req, deviceName);
  const challenge = await createLoginChallenge({ userId: user.id, rememberMe, context });
  await sendLoginOtp(user, challenge.otp);
  return { challengeId: challenge.challengeId };
};

const completeOtpLogin = async ({ challengeId, otp }, req) => {
  const challenge = await verifyLoginChallenge(challengeId, otp);
  return db.sequelize.transaction(async (transaction) => {
    const user = await db.User.findByPk(challenge.userId, { transaction, lock: transaction.LOCK.UPDATE });
    if (!user || user.accountStatus !== "ACTIVE") throw authError("ACCOUNT_NOT_ACTIVE", 403);
    const created = await createSession({ user, rememberMe: challenge.rememberMe, ...challenge.context, ...contextFromRequest(req, challenge.context.deviceName), transaction });
    user.lastLoginAt = new Date(); await user.save({ transaction });
    return { user, ...tokenPair(user, created.session, created.refreshToken) };
  });
};

const refresh = async (refreshToken, req) => {
  const rotated = await rotateSession(refreshToken, contextFromRequest(req));
  return { user: rotated.user, ...tokenPair(rotated.user, rotated.session, rotated.refreshToken) };
};

const authenticateOAuth = async (provider, input, req) => {
  const verified = provider === "google" ? await oauth.verifyGoogleToken(input.idToken) : await oauth.verifyAppleToken(input.idToken);
  return db.sequelize.transaction(async (transaction) => {
    let identity = await db.UserIdentity.findOne({ where: { provider, provider_subject: verified.subject }, transaction, lock: transaction.LOCK.UPDATE });
    let user = identity && await db.User.findByPk(identity.user_id, { transaction });
    if (!user) {
      if (!verified.email || !verified.emailVerified) throw authError("OAUTH_LINK_REQUIRED", 403);
      user = await db.User.findOne({ where: { email: verified.email }, transaction, lock: transaction.LOCK.UPDATE });
      if (user && (PRIVILEGED_ACCOUNT_TYPES.includes(user.accountType) || user.accountType === ACCOUNT_TYPES.RIDER)) throw authError("OAUTH_LINK_REQUIRED", 403);
      if (!user) {
        user = await db.User.create({ id: generateUserId(), firstName: verified.firstName || input.firstName || "ZUMRI", lastName: verified.lastName || input.lastName || "Customer", email: verified.email, password: null, accountType: ACCOUNT_TYPES.CUSTOMER, accountStatus: "ACTIVE", emailVerifiedAt: new Date(), tokenVersion: 0 }, { transaction });
        await db.Profile.create({ profile_id: generateId(), user_id: user.id, theme: "light", notificationsEnabled: true }, { transaction });
      }
      identity = await db.UserIdentity.create({ id: crypto.randomUUID(), user_id: user.id, provider, provider_subject: verified.subject, provider_email: verified.email }, { transaction });
    }
    if (user.accountStatus !== "ACTIVE") throw authError("ACCOUNT_NOT_ACTIVE", 403);
    const created = await createSession({ user, rememberMe: input.rememberMe, ...contextFromRequest(req, input.deviceName), transaction });
    user.lastLoginAt = new Date(); await user.save({ transaction });
    return { user, identity, ...tokenPair(user, created.session, created.refreshToken) };
  });
};

module.exports = { beginPasswordLogin, completeOtpLogin, refresh, authenticateOAuth, contextFromRequest, tokenPair };