using System.Text;
using Dpz.Core.Auth.Models;
using Dpz.Core.Authenticator;
using Dpz.Core.Service.RepositoryService;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace Dpz.Core.Auth.Controllers;

public class TwoFactorController(
    ILogger<HomeController> logger,
    IUserTwoFactorService userTwoFactorService
) : Controller
{
    /// <summary>
    /// 绑定双因素验证
    /// </summary>
    /// <returns></returns>
    [HttpGet]
    [Authorize]
    [Route("two-factor.html")]
    public async Task<IActionResult> BindTwoFactor(string returnUrl = "/")
    {
        var account = User.NameIdentifier;
        if (User.Identity?.IsAuthenticated != true || string.IsNullOrWhiteSpace(account))
        {
            return Challenge(authenticationSchemes: ConstValues.DefaultScheme);
        }
        var (key, isBind) = await userTwoFactorService.GetKeyAsync(account);
        if (isBind)
        {
            return Redirect(returnUrl);
        }

        if (!isBind && string.IsNullOrWhiteSpace(key))
        {
            logger.LogWarning("获取用户密钥失败，账号：{Account}", account);
            return Redirect(returnUrl);
        }

        var twoFactorAuthenticator = new TwoFactorAuthenticator();
        var setupInfo = twoFactorAuthenticator.GenerateSetupCode(
            issuer: "叫我阿胖",
            accountTitleNoSpaces: account,
            accountSecretKey: key,
            secretIsBase32: false
        );
        TempData["FromUrl"] = returnUrl;
        return View(setupInfo);
    }

    [HttpGet]
    [Authorize]
    [Route("unbind-two-factor.html")]
    public async Task<IActionResult> UnBindTwoFactor()
    {
        var account = User.NameIdentifier;
        var (_, isBind) = await userTwoFactorService.GetKeyAsync(account);
        if (!isBind)
        {
            TempData["Msg"] = "您未绑定双因素验证";
        }
        return View();
    }

    [ValidateAntiForgeryToken]
    [Authorize]
    [HttpPost]
    [Route("handel-bind-two-factor")]
    public async Task<IActionResult> HandleBindTwoFactor(string pinCode, string returnUrl = "/")
    {
        var account = User.NameIdentifier;
        if (User.Identity?.IsAuthenticated != true || string.IsNullOrWhiteSpace(account))
        {
            return Challenge(authenticationSchemes: ConstValues.DefaultScheme);
        }

        var (key, isBind) = await userTwoFactorService.GetKeyAsync(account);
        if (isBind)
        {
            return Redirect(returnUrl);
        }
        if (!isBind && string.IsNullOrWhiteSpace(key))
        {
            logger.LogWarning("获取用户密钥失败，账号：{Account}", account);
            return Redirect(returnUrl);
        }

        var twoFactorAuthenticator = new TwoFactorAuthenticator();
        var keyBuffer = Encoding.UTF8.GetBytes(key);
        var keyBase32 = Base32Encoding.ToString(keyBuffer);
        var twoFactorResult = twoFactorAuthenticator.ValidateTwoFactorPIN(keyBase32, pinCode, true);
        if (!twoFactorResult)
        {
            TempData["Msg"] = "PIN码验证失败";
            return RedirectToAction("BindTwoFactor", new { fromUrl = returnUrl });
        }

        await userTwoFactorService.BindAsync(account);
        return Redirect(returnUrl);
    }

    [HttpPost]
    [Authorize]
    [Route("unbind-two-factor")]
    public async Task<IActionResult> HandleUnbindTwoFactor(
        [FromQuery] string returnUrl,
        string pinCode
    )
    {
        var account = User.NameIdentifier;
        if (User.Identity?.IsAuthenticated != true || string.IsNullOrWhiteSpace(account))
        {
            return Challenge(authenticationSchemes: ConstValues.DefaultScheme);
        }
        var (key, isBind) = await userTwoFactorService.GetKeyAsync(account);
        if (!isBind)
        {
            TempData["Msg"] = "您未绑定双因素验证";
            return RedirectToAction("BindTwoFactor", new { returnUrl });
        }

        var twoFactorAuthenticator = new TwoFactorAuthenticator();
        var keyBuffer = Encoding.UTF8.GetBytes(key);
        var keyBase32 = Base32Encoding.ToString(keyBuffer);
        var twoFactorResult = twoFactorAuthenticator.ValidateTwoFactorPIN(keyBase32, pinCode, true);
        if (!twoFactorResult)
        {
            TempData["Msg"] = "PIN码验证失败";
            return RedirectToAction("UnBindTwoFactor", new { returnUrl });
        }

        await userTwoFactorService.UnbindAsync(account);
        return Redirect(returnUrl);
    }
}