<?php

namespace App\Security;

use App\BusProNet\UserDataHandler;
use App\Entity\Teamer;
use App\Entity\User;
use App\RequiredTeamerCheck\RequiredTeamerCheckRegistry;
use App\Security\OAuth2\AuthorizationDeniedException;
use App\Security\OAuth2\AuthorizationRequestException;
use App\Security\OAuth2\MyEpClient;
use Doctrine\ORM\EntityManagerInterface;
use Flagception\Manager\FeatureManagerInterface;
use League\OAuth2\Client\Provider\Exception\IdentityProviderException;
use Psr\Http\Client\ClientExceptionInterface;
use Psr\Log\LoggerInterface;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
use Symfony\Component\Security\Http\Util\TargetPathTrait;

class MyEpAuthenticator extends AbstractAuthenticator
{
    use TargetPathTrait;

    /**
     * The roles that entitle someone to log in here at all. Anything else MyE&P reports
     * is dropped rather than stored, so that no role this application assigns a meaning
     * to can be set from the outside.
     *
     * This list exists a second time on MyE&P, as the required_roles of this application's
     * oauth2_client row: MyE&P refuses the authorization request outright when the account
     * holds none of them, and explains why on its own page. The two are one policy written
     * twice and must be changed together — widening only one either strands a user at MyE&P
     * with no explanation this side can give, or lets one through to be refused here.
     */
    private const ELIGIBLE_ROLES = ['ROLE_TEAM_ADMIN', 'ROLE_TEAMER', 'ROLE_MANAGER', 'ROLE_HOUSE_MANAGER'];

    public function __construct(
        private readonly MyEpClient $client,
        private readonly UserDataHandler $userDataHandler,
        private readonly EntityManagerInterface $entityManager,
        private readonly UrlGeneratorInterface $urlGenerator,
        private readonly LoggerInterface $logger,
        private readonly FeatureManagerInterface $featureManager,
        private readonly RequiredTeamerCheckRegistry $requiredTeamerCheckRegistry,
    ) {
    }

    public function supports(Request $request): ?bool
    {
        if ('app_myep_auth_check' !== $request->attributes->get('_route')) {
            return false;
        }

        // the controller guards the route as well, but the authenticator must not fire
        // on a disabled feature either: it is what creates and updates accounts
        return $this->featureManager->isActive('myep_login');
    }

    public function authenticate(Request $request): Passport
    {
        try {
            $accessToken = $this->client->fetchAccessToken($request);
        } catch (AuthorizationDeniedException $e) {
            // MyE&P said why it sent no code, so this is not a failure to report as one
            $this->logger->info('Login via MyE&P was denied', [
                'error' => $e->getError(),
                'error_description' => $e->getErrorDescription(),
            ]);
            throw new CustomUserMessageAuthenticationException('Login via MyE&P wurde abgebrochen');
        } catch (AuthorizationRequestException|IdentityProviderException $e) {
            $this->logger->error('Login via MyE&P failed due to unobtainable access token', [
                'exception' => $e,
            ]);
            throw new CustomUserMessageAuthenticationException('Login via MyE&P nicht möglich');
        }

        try {
            $provider = $this->client->getProvider();
            $url = $provider->getResourceOwnerDetailsUrl($accessToken);
            $userinfoRequest = $provider->getAuthenticatedRequest('GET', $url, $accessToken, [
                'headers' => [
                    'Accept' => 'application/json',
                    'Content-Type' => 'application/json',
                ],
            ]);
            $response = $provider->getHttpClient()->sendRequest($userinfoRequest);
        } catch (ClientExceptionInterface $e) {
            $this->logger->error('Login via MyE&P failed due to unexpected userinfo response');
            throw new CustomUserMessageAuthenticationException('Login via MyE&P nicht möglich');
        }

        $userinfo = json_decode($response->getBody(), true);

        if (false === is_array($userinfo)) {
            $this->logger->error('Login via MyE&P failed due to unreadable userinfo payload');
            throw new CustomUserMessageAuthenticationException('Login via MyE&P nicht möglich');
        }

        if (null === ($userinfo['email'] ?? null)) {
            $this->logger->error('Login via MyE&P failed due to missing username claim');
            throw new CustomUserMessageAuthenticationException('Login via MyE&P nicht möglich');
        }

        $user = $this->createOrUpdateUserFromUserinfo($userinfo);

        if (null === $user) {
            throw new CustomUserMessageAuthenticationException('Login via MyE&P nicht möglich');
        }

        // The user is resolved here rather than by the user provider: the account is
        // matched on the BusPro ids, which the provider cannot do, and handing it an
        // email would risk loading a different row than the one just written. The
        // UserChecker still runs and still refuses deleted, disabled and unapproved
        // accounts.
        return new SelfValidatingPassport(
            new UserBadge($user->getUserIdentifier(), static fn (): User => $user),
        );
    }

    public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
    {
        /** @var User $user */
        $user = $token->getUser();

        // recorded here rather than while importing, so that only a login that actually
        // passed the UserChecker is counted as one
        $user->setLastLoginAt(new \DateTimeImmutable());
        $this->entityManager->flush();

        $this->logger->info('Logged in');

        if ($targetPath = $this->getTargetPath($request->getSession(), $firewallName)) {
            return new RedirectResponse($targetPath);
        }

        $route = $user->getDefaultRoute();
        if ('app_teamer_index' === $route) {
            $check = $this->requiredTeamerCheckRegistry->getFirstUnresolvedCheck($user);
            if (null !== $check) {
                $route = $check->getRouteName();
            }
        }

        $url = $this->urlGenerator->generate($route);

        return new RedirectResponse($url);
    }

    public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
    {
        $request->getSession()->getBag('flashes')->add('error', $exception->getMessage());

        $redirectUrl = $this->urlGenerator->generate('app_security_login');

        return new RedirectResponse($redirectUrl);
    }

    private function createOrUpdateUserFromUserinfo(array $userinfo): ?User
    {
        $claimedRoles = $this->collectClaimedRoles($userinfo);

        if ([] === $claimedRoles) {
            return null;
        }

        $isTeamer = in_array('ROLE_TEAMER', $claimedRoles, true);
        $pendingRoles = $this->userDataHandler->toPendingRoles($claimedRoles);
        $hotelCodes = $this->collectHotelCodes($userinfo);

        $user = $this->findLocalUser($userinfo);

        // A deleted account is excluded from every process, and MyE&P must not be able to
        // undo that: no data is written back, no role is granted or revoked, not even
        // lastLoginAt is bumped. It is returned untouched so the UserChecker can refuse
        // the login and say why. Only an admin restores it.
        if (true === $user?->isDeleted()) {
            $this->logger->info('Skip MyE&P sync for deleted user', [
                'user_id' => $user->getId(),
                'user_email' => $userinfo['email'],
            ]);

            return $user;
        }

        // Update existing user. MyE&P leads here exactly as BusPro does on the other login
        // path - the shared policy in UserDataHandler withdraws what is no longer claimed
        // and marks administrative claims for approval rather than granting them.
        if (null !== $user) {
            $this->refreshBusProIds($user, $userinfo);
            $this->userDataHandler->syncRoles($user, $claimedRoles);
            $this->userDataHandler->syncHotelCodes($user, $hotelCodes);

            $this->entityManager->flush();

            return $user;
        }

        return $this->createLocalUser($userinfo, $pendingRoles, $isTeamer, $hotelCodes);
    }

    /**
     * The roles MyE&P grants this person in this application.
     *
     * The remote list is filtered down to the eligible roles rather than trusted as it
     * stands: anything else the identity provider reports is meaningless here at best,
     * and at worst a role this application assigns a meaning to - ROLE_ADMINISTRATIVE
     * from the role hierarchy, say - which must never be settable from the outside.
     *
     * @return string[]
     */
    private function collectClaimedRoles(array $userinfo): array
    {
        $roles = $userinfo['roles'] ?? [];

        // User is expected to have at least one role
        if (false === is_array($roles) || [] === $roles) {
            // Claim keys only, the payload itself carries the full profile
            $this->logger->warning('Login via MyE&P failed due to missing roles claim', [
                'claims' => array_keys($userinfo),
            ]);

            return [];
        }

        // User is expected to have at least one of the roles teamer, manager, house manager or admin
        $claimedRoles = array_values(array_intersect(self::ELIGIBLE_ROLES, $roles));

        if ([] === $claimedRoles) {
            $this->logger->warning('Login via MyE&P failed due to lack of an eligible role', [
                'roles' => $roles,
                'eligible_roles' => self::ELIGIBLE_ROLES,
            ]);
        }

        return $claimedRoles;
    }

    /**
     * The houses MyE&P reports for this person. Read on both the create and the update
     * path, since they are led by the identity provider just like the roles are.
     *
     * @return string[]
     */
    private function collectHotelCodes(array $userinfo): array
    {
        $profile = is_array($userinfo['profile'] ?? null) ? $userinfo['profile'] : [];

        return is_array($profile['hotel_codes'] ?? null) ? array_values($profile['hotel_codes']) : [];
    }

    /**
     * Matches the local account on the BusPro ids first and falls back to the email, the
     * same precedence UserDataHandler::findLocalUser() applies to a BusPro login, so that
     * the two login paths cannot create two accounts for the same person.
     */
    private function findLocalUser(array $userinfo): ?User
    {
        $repository = $this->entityManager->getRepository(User::class);

        $addressId = $userinfo['address_id'] ?? null;
        $personId = $userinfo['person_id'] ?? null;
        $email = mb_strtolower(trim($userinfo['email']));

        if (null !== $addressId && null !== $personId) {
            $user = $repository->findOneBy([
                'busProAddressId' => $addressId,
                'busProPersonId' => $personId,
            ]);

            if (null !== $user) {
                return $user;
            }
        }

        $users = $repository->findBy(['email' => $email]);

        if (1 !== count($users)) {
            if (1 < count($users)) {
                $this->logger->warning('Unable to match local user by email: multiple users found', [
                    'email' => $email,
                    'count' => count($users),
                ]);
            }

            return null;
        }

        return $users[0];
    }

    /**
     * Backfills the BusPro ids on an account matched by email, so the next login matches
     * on the ids instead. Never called for a deleted user, who must not be written to.
     */
    private function refreshBusProIds(User $user, array $userinfo): void
    {
        $addressId = $userinfo['address_id'] ?? null;
        $personId = $userinfo['person_id'] ?? null;

        if (null === $addressId || null === $personId) {
            $this->logger->warning('Skip BusPro ID refresh: userinfo missing IDs', [
                'user_id' => $user->getId(),
                'user_email' => $user->getEmail(),
                'bus_pro_address_id' => $addressId,
                'bus_pro_person_id' => $personId,
            ]);

            return;
        }

        $user
            ->setBusProAddressId((int) $addressId)
            ->setBusProPersonId((int) $personId)
        ;
    }

    /**
     * @param string[] $pendingRoles
     * @param string[] $hotelCodes
     */
    private function createLocalUser(array $userinfo, array $pendingRoles, bool $isTeamer, array $hotelCodes): ?User
    {
        $addressId = $userinfo['address_id'] ?? null;
        $personId = $userinfo['person_id'] ?? null;

        // Both are required columns and there is nothing sensible to fall back to, so an
        // account is not created at all rather than half-created from a partial payload
        if (null === $addressId || null === $personId) {
            $this->logger->warning('Login via MyE&P failed due to missing BusPro ID claims', [
                'email' => $userinfo['email'],
                'claims' => array_keys($userinfo),
            ]);

            return null;
        }

        $profile = is_array($userinfo['profile'] ?? null) ? $userinfo['profile'] : [];

        $user = new User();
        $user
            ->setFirstName($profile['first_name'] ?? null)
            ->setLastName($profile['last_name'] ?? null)
            ->setEmail((string) $userinfo['email'])
            ->setBusProAddressId((int) $addressId)
            ->setBusProPersonId((int) $personId)
            ->setHotelCodes($hotelCodes)
            ->setRoles([...$pendingRoles, ...($isTeamer ? ['ROLE_TEAMER'] : [])])
        ;

        if (true === $isTeamer) {
            $teamer = Teamer::fromUserinfo($userinfo);
            $user->setTeamer($teamer);

            $this->entityManager->persist($teamer);

            $this->logger->info('Create teamer', [
                'teamer_id' => $teamer->getId(),
                'teamer_name' => (string) $teamer,
            ]);
        }

        $this->entityManager->persist($user);
        $this->entityManager->flush();

        $this->logger->info('Create user', [
            'user_id' => $user->getId(),
            'user_email' => $user->getEmail(),
        ]);

        return $user;
    }
}