package com.aigeo.auth.service;

import com.aigeo.auth.dto.LoginRequest;
import com.aigeo.auth.dto.LoginResponse;
import com.aigeo.auth.dto.RegisterRequest;
import com.aigeo.common.enums.UserRole;
import com.aigeo.common.exception.BusinessException;
import com.aigeo.common.result.ResultCode;
import com.aigeo.common.security.JwtTokenUtil;
import com.aigeo.company.entity.User;
import com.aigeo.company.repository.UserRepository;
import com.aigeo.company.repository.CompanyRepository;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import org.springframework.util.StringUtils;

import java.time.LocalDateTime;
import java.util.HashMap;
import java.util.Map;
import java.util.UUID;
import java.util.concurrent.TimeUnit;

/**
 * 认证服务层
 * 
 * 负责用户认证相关的业务逻辑处理，包括：
 * - 用户登录认证和授权
 * - 用户注册和账户创建
 * - JWT令牌的生成和验证
 * - 密码重置和安全验证
 * - 登录会话管理
 *
 * @author AIGEO Team
 * @since 1.0.0
 */
@Slf4j
@Service
@RequiredArgsConstructor
@Transactional(readOnly = true)
public class AuthService {

    private final UserRepository userRepository;
    private final CompanyRepository companyRepository;
    private final PasswordEncoder passwordEncoder;
    private final JwtTokenUtil jwtTokenUtil;
    private final RedisTemplate<String, Object> redisTemplate;
    
    // Redis key 前缀
    private static final String BLACKLIST_TOKEN_PREFIX = "auth:blacklist:";
    private static final String REFRESH_TOKEN_PREFIX = "auth:refresh:";
    private static final String PASSWORD_RESET_PREFIX = "auth:reset:";
    private static final String LOGIN_ATTEMPTS_PREFIX = "auth:attempts:";
    
    // 安全配置
    private static final int MAX_LOGIN_ATTEMPTS = 5;
    private static final int LOCKOUT_DURATION_MINUTES = 30;
    private static final int REFRESH_TOKEN_VALIDITY_DAYS = 7;
    private static final int PASSWORD_RESET_VALIDITY_HOURS = 2;

    /**
     * 用户登录认证
     * 
     * @param request 登录请求参数
     * @param ipAddress 客户端IP地址
     * @param userAgent 用户代理字符串
     * @return 登录响应，包含JWT令牌和用户信息
     */
    @Transactional
    public LoginResponse login(LoginRequest request, String ipAddress, String userAgent) {
        log.debug("处理用户登录: {}", request.getUsername());
        
        // 参数验证
        if (!StringUtils.hasText(request.getUsername()) || !StringUtils.hasText(request.getPassword())) {
            throw new BusinessException(ResultCode.PARAM_ERROR, "用户名和密码不能为空");
        }
        
        // 检查登录尝试次数
        checkLoginAttempts(request.getUsername(), ipAddress);
        
        // 查找用户
        User user = findUserByUsernameOrEmail(request.getUsername());
        if (user == null) {
            recordFailedLoginAttempt(request.getUsername(), ipAddress);
            throw new BusinessException(ResultCode.USER_NOT_FOUND, "用户名或密码错误");
        }
        
        // 检查用户状态
        if (!Boolean.TRUE.equals(user.getIsActive())) {
            throw new BusinessException(ResultCode.USER_DISABLED, "账户已被禁用");
        }
        
        // 验证密码
        if (!passwordEncoder.matches(request.getPassword(), user.getPasswordHash())) {
            recordFailedLoginAttempt(request.getUsername(), ipAddress);
            throw new BusinessException(ResultCode.PASSWORD_ERROR, "用户名或密码错误");
        }
        
        // 检查公司状态
        if (!isCompanyActive(user.getCompanyId())) {
            throw new BusinessException(ResultCode.COMPANY_DISABLED, "所属公司账户异常，请联系管理员");
        }
        
        // 清除失败登录记录
        clearLoginAttempts(request.getUsername(), ipAddress);
        
        // 更新最后登录时间
        user.setLastLogin(LocalDateTime.now());
        userRepository.save(user);
        
        // 生成令牌
        String accessToken = jwtTokenUtil.generateToken(user);
        String refreshToken = generateRefreshToken(user);
        
        // 构建响应
        LoginResponse response = LoginResponse.builder()
                .accessToken(accessToken)
                .refreshToken(refreshToken)
                .tokenType("Bearer")
                .expiresIn(jwtTokenUtil.getTokenValidityInSeconds())
                .user(buildUserInfo(user))
                .build();
        
        log.info("用户登录成功: userId={}, companyId={}, role={}", 
                user.getId(), user.getCompanyId(), user.getRole());
        
        return response;
    }

    /**
     * 用户注册
     * 
     * @param request 注册请求参数
     * @param ipAddress 客户端IP地址
     * @param userAgent 用户代理字符串
     * @return 注册响应，包含JWT令牌和用户信息
     */
    @Transactional
    public LoginResponse register(RegisterRequest request, String ipAddress, String userAgent) {
        log.debug("处理用户注册: {}", request.getUsername());
        
        // 参数验证
        validateRegisterRequest(request);
        
        // 检查用户名和邮箱是否已存在
        if (userRepository.existsByUsername(request.getUsername())) {
            throw new BusinessException(ResultCode.USER_ALREADY_EXISTS, "用户名已存在");
        }
        
        if (userRepository.existsByEmail(request.getEmail())) {
            throw new BusinessException(ResultCode.EMAIL_ALREADY_EXISTS, "邮箱已被注册");
        }
        
        // 验证公司信息
        if (!companyRepository.existsById(request.getCompanyId())) {
            throw new BusinessException(ResultCode.COMPANY_NOT_FOUND, "公司不存在");
        }
        
        if (!isCompanyActive(request.getCompanyId())) {
            throw new BusinessException(ResultCode.COMPANY_DISABLED, "公司账户异常，无法注册");
        }
        
        // 创建用户
        User user = User.builder()
                .companyId(request.getCompanyId())
                .username(request.getUsername())
                .email(request.getEmail())
                .passwordHash(passwordEncoder.encode(request.getPassword()))
                .fullName(request.getFullName())
                .role(request.getRole() != null ? request.getRole() : UserRole.EDITOR)
                .isActive(true)
                .build();
        
        user = userRepository.save(user);
        
        // 生成令牌
        String accessToken = jwtTokenUtil.generateToken(user);
        String refreshToken = generateRefreshToken(user);
        
        // 构建响应
        LoginResponse response = LoginResponse.builder()
                .accessToken(accessToken)
                .refreshToken(refreshToken)
                .tokenType("Bearer")
                .expiresIn(jwtTokenUtil.getTokenValidityInSeconds())
                .user(buildUserInfo(user))
                .build();
        
        log.info("用户注册成功: userId={}, username={}, email={}", 
                user.getId(), user.getUsername(), user.getEmail());
        
        return response;
    }

    /**
     * 刷新访问令牌
     * 
     * @param refreshToken 刷新令牌
     * @return 新的登录响应
     */
    @Transactional
    public LoginResponse refreshToken(String refreshToken) {
        log.debug("处理令牌刷新请求");
        
        if (!StringUtils.hasText(refreshToken)) {
            throw new BusinessException(ResultCode.PARAM_ERROR, "刷新令牌不能为空");
        }
        
        // 验证刷新令牌
        String userIdStr = (String) redisTemplate.opsForValue()
                .get(REFRESH_TOKEN_PREFIX + refreshToken);
        
        if (userIdStr == null) {
            throw new BusinessException(ResultCode.TOKEN_INVALID, "刷新令牌无效或已过期");
        }
        
        // 获取用户信息
        Integer userId = Integer.valueOf(userIdStr);
        User user = userRepository.findById(userId)
                .orElseThrow(() -> new BusinessException(ResultCode.USER_NOT_FOUND, "用户不存在"));
        
        // 检查用户状态
        if (!Boolean.TRUE.equals(user.getIsActive())) {
            throw new BusinessException(ResultCode.USER_DISABLED, "账户已被禁用");
        }
        
        // 检查公司状态
        if (!isCompanyActive(user.getCompanyId())) {
            throw new BusinessException(ResultCode.COMPANY_DISABLED, "所属公司账户异常");
        }
        
        // 删除旧的刷新令牌
        redisTemplate.delete(REFRESH_TOKEN_PREFIX + refreshToken);
        
        // 生成新令牌
        String newAccessToken = jwtTokenUtil.generateToken(user);
        String newRefreshToken = generateRefreshToken(user);
        
        // 构建响应
        LoginResponse response = LoginResponse.builder()
                .accessToken(newAccessToken)
                .refreshToken(newRefreshToken)
                .tokenType("Bearer")
                .expiresIn(jwtTokenUtil.getTokenValidityInSeconds())
                .user(buildUserInfo(user))
                .build();
        
        log.debug("令牌刷新成功: userId={}", userId);
        return response;
    }

    /**
     * 用户登出
     * 
     * @param token 访问令牌
     * @param ipAddress 客户端IP地址
     */
    @Transactional
    public void logout(String token, String ipAddress) {
        log.debug("处理用户登出");
        
        if (!StringUtils.hasText(token)) {
            throw new BusinessException(ResultCode.PARAM_ERROR, "令牌不能为空");
        }
        
        try {
            // 验证令牌并获取用户信息
            Integer userId = jwtTokenUtil.getUserIdFromToken(token);
            
            // 将令牌加入黑名单
            long tokenExpirationTime = jwtTokenUtil.getTokenExpirationTime(token);
            long ttl = tokenExpirationTime - System.currentTimeMillis();
            
            if (ttl > 0) {
                redisTemplate.opsForValue().set(
                        BLACKLIST_TOKEN_PREFIX + token, 
                        "blacklisted", 
                        ttl, 
                        TimeUnit.MILLISECONDS
                );
            }
            
            log.info("用户登出成功: userId={}, IP={}", userId, ipAddress);
            
        } catch (Exception e) {
            log.warn("登出时令牌验证失败: {}", e.getMessage());
            // 即使令牌无效，也允许登出操作完成
        }
    }

    /**
     * 获取当前用户信息
     * 
     * @param token 访问令牌
     * @return 用户信息
     */
    public Object getCurrentUserInfo(String token) {
        log.debug("获取当前用户信息");
        
        if (!validateToken(token)) {
            throw new BusinessException(ResultCode.TOKEN_INVALID, "令牌无效");
        }
        
        Integer userId = jwtTokenUtil.getUserIdFromToken(token);
        User user = userRepository.findById(userId)
                .orElseThrow(() -> new BusinessException(ResultCode.USER_NOT_FOUND, "用户不存在"));
        
        return buildUserInfo(user);
    }

    /**
     * 验证令牌有效性
     * 
     * @param token 访问令牌
     * @return 是否有效
     */
    public boolean validateToken(String token) {
        if (!StringUtils.hasText(token)) {
            return false;
        }
        
        // 检查令牌是否在黑名单中
        if (Boolean.TRUE.equals(redisTemplate.hasKey(BLACKLIST_TOKEN_PREFIX + token))) {
            log.debug("令牌在黑名单中: {}", token.substring(0, 10) + "...");
            return false;
        }
        
        // 验证令牌格式和过期时间
        if (!jwtTokenUtil.validateToken(token)) {
            return false;
        }
        
        // 验证用户状态
        try {
            Integer userId = jwtTokenUtil.getUserIdFromToken(token);
            User user = userRepository.findById(userId).orElse(null);
            
            return user != null && Boolean.TRUE.equals(user.getIsActive()) && 
                   isCompanyActive(user.getCompanyId());
                   
        } catch (Exception e) {
            log.debug("令牌验证过程中出现异常: {}", e.getMessage());
            return false;
        }
    }

    /**
     * 发送密码重置邮件
     * 
     * @param email 用户邮箱
     * @param ipAddress 客户端IP地址
     */
    @Transactional
    public void sendPasswordResetEmail(String email, String ipAddress) {
        log.debug("发送密码重置邮件: {}", email);
        
        if (!StringUtils.hasText(email)) {
            throw new BusinessException(ResultCode.PARAM_ERROR, "邮箱地址不能为空");
        }
        
        // 查找用户（即使用户不存在也不暴露信息）
        User user = userRepository.findByEmail(email).orElse(null);
        if (user == null) {
            log.info("密码重置请求：用户不存在, email={}, IP={}", email, ipAddress);
            return; // 为了安全，不抛出异常
        }
        
        // 检查用户状态
        if (!Boolean.TRUE.equals(user.getIsActive())) {
            log.info("密码重置请求：用户已禁用, email={}, IP={}", email, ipAddress);
            return;
        }
        
        // 生成重置令牌
        String resetToken = UUID.randomUUID().toString();
        
        // 存储重置令牌（2小时有效）
        redisTemplate.opsForValue().set(
                PASSWORD_RESET_PREFIX + resetToken,
                user.getId().toString(),
                PASSWORD_RESET_VALIDITY_HOURS,
                TimeUnit.HOURS
        );
        
        // TODO: 发送邮件（集成邮件服务）
        // emailService.sendPasswordResetEmail(user.getEmail(), resetToken);
        
        log.info("密码重置邮件已发送: userId={}, email={}, IP={}", 
                user.getId(), email, ipAddress);
    }

    /**
     * 重置密码
     * 
     * @param resetToken 重置令牌
     * @param newPassword 新密码
     * @param ipAddress 客户端IP地址
     */
    @Transactional
    public void resetPassword(String resetToken, String newPassword, String ipAddress) {
        log.debug("执行密码重置");
        
        if (!StringUtils.hasText(resetToken) || !StringUtils.hasText(newPassword)) {
            throw new BusinessException(ResultCode.PARAM_ERROR, "重置令牌和新密码不能为空");
        }
        
        // 验证新密码强度
        validatePasswordStrength(newPassword);
        
        // 验证重置令牌
        String userIdStr = (String) redisTemplate.opsForValue().get(PASSWORD_RESET_PREFIX + resetToken);
        if (userIdStr == null) {
            throw new BusinessException(ResultCode.TOKEN_INVALID, "重置令牌无效或已过期");
        }
        
        // 获取用户信息
        Integer userId = Integer.valueOf(userIdStr);
        User user = userRepository.findById(userId)
                .orElseThrow(() -> new BusinessException(ResultCode.USER_NOT_FOUND, "用户不存在"));
        
        // 检查用户状态
        if (!Boolean.TRUE.equals(user.getIsActive())) {
            throw new BusinessException(ResultCode.USER_DISABLED, "账户已被禁用");
        }
        
        // 更新密码
        user.setPasswordHash(passwordEncoder.encode(newPassword));
        userRepository.save(user);
        
        // 删除重置令牌
        redisTemplate.delete(PASSWORD_RESET_PREFIX + resetToken);
        
        log.info("密码重置成功: userId={}, IP={}", userId, ipAddress);
    }

    // ========== 私有辅助方法 ==========

    /**
     * 根据用户名或邮箱查找用户
     */
    private User findUserByUsernameOrEmail(String usernameOrEmail) {
        // 首先尝试用户名查找
        return userRepository.findByUsername(usernameOrEmail)
                .orElseGet(() -> userRepository.findByEmail(usernameOrEmail).orElse(null));
    }

    /**
     * 检查公司状态是否活跃
     */
    private boolean isCompanyActive(Integer companyId) {
        if (companyId == null) return false;
        
        return companyRepository.findById(companyId)
                .map(company -> company.getStatus().isActive())
                .orElse(false);
    }

    /**
     * 生成刷新令牌
     */
    private String generateRefreshToken(User user) {
        String refreshToken = UUID.randomUUID().toString();
        
        // 存储到Redis（7天有效）
        redisTemplate.opsForValue().set(
                REFRESH_TOKEN_PREFIX + refreshToken,
                user.getId().toString(),
                REFRESH_TOKEN_VALIDITY_DAYS,
                TimeUnit.DAYS
        );
        
        return refreshToken;
    }

    /**
     * 构建用户信息响应
     */
    private Map<String, Object> buildUserInfo(User user) {
        Map<String, Object> userInfo = new HashMap<>();
        userInfo.put("id", user.getId());
        userInfo.put("username", user.getUsername());
        userInfo.put("email", user.getEmail());
        userInfo.put("fullName", user.getFullName());
        userInfo.put("role", user.getRole());
        userInfo.put("companyId", user.getCompanyId());
        userInfo.put("avatarUrl", user.getAvatarUrl());
        userInfo.put("lastLogin", user.getLastLogin());
        
        return userInfo;
    }

    /**
     * 检查登录尝试次数
     */
    private void checkLoginAttempts(String username, String ipAddress) {
        String key = LOGIN_ATTEMPTS_PREFIX + username + ":" + ipAddress;
        Integer attempts = (Integer) redisTemplate.opsForValue().get(key);
        
        if (attempts != null && attempts >= MAX_LOGIN_ATTEMPTS) {
            throw new BusinessException(ResultCode.ACCOUNT_LOCKED, 
                    "登录失败次数过多，账户已被锁定" + LOCKOUT_DURATION_MINUTES + "分钟");
        }
    }

    /**
     * 记录失败登录尝试
     */
    private void recordFailedLoginAttempt(String username, String ipAddress) {
        String key = LOGIN_ATTEMPTS_PREFIX + username + ":" + ipAddress;
        Integer attempts = (Integer) redisTemplate.opsForValue().get(key);
        attempts = (attempts == null) ? 1 : attempts + 1;
        
        redisTemplate.opsForValue().set(key, attempts, LOCKOUT_DURATION_MINUTES, TimeUnit.MINUTES);
    }

    /**
     * 清除登录尝试记录
     */
    private void clearLoginAttempts(String username, String ipAddress) {
        String key = LOGIN_ATTEMPTS_PREFIX + username + ":" + ipAddress;
        redisTemplate.delete(key);
    }

    /**
     * 验证注册请求参数
     */
    private void validateRegisterRequest(RegisterRequest request) {
        if (!StringUtils.hasText(request.getUsername())) {
            throw new BusinessException(ResultCode.PARAM_ERROR, "用户名不能为空");
        }
        
        if (!StringUtils.hasText(request.getEmail())) {
            throw new BusinessException(ResultCode.PARAM_ERROR, "邮箱不能为空");
        }
        
        if (!StringUtils.hasText(request.getPassword())) {
            throw new BusinessException(ResultCode.PARAM_ERROR, "密码不能为空");
        }
        
        if (request.getCompanyId() == null) {
            throw new BusinessException(ResultCode.PARAM_ERROR, "公司ID不能为空");
        }
        
        // 验证邮箱格式
        if (!isValidEmail(request.getEmail())) {
            throw new BusinessException(ResultCode.PARAM_ERROR, "邮箱格式不正确");
        }
        
        // 验证密码强度
        validatePasswordStrength(request.getPassword());
    }

    /**
     * 验证邮箱格式
     */
    private boolean isValidEmail(String email) {
        return email != null && email.matches("^[\\w-\\.]+@([\\w-]+\\.)+[\\w-]{2,4}$");
    }

    /**
     * 验证密码强度
     */
    private void validatePasswordStrength(String password) {
        if (password == null || password.length() < 8) {
            throw new BusinessException(ResultCode.PARAM_ERROR, "密码长度不能少于8位");
        }
        
        if (password.length() > 128) {
            throw new BusinessException(ResultCode.PARAM_ERROR, "密码长度不能超过128位");
        }
        
        // TODO: 添加更复杂的密码强度验证规则
        // 例如：必须包含大小写字母、数字、特殊字符等
    }
}