package service

import (
	"context"
	"errors"
	"time"

	"gen2d/internal/db"
	"gen2d/internal/logger"
	"gen2d/internal/model"

	"github.com/golang-jwt/jwt/v5"
	"golang.org/x/crypto/bcrypt"
	"gorm.io/gorm"
)

// AuthService 用户认证服务。
type AuthService struct {
	jwtSecret []byte
	jwtExpire time.Duration
}

// NewAuthService 创建 AuthService 实例。
func NewAuthService(jwtSecret string, jwtExpire int64) *AuthService {
	return &AuthService{
		jwtSecret: []byte(jwtSecret),
		jwtExpire: time.Duration(jwtExpire) * time.Second,
	}
}

// Register 注册新用户，密码使用 bcrypt 加密存储。
func (s *AuthService) Register(ctx context.Context, username, password, email string) (*model.User, error) {
	l := logger.FromCtx(ctx)

	hashed, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
	if err != nil {
		l.Error("bcrypt failed", "error", err)
		return nil, err
	}

	user := model.User{
		Username: username,
		Password: string(hashed),
		Email:    email,
	}

	if err := db.DB.WithContext(ctx).Create(&user).Error; err != nil {
		if errors.Is(err, gorm.ErrDuplicatedKey) {
			l.Warn("register failed: duplicate username", "username", username)
			return nil, errors.New("用户名已存在")
		}
		l.Error("register db failed", "username", username, "error", err)
		return nil, err
	}

	l.Info("user registered", "username", username, "user_id", user.ID)
	return &user, nil
}

// Login 校验用户名密码，成功返回 JWT token 及用户信息。
func (s *AuthService) Login(ctx context.Context, username, password string) (string, int64, *model.User, error) {
	l := logger.FromCtx(ctx)

	var user model.User
	if err := db.DB.WithContext(ctx).Where("username = ?", username).First(&user).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			l.Warn("login failed: user not found", "username", username)
			return "", 0, nil, errors.New("用户名或密码错误")
		}
		l.Error("login db query failed", "username", username, "error", err)
		return "", 0, nil, err
	}

	if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)); err != nil {
		l.Warn("login failed: wrong password", "username", username)
		return "", 0, nil, errors.New("用户名或密码错误")
	}

	expiresAt := time.Now().Add(s.jwtExpire)
	claims := jwt.MapClaims{
		"sub": user.ID,
		"exp": expiresAt.Unix(),
		"iat": time.Now().Unix(),
	}
	token, err := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString(s.jwtSecret)
	if err != nil {
		l.Error("jwt sign failed", "error", err)
		return "", 0, nil, err
	}

	l.Info("login succeeded", "username", username, "user_id", user.ID)
	return token, int64(s.jwtExpire.Seconds()), &user, nil
}