using AuthHex.Infra.UoW;
using AuthHex.Interfaces;
using AuthHex.Models;
using AuthHex.Models.IOs;
using AuthHex.Repos;
using AuthHex.Utility;
using AuthHex.Utility.passwordHasher;
using AuthSystem.API.Utils;
using Core_Archi.Helpers;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Http.HttpResults;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using System.Net;
using System.Security.Cryptography.X509Certificates;
using System.Text.Json;
using static System.Runtime.InteropServices.JavaScript.JSType;


namespace AuthHex.Services.UserManager;

public class UserManagerService
{
    private readonly IUserManageRepository _repository;
    private readonly IRecoveryManagerRepository _recoveryRepository;
    private readonly IUnitOfWork _uow;
    private readonly JwtTokenHelper _jwt;
    private readonly AppDBContext _dbContext;
    private readonly ThirdPartyService _thirdPartyService;
    private readonly UserHelper _userHelper;

    public UserManagerService(IUserManageRepository repository, IRecoveryManagerRepository recoveryRepository, IUnitOfWork uow, JwtTokenHelper jwt, AppDBContext dbContext, ThirdPartyService thirdPartyService, UserHelper userHelper)
    {
        _repository = repository;
        _recoveryRepository = recoveryRepository;
        _uow = uow;
        _jwt = jwt;
        _dbContext = dbContext;
        _thirdPartyService = thirdPartyService;
        _userHelper = userHelper;
    }

    public async Task<object> RegisterUser(object payload, HttpContext httpContext)
    {
        await _uow.BeginAsync();
        try
        {
            var ipAddress = httpContext.Connection.RemoteIpAddress?.ToString();
            var userAgent = httpContext.Request.Headers["User-Agent"].ToString();

            var data = DeserializePayload.Deserialize(payload);

            //check payload data
            if (data == null || !data.Any())
                throw new ArgumentException("Invalid payload data");

            Guid userID = Guid.Parse(data.ContainsKey("userId") ? data["userId"].GetString() : throw new Exception("user id need"));
            var FullName = data.ContainsKey("fullname") ? data["fullname"].GetString() : null;
            var UserName = data.ContainsKey("userName") ? data["userName"].GetString() : null;
            var Nic = data.ContainsKey("nic") ? data["nic"].GetString() : null;
            var Email = data.ContainsKey("email") ? data["email"].GetString() : null;
            var MobileNumber = data.ContainsKey("mobileNumber") ? data["mobileNumber"].GetString() : null;

            var deviceName = data.ContainsKey("deviceName") ? data["deviceName"].GetString() : "Unknown Device";

            if (!data.ContainsKey("roleId") || !Guid.TryParse(data["roleId"].GetString(), out var RoleId))
                throw new ArgumentException("Invalid roleId");

            if (!data.ContainsKey("userTypeId") || !Guid.TryParse(data["userTypeId"].GetString(), out var UserTypeId))
                throw new ArgumentException("Invalid userTypeId");


            //chk user exist
            if (data.ContainsKey("chkUser") == true) {
                var userToCheck = new User
                {
                    FullName = FullName,
                    Email = Email,
                    MobileNumber = MobileNumber,
                    Nic = Nic,
                    RoleId = RoleId,
                    UserTypeId = UserTypeId
                };
                bool canSave = await CanRegisterUser(userToCheck);

                if (!canSave)
                    throw new InvalidOperationException("User already exists");
            }


            // if send password empty generate random password
            if (!data.ContainsKey("password") || string.IsNullOrWhiteSpace(data["password"].GetString()))
            {
                data["password"] = JsonDocument.Parse($"\"{Guid.NewGuid().ToString().Substring(0, 8)}\"").RootElement;
            }

            var RawPassword = data["password"].GetString()!;
            var PasswordHash = PasswordHasher.Hash(RawPassword);

            var sendCredentialsEmail = !data.ContainsKey("sendCredentialsEmail") || data["sendCredentialsEmail"].GetBoolean();

            // Create User object
            User user = new User
            {
                Id = userID,
                FullName = FullName,
                UserName = UserName,
                Nic = Nic,
                Email = Email,
                MobileNumber = MobileNumber,
                RoleId = RoleId,
                UserTypeId = UserTypeId,
                CreatedAt = DateTime.UtcNow,
                IsActive = true,
                IsLocked = false,
                EmailVerified = false,
                MobileNumberVerified = false,
                PasswordHash = PasswordHash

            };

            await _repository.AddUserAsync(user);

            var jwtToken = await _jwt.GenerateToken(user);
            var refreshToken = Guid.NewGuid().ToString();
            var refreshTokenHash = PasswordHasher.Hash(refreshToken);
            var jwtTokenHash = PasswordHasher.Hash(jwtToken);

            var token = new Token
            {
                UserId = user.Id,
                TokenHash = jwtToken
            };


            var userSession = new UserSession
            {
                UserId = user.Id,
                RefreshTokenHash = refreshTokenHash,
                DeviceName = deviceName,
                IPAddress = ipAddress,
                Browser = _userHelper.ExtractBrowser(userAgent),
                OS = _userHelper.ExtractOS(userAgent),
                ExpiresAt = DateTime.UtcNow.AddDays(30),
                CreatedAt = DateTime.UtcNow
            };

            _dbContext.UserSessions.Add(userSession);
            _dbContext.Token.Add(token);


            await LogAuthEvent(user.Id, "LOGIN_SUCCESS", ipAddress, userAgent);

            await _uow.CommitAsync();

            if (sendCredentialsEmail && !string.IsNullOrWhiteSpace(Email))
            {
                try
                {
                    await _thirdPartyService.EmailConfiguration(
                        Email,
                        RawPassword,
                        "Your ERP System Account",
                        $@"
                        <html>
                            <body style='font-family: Arial, sans-serif;'>
                                <h2>Your ERP System account has been created</h2>
                                <p>Username: <strong>{WebUtility.HtmlEncode(UserName ?? Email)}</strong></p>
                                <p>Temporary password: <strong>{{code}}</strong></p>
                                <p>Please log in and change your password as soon as possible.</p>
                            </body>
                        </html>");
                }
                catch
                {
                    // Best-effort: account creation already committed; do not fail the request on email delivery issues.
                }
            }

            return new
            {
                AccessToken = jwtToken,
                RefreshToken = refreshToken,
                ExpiresIn = 3600,
                User = new
                {
                    user.Id,
                    user.FullName,
                    user.UserName,
                    user.Email,
                    user.MobileNumber,
                    user.EmailVerified,
                    user.MobileNumberVerified,
                    user.IsMfaEnabled,
                    RoleId = user.RoleId,
                    UserTypeId = user.UserTypeId
                }
            };
        }
        catch
        {
            await _uow.RollbackAsync();
            throw;
        }

    }





    public async Task<object> LoginUser(object payload, HttpContext httpContext)
    {
        var ipAddress = httpContext.Connection.RemoteIpAddress?.ToString();
        var userAgent = httpContext.Request.Headers["User-Agent"].ToString();
        
        await _uow.BeginAsync();
        try
        {
            var data = DeserializePayload.Deserialize(payload);

            var identifier = data.ContainsKey("identifier") ? data["identifier"].GetString() : null;
            var password = data.ContainsKey("password") ? data["password"].GetString() : null;
            var userTypeId = data.ContainsKey("userTypeId") && Guid.TryParse(data["userTypeId"].GetString(), out var utid) ? utid : (Guid?)null;
            var deviceName = data.ContainsKey("deviceName") ? data["deviceName"].GetString() : "Unknown Device";

            if (string.IsNullOrWhiteSpace(identifier))
                throw new ArgumentException("Identifier and password are required");

            var user = await _repository.GetUserByIdentifierAndType(identifier, userTypeId);

            

            if (user is null)
            {
                
                await LogAuthEvent(null, "LOGIN_FAILED", ipAddress, userAgent);
                throw new ArgumentException("Invalid credentials");
            }

            
            if (user.IsLocked == true)
            {
                await LogAuthEvent(user.Id, "LOGIN_FAILED_LOCKED", ipAddress, userAgent);
                throw new ArgumentException("Account is locked");
            }

            
            if (user.IsActive == false)
            {
                await LogAuthEvent(user.Id, "LOGIN_FAILED_INACTIVE", ipAddress, userAgent);
                throw new ArgumentException("Account is deactivated");
            }


            if (string.IsNullOrEmpty(user.PasswordHash) || !PasswordHasher.Verify(password, user.PasswordHash))
            {
                await LogAuthEvent(user.Id, "LOGIN_FAILED", ipAddress, userAgent);
                throw new ArgumentException("Invalid credentials");
            }


            var jwtToken = await _jwt.GenerateToken(user);
            
            
            var refreshToken = Guid.NewGuid().ToString();
            var refreshTokenHash = PasswordHasher.Hash(refreshToken);

            
            var userSession = new UserSession
            {
                UserId = user.Id,
                RefreshTokenHash = refreshTokenHash,
                DeviceName = deviceName,
                IPAddress = ipAddress,
                Browser = _userHelper.ExtractBrowser(userAgent),
                OS = _userHelper.ExtractOS(userAgent),
                ExpiresAt = DateTime.UtcNow.AddDays(30), 
                CreatedAt = DateTime.UtcNow
            };

            _dbContext.UserSessions.Add(userSession);

         
            await LogAuthEvent(user.Id, "LOGIN_SUCCESS", ipAddress, userAgent);
            
            await _uow.CommitAsync();

            return new
            {
                AccessToken = jwtToken,
                RefreshToken = refreshToken,
                ExpiresIn = 3600, 
                User = new
                {
                    user.Id,
                    user.FullName,
                    user.UserName,
                    user.Email,
                    user.MobileNumber,
                    user.EmailVerified,
                    user.MobileNumberVerified,
                    user.IsMfaEnabled,
                    RoleId = user.RoleId,
                    UserTypeId = user.UserTypeId
                }
            };
        }
        catch
        {
            await _uow.RollbackAsync();
            throw;
        }
    }




    public async Task<object> VerifyOtpForLogin(object payload, HttpContext httpContext)
    {
        await _uow.BeginAsync();
        try
        {
            var ipAddress = httpContext.Connection.RemoteIpAddress?.ToString();
            var userAgent = httpContext.Request.Headers["User-Agent"].ToString();

            var data = DeserializePayload.Deserialize(payload);

            var referenceNumber = data.ContainsKey("referenceNumber") ? data["referenceNumber"].GetString() : null;
            var otpCode = data.ContainsKey("otpCode") ? data["otpCode"].GetString() : null;
            var deviceName = data.ContainsKey("deviceName") ? data["deviceName"].GetString() : "Unknown Device";

            if (string.IsNullOrEmpty(referenceNumber) || string.IsNullOrEmpty(otpCode))
                throw new ArgumentException("Reference number and OTP code are required.");

            var recovery = await _recoveryRepository.GetRecoveryByReferenceNumAsync(referenceNumber);

            if (recovery == null)
                throw new KeyNotFoundException("Invalid reference number.");

            if (recovery.IsUsed)
                throw new InvalidOperationException("This OTP has already been used.");

            if (recovery.Status != "Pending")
                throw new InvalidOperationException("This OTP is no longer valid.");

            if (DateTime.UtcNow > recovery.ExpirationTime)
            {
                recovery.Status = "Expired";
                await _recoveryRepository.UpdateRecoveryAsync(recovery);
                throw new InvalidOperationException("This OTP has expired. Please request a new one.");
            }

            if (recovery.OTP != otpCode)
                throw new InvalidOperationException("Invalid OTP code.");

            recovery.Status = "Verified";
            recovery.IsUsed = true;
            await _recoveryRepository.UpdateRecoveryAsync(recovery);

            if (!recovery.UserId.HasValue)
                throw new KeyNotFoundException("No user linked to this OTP.");

            var user = await _repository.GetUserByIdAsync(recovery.UserId.Value);

            if (user is null)
                throw new KeyNotFoundException("User not found.");

            var jwtToken = await _jwt.GenerateToken(user);
            var refreshToken = Guid.NewGuid().ToString();
            var refreshTokenHash = PasswordHasher.Hash(refreshToken);

            var userSession = new UserSession
            {
                UserId = user.Id,
                RefreshTokenHash = refreshTokenHash,
                DeviceName = deviceName,
                IPAddress = ipAddress,
                Browser = _userHelper.ExtractBrowser(userAgent),
                OS = _userHelper.ExtractOS(userAgent),
                ExpiresAt = DateTime.UtcNow.AddDays(30),
                CreatedAt = DateTime.UtcNow
            };

            _dbContext.UserSessions.Add(userSession);

            await LogAuthEvent(user.Id, "LOGIN_SUCCESS", ipAddress, userAgent);

            await _uow.CommitAsync();

            return new
            {
                Success = true,
                Message ="OTP verified successfully.",
                Data = new
                {
                    ReferenceNumber = recovery.RecoveryReferenceNum,
                    UserId = user.Id,
                    Verified = true,
                    AccessToken = jwtToken,
                    RefreshToken = refreshToken,
                    ExpiresIn = 3600,
                    User = new
                    {
                        user.Id,
                        user.FullName,
                        user.UserName,
                        user.Email,
                        user.MobileNumber,
                        user.EmailVerified,
                        user.MobileNumberVerified,
                        user.IsMfaEnabled,
                        RoleId = user.RoleId,
                        UserTypeId = user.UserTypeId
                    }
                }
            };
        }
        catch
        {
            await _uow.RollbackAsync();
            throw;
        }
    }

    public async Task<object> RefreshToken(object payload, HttpContext httpContext)
    {
        var ipAddress = httpContext.Connection.RemoteIpAddress?.ToString();
        var userAgent = httpContext.Request.Headers["User-Agent"].ToString();

        await _uow.BeginAsync();
        try
        {
            var data = DeserializePayload.Deserialize(payload);

            var refreshToken = data.ContainsKey("refreshToken") ? data["refreshToken"].GetString() : null;
            var requestedDeviceName = data.ContainsKey("deviceName") ? data["deviceName"].GetString() : null;

            if (string.IsNullOrWhiteSpace(refreshToken))
                throw new ArgumentException("refreshToken is required");

            var existingSession = await _repository.GetActiveSessionByRefreshTokenAsync(refreshToken);

            if (existingSession == null)
            {
                await LogAuthEvent(null, "REFRESH_FAILED", ipAddress, userAgent);
                throw new ArgumentException("Invalid or expired refresh token");
            }

            var user = existingSession.User;

            if (user == null)
                throw new ArgumentException("Invalid session user");

            if (user.IsLocked == true)
            {
                await LogAuthEvent(user.Id, "REFRESH_FAILED_LOCKED", ipAddress, userAgent);
                throw new ArgumentException("Account is locked");
            }

            if (user.IsActive == false)
            {
                await LogAuthEvent(user.Id, "REFRESH_FAILED_INACTIVE", ipAddress, userAgent);
                throw new ArgumentException("Account is deactivated");
            }

            existingSession.RevokedAt = DateTime.UtcNow;

            var newAccessToken = await _jwt.GenerateToken(user);
            var newRefreshToken = Guid.NewGuid().ToString();
            var newRefreshTokenHash = PasswordHasher.Hash(newRefreshToken);

            var rotatedSession = new UserSession
            {
                UserId = user.Id,
                RefreshTokenHash = newRefreshTokenHash,
                DeviceName = string.IsNullOrWhiteSpace(requestedDeviceName) ? existingSession.DeviceName : requestedDeviceName,
                IPAddress = ipAddress,
                Browser = _userHelper.ExtractBrowser(userAgent),
                OS = _userHelper.ExtractOS(userAgent),
                ExpiresAt = DateTime.UtcNow.AddDays(30),
                CreatedAt = DateTime.UtcNow
            };

            _dbContext.UserSessions.Add(rotatedSession);

            await LogAuthEvent(user.Id, "REFRESH_SUCCESS", ipAddress, userAgent);

            await _uow.CommitAsync();

            return new
            {
                AccessToken = newAccessToken,
                RefreshToken = newRefreshToken,
                ExpiresIn = 3600,
                User = new
                {
                    user.Id,
                    user.FullName,
                    user.UserName,
                    user.Email,
                    user.MobileNumber,
                    user.EmailVerified,
                    user.MobileNumberVerified,
                    user.IsMfaEnabled,
                    RoleId = user.RoleId,
                    UserTypeId = user.UserTypeId
                }
            };
        }
        catch
        {
            await _uow.RollbackAsync();
            throw;
        }
    }



    

   

    public async Task<object> GetUserDetails(object payload , HttpContext httpContext)
    {
        try
        {
            var data = DeserializePayload.Deserialize(payload);

            Guid userId = data.ContainsKey("userId") ? data["userId"].GetGuid() : throw new Exception("UserId required");

            var user = await _repository.GetUserByIdAsync(userId);

            if (user == null)
            {
                throw new ArgumentException("User not found");
            }

            return new
            {
                user.Id,
                user.FullName,
                user.UserName,
                user.Email,
                user.Nic,
                user.MobileNumber,
                user.EmailVerified,
                user.MobileNumberVerified,
                user.IsMfaEnabled,
                user.IsActive,
                user.IsLocked,
                user.CreatedAt,
                Role = new
                {
                    user.Role?.RoleId,
                    user.Role?.Code,
                    user.Role?.Name
                },
                UserType = new
                {
                    user.UserType?.UserTypeId,
                    user.UserType?.Code,
                    user.UserType?.Description
                }
            };
        }
        catch
        {
            throw;
        }
    }

    public async Task<object> ListUserTypes(HttpContext httpContext)
    {
        var userTypes = await _dbContext.UserType.OrderBy(t => t.Code).ToListAsync();
        return userTypes.Select(t => new
        {
            t.UserTypeId,
            t.Code,
            t.Description
        }).ToList();
    }

    public async Task<object> GetUserSessions(HttpContext httpContext)
    {
        try
        {
            var userId = _userHelper.GetUserIdFromClaims(httpContext);

            var sessions = await _repository.GetUserSessionsAsync(userId);

            return sessions.Select(s => new
            {
                s.SessionId,
                s.DeviceName,
                s.Browser,
                s.OS,
                s.IPAddress,
                s.CreatedAt,
                s.ExpiresAt,
                s.RevokedAt,
                s.IsActive
            }).ToList();
        }
        catch
        {
            throw;
        }
    }

    public async Task<object> ChangeUserStatus(object payload, HttpContext httpContext)
    {
        await _uow.BeginAsync();
        try
        {
            var data = DeserializePayload.Deserialize(payload);

            var userId = _userHelper.GetUserIdFromClaims(httpContext);

            var isActive = data.ContainsKey("isActive") ? data["isActive"].GetBoolean() : (bool?)null;

            if (isActive == null)
                throw new ArgumentException("isActive is required");

            var user = await _repository.GetUserByIdAsync(userId);

            if (user == null)
                throw new ArgumentException("User not found");

            user.IsActive = isActive.Value;

            await _uow.CommitAsync();

            return new
            {
                user.Id,
                user.FullName,
                user.UserName,
                user.Email,
                user.MobileNumber,
                user.IsActive
            };
        }
        catch
        {
            await _uow.RollbackAsync();
            throw;
        }
    }


    public async Task<object> LockUserAccount(object payload, HttpContext httpContext)
    {
        await _uow.BeginAsync();
        try
        {
            var data = DeserializePayload.Deserialize(payload);

            var userId = _userHelper.GetUserIdFromClaims(httpContext);

            var isLocked = data.ContainsKey("isLocked") ? data["isLocked"].GetBoolean() : (bool?)null;

            if (isLocked == null)
                throw new ArgumentException("isLocked is required");

            var user = await _repository.GetUserByIdAsync(userId);

            if (user == null)
                throw new ArgumentException("User not found");

            user.IsLocked = isLocked.Value;
            user.DeletedAt = DateTime.UtcNow;

            await _uow.CommitAsync();
            await _repository.InvalidateUserSessionsAsync(user.Id);

            return new
            {
                user.Id,
                user.FullName,
                user.UserName,
                user.Email,
                user.MobileNumber,
                user.IsLocked,
                user.DeletedAt
            };
        }
        catch
        {
            await _uow.RollbackAsync();
            throw;
        }
    }



    public async Task<object> VerifyPassword(object payload, HttpContext httpContext)
    {
        var data = DeserializePayload.Deserialize(payload);
        var userId = _userHelper.GetUserIdFromClaims(httpContext);

        var password = data.ContainsKey("password") ? data["password"].GetString() : null;
        if (string.IsNullOrWhiteSpace(password))
            throw new ArgumentException("Password is required");

        var user = await _repository.GetUserByIdAsync(userId);
        if (user == null)
            throw new ArgumentException("User not found");

        bool valid = !string.IsNullOrEmpty(user.PasswordHash) && PasswordHasher.Verify(password, user.PasswordHash);
        return new { valid };
    }

    public async Task<object> ChangeUserPassword(object payload, HttpContext httpContext)
    {
        await _uow.BeginAsync();
        try
        {
            var data = DeserializePayload.Deserialize(payload);

            var userId = _userHelper.GetUserIdFromClaims(httpContext);

            var currentPassword = data.ContainsKey("currentPassword") ? data["currentPassword"].GetString() : null;
            var newPassword = data.ContainsKey("newPassword") ? data["newPassword"].GetString() : null;

            if (string.IsNullOrWhiteSpace(currentPassword) || string.IsNullOrWhiteSpace(newPassword))
                throw new ArgumentException("Current password and new password are required");

            var user = await _repository.GetUserByIdAsync(userId);

            if (user == null)
                throw new ArgumentException("User not found");


            if (string.IsNullOrEmpty(user.PasswordHash) || !PasswordHasher.Verify(currentPassword, user.PasswordHash))
            {
                throw new ArgumentException("Current password is incorrect");
            }

            user.PasswordHash = PasswordHasher.Hash(newPassword);

            await _dbContext.SaveChangesAsync();

            await _repository.InvalidateUserSessionsAsync(user.Id);

            await _uow.CommitAsync();

            return new
            {
                message = "Password changed successfully"
            };
        }
        catch
        {
            await _uow.RollbackAsync();
            throw;
        }
    }


    public async Task<object> LogoutUser(object payload, HttpContext httpContext)
    {
        await _uow.BeginAsync();
        try
        {
            var data = DeserializePayload.Deserialize(payload);
            Guid userId = Guid.Parse(data.ContainsKey("userId") ? data["userId"].GetString() : throw new Exception("user id need"));

            await _repository.InvalidateUserSessionsAsync(userId);

            await _uow.CommitAsync();

            return new
            {
                message = "User logged out successfully"
            };
        }
        catch
        {
            await _uow.RollbackAsync();
            throw;
        }
    }


    public async Task<object> UpdateUser(object payload, HttpContext httpContext)
    {
        await _uow.BeginAsync();
        try
        {
            var data = DeserializePayload.Deserialize(payload);

            if (data == null || !data.Any())
                throw new ArgumentException("Invalid payload data");

            var userId = _userHelper.GetUserIdFromClaims(httpContext);

            var user = await _repository.GetUserByIdAsync(userId);

            if (user == null)
                throw new ArgumentException("User not found");

            var updated = false;

            if (data.ContainsKey("fullName"))
            {
                user.FullName = data["fullName"].GetString();
                updated = true;
            }

            if (data.ContainsKey("userName"))
            {
                user.UserName = data["userName"].GetString();
                updated = true;
            }

            if (data.ContainsKey("nic"))
            {
                user.Nic = data["nic"].GetString();
                updated = true;
            }

            if (data.ContainsKey("address"))
            {
                user.Address = data["address"].GetString();
                updated = true;
            }

            if (data.ContainsKey("optional1"))
            {
                user.Optional1 = data["optional1"].GetString();
                updated = true;
            }

            if (data.ContainsKey("optional2"))
            {
                user.Optional2 = data["optional2"].GetString();
                updated = true;
            }

            if (data.ContainsKey("email"))
            {
                var newEmail = data["email"].ValueKind == JsonValueKind.Null ? null : data["email"].GetString();
                if (!string.Equals(user.Email, newEmail, StringComparison.Ordinal))
                {
                    user.Email = newEmail;
                    user.EmailVerified = false;
                }

                updated = true;
            }

            if (data.ContainsKey("mobileNumber"))
            {
                var newMobile = data["mobileNumber"].ValueKind == JsonValueKind.Null ? null : data["mobileNumber"].GetString();
                if (!string.Equals(user.MobileNumber, newMobile, StringComparison.Ordinal))
                {
                    user.MobileNumber = newMobile;
                    user.MobileNumberVerified = false;
                }

                updated = true;
            }

            if (data.ContainsKey("newPassword"))
            {
                var currentPassword = data.ContainsKey("currentPassword") ? data["currentPassword"].GetString() : null;
                var newPassword = data["newPassword"].GetString();

                if (string.IsNullOrWhiteSpace(newPassword))
                    throw new ArgumentException("New password is required for password update");

                if (string.IsNullOrEmpty(user.PasswordHash))
                {
                    user.PasswordHash = PasswordHasher.Hash(newPassword);
                    updated = true;
                }
                else
                {
                    if (string.IsNullOrWhiteSpace(currentPassword))
                        throw new ArgumentException("Current password is required to change existing password");

                    if (!PasswordHasher.Verify(currentPassword, user.PasswordHash))
                        throw new ArgumentException("Current password is incorrect");

                    user.PasswordHash = PasswordHasher.Hash(newPassword);
                    updated = true;

                        await _repository.InvalidateUserSessionsAsync(user.Id);
                }
            }

            if (!updated)
                throw new ArgumentException("No valid fields provided for update");

            await _uow.CommitAsync();

            return new
            {
                message = "User updated successfully",
                user = new
                {
                    user.Id,
                    user.FullName,
                    user.UserName,
                    user.Nic,
                    user.Address,
                    user.Optional1,
                    user.Optional2,
                    user.Email,
                    user.EmailVerified,
                    user.MobileNumber,
                    user.MobileNumberVerified
                }
            };
        }
        catch
        {
            await _uow.RollbackAsync();
            throw;
        }
    }



//------------------------------------2FA Functions------------------------------------------------

    public async Task<object> InitiateTwoFASetup(HttpContext httpContext)
    {
        try
        {
            var userId = _userHelper.GetUserIdFromClaims(httpContext);

            var user = await _repository.GetUserByIdAsync(userId);

            if (user == null)
                throw new ArgumentException("User not found");

            if (user.IsMfaEnabled)
                throw new InvalidOperationException("2FA is already enabled for this user");

            if (string.IsNullOrWhiteSpace(user.Email))
                throw new ArgumentException("Email is required for 2FA setup");

            // Generate setup data using ThirdPartyService
            var setupResult = await _thirdPartyService.InitiateTwoFASetup(user.Email, user.FullName ?? user.UserName);

            return setupResult;
        }
        catch
        {
            throw;
        }
    }

    public async Task<object> CompleteTwoFASetup(object payload, HttpContext httpContext)
    {
        await _uow.BeginAsync();
        try
        {
            var data = DeserializePayload.Deserialize(payload);

            var userId = _userHelper.GetUserIdFromClaims(httpContext);

            var secretKey = data.ContainsKey("secretKey") ? data["secretKey"].GetString() : null;
            var verificationCode = data.ContainsKey("verificationCode") ? data["verificationCode"].GetString() : null;

            if (string.IsNullOrWhiteSpace(secretKey) || string.IsNullOrWhiteSpace(verificationCode))
                throw new ArgumentException("Secret key and verification code are required");

            var user = await _repository.GetUserByIdAsync(userId);

            if (user == null)
                throw new ArgumentException("User not found");

            if (user.IsMfaEnabled)
                throw new InvalidOperationException("2FA is already enabled for this user");

            // Verify the code using ThirdPartyService
            var verificationResult = await _thirdPartyService.CompleteTwoFASetup(secretKey, verificationCode, user.Email);

            if (verificationResult.StatusCode != 200)
                throw new ArgumentException("Invalid verification code. Please check your authenticator app and try again.");

            // Get backup codes from verification result
            var resultData = JsonSerializer.Deserialize<JsonElement>(JsonSerializer.Serialize(verificationResult.Data));
            var backupCodes = resultData.GetProperty("backupCodes").EnumerateArray().Select(x => x.GetString()).ToArray();

            // Create or update UserMfa record
            var existingMfa = await _dbContext.UserMfas.FirstOrDefaultAsync(m => m.UserId == userId);
            
            if (existingMfa != null)
            {
                // Update existing record
                existingMfa.SecretKey = secretKey; 
                existingMfa.IsEnabled = true;
                existingMfa.IsVerified = true;
                existingMfa.VerifiedAt = DateTime.UtcNow;
                existingMfa.BackupCodes = JsonSerializer.Serialize(backupCodes);
                existingMfa.UpdatedAt = DateTime.UtcNow;
            }
            else
            {
                // Create new record
                var userMfa = new UserMfa
                {
                    UserId = userId,
                    SecretKey = secretKey, 
                    IsEnabled = true,
                    IsVerified = true,
                    VerifiedAt = DateTime.UtcNow,
                    BackupCodes = JsonSerializer.Serialize(backupCodes),
                    CreatedAt = DateTime.UtcNow
                };

                _dbContext.UserMfas.Add(userMfa);
            }

            // Update user's MFA flag
            user.IsMfaEnabled = true;

            await _uow.CommitAsync();

            return new
            {
                message = "2FA setup completed successfully",
                backupCodes = backupCodes,
                user = new
                {
                    user.Id,
                    user.FullName,
                    user.UserName,
                    user.Email,
                    user.IsMfaEnabled
                }
            };
        }
        catch
        {
            await _uow.RollbackAsync();
            throw;
        }
    }

    public async Task<object> VerifyTwoFA(object payload, HttpContext httpContext)
    {
        try
        {
            var data = DeserializePayload.Deserialize(payload);

            var userId = _userHelper.GetUserIdFromClaims(httpContext);

            var verificationCode = data.ContainsKey("verificationCode") ? data["verificationCode"].GetString() : null;

            if (string.IsNullOrWhiteSpace(verificationCode))
                throw new ArgumentException("Verification code is required");

            var user = await _repository.GetUserByIdAsync(userId);

            if (user == null)
                throw new ArgumentException("User not found");

            if (!user.IsMfaEnabled)
                throw new InvalidOperationException("2FA is not enabled for this user");

            var userMfa = await _dbContext.UserMfas.FirstOrDefaultAsync(m => m.UserId == userId && m.IsEnabled == true);

            if (userMfa == null || string.IsNullOrEmpty(userMfa.SecretKey))
                throw new InvalidOperationException("2FA configuration not found");

            // Verify using ThirdPartyService
            var verificationResult = await _thirdPartyService.VerifyTwoFACode(userMfa.SecretKey, verificationCode);

            if (verificationResult.StatusCode == 200)
            {
                // Update last used timestamp
                userMfa.LastUsedAt = DateTime.UtcNow;
                userMfa.UpdatedAt = DateTime.UtcNow;
                await _dbContext.SaveChangesAsync();
            }

            return verificationResult;
        }
        catch
        {
            throw;
        }
    }

    public async Task<object> DisableTwoFA(object payload, HttpContext httpContext)
    {
        await _uow.BeginAsync();
        try
        {
            var data = DeserializePayload.Deserialize(payload);

            var userId = _userHelper.GetUserIdFromClaims(httpContext);

            var verificationCode = data.ContainsKey("verificationCode") ? data["verificationCode"].GetString() : null;

            if (string.IsNullOrWhiteSpace(verificationCode))
                throw new ArgumentException("Verification code is required to disable 2FA");

            var user = await _repository.GetUserByIdAsync(userId);

            if (user == null)
                throw new ArgumentException("User not found");

            if (!user.IsMfaEnabled)
                throw new InvalidOperationException("2FA is not enabled for this user");

            var userMfa = await _dbContext.UserMfas.FirstOrDefaultAsync(m => m.UserId == userId && m.IsEnabled == true);

            if (userMfa == null || string.IsNullOrEmpty(userMfa.SecretKey))
                throw new InvalidOperationException("2FA configuration not found");

            // Verify using ThirdPartyService before disabling
            var disableResult = await _thirdPartyService.DisableTwoFA(userMfa.SecretKey, verificationCode);

            if (disableResult.StatusCode != 200)
                throw new ArgumentException("Invalid verification code. Cannot disable 2FA without valid code.");

            // Disable 2FA
            userMfa.IsEnabled = false;
            userMfa.UpdatedAt = DateTime.UtcNow;
            user.IsMfaEnabled = false;

            await _uow.CommitAsync();

            return new
            {
                message = "2FA has been disabled successfully",
                user = new
                {
                    user.Id,
                    user.FullName,
                    user.UserName,
                    user.Email,
                    user.IsMfaEnabled
                }
            };
        }
        catch
        {
            await _uow.RollbackAsync();
            throw;
        }
    }

    public async Task<object> GetTwoFAStatus(HttpContext httpContext)
    {
        try
        {
            var userId = _userHelper.GetUserIdFromClaims(httpContext);

            var user = await _repository.GetUserByIdAsync(userId);

            if (user == null)
                throw new ArgumentException("User not found");

            var userMfa = await _dbContext.UserMfas.FirstOrDefaultAsync(m => m.UserId == userId);

            return new
            {
                isMfaEnabled = user.IsMfaEnabled,
                isVerified = userMfa?.IsVerified ?? false,
                lastUsedAt = userMfa?.LastUsedAt,
                verifiedAt = userMfa?.VerifiedAt,
                hasBackupCodes = !string.IsNullOrEmpty(userMfa?.BackupCodes)
            };
        }
        catch
        {
            throw;
        }
    }

    






















 //------------------------------- HELPER FUNCTIONS ---------------------------------//


    public async Task<bool> CanRegisterUser(User userToCheck)
    {
        var existingUsers = await _repository.GetUserByIdentifiers(userToCheck.Email, userToCheck.MobileNumber, userToCheck.Nic, userToCheck.UserName, userToCheck.Optional1);

        if (!existingUsers.Any())
            return true;

        foreach (var user in existingUsers)
        {
            if (user.UserTypeId == userToCheck.UserTypeId)
                return false;

            if (user.RoleId == userToCheck.RoleId)
                return false;

            if (user.IsLocked == false)
                return false;

            if (user.IsActive == false)
                return false;
        }

        return true;
    }



    private async Task LogAuthEvent(Guid? userId, string eventType, string? ipAddress, string? userAgent)
    {
        var authEvent = new AuthEventLog
        {
            UserId = userId,
            EventType = eventType,
            IPAddress = ipAddress,
            UserAgent = userAgent,
            CreatedAt = DateTime.UtcNow
        };

        _dbContext.AuthEventLogs.Add(authEvent);
        await Task.CompletedTask;
    }

    private bool IsEmail(string identifier)
    {
        if (string.IsNullOrWhiteSpace(identifier)) return false;
        return System.Text.RegularExpressions.Regex.IsMatch(
            identifier,
            @"^[^@\s]+@[^@\s]+\.[^@\s]+$",
            System.Text.RegularExpressions.RegexOptions.IgnoreCase);
    }

    private bool IsMobileNumber(string identifier)
    {
        if (string.IsNullOrWhiteSpace(identifier)) return false;
        var cleaned = identifier.Replace(" ", "").Replace("-", "").Replace("(", "").Replace(")", "").Replace("+", "");
        return System.Text.RegularExpressions.Regex.IsMatch(cleaned, @"^\d{7,15}$");
    }

}