using Dpz.Core.EnumLibrary;
using Dpz.Core.Service.Mediator.Features.Security.Queries;
using Dpz.Core.Web.Library.Middleware;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc.Filters;

namespace Dpz.Core.Web.Library.Filter;

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
public class CheckAuthorizeAttribute : Attribute, IFilterFactory
{
    public IFilterMetadata CreateInstance(IServiceProvider serviceProvider)
    {
        return new InternalFilter(
            Permissions == 0 ? null : Permissions,
            serviceProvider.GetRequiredService<ILoggerFactory>(),
            serviceProvider.GetRequiredService<IAccountService>(),
            serviceProvider.GetRequiredService<IMediator>(),
            serviceProvider.GetRequiredService<IApplicationSignInManager>(),
            serviceProvider.GetRequiredService<IAccountSessionService>(),
            serviceProvider.GetRequiredService<IHttpCurrentUserService>()
        );
    }

    private class InternalFilter(
        Permissions? innerPermissions,
        ILoggerFactory logger,
        IAccountService accountService,
        IMediator mediator,
        IApplicationSignInManager signInManager,
        IAccountSessionService accountSessionService,
        IHttpCurrentUserService currentUserService
    ) : IAsyncActionFilter
    {
        private readonly ILogger<InternalFilter> _logger = logger.CreateLogger<InternalFilter>();

        private Permissions? InnerPermissions => innerPermissions;

        public async Task OnActionExecutionAsync(
            ActionExecutingContext context,
            ActionExecutionDelegate next
        )
        {
            if (SkipAuthorization(context))
            {
                await next();
                return;
            }

            var (isValid, errorResult) = ValidateRequest(context);
            if (!isValid)
            {
                context.Result = errorResult!;
                return;
            }

            var userValidationResult = await ValidateUserAsync(context);
            if (!userValidationResult.IsValid)
            {
                context.Result = userValidationResult.ErrorResult!;
                return;
            }

            await next();
        }

        private static bool SkipAuthorization(ActionContext context)
        {
            return context.ActionDescriptor.EndpointMetadata.Any(x => x is AllowAnonymousAttribute);
        }

        private (bool IsValid, IActionResult? ErrorResult) ValidateRequest(ActionContext context)
        {
            var httpContext = context.HttpContext;

            if (!httpContext.User.Authenticated)
            {
                _logger.LogInformation("Unauthenticated access attempt");
                return (
                    false,
                    CreateErrorResponse(
                        context,
                        httpContext.Request.ExpectsJsonResponse()
                            ? "请先登录"
                            : "Authentication required",
                        401
                    )
                );
            }

            return (true, null);
        }

        private async Task<(bool IsValid, IActionResult? ErrorResult)> ValidateUserAsync(
            ActionExecutingContext context
        )
        {
            var httpContext = context.HttpContext;
            var clientUser = await currentUserService.GetUserInfoAsync(httpContext.RequestAborted);
            var sessionId = httpContext.User.SessionId;

            if (
                !string.IsNullOrWhiteSpace(sessionId)
                && await accountSessionService.IsRevokedAsync(sessionId, httpContext.RequestAborted)
            )
            {
                _logger.LogWarning("Revoked session access attempt: {SessionId}", sessionId);
                return (
                    false,
                    CreateErrorResponse(context, "您的登录会话已被撤销，请重新登录", 302)
                );
            }

            if (clientUser == null)
            {
                _logger.LogWarning("Invalid user identity");
                return (false, CreateErrorResponse(context, "无效的用户身份", 403));
            }

            var user = await accountService.GetOneUserAsync(clientUser.Id);
            if (user == null)
            {
                _logger.LogWarning("User not found: {Account}", clientUser.Id);
                return (false, CreateErrorResponse(context, "用户不存在", 403));
            }

            var stampResult = await mediator.Send(
                new ValidateUserSecurityStampRequest
                {
                    UserId = user.Id,
                    SecurityStamp = clientUser.Key,
                }
            );
            if (!stampResult.Success || stampResult.Data != UserSecurityValidationResult.Valid)
            {
                _logger.LogWarning(
                    "SecurityStamp validation failed for user: {UserName}",
                    clientUser.Name
                );
                return (
                    false,
                    CreateErrorResponse(context, "您的账户安全状态已更新，请重新登录", 302)
                );
            }

            if (user.Enable == false)
            {
                _logger.LogWarning("Disabled account access attempt: {UserName}", clientUser.Name);
                return (false, CreateErrorResponse(context, "账号已停用", 403));
            }

            if (!CheckPermissions(user.Permissions))
            {
                _logger.LogWarning(
                    "Insufficient permissions for user: {UserName}",
                    clientUser.Name
                );
                return (false, CreateErrorResponse(context, "权限不足", 403));
            }

            if (
                clientUser.LastAccessTime.HasValue
                && DateTime.Now - clientUser.LastAccessTime.Value > TimeSpan.FromDays(1)
            )
            {
                _logger.LogInformation(
                    "User {UserName} has been inactive for more than 1 day",
                    clientUser.Name
                );
                await signInManager.RefreshSignInAsync(user);
            }

            SetViewData(context, user);
            return (true, null);
        }

        private bool CheckPermissions(Permissions? userPermissions)
        {
            if (InnerPermissions == null)
            {
                return true;
            }

            if (userPermissions == null)
            {
                return false;
            }
            return (userPermissions.Value & InnerPermissions.Value) == InnerPermissions.Value;
        }

        private static void SetViewData(ActionExecutingContext context, VmUserInfo user)
        {
            if (context.Controller is Controller controller)
            {
                controller.ViewData["CurrentUser"] = user;
            }
        }

        private static IActionResult CreateErrorResponse(
            ActionContext context,
            string message,
            int statusCode
        )
        {
            var request = context.HttpContext.Request;

            if (request.ExpectsJsonResponse())
            {
                return new JsonResult(new ResultInfo(message));
            }

            return statusCode switch
            {
                302 => new RedirectToActionResult("ReLogin", "Account", new { }),
                401 => new RedirectToActionResult(
                    "Login",
                    "Home",
                    new { fromUrl = request.Path + request.QueryString }
                ),
                403 => CreateForbiddenResult(context, message),
                _ => new ContentResult { Content = message, StatusCode = statusCode },
            };
        }

        private static StatusCodeResult CreateForbiddenResult(ActionContext context, string message)
        {
            context.HttpContext.Items[HtmlErrorPageMiddleware.ErrorMessageItemKey] = message;
            return new StatusCodeResult(StatusCodes.Status403Forbidden);
        }
    }

    public Permissions Permissions { get; set; }

    public bool IsReusable => false;
}