import type {
    DeleteWebAuthnCredentialRequest,
    DeleteWebAuthnCredentialResult,
    RedirectResult,
    ResponseResult,
    SessionMetadataPayload,
    WebAuthnCredentialViewModel,
} from "../models/AuthModels";
import { ApiHttpClient } from "./ApiHttpClient";
import Bowser from "bowser";

const WEBAUTHN_TIMEOUT_MS = 60000;

export class WebAuthnService {
    constructor(private readonly http = new ApiHttpClient()) {}

    async list() {
        return await this.http.get<WebAuthnCredentialViewModel[]>("/api/auth/webauthn/credentials");
    }

    async register(displayName = this.createDisplayName()) {
        const optionsResult = await this.http.post<PublicKeyCredentialCreationOptions>(
            "/api/auth/webauthn/register/options",
            { displayName },
        );
        if (!optionsResult.success || !optionsResult.data) {
            return {
                success: false,
                code: optionsResult.code,
                message: optionsResult.message,
            };
        }

        const credential = await this.createCredential(
            this.decodeCreationOptions(optionsResult.data),
        );
        return await this.http.post("/api/auth/webauthn/register/complete", {
            displayName,
            credential: this.serializeCredential(credential),
        });
    }

    async signIn(
        account: string | undefined,
        returnUrl: string | undefined,
        remember: boolean,
        sessionInfo?: SessionMetadataPayload,
    ): Promise<ResponseResult<RedirectResult>> {
        const optionsResult = await this.http.post<PublicKeyCredentialRequestOptions>(
            "/api/auth/webauthn/assertion/options",
            { account },
        );
        if (!optionsResult.success || !optionsResult.data) {
            return {
                success: false,
                code: optionsResult.code,
                message: optionsResult.message,
            };
        }

        const credential = await this.getCredential(this.decodeRequestOptions(optionsResult.data));
        return await this.http.post<RedirectResult>("/api/auth/webauthn/assertion/complete", {
            credential: this.serializeCredential(credential),
            challenge: optionsResult.data.challenge,
            returnUrl,
            remember,
            sessionInfo,
        });
    }

    async deleteCredential(
        credentialId: string,
        request: DeleteWebAuthnCredentialRequest = {},
    ): Promise<ResponseResult<DeleteWebAuthnCredentialResult>> {
        return await this.http.post<DeleteWebAuthnCredentialResult>(
            `/api/auth/webauthn/credentials/${encodeURIComponent(credentialId)}/delete`,
            request,
        );
    }

    /** 用于受 MFA 保护的流程：从服务端下发的参数发起浏览器断言（不做网络请求）。 */
    async createAssertion(assertionOptions: PublicKeyCredentialRequestOptions) {
        const credential = await this.getCredential(this.decodeRequestOptions(assertionOptions));
        return this.serializeCredential(credential);
    }

    isWebAuthnSupported() {
        return (
            typeof window !== "undefined" &&
            window.isSecureContext &&
            "PublicKeyCredential" in window &&
            "credentials" in navigator &&
            typeof navigator.credentials?.create === "function" &&
            typeof navigator.credentials?.get === "function"
        );
    }

    createDisplayName() {
        const parser = Bowser.getParser(navigator.userAgent);
        const browser = parser.getBrowser();
        const os = parser.getOS();
        const platform = parser.getPlatform();
        const parts = [
            platform.model || os.name || this.toDeviceTypeName(platform.type),
            browser.name,
            this.formatDisplayDate(new Date()),
        ].filter((value): value is string => Boolean(value));

        return parts.join(" · ");
    }

    toFriendlyError(error: unknown, context: { discoverable?: boolean } = {}) {
        if (!(error instanceof DOMException)) {
            return error instanceof Error ? error.message : "Passkey 操作失败，请重试";
        }

        const discoverableMessage =
            "Passkey 操作未完成。当前是无账号发现式登录，浏览器会列出所有 localhost 通行密钥；如果本机存在多个旧凭据，请先输入账号再登录，或删除旧的 localhost Passkey 后重试";

        switch (error.name) {
            case "NotAllowedError":
                if (context.discoverable) {
                    return discoverableMessage;
                }
                return "Passkey 操作已取消，或当前浏览器没有这个站点的可用凭证；如果已绑定，请先输入账号再试";
            case "TimeoutError":
            case "AbortError":
                if (context.discoverable) {
                    return discoverableMessage;
                }
                return "Passkey 操作超时，请重新点击后完成系统验证";
            case "SecurityError":
                return "当前站点或浏览器安全上下文不允许使用 Passkey";
            case "InvalidStateError":
                return "该设备可能已经绑定过 Passkey，请换一个凭证或刷新列表";
            case "NotSupportedError":
                return "当前浏览器或认证器不支持本次 Passkey 操作";
            case "UnknownError":
                if (context.discoverable) {
                    return discoverableMessage;
                }
                return "Passkey 操作遇到浏览器或系统的临时错误，请关闭弹窗后重新点击；如果连续失败，请重新绑定 Passkey";
            default:
                return error.message || "Passkey 操作失败，请重试";
        }
    }

    private decodeCreationOptions(options: PublicKeyCredentialCreationOptions) {
        return {
            ...options,
            challenge: this.base64UrlToArrayBuffer(options.challenge as unknown as string),
            user: {
                ...options.user,
                id: this.base64UrlToArrayBuffer(options.user.id as unknown as string),
            },
            excludeCredentials: options.excludeCredentials?.map((credential) => ({
                ...credential,
                id: this.base64UrlToArrayBuffer(credential.id as unknown as string),
            })),
        };
    }

    decodeRequestOptions(options: PublicKeyCredentialRequestOptions) {
        const decoded = {
            ...options,
            challenge: this.base64UrlToArrayBuffer(options.challenge as unknown as string),
        };

        if (options.allowCredentials?.length) {
            decoded.allowCredentials = options.allowCredentials.map((credential) => ({
                ...credential,
                id: this.base64UrlToArrayBuffer(credential.id as unknown as string),
            }));
        } else {
            delete decoded.allowCredentials;
        }

        return decoded;
    }

    private async createCredential(publicKey: PublicKeyCredentialCreationOptions) {
        const credential = await this.withAbort((signal) =>
            navigator.credentials.create({
                publicKey,
                signal,
            }),
        );
        if (!credential) {
            throw new DOMException("No credential returned", "NotAllowedError");
        }

        return credential;
    }

    private async getCredential(publicKey: PublicKeyCredentialRequestOptions) {
        const credential = await this.withAbort((signal) =>
            navigator.credentials.get({
                publicKey,
                signal,
            }),
        );
        if (!credential) {
            throw new DOMException("No credential returned", "NotAllowedError");
        }

        return credential;
    }

    private async withAbort<T>(operation: (signal: AbortSignal) => Promise<T>) {
        const controller = new AbortController();
        let timer = 0;
        const timeout = new Promise<never>((_, reject) => {
            timer = window.setTimeout(() => {
                controller.abort();
                reject(new DOMException("Passkey operation timed out", "TimeoutError"));
            }, WEBAUTHN_TIMEOUT_MS);
        });

        try {
            return await Promise.race([operation(controller.signal), timeout]);
        } finally {
            window.clearTimeout(timer);
        }
    }

    private base64UrlToArrayBuffer(value: string) {
        const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
        const padded = normalized.padEnd(
            normalized.length + ((4 - (normalized.length % 4)) % 4),
            "=",
        );
        const binary = atob(padded);
        const buffer = new ArrayBuffer(binary.length);
        const bytes = new Uint8Array(buffer);
        for (let index = 0; index < binary.length; index += 1) {
            bytes[index] = binary.charCodeAt(index);
        }
        return buffer;
    }

    serializeCredential(credential: Credential | null) {
        if (!this.isPublicKeyCredential(credential)) {
            return credential;
        }

        const response = credential.response;
        const result: Record<string, unknown> = {
            id: credential.id,
            rawId: this.arrayBufferToBase64Url(credential.rawId),
            type: credential.type,
            clientExtensionResults: credential.getClientExtensionResults(),
            authenticatorAttachment: credential.authenticatorAttachment,
        };

        if (this.isAttestationResponse(response)) {
            result.response = {
                attestationObject: this.arrayBufferToBase64Url(response.attestationObject),
                clientDataJSON: this.arrayBufferToBase64Url(response.clientDataJSON),
                transports: response.getTransports(),
            };
            return result;
        }

        if (this.isAssertionResponse(response)) {
            result.response = {
                authenticatorData: this.arrayBufferToBase64Url(response.authenticatorData),
                clientDataJSON: this.arrayBufferToBase64Url(response.clientDataJSON),
                signature: this.arrayBufferToBase64Url(response.signature),
                userHandle: response.userHandle
                    ? this.arrayBufferToBase64Url(response.userHandle)
                    : null,
            };
            return result;
        }

        throw new Error("Passkey 返回数据格式无效");
    }

    private arrayBufferToBase64Url(value: ArrayBuffer) {
        const bytes = new Uint8Array(value);
        let binary = "";
        for (const byte of bytes) {
            binary += String.fromCharCode(byte);
        }
        return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
    }

    private toDeviceTypeName(deviceType: string | undefined) {
        switch (deviceType) {
            case "mobile":
                return "Mobile";
            case "tablet":
                return "Tablet";
            case "tv":
                return "TV";
            default:
                return "Desktop";
        }
    }

    private formatDisplayDate(value: Date) {
        const pad = (part: number) => String(part).padStart(2, "0");
        return `${value.getFullYear()}-${pad(value.getMonth() + 1)}-${pad(
            value.getDate(),
        )} ${pad(value.getHours())}:${pad(value.getMinutes())}`;
    }

    private isPublicKeyCredential(
        credential: Credential | null,
    ): credential is PublicKeyCredential {
        return (
            credential !== null &&
            credential.type === "public-key" &&
            "rawId" in credential &&
            "response" in credential &&
            typeof (credential as PublicKeyCredential).getClientExtensionResults ===
                "function"
        );
    }

    private isAttestationResponse(
        response: AuthenticatorResponse,
    ): response is AuthenticatorAttestationResponse {
        return "attestationObject" in response;
    }

    private isAssertionResponse(
        response: AuthenticatorResponse,
    ): response is AuthenticatorAssertionResponse {
        return "authenticatorData" in response && "signature" in response;
    }
}