namespace Dpz.Core.Auth.Middleware;

public class AuthStatusPageMiddleware(
    RequestDelegate next,
    IConfiguration configuration,
    ILogger<AuthStatusPageMiddleware> logger,
    IIpRateLimitService rateLimitService
)
{
    public async Task InvokeAsync(HttpContext context, AuthShellRenderService shellRenderService)
    {
        await next(context);

        if (!ShouldRenderStatusPage(context))
        {
            return;
        }

        var requestPath = context.Request.Path.Value ?? "";
        if (
            context.Response.StatusCode == StatusCodes.Status404NotFound
            && context.User.Identity?.IsAuthenticated != true
        )
        {
            await RecordNotFoundAsync(context, requestPath);
        }

        AuthShellViewModel? model = context.Response.StatusCode switch
        {
            StatusCodes.Status403Forbidden => CreateForbiddenModel(),
            StatusCodes.Status404NotFound => CreateNotFoundModel(requestPath),
            StatusCodes.Status500InternalServerError => CreateErrorModel(),
            _ => null,
        };

        if (model is null)
        {
            return;
        }

        context.Response.ContentLength = null;
        await shellRenderService.WriteAsync(context, model);
    }

    private static bool ShouldRenderStatusPage(HttpContext context)
    {
        if (
            context.Response.HasStarted
            || context.Request.Method.Equals("HEAD", StringComparison.OrdinalIgnoreCase)
            || context.Response.StatusCode
                is not StatusCodes.Status403Forbidden
                    and not StatusCodes.Status404NotFound
                    and not StatusCodes.Status500InternalServerError
        )
        {
            return false;
        }

        return IsHtmlRequest(context) && !IsProtocolOrApiRequest(context.Request.Path);
    }

    private static bool IsHtmlRequest(HttpContext context)
    {
        var accept = context.Request.Headers.Accept.ToString();
        if (string.IsNullOrWhiteSpace(accept))
        {
            return true;
        }

        return accept.Contains("text/html", StringComparison.OrdinalIgnoreCase)
            || accept.Contains("*/*", StringComparison.OrdinalIgnoreCase);
    }

    private static bool IsProtocolOrApiRequest(PathString path)
    {
        return path.StartsWithSegments("/api", StringComparison.OrdinalIgnoreCase)
            || path.StartsWithSegments("/connect/token", StringComparison.OrdinalIgnoreCase)
            || path.StartsWithSegments("/connect/userinfo", StringComparison.OrdinalIgnoreCase)
            || path.StartsWithSegments("/connect/introspect", StringComparison.OrdinalIgnoreCase)
            || path.StartsWithSegments("/connect/revocation", StringComparison.OrdinalIgnoreCase);
    }

    private async Task RecordNotFoundAsync(HttpContext context, string requestPath)
    {
        if (string.IsNullOrWhiteSpace(requestPath) || requestPath == "/")
        {
            return;
        }

        var ignoreRequestPrefixes =
            configuration.GetSection("IgnoreRequestPrefix").Get<List<string>>() ?? [];
        if (
            ignoreRequestPrefixes.Any(prefix =>
                requestPath.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)
            )
        )
        {
            return;
        }

        try
        {
            await rateLimitService.RecordEventAsync(
                context.Request.GetIpAddress(),
                "404请求",
                context.RequestAborted
            );
        }
        catch (Exception ex)
        {
            logger.LogWarning(ex, "记录404请求失败，RequestPath: {RequestPath}", requestPath);
        }
    }

    private static AuthShellViewModel<string[]> CreateForbiddenModel() =>
        new()
        {
            EntryName = "public",
            PageName = "forbidden",
            Message = "rejected-request",
            Payload =
            [
                "你的 IP 访问频率过高",
                "User-Agent 并不被信任",
                "浏览器版本过低",
                "访问了禁止访问的资源",
            ],
        };

    private static AuthShellViewModel<NotFoundShellPayload> CreateNotFoundModel(
        string requestPath
    ) =>
        new()
        {
            EntryName = "public",
            PageName = "not-found",
            Message = "not-found",
            Payload = new NotFoundShellPayload { Path = requestPath },
        };

    private static AuthShellViewModel<EmptyAuthShellPayload> CreateErrorModel() =>
        new()
        {
            EntryName = "public",
            PageName = "auth-status",
            Message = "server-error",
            Payload = new EmptyAuthShellPayload(),
        };
}

public class NotFoundShellPayload
{
    public required string Path { get; init; }
}

public static class AuthStatusPageMiddlewareExtensions
{
    public static IApplicationBuilder UseAuthStatusPages(this IApplicationBuilder builder)
    {
        return builder.UseMiddleware<AuthStatusPageMiddleware>();
    }
}