package main

import (
	"encoding/json"
	"fmt"
	"llostre/backend/auth"
	"llostre/backend/fetchers"
	"log/slog"
	"net/http"
	"os"
	"strings"
	"sync"
	"time"

	"github.com/joho/godotenv"
)

var (
	logger        *slog.Logger
	backendURL    string
	frontendURL   string
	slingshotURL  string
	sessionsMutex sync.RWMutex
	sessions      = make(map[string]*auth.OAuthState)
	cache         *fetchers.Cache
)

func init() {
	godotenv.Load("../.env")

	// setup URLs
	appDomain := os.Getenv("APP_DOMAIN")
	if appDomain == "" {
		appDomain = "http://127.0.0.1:8080"
	}

	backendURL = appDomain + "/api"
	frontendURL = appDomain

	// setup logger
	logLevel := slog.LevelInfo
	switch strings.ToLower(os.Getenv("LOG_LEVEL")) {
	case "debug":
		logLevel = slog.LevelDebug
	case "info":
		logLevel = slog.LevelInfo
	case "warn":
		logLevel = slog.LevelWarn
	case "error":
		logLevel = slog.LevelError
	}

	logger = slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{
		Level: logLevel,
	}))

	slingshotURL = os.Getenv("SLINGSHOT_URL")

	cache = fetchers.NewCache()
}

func loginHandler(w http.ResponseWriter, r *http.Request) {
	handle := r.URL.Query().Get("handle")
	if handle == "" {
		http.Error(w, "handle parameter required", http.StatusBadRequest)
		return
	}

	did, err := fetchers.FetchDID(handle)
	if err != nil {
		http.Error(w, fmt.Sprintf("failed to resolve handle: %v", err), http.StatusInternalServerError)
		return
	}

	pds, err := fetchers.FetchPDS(did)
	if err != nil {
		http.Error(w, fmt.Sprintf("failed to fetch PDS: %v", err), http.StatusInternalServerError)
		return
	}
	logger.Debug("Resolved DID and PDS", "did", did, "pds", pds)

	// fetch oauth metadata from PDS
	metadata, err := auth.FetchOAuthMetadata(pds)
	if err != nil {
		http.Error(w, fmt.Sprintf("failed to fetch oauth metadata: %v", err), http.StatusInternalServerError)
		return
	}

	state, err := auth.GenerateRandomToken()
	if err != nil {
		http.Error(w, "failed to generate state", http.StatusInternalServerError)
		return
	}

	verifier, err := auth.GenerateRandomToken()
	if err != nil {
		http.Error(w, "failed to generate verifier", http.StatusInternalServerError)
		return
	}

	// generate DPoP keypair
	keypair, err := auth.GenerateDPoPKeyPair()
	if err != nil {
		http.Error(w, "failed to generate keypair", http.StatusInternalServerError)
		return
	}

	sessionsMutex.Lock()
	sessions[state] = &auth.OAuthState{
		State:        state,
		CodeVerifier: verifier,
		DID:          did,
		PDS:          pds,
		KeyPair:      keypair,
	}
	sessionsMutex.Unlock()

	config := auth.OAuthConfig{
		ClientID:    backendURL + "/callback",
		RedirectURI: backendURL + "/callback",
		Scopes:      []string{"atproto"},
	}

	challenge := auth.GenerateCodeChallenge(verifier)
	authURL := auth.BuildAuthorizationURL(metadata, &config, state, challenge, handle)

	// redirect user to PDS
	http.Redirect(w, r, authURL, http.StatusFound)
}

func callbackHandler(w http.ResponseWriter, r *http.Request) {
	// serve client metadata if no oauth params present
	if r.URL.Query().Get("code") == "" && r.URL.Query().Get("state") == "" && r.URL.Query().Get("error") == "" {
		w.Header().Set("Content-Type", "application/json")
		json.NewEncoder(w).Encode(map[string]interface{}{
			"client_id":                  backendURL + "/callback",
			"client_name":                "llostre",
			"redirect_uris":              []string{backendURL + "/callback"},
			"scope":                      "atproto",
			"grant_types":                []string{"authorization_code", "refresh_token"},
			"response_types":             []string{"code"},
			"token_endpoint_auth_method": "none",
			"application_type":           "web",
			"dpop_bound_access_tokens":   true,
		})
		return
	}

	code := r.URL.Query().Get("code")
	state := r.URL.Query().Get("state")

	if code == "" || state == "" {
		http.Error(w, "missing code or state", http.StatusBadRequest)
		return
	}

	// verify state matches stored session
	sessionsMutex.RLock()
	oauthState, exists := sessions[state]
	sessionsMutex.RUnlock()

	if !exists {
		http.Error(w, "invalid state", http.StatusBadRequest)
		return
	}

	// exchange code for tokens
	tokens, err := auth.ExchangeCodeForTokens(
		oauthState.PDS,
		code,
		oauthState.CodeVerifier,
		backendURL+"/callback",
		oauthState.KeyPair,
	)
	if err != nil {
		http.Error(w, fmt.Sprintf("token exchange failed: %v", err), http.StatusInternalServerError)
		return
	}

	// create session with tokens
	sessionToken, err := auth.GenerateRandomToken()
	if err != nil {
		http.Error(w, "failed to generate session token", http.StatusInternalServerError)
		return
	}

	// store session with tokens from the callback
	sessionsMutex.Lock()
	sessions[sessionToken] = &auth.OAuthState{
		State:        sessionToken,
		DID:          oauthState.DID,
		PDS:          oauthState.PDS,
		AccessToken:  tokens.AccessToken,
		RefreshToken: tokens.RefreshToken,
		ExpiresAt:    time.Now().Add(time.Duration(tokens.ExpiresIn) * time.Second),
		KeyPair:      oauthState.KeyPair,
	}
	delete(sessions, state) // remove the partial oauth state from login
	sessionsMutex.Unlock()

	logger.Debug("About to set cookie", "token", sessionToken)

	// set session cookie
	http.SetCookie(w, &http.Cookie{
		Name:     "session_token",
		Value:    sessionToken,
		Path:     "/",
		HttpOnly: true,
		Secure:   strings.HasPrefix(backendURL, "https"),
		SameSite: http.SameSiteLaxMode,
		MaxAge:   86400 * 30,
	})

	logger.Debug("Cookie set, redirecting to frontend", "destination", frontendURL+"/")

	// redirect to main app
	http.Redirect(w, r, frontendURL, http.StatusFound)
}

func sessionHandler(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Access-Control-Allow-Origin", frontendURL)
	w.Header().Set("Access-Control-Allow-Credentials", "true")
	w.Header().Set("Access-Control-Allow-Methods", "GET, OPTIONS")
	w.Header().Set("Access-Control-Allow-Headers", "Content-Type")

	if r.Method == "OPTIONS" {
		w.WriteHeader(http.StatusOK)
		return
	}

	// get session token from cookie
	cookie, err := r.Cookie("session_token")
	if err != nil {
		w.WriteHeader(http.StatusUnauthorized)
		return
	}

	// check if session exists
	sessionsMutex.RLock()
	_, exists := sessions[cookie.Value]
	sessionsMutex.RUnlock()

	if !exists {
		w.WriteHeader(http.StatusUnauthorized)
		return
	}
	w.WriteHeader(http.StatusOK)
}

func refreshTokens(session *auth.OAuthState, cookieValue string) error {
	// Check for access token refresh
	needsRefresh := time.Now().After(session.ExpiresAt)
	pds := session.PDS
	refreshToken := session.RefreshToken
	keypair := session.KeyPair
	sessionsMutex.RUnlock()

	if needsRefresh {
		newTokens, err := auth.RefreshAccessToken(pds, refreshToken, backendURL+"/callback", keypair)
		if err != nil {
			sessionsMutex.Lock()
			delete(sessions, cookieValue)
			sessionsMutex.Unlock()
			logger.Error("no authorization servers found for token refresh")
			return fmt.Errorf("no authorization servers found")
		}

		sessionsMutex.Lock()
		session.AccessToken = newTokens.AccessToken
		session.RefreshToken = newTokens.RefreshToken
		session.ExpiresAt = time.Now().Add(time.Duration(newTokens.ExpiresIn) * time.Second)
		sessionsMutex.Unlock()
	}

	return nil
}

func postsHandler(w http.ResponseWriter, r *http.Request) {
	logger.Debug("posts handler start")

	cookie, err := r.Cookie("session_token")
	if err != nil {
		logger.Error("cookie not received", "error", err)
		http.Error(w, "unauthorized", http.StatusUnauthorized)
		return
	}

	logger.Debug("cookie received", "value", cookie.Value)

	sessionsMutex.RLock()
	session, exists := sessions[cookie.Value]
	if !exists {
		sessionsMutex.RUnlock()
		http.Error(w, "invalid session", http.StatusUnauthorized)
		return
	}

	logger.Debug("session found", "did", session.DID, "pds", session.PDS, "access token length", len(session.AccessToken), "session keypair", session.KeyPair)
	if session.KeyPair != nil {
		logger.Debug("session public key", "key", session.KeyPair.PublicKey)
	}

	refreshTokens(session, cookie.Value)

	// Fetch app.bsky.feed.post records
	posts, err := fetchers.FetchAppBskyFeedPosts(logger, session.DID, session.PDS, slingshotURL, session, cache)
	if err != nil {
		logger.Error("fetching app.bsky.feed.posts failed", "error", err)
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}

	logger.Debug("successfully fetched posts", "number", len(posts))

	w.Header().Set("Access-Control-Allow-Origin", "*")
	w.Header().Set("Content-Type", "application/json")
	json.NewEncoder(w).Encode(posts)
}

func main() {
	// serve static files
	fs := http.FileServer(http.Dir("../frontend/dist"))
	http.Handle("/", fs)

	// api routes
	http.HandleFunc("/api/posts", postsHandler)
	http.HandleFunc("/api/session", sessionHandler)
	http.HandleFunc("/api/login", loginHandler)
	http.HandleFunc("/api/callback", callbackHandler)
	http.ListenAndServe("0.0.0.0:8080", nil)
}