namespace Dpz.Core.Auth.Controllers.UserCenter;

[ApiController]
[Route("api/user/security")]
[Authorize]
public class UserSecurityController(
    IUserTwoFactorService userTwoFactorService,
    IUserWebAuthnCredentialService credentialService
) : ControllerBase
{
    [HttpGet]
    public async Task<ResponseResult<SecurityModel>> DetailAsync(
        CancellationToken cancellationToken = default
    )
    {
        var account = User.NameIdentifier;
        if (string.IsNullOrWhiteSpace(account))
        {
            return ResponseResult<SecurityModel>.Fail("用户未登录");
        }

        var twoFactorStatus = await userTwoFactorService.GetBindingStatusAsync(
            account,
            cancellationToken
        );
        var credentials = await credentialService.ListAsync(account, cancellationToken);
        var recommendations = new List<string>();
        if (!twoFactorStatus.HasTwoFactor)
        {
            recommendations.Add("建议绑定双因素认证，提升敏感操作保护强度");
        }
        var hasPasskey = credentials.Count > 0;
        if (!hasPasskey)
        {
            recommendations.Add("请添加 Passkey，完成当前必需的安全绑定");
        }

        return ResponseResult<SecurityModel>.Ok(
            new SecurityModel
            {
                HasTwoFactor = twoFactorStatus.HasTwoFactor,
                HasPasskey = hasPasskey,
                IsFullyBound = twoFactorStatus.HasTwoFactor && hasPasskey,
                HasRequiredSecurity = hasPasskey,
                RequiresSecurityOnboarding = !hasPasskey,
                PasskeyCount = credentials.Count,
                Recommendations = recommendations.ToArray(),
            }
        );
    }
}