using AuthHex.Infra.UoW;
using AuthHex.Interfaces;
using AuthHex.Models;
using AuthHex.Models.IOs;
using AuthHex.Utility.passwordHasher;
using AuthSystem.API.Utils;
using Core_Archi.Helpers;
using Microsoft.EntityFrameworkCore;
using System.Security.Cryptography;
using AuthHex.Utility;

namespace AuthHex.Services.RecoveryManager;

public class RecoveryManagerService
{
    private readonly IRecoveryManagerRepository _repository;
    private readonly IUserManageRepository _userRepository;
    private readonly IUnitOfWork _uow;
    private readonly JwtTokenHelper _jwt;
    private readonly AppDBContext _dbContext;
    private readonly ThirdPartyService _thirdPartyService;
    private readonly IConfiguration _configuration;

    public RecoveryManagerService(
        IRecoveryManagerRepository Recoveryrepository,
        IUserManageRepository userRepository,
        IUnitOfWork uow,
        JwtTokenHelper jwt,
        AppDBContext dbContext,
        ThirdPartyService thirdPartyService,
        IConfiguration configuration)
    {
        _repository = Recoveryrepository;
        _userRepository = userRepository;
        _uow = uow;
        _jwt = jwt;
        _dbContext = dbContext;
        _thirdPartyService = thirdPartyService;
        _configuration = configuration;
    }

 
    public async Task<object> ForgotPassword(object payload, HttpContext httpContext)
    {
        await _uow.BeginAsync();
        try
        {
            var data = DeserializePayload.Deserialize(payload);
            var identifier = data.ContainsKey("identifier") ? data["identifier"].GetString() : null;
            var useResetLink = data.ContainsKey("useResetLink") ? data["useResetLink"].GetBoolean() : false;
            var numberOfDigits = data.ContainsKey("numberOfDigits") ? data["numberOfDigits"].GetInt32() : 6;

            if (string.IsNullOrEmpty(identifier))
                throw new ArgumentException("Identifier is required.");

            var user = await _userRepository.GetUserByIdentifierAndType(identifier, null);
            if (user == null)
                throw new KeyNotFoundException("No user found with the provided identifier.");

            if (user.IsLocked == true)
                throw new InvalidOperationException("User account is locked. Please contact support.");

            if (user.IsActive == false)
                throw new InvalidOperationException("User account is inactive. Please contact support.");

            // invalidate all previous pending recovery attempts for this user .. 
            await _userRepository.InvalidateUserSessionsAsync(user.Id);
            var pendingRecoveries = await _repository.GetPendingRecoveriesByUserIdAsync(user.Id);
            foreach (var oldRecovery in pendingRecoveries)
            {
                oldRecovery.Status = "Expired";
                oldRecovery.IsUsed = true;
                await _repository.UpdateRecoveryAsync(oldRecovery);
            }

            Recovery recovery;

            if (useResetLink)
            {
            
                var resetToken = GenerateSecureResetToken();
                var tokenHash = HashToken(resetToken);

                recovery = new Recovery
                {
                    UserId = user.Id,
                    RecoveryReferenceNum = GenerateSecureReferenceNumber(),
                    ResetTokenHash = tokenHash,  
                    Status = "Pending",
                    IsUsed = false,
                    CreatedAt = DateTime.UtcNow,
                    ExpirationTime = DateTime.UtcNow.AddMinutes(15), 
                    RecoveryType = "ResetLink"
                };

                await _repository.AddRecoveryAsync(recovery);
                await _uow.CommitAsync();

                // send reset link via email
                if (!string.IsNullOrWhiteSpace(user.Email))
                {
                    var frontendUrl = _configuration["AppSettings:FrontendUrl"] ?? "http://localhost:3000";  //wanna add app.setting frontend URL
                    var resetLink = $"{frontendUrl}/reset-password?token={resetToken}";

                    await _thirdPartyService.EmailConfiguration(
                        user.Email!,
                        resetToken,
                        "Password Reset Request",
                        $@"
                        <h2>Password Reset Request</h2>
                        <p>Hello {user.FullName ?? user.UserName},</p>
                        <p>You requested to reset your password. Click the link below to proceed:</p>
                        <p><a href='{resetLink}'>Reset Password</a></p>
                        <p>This link will expire in 15 minutes.</p>
                        <p>If you didn't request this, please ignore this email.</p>
                        <p><strong>Reference Number:</strong> {recovery.RecoveryReferenceNum}</p>
                        ");
                }

                return new
                {
                    Success = true,
                    Message = "Password reset link sent to your email.",
                    Data = new
                    {
                        ReferenceNumber = recovery.RecoveryReferenceNum,
                        ExpiresAt = recovery.ExpirationTime,
                        RecoveryType = "ResetLink"
                    }
                };
            }
            else
            {
                
                var otpCode = await GenerateOtpCode(numberOfDigits);

                recovery = new Recovery
                {
                    UserId = user.Id,
                    RecoveryReferenceNum = GenerateSecureReferenceNumber(),
                    OTP = otpCode,  
                    Status = "Pending",
                    IsUsed = false,
                    CreatedAt = DateTime.UtcNow,
                    ExpirationTime = DateTime.UtcNow.AddMinutes(10), 
                    RecoveryType = "OTP"
                };

                await _repository.AddRecoveryAsync(recovery);
                await _uow.CommitAsync();

                
                if (!string.IsNullOrWhiteSpace(user.MobileNumber))
                {
                    await _thirdPartyService.SendSmsAsync(
                        user.MobileNumber!,
                        otpCode,
                        $"Your password recovery OTP is: {otpCode}. It expires in 10 minutes. Ref: {recovery.RecoveryReferenceNum}");
                }

                
                if (!string.IsNullOrWhiteSpace(user.Email))
                {
                    await _thirdPartyService.EmailConfiguration(
                        user.Email!,
                        otpCode,
                        "Password Recovery OTP",
                        $@"
                        <h2>Password Recovery OTP</h2>
                        <p>Hello {user.FullName ?? user.UserName},</p>
                        <p>Your OTP code is: <strong style='font-size: 24px;'>{otpCode}</strong></p>
                        <p>This code expires in 10 minutes.</p>
                        <p><strong>Reference Number:</strong> {recovery.RecoveryReferenceNum}</p>
                        ");
                }

                return new
                {
                    Success = true,
                    Message = "OTP sent successfully.",
                    Data = new
                    {
                        ReferenceNumber = recovery.RecoveryReferenceNum,
                        ExpiresAt = recovery.ExpirationTime,
                        RecoveryType = "OTP"
                    }
                };
            }
        }
        catch
        {
            await _uow.RollbackAsync();
            throw;
        }
    }

    
    public async Task<object> VerifyOTP(object payload, HttpContext httpContext)
    {
        await _uow.BeginAsync();
        try
        {
            var data = DeserializePayload.Deserialize(payload);
            var referenceNumber = data.ContainsKey("referenceNumber") ? data["referenceNumber"].GetString() : null;
            var otpCode = data.ContainsKey("otpCode") ? data["otpCode"].GetString() : null;

            if (string.IsNullOrEmpty(referenceNumber) || string.IsNullOrEmpty(otpCode))
                throw new ArgumentException("Reference number and OTP code are required.");

            var recovery = await _repository.GetRecoveryByReferenceNumAsync(referenceNumber);

            if (recovery == null)
                throw new KeyNotFoundException("Invalid reference number.");

            if (recovery.IsUsed)
                throw new InvalidOperationException("This OTP has already been used.");

            if (recovery.Status != "Pending")
                throw new InvalidOperationException("This OTP is no longer valid.");

            if (DateTime.UtcNow > recovery.ExpirationTime)
            {
                recovery.Status = "Expired";
                await _repository.UpdateRecoveryAsync(recovery);
                await _uow.CommitAsync();
                throw new InvalidOperationException("This OTP has expired. Please request a new one.");
            }

            if (recovery.OTP != otpCode)
                throw new InvalidOperationException("Invalid OTP code.");


            
            recovery.Status = "Verified";
            await _repository.UpdateRecoveryAsync(recovery);
            await _uow.CommitAsync();

            return new
            {
                Success = true,
                Message = "OTP verified successfully. You can now reset your password.",
                Data = new
                {
                    ReferenceNumber = recovery.RecoveryReferenceNum,
                    UserId = recovery.UserId,
                    Verified = true
                }
            };
        }
        catch
        {
            await _uow.RollbackAsync();
            throw;
        }
    }

    
    public async Task<object> ResetPasswordWithToken(object payload, HttpContext httpContext)
    {
        await _uow.BeginAsync();
        try
        {
            var data = DeserializePayload.Deserialize(payload);
            var resetToken = data.ContainsKey("resetToken") ? data["resetToken"].GetString() : null;
            var newPassword = data.ContainsKey("newPassword") ? data["newPassword"].GetString() : null;
            var confirmPassword = data.ContainsKey("confirmPassword") ? data["confirmPassword"].GetString() : null;

            if (string.IsNullOrEmpty(resetToken))
                throw new ArgumentException("Reset token is required.");

            if (string.IsNullOrEmpty(newPassword) || string.IsNullOrEmpty(confirmPassword))
                throw new ArgumentException("New password and confirmation are required.");

            if (newPassword != confirmPassword)
                throw new ArgumentException("Passwords do not match.");

            
            if (newPassword.Length < 8)
                throw new ArgumentException("Password must be at least 8 characters long.");

            
            var tokenHash = HashToken(resetToken);
            var recovery = await _repository.GetRecoveryByTokenHashAsync(tokenHash);

            if (recovery == null)
                throw new KeyNotFoundException("Invalid or expired reset token.");

            if (recovery.IsUsed)
                throw new InvalidOperationException("This reset link has already been used.");

            if (recovery.Status != "Pending")
                throw new InvalidOperationException("This reset link is no longer valid.");

            if (DateTime.UtcNow > recovery.ExpirationTime)
            {
                recovery.Status = "Expired";
                recovery.IsUsed = true;
                await _repository.UpdateRecoveryAsync(recovery);
                await _uow.CommitAsync();
                throw new InvalidOperationException("This reset link has expired. Please request a new one.");
            }

            if (recovery.RecoveryType != "ResetLink")
                throw new InvalidOperationException("Invalid recovery method.");

            // Get user
            var user = await _userRepository.GetUserByIdAsync((Guid)recovery.UserId);
            if (user == null)
                throw new KeyNotFoundException("User not found.");

            if (user.IsLocked == true)
                throw new InvalidOperationException("User account is locked. Please contact support.");

            user.PasswordHash = PasswordHasher.Hash(newPassword);

            // Update user
            await _dbContext.SaveChangesAsync();
            recovery.Status = "Used";
            recovery.IsUsed = true;
         
            await _repository.UpdateRecoveryAsync(recovery);

            // invalid all user sessions (force re-login)
            await _userRepository.InvalidateUserSessionsAsync(user.Id);  // can change BE requirement

            await _uow.CommitAsync();

            
            if (!string.IsNullOrWhiteSpace(user.Email))
            {
                await _thirdPartyService.EmailConfiguration(
                    user.Email!,
                    "SUCCESS",
                    "Password Reset Successful",
                    $@"
                    <h2>Password Reset Successful</h2>
                    <p>Hello {user.FullName ?? user.UserName},</p>
                    <p>Your password has been successfully reset.</p>
                    <p>If you did not make this change, please contact support immediately.</p>
                    <p><strong>Time:</strong> {DateTime.UtcNow:yyyy-MM-dd HH:mm:ss} UTC</p>
                    ");
            }

            return new
            {
                Success = true,
                Message = "Password reset successful. Please login with your new password.",
                Data = new
                {
                    UserId = user.Id,
                    Email = user.Email,
                    ResetAt = DateTime.UtcNow
                }
            };
        }
        catch
        {
            await _uow.RollbackAsync();
            throw;
        }
    }

    
    public async Task<object> ResetPassword(object payload, HttpContext httpContext)
    {
        await _uow.BeginAsync();
        try
        {
            var data = DeserializePayload.Deserialize(payload);
            var referenceNumber = data.ContainsKey("referenceNumber") ? data["referenceNumber"].GetString() : null;
            var newPassword = data.ContainsKey("newPassword") ? data["newPassword"].GetString() : null;
            var confirmPassword = data.ContainsKey("confirmPassword") ? data["confirmPassword"].GetString() : null;

            if (string.IsNullOrEmpty(referenceNumber))
                throw new ArgumentException("Reference number is required.");

            if (string.IsNullOrEmpty(newPassword) || string.IsNullOrEmpty(confirmPassword))
                throw new ArgumentException("New password and confirmation are required.");

            if (newPassword != confirmPassword)
                throw new ArgumentException("Passwords do not match.");

            
            if (newPassword.Length < 8)
                throw new ArgumentException("Password must be at least 8 characters long.");

            var recovery = await _repository.GetRecoveryByReferenceNumAsync(referenceNumber);

            if (recovery == null)
                throw new KeyNotFoundException("Invalid reference number.");

            if (recovery.Status != "Verified")
                throw new InvalidOperationException("Please verify your OTP first before resetting password.");

            if (recovery.IsUsed)
                throw new InvalidOperationException("This recovery request has already been used.");

            if (DateTime.UtcNow > recovery.ExpirationTime)
            {
                recovery.Status = "Expired";
                recovery.IsUsed = true;
                await _repository.UpdateRecoveryAsync(recovery);
                await _uow.CommitAsync();
                throw new InvalidOperationException("This recovery request has expired.");
            }

            var user = await _userRepository.GetUserByIdAsync((Guid)recovery.UserId);
            if (user == null)
                throw new KeyNotFoundException("User not found.");

            if (user.IsLocked == true)
                throw new InvalidOperationException("User account is locked. Please contact support.");

            user.PasswordHash = PasswordHasher.Hash(newPassword);

            await _dbContext.SaveChangesAsync();

            recovery.Status = "Used";
            recovery.IsUsed = true;
            await _repository.UpdateRecoveryAsync(recovery);

            await _userRepository.InvalidateUserSessionsAsync(user.Id);  //as previous comment can be changed BE requirement

            await _uow.CommitAsync();

            // Send confirmation email
            if (!string.IsNullOrWhiteSpace(user.Email))
            {
                await _thirdPartyService.EmailConfiguration(
                    user.Email!,
                    "SUCCESS",
                    "Password Reset Successful",
                    $@"
                    <h2>Password Reset Successful</h2>
                    <p>Hello {user.FullName ?? user.UserName},</p>
                    <p>Your password has been successfully reset.</p>
                    <p>If you did not make this change, please contact support immediately.</p>
                    <p><strong>Time:</strong> {DateTime.UtcNow:yyyy-MM-dd HH:mm:ss} UTC</p>
                    ");
            }

            return new
            {
                Success = true,
                Message = "Password reset successful. Please login with your new password.",
                Data = new
                {
                    UserId = user.Id,
                    Email = user.Email,
                    ResetAt = DateTime.UtcNow
                }
            };
        }
        catch
        {
            await _uow.RollbackAsync();
            throw;
        }
    }

    //------------------------------- HELPER METHODS -------------------------------

    private string GenerateSecureResetToken()
    {
        using var rng = RandomNumberGenerator.Create();
        byte[] tokenBytes = new byte[32]; 
        rng.GetBytes(tokenBytes);

        // Convert to URL-safe base64 string
        return Convert.ToBase64String(tokenBytes)
            .Replace("+", "-")
            .Replace("/", "_")
            .Replace("=", "");
    }

   
    private string HashToken(string token)
    {
        using var sha256 = SHA256.Create();
        byte[] hashBytes = sha256.ComputeHash(System.Text.Encoding.UTF8.GetBytes(token));
        return Convert.ToBase64String(hashBytes);
    }

        private async Task<string> GenerateOtpCode(int numberOfDigits)
    {
        if (numberOfDigits <= 0 )
            throw new ArgumentException("Number of digits must be at least 1", nameof(numberOfDigits));

        using var rng = RandomNumberGenerator.Create();
        var otpCode = "";

        for (int i = 0; i < numberOfDigits; i++)
        {
            byte[] randomBytes = new byte[4];
            rng.GetBytes(randomBytes);
            uint randomValue = BitConverter.ToUInt32(randomBytes, 0);
            otpCode += (randomValue % 10).ToString();
        }

        return await Task.FromResult(otpCode);
    }

   
    private string GenerateSecureReferenceNumber()
    {
        var timestamp = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
        using var rng = RandomNumberGenerator.Create();

        byte[] randomBytes = new byte[8];
        rng.GetBytes(randomBytes);

        var randomPart = Convert.ToBase64String(randomBytes)
            .Replace("/", "")
            .Replace("+", "")
            .Replace("=", "")
            .Substring(0, 8).ToUpper();

        return $"REC{timestamp}{randomPart}";
    }
}