using System.Text;
using adas_core.Application.Repositories.Interfaces;
using adas_core.Application.Services.Interfaces;
using adas_core.Domain.Models.AppSettings;
using adas_core.Domain.Models.MongoModels;
using adas_core.Domain.Models.Responses;
using adas_core.Domain.Utils;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
using MongoDB.Bson;
using Newtonsoft.Json;

namespace adas_core.Application.Services;

/// <summary>
/// Provides an implementation of the <see cref="IAuthService"/> interface, offering
/// authentication-related services to consuming components.
/// </summary>
/// <!-- aidoc:v1 sig=c025df9 -->
public class AuthService : IAuthService
{
    private readonly IAuthorityRepository _authorityRepository;
    private readonly ILogger<AuthService> _logger;
    private readonly RecordingSettings _recordingSettings;

    //private LoginResponse? _loginResponse;

    /// <summary>
    /// Initializes a new instance of the <see cref="AuthService"/> class, capturing the recording settings, logger, and authority repository required for authentication operations.
    /// </summary>
    /// <param name="recordingSettings">The <see cref="IOptions{RecordingSettings}"/> providing access to the configured <see cref="RecordingSettings"/>.</param>
    /// <param name="logger">The <see cref="ILogger{AuthService}"/> used to log authentication activity.</param>
    /// <param name="authorityRepository">The <see cref="IAuthorityRepository"/> used to access authority data.</param>
    /// <exception cref="Exception">Thrown when <paramref name="recordingSettings"/>.Value is <see langword="null"/>.</exception>
    /// <!-- aidoc:v1 sig=acf40f6 body=d2bb62a -->
    public AuthService(IOptions<RecordingSettings> recordingSettings, ILogger<AuthService> logger,
        IAuthorityRepository authorityRepository)
    {
        _recordingSettings = recordingSettings.Value ??
                             throw new Exception("RecordingSettings must be defined on appSettings");

        _logger = logger;

        _authorityRepository = authorityRepository;

        _ = InstanceAuthUtils();
    }

    /// <summary>
    /// Asynchronously obtains a login token from the recording API using the configured client credentials and caches it for reuse via <see cref="AuthUtils"/>.
    /// </summary>
    /// <returns>A <see cref="LoginResponse"/> containing the authentication token when the request succeeds and the response is valid; otherwise, <c>null</c> if the API URL is not configured, the request fails, the returned token is empty, or an exception is caught and logged.</returns>
    /// <!-- aidoc:v1 sig=6d8b512 body=bfaf63a -->
    public async Task<LoginResponse?> GetLoginResponse()
    {
        try
        {
            if (_recordingSettings.RecordingApiUrl.IsEmpty())
            {
                _logger.LogInformation("Url not defined to get token on AuthUtils...");
                return null;
            }

            var user = new
            {
                Username = _recordingSettings.RecordingOrApiClientId,
                Password = _recordingSettings.RecordingOrApiClientSecret
            };

            var handler = new HttpClientHandler
            {
                ServerCertificateCustomValidationCallback = (_, _, _, _) => true
            };

            var client = new HttpClient(handler);
            var json = JsonConvert.SerializeObject(user);

            var data = new StringContent(json, Encoding.UTF8, "application/json");
            var response = await client.PostAsync($"{_recordingSettings.RecordingApiUrl}/users/login", data);
            var respToken = response.IsSuccessStatusCode ? await response.Content.ReadAsStringAsync() : null;
            if (respToken != null)
            {
                var ton = JsonConvert.DeserializeObject<LoginResponse>(respToken);
                if (ton != null && !ton.Token.IsEmpty())
                {
                    AuthUtils.Instance.LoginResponse = ton;
                    return ton;
                }
            }

            return null;
        }
        catch (Exception e)
        {
            _logger.LogError("Error trying to get token: exception: {eMessage}", e.Message);
            return null;
        }
    }

    /// <summary>
    /// Retrieves an authentication token, returning the cached token if it is not empty or expired.
    /// Otherwise, attempts a fresh login and returns the new token, falling back to an empty string when no token is obtained.
    /// </summary>
    /// <returns>A task that resolves to the authentication token, or an empty string if the token could not be obtained.</returns>
    /// <!-- aidoc:v1 sig=2e832cc body=0ab9bf1 -->
    public async Task<string> GetToken()
    {
        var loginResponse = AuthUtils.Instance.GetLoginResponse();
        if (!loginResponse.Token.IsEmptyOrWhiteSpace() && !loginResponse.IsExpired()) return loginResponse.Token;
        var resp = await GetLoginResponse();
        if (resp != null) return resp.Token;
        _logger.LogWarning("Failed Getting token check recordingSettings for user and pass");
        return "";
    }

    /// <summary>
    /// Retrieves a list of authorizations associated with the specified unit identifier by delegating to the authority repository.
    /// </summary>
    /// <param name="unitId">The unique identifier of the unit whose authorizations are being retrieved.</param>
    /// <returns>A task that represents the asynchronous operation, containing a list of <see cref="Authorization"/> objects for the specified unit.</returns>
    /// <!-- aidoc:v1 sig=37cf403 body=9b4aba2 -->
    public async Task<List<Authorization>> GetByUnitId(ObjectId unitId)
    {
        return await _authorityRepository.GetByUnitId(unitId);
    }

    /// <summary>
    /// Retrieves the list of authorizations associated with the specified user identifier.
    /// </summary>
    /// <param name="id">The unique identifier of the user whose authorities are being requested.</param>
    /// <returns>A task that represents the asynchronous operation, containing a list of <see cref="Authorization"/> entries for the user.</returns>
    /// <!-- aidoc:v1 sig=7b40daa body=48ea4d9 -->
    public async Task<List<Authorization>> GetUserAuthorities(ObjectId id)
    {
        return await _authorityRepository.GetUserAuthorities(id);
    }

    /// <summary>
    /// Deletes all authorities associated with the specified unit identifier by delegating to the authority repository.
    /// </summary>
    /// <param name="unitId">The identifier of the unit whose authorities are to be removed.</param>
    /// <returns>A task that represents the asynchronous operation. The task result is <c>true</c> if the deletion was successful; otherwise, <c>false</c>.</returns>
    /// <!-- aidoc:v1 sig=d4333b3 body=ae8ffe1 -->
    public async Task<bool> DeleteByUnitId(ObjectId unitId)
    {
        return await _authorityRepository.DeleteAllAuthoritiesByUnit(unitId);
    }

    /// <summary>
    /// Deletes all authorities associated with the specified display identifier by delegating to the authority repository.
    /// </summary>
    /// <param name="displayId">The unique identifier of the display whose related authorities should be removed.</param>
    /// <returns>A task that resolves to <c>true</c> if authorities were successfully deleted; otherwise, <c>false</c>.</returns>
    /// <!-- aidoc:v1 sig=87a9f41 body=fa867f0 -->
    public async Task<bool> DeleteByDisplayId(ObjectId displayId)
    {
        return await _authorityRepository.DeleteAllAuthoritiesByDisplay(displayId);
    }

    /// <summary>
    /// Ensures the authentication utilities are initialized with a valid login token. Returns early if the recording API URL is not configured; otherwise, requests a new token when the current one is missing or expired, and updates the shared <see cref="AuthUtils"/> instance with the refreshed response when successful.
    /// </summary>
    /// <!-- aidoc:v1 sig=e577d60 body=e927320 -->
    private async Task InstanceAuthUtils()
    {
        if (_recordingSettings.RecordingApiUrl.IsEmpty())
        {
            _logger.LogInformation(
                "RecordingOrApiUrl not defined on appsettings RecordingSettings AuthUtils not instanciated");
            return;
        }

        if (AuthUtils.Instance.GetLoginResponse().Token.IsEmpty() || AuthUtils.Instance.GetLoginResponse().IsExpired())
        {
            _logger.LogInformation("Token is not generated or is expired sending request for new token");
            var newLoginResponse = await GetLoginResponse();
            if (newLoginResponse == null)
            {
                _logger.LogError("Token request is null check recordingSettings for user, pass and authorities");
            }
            else
            {
                _logger.LogInformation("New Token generated at UTC DATE: {DateTime} exires at: {newLoginResponse}",
                    DateTime.UtcNow, newLoginResponse.Expiration);
                AuthUtils.Instance.LoginResponse = newLoginResponse;
            }
        }
    }
}