using System.Security.Claims;
using Dpz.Core.Service.Mediator.Features.Security.Queries;
using Microsoft.AspNetCore.Authentication;
using Microsoft.Extensions.Options;
using SignInResult = Microsoft.AspNetCore.Identity.SignInResult;

namespace Dpz.Core.Auth.Service;

public sealed class OidcSignInManager(
    UserManager<VmUserInfo> userManager,
    IHttpContextAccessor contextAccessor,
    IUserClaimsPrincipalFactory<VmUserInfo> claimsFactory,
    IOptions<IdentityOptions> optionsAccessor,
    ILoggerFactory loggerFactory,
    IAuthenticationSchemeProvider schemes,
    IUserConfirmation<VmUserInfo> confirmation,
    IMediator mediator,
    IFusionCache fusionCache,
    IAccountSessionService accountSessionService
)
    : SignInManager<VmUserInfo>(
        userManager,
        contextAccessor,
        claimsFactory,
        optionsAccessor,
        loggerFactory.CreateLogger<SignInManager<VmUserInfo>>(),
        schemes,
        confirmation
    )
{
    public override async Task SignInAsync(
        VmUserInfo user,
        AuthenticationProperties authenticationProperties,
        string? authenticationMethod = null
    )
    {
        InitSessionId(user);
        var userPrincipalAsync = await CreateUserPrincipalAsync(user);
        if (authenticationMethod != null)
        {
            userPrincipalAsync
                .Identities.First()
                .AddClaim(
                    new Claim(
                        "https://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod",
                        authenticationMethod
                    )
                );
        }
        await CacheUserSessionAsync(user);
        await Context.SignInAsync(
            ConstValues.DefaultScheme,
            userPrincipalAsync,
            authenticationProperties
        );
    }

    private readonly IUserClaimsPrincipalFactory<VmUserInfo> _claimsFactory = claimsFactory;
    private readonly ILogger<SignInManager<VmUserInfo>> _logger =
        loggerFactory.CreateLogger<OidcSignInManager>();

    public override async Task<SignInResult> PasswordSignInAsync(
        string userName,
        string password,
        bool isPersistent,
        bool lockoutOnFailure
    )
    {
        var verifyResult = await mediator.Send(
            new VerifyAccountPasswordRequest { Account = userName, Password = password }
        );
        var userInfo = verifyResult.Data;

        // 检查用户是否存在且密码是否正确
        if (!verifyResult.Success || userInfo == null)
        {
            return SignInResult.Failed;
        }

        // 检查用户是否被禁用
        if (userInfo.Enable == false)
        {
            _logger.LogWarning("用户 {UserName} 被禁用，登录被拒绝", userName);
            // 设置标记以表示账户被禁用
            Context.SetAccountDisabled();
            return SignInResult.Failed;
        }

        var result = await SignInOrTwoFactorAsync(userInfo, isPersistent);
        return result;
    }

    public override async Task RefreshSignInAsync(VmUserInfo user)
    {
        var authenticateResult = await Context.AuthenticateAsync();
        var sessionId = authenticateResult.Principal.SessionId;
        if (!string.IsNullOrWhiteSpace(sessionId))
        {
            user.SessionId = sessionId;
        }
        await CacheUserSessionAsync(user);
        await Context.SignInAsync(
            ConstValues.DefaultScheme,
            await _claimsFactory.CreateAsync(user),
            authenticateResult.Properties
        );
    }

    /// <summary>
    /// 判断应用程序cookie身份
    /// </summary>
    public override bool IsSignedIn(ClaimsPrincipal principal)
    {
        _logger.LogInformation("IsSignedIn");
        if (principal == null)
        {
            throw new ArgumentNullException(nameof(principal));
        }

        return principal.Identities.Any(i => i.AuthenticationType == ConstValues.DefaultScheme);
    }

    /// <summary>
    /// 登录指定的用户 <see cref="VmUserInfo"/>
    /// </summary>
    public override async Task SignInWithClaimsAsync(
        VmUserInfo user,
        AuthenticationProperties? authenticationProperties,
        IEnumerable<Claim> additionalClaims
    )
    {
        InitSessionId(user);
        var userPrincipal = await CreateUserPrincipalAsync(user);
        foreach (var claim in additionalClaims)
        {
            userPrincipal.Identities.First().AddClaim(claim);
        }

        await CacheUserSessionAsync(user);
        await Context.SignInAsync(
            ConstValues.DefaultScheme,
            userPrincipal,
            authenticationProperties ?? new AuthenticationProperties()
        );
    }

    private async Task CacheUserSessionAsync(VmUserInfo user)
    {
        InitSessionId(user);
        var sessionId = user.SessionId!;

        await fusionCache.SetAsync(UserSessionKeys.InfoKey(sessionId), user, TimeSpan.FromDays(30));
        await accountSessionService.CreateOrRefreshAsync(user);
    }

    private static void InitSessionId(VmUserInfo user)
    {
        if (string.IsNullOrWhiteSpace(user.SessionId))
        {
            user.SessionId = Guid.NewGuid().ToString("N");
        }
    }
}

/// <summary>
/// SignInResult 扩展方法，用于标记不同的失败原因
/// </summary>
public static class SignInResultExtensions
{
    private const string AccountDisabledKey = "AccountDisabled";

    /// <summary>
    /// 设置账户被禁用标记到 HttpContext
    /// </summary>
    public static void SetAccountDisabled(this HttpContext context)
    {
        context.Items[AccountDisabledKey] = true;
    }

    /// <summary>
    /// 检查 HttpContext 中是否有账户被禁用标记
    /// </summary>
    public static bool HasAccountDisabledFlag(this HttpContext context)
    {
        return context.Items.ContainsKey(AccountDisabledKey);
    }
}