using System.Text;
using Dpz.Core.Authenticator;

namespace Dpz.Core.Auth.Controllers;

public class TwoFactorController(
    ILogger<HomeController> logger,
    IUserTwoFactorService userTwoFactorService
) : Controller
{
    /// <summary>
    /// 绑定双因素验证
    /// </summary>
    /// <returns></returns>
    [HttpGet]
    [Authorize]
    [Route("two-factor.html")]
    public async Task<IActionResult> BindTwoFactor(
        string returnUrl = "/",
        CancellationToken cancellationToken = default
    )
    {
        var account = User.NameIdentifier;
        if (User.Identity?.IsAuthenticated != true || string.IsNullOrWhiteSpace(account))
        {
            return Challenge(authenticationSchemes: ConstValues.DefaultScheme);
        }
        var status = await userTwoFactorService.GetBindingStatusAsync(account, cancellationToken);
        if (status.HasTwoFactor)
        {
            return Redirect(returnUrl);
        }

        var model = await BuildBindModelAsync(
            account,
            returnUrl,
            cancellationToken: cancellationToken
        );
        return model == null ? Redirect(returnUrl) : this.ShellView(model);
    }

    [HttpGet]
    [Authorize]
    [Route("unbind-two-factor.html")]
    public async Task<IActionResult> UnBindTwoFactor(CancellationToken cancellationToken = default)
    {
        var account = User.NameIdentifier;
        var key = await userTwoFactorService.GetBoundKeyAsync(account, cancellationToken);
        return this.ShellView(
            BuildUnbindModel(string.IsNullOrWhiteSpace(key) ? "您未绑定双因素验证" : null)
        );
    }

    [ValidateAntiForgeryToken]
    [Authorize]
    [HttpPost]
    [Route("handel-bind-two-factor")]
    public async Task<IActionResult> HandleBindTwoFactor(
        string pinCode,
        string setupToken,
        string returnUrl = "/",
        CancellationToken cancellationToken = default
    )
    {
        var account = User.NameIdentifier;
        if (User.Identity?.IsAuthenticated != true || string.IsNullOrWhiteSpace(account))
        {
            return Challenge(authenticationSchemes: ConstValues.DefaultScheme);
        }

        var status = await userTwoFactorService.GetBindingStatusAsync(account, cancellationToken);
        if (status.HasTwoFactor)
        {
            return Redirect(returnUrl);
        }
        var key = await userTwoFactorService.GetSetupKeyAsync(
            account,
            setupToken,
            cancellationToken
        );
        if (string.IsNullOrWhiteSpace(key))
        {
            logger.LogWarning("获取用户密钥失败，账号：{Account}", account);
            var model = await BuildBindModelAsync(
                account,
                returnUrl,
                "双因素绑定请求已过期，请重新获取二维码",
                cancellationToken
            );
            return model == null ? Redirect(returnUrl) : this.ShellView(model);
        }

        var twoFactorAuthenticator = new TwoFactorAuthenticator();
        var keyBuffer = Encoding.UTF8.GetBytes(key);
        var keyBase32 = Base32Encoding.ToString(keyBuffer);
        var twoFactorResult = twoFactorAuthenticator.ValidateTwoFactorPIN(keyBase32, pinCode, true);
        if (!twoFactorResult)
        {
            var model = await BuildBindModelAsync(
                account,
                returnUrl,
                "PIN码验证失败",
                cancellationToken
            );
            return model == null ? Redirect(returnUrl) : this.ShellView(model);
        }

        await userTwoFactorService.BindAsync(account, setupToken, cancellationToken);
        return Redirect(returnUrl);
    }

    [HttpPost]
    [Authorize]
    [Route("unbind-two-factor")]
    public async Task<IActionResult> HandleUnbindTwoFactor(
        [FromQuery] string returnUrl,
        string pinCode,
        CancellationToken cancellationToken = default
    )
    {
        var account = User.NameIdentifier;
        if (User.Identity?.IsAuthenticated != true || string.IsNullOrWhiteSpace(account))
        {
            return Challenge(authenticationSchemes: ConstValues.DefaultScheme);
        }
        var key = await userTwoFactorService.GetBoundKeyAsync(account, cancellationToken);
        if (string.IsNullOrWhiteSpace(key))
        {
            return this.ShellView(BuildUnbindModel("您未绑定双因素验证"));
        }

        var twoFactorAuthenticator = new TwoFactorAuthenticator();
        var keyBuffer = Encoding.UTF8.GetBytes(key);
        var keyBase32 = Base32Encoding.ToString(keyBuffer);
        var twoFactorResult = twoFactorAuthenticator.ValidateTwoFactorPIN(keyBase32, pinCode, true);
        if (!twoFactorResult)
        {
            return this.ShellView(BuildUnbindModel("PIN码验证失败"));
        }

        await userTwoFactorService.UnbindAsync(account, cancellationToken);
        return Redirect(returnUrl);
    }

    /// <summary>
    /// 构建 2FA 绑定页面模型，包括生成 setup token、TOTP 密钥和二维码
    /// </summary>
    private async Task<AuthShellViewModel<TwoFactorSetupShellPayload>?> BuildBindModelAsync(
        string account,
        string returnUrl,
        string? message = null,
        CancellationToken cancellationToken = default
    )
    {
        var challenge = await userTwoFactorService.BeginSetupAsync(account, cancellationToken);
        if (challenge == null)
        {
            logger.LogWarning("获取用户密钥失败，账号：{Account}", account);
            return null;
        }

        var twoFactorAuthenticator = new TwoFactorAuthenticator();
        var setupInfo = twoFactorAuthenticator.GenerateSetupCode(
            issuer: "叫我阿胖",
            accountTitleNoSpaces: account,
            accountSecretKey: challenge.Key,
            secretIsBase32: false
        );

        return new AuthShellViewModel<TwoFactorSetupShellPayload>
        {
            EntryName = "identity",
            PageName = "bind-two-factor",
            ReturnUrl = returnUrl,
            Payload = new TwoFactorSetupShellPayload
            {
                SetupToken = challenge.SetupToken,
                Account = setupInfo.Account,
                ManualEntryKey = setupInfo.ManualEntryKey,
                QrCodeSetupImageUrl = setupInfo.QrCodeSetupImageUrl,
                SetupUrl = setupInfo.SetupUrl,
            },
            Message = message,
        };
    }

    /// <summary>
    /// 构建 2FA 解绑页面模型
    /// </summary>
    private static AuthShellViewModel<EmptyAuthShellPayload> BuildUnbindModel(
        string? message = null
    ) =>
        new()
        {
            EntryName = "identity",
            PageName = "unbind-two-factor",
            Message = message,
        };
}