<?php

declare(strict_types=1);

namespace KTXM\AuthenticationProviderMail;

use KTXC\Service\UserAccountsService;
use KTXF\Mail\Object\Address;
use KTXF\Mail\Object\MessagePropertiesBaseInterface;
use KTXF\Mail\Provider\ProviderBaseInterface;
use KTXF\Mail\Submission\EntitySubmitResult;
use KTXF\Security\Authentication\AuthenticationProviderAbstract;
use KTXF\Security\Authentication\ProviderContext;
use KTXF\Security\Authentication\ProviderResult;
use KTXM\AuthenticationProviderMail\Stores\ChallengeStore;
use KTXM\MailManager\Manager as MailManager;
use Psr\Log\LoggerInterface;

/**
 * Email Challenge Authentication Provider
 *
 * Authenticates users by sending a one-time verification code to the email
 * address on the user's profile. The login identity is only used to resolve
 * the user account, never as a mail recipient.
 */
class Provider extends AuthenticationProviderAbstract
{
    private const DEFAULT_CODE_TTL = 300; // 5 minutes
    private const DEFAULT_DIGITS = 6;

    public function __construct(
        private readonly ChallengeStore $challengeStore,
        private readonly MailManager $mailManager,
        private readonly UserAccountsService $userService,
        private readonly LoggerInterface $logger,
    ) {}

    // =========================================================================
    // Provider Implementation
    // =========================================================================

    public function type(): string
    {
        return 'authentication';
    }

    public function identifier(): string
    {
        return 'mail';
    }

    public function method(): string
    {
        return self::METHOD_CHALLENGE;
    }

    public function label(): string
    {
        return 'Email Code';
    }

    public function description(): string
    {
        return 'Authenticate using a one-time verification code sent to your email address.';
    }

    public function icon(): string
    {
        return 'mail';
    }

    /**
     * Begin the email challenge
     *
     * Generates a verification code and sends it to the email address on the
     * user's profile.
     */
    public function beginChallenge(ProviderContext $context): ProviderResult
    {
        $tenantId = $context->tenantId;

        if (empty($tenantId)) {
            return ProviderResult::failed(
                ProviderResult::ERROR_INTERNAL,
                'Invalid tenant context'
            );
        }

        $recipientAddress = $this->resolveRecipientAddress($context);
        if ($recipientAddress === null) {
            return ProviderResult::failed(
                ProviderResult::ERROR_INVALID_CREDENTIALS,
                'No valid email address on file for this account'
            );
        }

        // Check for existing pending challenge (rate limiting)
        if ($this->challengeStore->hasPending($tenantId, $recipientAddress)) {
            // Allow resend but inform user
            $this->logger->debug('Resending email challenge', [
                'tenantId' => $tenantId,
            ]);
        }

        // Generate and store challenge
        $ttl = $context->getConfig('code_ttl', self::DEFAULT_CODE_TTL);
        $challenge = $this->challengeStore->create($tenantId, $recipientAddress, $ttl);

        // Send verification email
        $emailResult = $this->sendVerificationEmail(
            $tenantId,
            $recipientAddress,
            $challenge['code'],
            $challenge['expires'],
            $context
        );

        if (!$emailResult['success']) {
            // Invalidate the challenge since email failed
            $this->challengeStore->invalidate($tenantId, $recipientAddress);

            $this->logger->error('Failed to send verification email', [
                'tenantId' => $tenantId,
                'error' => $emailResult['error'] ?? 'Unknown error',
            ]);

            return ProviderResult::failed(
                ProviderResult::ERROR_INTERNAL,
                'Failed to send verification email'
            );
        }

        $this->logger->info('Email challenge initiated', [
            'tenantId' => $tenantId,
            'expires' => $challenge['expires'],
        ]);

        return ProviderResult::challenge(
            [
                'type' => 'email',
                'message' => 'A verification code has been sent to your email address',
                'digits' => self::DEFAULT_DIGITS,
                'expires_in' => $ttl,
                'masked_email' => $this->maskEmail($recipientAddress),
            ],
            [
                'identity' => $recipientAddress,
                'challenge_expires' => $challenge['expires'],
            ]
        );
    }

    /**
     * Verify the email challenge code
     */
    public function verifyChallenge(ProviderContext $context, string $code): ProviderResult
    {
        $tenantId = $context->tenantId;
        // The address the code was sent to, stored when the challenge began
        $recipientAddress = $context->getMeta('identity') ?? $this->resolveRecipientAddress($context);

        if (empty($tenantId)) {
            return ProviderResult::failed(
                ProviderResult::ERROR_INTERNAL,
                'Invalid tenant context'
            );
        }

        if (empty($recipientAddress)) {
            return ProviderResult::failed(
                ProviderResult::ERROR_INVALID_CREDENTIALS,
                'No valid email address on file for this account'
            );
        }

        // Normalize code (remove spaces, dashes)
        $code = preg_replace('/[\s\-]/', '', $code);

        // Verify the challenge
        $result = $this->challengeStore->verify($tenantId, $recipientAddress, $code);

        if (!$result['success']) {
            $this->logger->debug('Email challenge verification failed', [
                'tenantId' => $tenantId,
                'error' => $result['error'] ?? 'Unknown',
            ]);

            return ProviderResult::failed(
                ProviderResult::ERROR_FACTOR_FAILED,
                $result['error'] ?? 'Invalid verification code'
            );
        }

        $this->logger->info('Email challenge verified successfully', [
            'tenantId' => $tenantId,
        ]);

        return ProviderResult::success([
            'identity' => $context->userIdentity ?? $recipientAddress,
            'provider' => $this->identifier(),
            'verified_email' => $recipientAddress,
        ]);
    }

    /**
     * Direct verify (not typically used for email, but implemented for interface)
     */
    public function verify(ProviderContext $context, string $secret): ProviderResult
    {
        return $this->verifyChallenge($context, $secret);
    }

    private function resolveRecipientAddress(ProviderContext $context): ?string
    {
        $userIdentifier = $context->userIdentifier;

        if ($userIdentifier === null && !empty($context->userIdentity)) {
            $user = $this->userService->fetchByIdentityRaw($context->userIdentity);
            $userIdentifier = $user['uid'] ?? null;
        }

        if ($userIdentifier === null) {
            return null;
        }

        $profile = $this->userService->fetchProfile($userIdentifier);
        $address = trim((string)($profile['profile']['email'] ?? ''));

        if ($address === '' || !filter_var($address, FILTER_VALIDATE_EMAIL)) {
            $this->logger->debug('No valid profile email address for email challenge', [
                'tenantId' => $context->tenantId,
            ]);
            return null;
        }

        return $address;
    }

    // =========================================================================
    // Email Sending
    // =========================================================================

    /**
     * Send the verification email
     */
    private function sendVerificationEmail(
        string $tenantId,
        string $recipientEmail,
        string $code,
        int $expires,
        ProviderContext $context
    ): array {
        try {
            // Format code with spaces for readability (123 456)
            $formattedCode = wordwrap($code, 3, ' ', true);

            // Calculate remaining time
            $remainingMinutes = ceil(($expires - time()) / 60);

            // Build email body
            $textBody = $this->buildTextBody($formattedCode, (int)$remainingMinutes);
            $htmlBody = $this->buildHtmlBody($formattedCode, (int)$remainingMinutes);

            // Submit through the system mail route for the authentication channel
            $result = $this->mailManager->entitySubmit(
                $tenantId,
                ProviderBaseInterface::USER_SYSTEM,
                'authentication@system',
                null,
                [
                    MessagePropertiesBaseInterface::PROPERTY_TO => [(new Address($recipientEmail))->toArray()],
                    MessagePropertiesBaseInterface::PROPERTY_SUBJECT => 'Your verification code',
                    MessagePropertiesBaseInterface::PROPERTY_BODY => [
                        'partId' => 'body',
                        'type' => 'multipart/alternative',
                        'subParts' => [
                            [
                                'partId' => 'body.text',
                                'type' => 'text/plain',
                                'charset' => 'utf-8',
                                'content' => $textBody,
                                'disposition' => 'inline',
                            ],
                            [
                                'partId' => 'body.html',
                                'type' => 'text/html',
                                'charset' => 'utf-8',
                                'content' => $htmlBody,
                                'disposition' => 'inline',
                            ],
                        ],
                    ],
                ]
            );

            if ($result->disposition !== EntitySubmitResult::DISPOSITION_SENT) {
                return [
                    'success' => false,
                    'error' => $result->errorMessage ?? 'Mail submission failed',
                ];
            }

            return ['success' => true];

        } catch (\Throwable $e) {
            $this->logger->error('Email send failed', [
                'error' => $e->getMessage(),
                'trace' => $e->getTraceAsString(),
            ]);
            
            return [
                'success' => false,
                'error' => $e->getMessage(),
            ];
        }
    }

    /**
     * Build plain text email body
     */
    private function buildTextBody(string $code, int $minutes): string
    {
        return <<<TEXT
Your verification code is: $code

This code will expire in $minutes minute(s).

If you did not request this code, please ignore this email.

---
This is an automated message. Please do not reply.
TEXT;
    }

    /**
     * Build HTML email body
     */
    private function buildHtmlBody(string $code, int $minutes): string
    {
        return <<<HTML
<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Verification Code</title>
</head>
<body style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, sans-serif; background-color: #f5f5f5; margin: 0; padding: 20px;">
    <div style="max-width: 480px; margin: 0 auto; background-color: #ffffff; border-radius: 8px; padding: 40px; box-shadow: 0 2px 4px rgba(0,0,0,0.1);">
        <h1 style="color: #333333; font-size: 24px; margin: 0 0 20px 0; text-align: center;">
            Verification Code
        </h1>
        
        <p style="color: #666666; font-size: 16px; margin: 0 0 30px 0; text-align: center;">
            Enter the following code to verify your identity:
        </p>
        
        <div style="background-color: #f0f0f0; border-radius: 8px; padding: 20px; text-align: center; margin: 0 0 30px 0;">
            <span style="font-family: 'Monaco', 'Menlo', 'Courier New', monospace; font-size: 32px; font-weight: bold; letter-spacing: 4px; color: #333333;">
                $code
            </span>
        </div>
        
        <p style="color: #999999; font-size: 14px; margin: 0 0 20px 0; text-align: center;">
            This code will expire in <strong>$minutes minute(s)</strong>.
        </p>
        
        <hr style="border: none; border-top: 1px solid #eeeeee; margin: 30px 0;">
        
        <p style="color: #999999; font-size: 12px; margin: 0; text-align: center;">
            If you did not request this code, please ignore this email.
        </p>
    </div>
</body>
</html>
HTML;
    }

    /**
     * Mask email address for display
     */
    private function maskEmail(string $email): string
    {
        $parts = explode('@', $email);
        if (count($parts) !== 2) {
            return '***@***';
        }
        
        $local = $parts[0];
        $domain = $parts[1];
        
        // Show first 2 chars of local part
        $maskedLocal = substr($local, 0, 2) . str_repeat('*', max(3, strlen($local) - 2));
        
        // Show domain
        return $maskedLocal . '@' . $domain;
    }
}