package app

import (
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"errors"
	"io"
	"net"
	"net/http"
	"os"
	"path/filepath"
	"sort"
	"sync"
	"time"
)

const accountLifetime = 30 * 24 * time.Hour
const accountLimit = 1000
const accountSessionLimit = 16

var errAccountStore = errors.New("账号数据无法读取，原文件已保留，请检查数据目录或恢复备份")

type accountRecord struct {
	OnlineOnly            bool      `json:"onlineOnly,omitempty"`
	Sources               []string  `json:"sources,omitempty"`
	Admin                 bool      `json:"admin,omitempty"`
	RequirePasswordChange bool      `json:"requirePasswordChange,omitempty"`
	ID                    string    `json:"id"`
	Username              string    `json:"username"`
	Salt                  string    `json:"salt"`
	PasswordHash          string    `json:"passwordHash"`
	Iterations            int       `json:"iterations"`
	Algorithm             string    `json:"algorithm"`
	CreatedAt             time.Time `json:"createdAt"`
}

type accountPublic struct {
	OnlineOnly            bool      `json:"onlineOnly"`
	Sources               []string  `json:"sources"`
	Admin                 bool      `json:"admin"`
	RequirePasswordChange bool      `json:"requirePasswordChange"`
	Username              string    `json:"username"`
	CreatedAt             time.Time `json:"createdAt"`
}

func (account accountRecord) public() accountPublic {
	return accountPublic{OnlineOnly: account.onlineOnly(), Sources: account.effectiveSources(), Username: account.Username, CreatedAt: account.CreatedAt, Admin: account.Admin, RequirePasswordChange: account.RequirePasswordChange}
}

func (account accountRecord) viewerID() string {
	return viewerID("account:" + account.ID)
}

type accountSession struct {
	Account   string    `json:"account"`
	CreatedAt time.Time `json:"createdAt"`
	ExpiresAt time.Time `json:"expiresAt"`
}

type accountGuestImport struct {
	Account   string `json:"account"`
	Completed bool   `json:"completed"`
}

type accountState struct {
	RequireLogin      bool                          `json:"requireLogin"`
	AllowRegistration bool                          `json:"allowRegistration"`
	Version           int                           `json:"version"`
	Accounts          map[string]accountRecord      `json:"accounts"`
	Sessions          map[string]accountSession     `json:"sessions"`
	GuestImports      map[string]accountGuestImport `json:"guestImports,omitempty"`
}

type accountAttempt struct {
	count int
	until time.Time
}

type accountStore struct {
	mu       sync.Mutex
	path     string
	state    accountState
	err      error
	attempts map[string]accountAttempt
	hashing  chan struct{}
}

func validAccountHex(value string, size int) bool {
	decoded, err := hex.DecodeString(value)
	return err == nil && len(decoded) == size && hex.EncodeToString(decoded) == value
}

func (manager *viewerManager) accountStore() *accountStore {
	manager.accountsOnce.Do(func() {
		store := &accountStore{path: filepath.Join(manager.directory, "accounts.json"),
			state:    accountState{Version: 1, AllowRegistration: true, Accounts: map[string]accountRecord{}, Sessions: map[string]accountSession{}, GuestImports: map[string]accountGuestImport{}},
			attempts: map[string]accountAttempt{}, hashing: make(chan struct{}, 2)}
		store.err = store.load()
		manager.accounts = store
	})
	return manager.accounts
}

func (store *accountStore) load() error {
	file, err := os.Open(store.path)
	if errors.Is(err, os.ErrNotExist) {
		return nil
	}
	if err != nil {
		return errAccountStore
	}
	defer file.Close()
	state := accountState{AllowRegistration: true}
	decoder := json.NewDecoder(io.LimitReader(file, 16<<20))
	if decoder.Decode(&state) != nil || decoder.Decode(new(any)) != io.EOF || state.Version != 1 || state.Accounts == nil || len(state.Accounts) > accountLimit || len(state.Sessions) > accountLimit*accountSessionLimit {
		return errAccountStore
	}
	identifiers := make(map[string]bool, len(state.Accounts))
	adminCount := 0
	for name, account := range state.Accounts {
		key, _, nameErr := normalizeAccountUsername(account.Username)
		if nameErr != nil || key != name || !validAccountHex(account.ID, 32) || identifiers[account.ID] || !validAccountHex(account.Salt, 16) || !validAccountHex(account.PasswordHash, 32) || account.Algorithm != "pbkdf2-sha256" || account.Iterations < accountPasswordIterations || account.Iterations > 2000000 || account.CreatedAt.IsZero() {
			return errAccountStore
		}
		sources, sourceErr := normalizeAccountSources(account.Sources)
		if sourceErr != nil {
			return errAccountStore
		}
		account.Sources = sources
		state.Accounts[name] = account
		if account.Admin {
			adminCount++
		}
		identifiers[account.ID] = true
	}
	if adminCount > 1 {
		return errAccountStore
	}
	for token, session := range state.Sessions {
		if !validAccountHex(token, 32) || state.Accounts[session.Account].ID == "" || session.CreatedAt.IsZero() || !session.ExpiresAt.After(session.CreatedAt) {
			return errAccountStore
		}
	}
	for guest, imported := range state.GuestImports {
		if !validAccountHex(guest, 32) || state.Accounts[imported.Account].ID == "" {
			return errAccountStore
		}
	}
	if state.Sessions == nil {
		state.Sessions = map[string]accountSession{}
	}
	if state.GuestImports == nil {
		state.GuestImports = map[string]accountGuestImport{}
	}
	store.state = state
	return nil
}

func (store *accountStore) snapshotLocked() accountState {
	state := accountState{Version: 1, RequireLogin: store.state.RequireLogin, AllowRegistration: store.state.AllowRegistration, Accounts: make(map[string]accountRecord, len(store.state.Accounts)), Sessions: make(map[string]accountSession, len(store.state.Sessions)), GuestImports: make(map[string]accountGuestImport, len(store.state.GuestImports))}
	for key, value := range store.state.Accounts {
		if value.Sources != nil {
			value.Sources = append([]string{}, value.Sources...)
		}
		state.Accounts[key] = value
	}
	for key, value := range store.state.Sessions {
		state.Sessions[key] = value
	}
	for key, value := range store.state.GuestImports {
		state.GuestImports[key] = value
	}
	return state
}

func (store *accountStore) saveLocked(state accountState) error {
	if store.err != nil {
		return store.err
	}
	data, err := json.Marshal(state)
	if err != nil {
		return err
	}
	if err = os.MkdirAll(filepath.Dir(store.path), 0o700); err != nil {
		return err
	}
	file, err := os.CreateTemp(filepath.Dir(store.path), ".accounts-*.json")
	if err != nil {
		return err
	}
	defer os.Remove(file.Name())
	if _, err = file.Write(data); err == nil {
		err = file.Sync()
	}
	if closeErr := file.Close(); err == nil {
		err = closeErr
	}
	if err != nil {
		return err
	}
	if err = os.Rename(file.Name(), store.path); err != nil {
		return err
	}
	store.state = state
	return nil
}

func accountTokenHash(token string) string {
	sum := sha256.Sum256([]byte(token))
	return hex.EncodeToString(sum[:])
}

func (manager *viewerManager) accountCookieName() string { return manager.cookie + "_account" }

func (store *accountStore) resolve(token string) (accountRecord, string, bool) {
	if !validAccountHex(token, 32) {
		return accountRecord{}, "", false
	}
	store.mu.Lock()
	defer store.mu.Unlock()
	session, found := store.state.Sessions[accountTokenHash(token)]
	if !found || !session.ExpiresAt.After(time.Now()) {
		return accountRecord{}, "", false
	}
	account, found := store.state.Accounts[session.Account]
	return account, session.Account, found && store.err == nil
}

func (manager *viewerManager) requestAccount(request *http.Request) (accountRecord, string, bool, error) {
	cookie, err := request.Cookie(manager.accountCookieName())
	if err != nil || cookie.Value == "" {
		return accountRecord{}, "", false, nil
	}
	store := manager.accountStore()
	if store.err != nil {
		return accountRecord{}, "", true, store.err
	}
	account, name, valid := store.resolve(cookie.Value)
	if !valid {
		return accountRecord{}, "", true, nil
	}
	return account, name, true, nil
}

func (store *accountStore) allowAttempt(name, remote string, now time.Time) bool {
	ip, _, err := net.SplitHostPort(remote)
	if err != nil {
		ip = remote
	}
	store.mu.Lock()
	defer store.mu.Unlock()
	for key, attempt := range store.attempts {
		if !attempt.until.After(now) {
			delete(store.attempts, key)
		}
	}
	keys := []string{"name:" + name, "ip:" + ip}
	for index, key := range keys {
		limit := 10
		if index == 1 {
			limit = 60
		}
		if store.attempts[key].count >= limit || len(store.attempts) >= 4096 && store.attempts[key].count == 0 {
			return false
		}
	}
	for _, key := range keys {
		attempt := store.attempts[key]
		if attempt.count == 0 {
			attempt.until = now.Add(time.Minute)
		}
		attempt.count++
		store.attempts[key] = attempt
	}
	return true
}

func (state *accountState) addSession(name string, now time.Time) (string, error) {
	token := randomHex(32)
	if token == "" {
		return "", errors.New("无法创建登录会话，请重试")
	}
	var current []string
	for key, session := range state.Sessions {
		if !session.ExpiresAt.After(now) {
			delete(state.Sessions, key)
			continue
		}
		if session.Account == name {
			current = append(current, key)
		}
	}
	sort.Slice(current, func(i, j int) bool {
		return state.Sessions[current[i]].CreatedAt.Before(state.Sessions[current[j]].CreatedAt)
	})
	for len(current) >= accountSessionLimit {
		delete(state.Sessions, current[0])
		current = current[1:]
	}
	state.Sessions[accountTokenHash(token)] = accountSession{Account: name, CreatedAt: now, ExpiresAt: now.Add(accountLifetime)}
	return token, nil
}