import {
  Injectable,
  UnauthorizedException,
  ConflictException,
  BadRequestException,
  Logger,
} from "@nestjs/common";
import { JwtService } from "@nestjs/jwt";
import { ConfigService } from "@nestjs/config";
import * as bcrypt from "bcrypt";
import { UsersService } from "../users/users.service";
import { MappingsService } from "../mappings/mappings.service";
import { WhmcsService } from "../vendors/whmcs/whmcs.service";
import { SalesforceService } from "../vendors/salesforce/salesforce.service";
import { AuditService, AuditAction } from "../common/audit/audit.service";
import { TokenBlacklistService } from "./services/token-blacklist.service";
import { SignupDto } from "./dto/signup.dto";
import { LinkWhmcsDto } from "./dto/link-whmcs.dto";
import { SetPasswordDto } from "./dto/set-password.dto";
import { getErrorMessage } from "../common/utils/error.util";

@Injectable()
export class AuthService {
  private readonly logger = new Logger(AuthService.name);
  private readonly MAX_LOGIN_ATTEMPTS = 5;
  private readonly LOCKOUT_DURATION_MINUTES = 15;

  constructor(
    private usersService: UsersService,
    private mappingsService: MappingsService,
    private jwtService: JwtService,
    private configService: ConfigService,
    private whmcsService: WhmcsService,
    private salesforceService: SalesforceService,
    private auditService: AuditService,
    private tokenBlacklistService: TokenBlacklistService,
  ) {}

  async signup(signupData: SignupDto, request?: any) {
    const { email, password, firstName, lastName, company, phone } = signupData;

    // Check if user already exists
    const existingUser = await this.usersService.findByEmailInternal(email);
    if (existingUser) {
      await this.auditService.logAuthEvent(
        AuditAction.SIGNUP,
        undefined,
        { email, reason: "User already exists" },
        request,
        false,
        "User with this email already exists",
      );
      throw new ConflictException("User with this email already exists");
    }

    // Hash password
    const saltRounds = 12; // Use a fixed safe value
    const passwordHash = await bcrypt.hash(password, saltRounds);

    try {
      // 1. Create user in portal
      const user = await this.usersService.create({
        email,
        passwordHash,
        firstName,
        lastName,
        company,
        phone,
        emailVerified: false,
        failedLoginAttempts: 0,
        lockedUntil: null,
        lastLoginAt: null,
      });

      // 2. Create client in WHMCS
      const whmcsClient = await this.whmcsService.addClient({
        firstname: firstName,
        lastname: lastName,
        email,
        companyname: company || "",
        phonenumber: phone || "",
        password2: password, // WHMCS requires plain password for new clients
      });

      // 3. Create account in Salesforce (no Contact, just Account)
      const sfAccount = await this.salesforceService.upsertAccount({
        name: company || `${firstName} ${lastName}`,
        phone: phone,
      });

      // 4. Store ID mappings
      await this.mappingsService.createMapping({
        userId: user.id,
        whmcsClientId: whmcsClient.clientId,
        sfAccountId: sfAccount.id,
      });

      // Log successful signup
      await this.auditService.logAuthEvent(
        AuditAction.SIGNUP,
        user.id,
        { email, whmcsClientId: whmcsClient.clientId },
        request,
        true,
      );

      // Generate JWT token
      const tokens = await this.generateTokens(user);

      return {
        user: this.sanitizeUser(user),
        ...tokens,
      };
    } catch (error) {
      // Log failed signup
      await this.auditService.logAuthEvent(
        AuditAction.SIGNUP,
        undefined,
        { email, error: getErrorMessage(error) },
        request,
        false,
        getErrorMessage(error),
      );

      // TODO: Implement rollback logic if any step fails
      this.logger.error("Signup error:", error);
      throw new BadRequestException("Failed to create user account");
    }
  }

  async login(user: any, request?: any) {
    // Update last login time and reset failed attempts
    await this.usersService.update(user.id, {
      lastLoginAt: new Date(),
      failedLoginAttempts: 0,
      lockedUntil: null,
    });

    // Log successful login
    await this.auditService.logAuthEvent(
      AuditAction.LOGIN_SUCCESS,
      user.id,
      { email: user.email },
      request,
      true,
    );

    const tokens = await this.generateTokens(user);
    return {
      user: this.sanitizeUser(user),
      ...tokens,
    };
  }

  async linkWhmcsUser(linkData: LinkWhmcsDto, request?: any) {
    const { email, password } = linkData;

    // Check if user already exists in portal
    const existingUser = await this.usersService.findByEmailInternal(email);
    if (existingUser) {
      // If user exists but has no password (abandoned during setup), allow them to continue
      if (!existingUser.passwordHash) {
        this.logger.log(
          `User ${email} exists but has no password - allowing password setup to continue`,
        );
        return {
          user: this.sanitizeUser(existingUser),
          needsPasswordSet: true,
        };
      } else {
        throw new ConflictException(
          "User already exists in portal and has completed setup. Please use the login page.",
        );
      }
    }

    try {
      // 1. First, find the client by email using GetClientsDetails directly
      let clientDetails;
      try {
        clientDetails = await this.whmcsService.getClientDetailsByEmail(email);
      } catch (error) {
        throw new UnauthorizedException(
          "WHMCS client not found with this email address",
        );
      }

      // 2. Validate the password using ValidateLogin
      try {
        this.logger.debug(`About to validate WHMCS password for ${email}`);
        const validateResult = await this.whmcsService.validateLogin(
          email,
          password,
        );
        this.logger.debug(
          `WHMCS validation successful for ${email}:`,
          validateResult,
        );
        if (!validateResult || !validateResult.userId) {
          throw new UnauthorizedException("Invalid WHMCS credentials");
        }
      } catch (error) {
        this.logger.debug(
          `WHMCS validation failed for ${email}:`,
          getErrorMessage(error),
        );
        throw new UnauthorizedException("Invalid WHMCS password");
      }

      // 3. Extract Customer Number from field ID 198
      const customerNumberField = clientDetails.customfields?.find(
        (field: any) => field.id == 198, // Use == instead of === to handle string/number comparison
      );

      const customerNumber = customerNumberField?.value;

      if (!customerNumber || customerNumber.toString().trim() === "") {
        throw new BadRequestException(
          `Customer Number not found in WHMCS custom field 198. ` +
            `Found field: ${JSON.stringify(customerNumberField)}. ` +
            `Available custom fields: ${JSON.stringify(clientDetails.customfields || [])}. ` +
            `Please contact support.`,
        );
      }

      this.logger.log(
        `Found Customer Number: ${customerNumber} for WHMCS client ${clientDetails.id}`,
      );

      // 3. Find existing Salesforce account using Customer Number
      const sfAccount =
        await this.salesforceService.findAccountByCustomerNumber(
          customerNumber,
        );
      if (!sfAccount) {
        throw new BadRequestException(
          `Salesforce account not found for Customer Number: ${customerNumber}. Please contact support.`,
        );
      }

      // 4. Create portal user (without password initially)
      const user = await this.usersService.create({
        email,
        passwordHash: null, // No password hash - will be set when user sets password
        firstName: clientDetails.firstname || "",
        lastName: clientDetails.lastname || "",
        company: clientDetails.companyname || "",
        phone: clientDetails.phonenumber || "",
        emailVerified: true, // WHMCS users are pre-verified
      });

      // 5. Store ID mappings
      await this.mappingsService.createMapping({
        userId: user.id,
        whmcsClientId: parseInt(clientDetails.id),
        sfAccountId: sfAccount.id,
      });

      return {
        user: this.sanitizeUser(user),
        needsPasswordSet: true,
      };
    } catch (error) {
      this.logger.error("WHMCS linking error:", error);
      if (
        error instanceof BadRequestException ||
        error instanceof UnauthorizedException
      ) {
        throw error;
      }
      throw new BadRequestException("Failed to link WHMCS account");
    }
  }

  async checkPasswordNeeded(email: string) {
    const user = await this.usersService.findByEmailInternal(email);
    if (!user) {
      return { needsPasswordSet: false, userExists: false };
    }

    return {
      needsPasswordSet: !user.passwordHash,
      userExists: true,
      email: user.email,
    };
  }

  async setPassword(setPasswordData: SetPasswordDto, request?: any) {
    const { email, password } = setPasswordData;

    const user = await this.usersService.findByEmailInternal(email);
    if (!user) {
      throw new UnauthorizedException("User not found");
    }

    // Check if user needs to set password (linked users have null password hash)
    if (user.passwordHash) {
      throw new BadRequestException("User already has a password set");
    }

    // Hash new password
    const saltRounds = 12; // Use a fixed safe value
    const passwordHash = await bcrypt.hash(password, saltRounds);

    // Update user with new password
    const updatedUser = await this.usersService.update(user.id, {
      passwordHash,
    });

    // Generate tokens
    const tokens = await this.generateTokens(updatedUser);

    return {
      user: this.sanitizeUser(updatedUser),
      ...tokens,
    };
  }

  async validateUser(
    email: string,
    password: string,
    request?: any,
  ): Promise<any> {
    const user = await this.usersService.findByEmailInternal(email);

    if (!user) {
      await this.auditService.logAuthEvent(
        AuditAction.LOGIN_FAILED,
        undefined,
        { email, reason: "User not found" },
        request,
        false,
        "User not found",
      );
      return null;
    }

    // Check if account is locked
    if (user.lockedUntil && user.lockedUntil > new Date()) {
      await this.auditService.logAuthEvent(
        AuditAction.LOGIN_FAILED,
        user.id,
        { email, reason: "Account locked" },
        request,
        false,
        "Account is locked",
      );
      return null;
    }

    if (!user.passwordHash) {
      await this.auditService.logAuthEvent(
        AuditAction.LOGIN_FAILED,
        user.id,
        { email, reason: "No password set" },
        request,
        false,
        "No password set",
      );
      return null;
    }

    try {
      const isPasswordValid = await bcrypt.compare(password, user.passwordHash);

      if (isPasswordValid) {
        return user;
      } else {
        // Increment failed login attempts
        await this.handleFailedLogin(user, request);
        return null;
      }
    } catch (error) {
      this.logger.error(
        `Password validation error for ${email}:`,
        getErrorMessage(error),
      );
      await this.auditService.logAuthEvent(
        AuditAction.LOGIN_FAILED,
        user.id,
        { email, error: getErrorMessage(error) },
        request,
        false,
        getErrorMessage(error),
      );
      return null;
    }
  }

  private async handleFailedLogin(user: any, request?: any): Promise<void> {
    const newFailedAttempts = (user.failedLoginAttempts || 0) + 1;
    let lockedUntil = null;
    let isAccountLocked = false;

    // Lock account if max attempts reached
    if (newFailedAttempts >= this.MAX_LOGIN_ATTEMPTS) {
      lockedUntil = new Date();
      lockedUntil.setMinutes(
        lockedUntil.getMinutes() + this.LOCKOUT_DURATION_MINUTES,
      );
      isAccountLocked = true;
    }

    await this.usersService.update(user.id, {
      failedLoginAttempts: newFailedAttempts,
      lockedUntil,
    });

    // Log failed login
    await this.auditService.logAuthEvent(
      AuditAction.LOGIN_FAILED,
      user.id,
      {
        email: user.email,
        failedAttempts: newFailedAttempts,
        lockedUntil: lockedUntil?.toISOString(),
      },
      request,
      false,
      "Invalid password",
    );

    // Log account lock if applicable
    if (isAccountLocked) {
      await this.auditService.logAuthEvent(
        AuditAction.ACCOUNT_LOCKED,
        user.id,
        {
          email: user.email,
          lockDuration: this.LOCKOUT_DURATION_MINUTES,
          lockedUntil: lockedUntil?.toISOString(),
        },
        request,
        false,
        `Account locked for ${this.LOCKOUT_DURATION_MINUTES} minutes`,
      );
    }
  }

  async logout(userId: string, token: string, request?: any): Promise<void> {
    // Blacklist the token
    await this.tokenBlacklistService.blacklistToken(token);

    await this.auditService.logAuthEvent(
      AuditAction.LOGOUT,
      userId,
      {},
      request,
      true,
    );
  }

  // Helper methods
  private async generateTokens(user: any) {
    const payload = { email: user.email, sub: user.id, role: user.role };
    return {
      access_token: this.jwtService.sign(payload),
    };
  }

  private sanitizeUser(user: any) {
    const { passwordHash, failedLoginAttempts, lockedUntil, ...sanitizedUser } =
      user;
    return sanitizedUser;
  }

  /**
   * Create SSO link to WHMCS for general access
   */
  async createSsoLink(
    userId: string,
    destination?: string,
  ): Promise<{ url: string; expiresAt: string }> {
    try {
      // Production-safe logging - no sensitive data
      this.logger.log("Creating SSO link request");

      // Get WHMCS client ID from user mapping
      const mapping = await this.mappingsService.findByUserId(userId);

      if (!mapping?.whmcsClientId) {
        this.logger.warn("SSO link creation failed: No WHMCS mapping found");
        throw new UnauthorizedException("WHMCS client mapping not found");
      }

      // Create SSO token using custom redirect for better compatibility
      let ssoDestination = "sso:custom_redirect";
      let ssoRedirectPath = destination || "clientarea.php";

      const result = await this.whmcsService.createSsoToken(
        mapping.whmcsClientId,
        ssoDestination,
        ssoRedirectPath,
      );

      this.logger.log("SSO link created successfully");

      return result;
    } catch (error) {
      // Production-safe error logging - no sensitive data or stack traces
      this.logger.error("SSO link creation failed", {
        errorType: error instanceof Error ? error.constructor.name : "Unknown",
        message: getErrorMessage(error),
      });
      throw error;
    }
  }
}