package handlers

import (
	"encoding/json"
	"net/http"

	"git.nakama.town/fmartingr/hako/internal/model"
	"git.nakama.town/fmartingr/hako/internal/server/webcontext"
)

// AuthHandler handles authentication-related HTTP requests
type AuthHandler struct {
	deps model.Dependencies
}

// NewAuthHandler creates a new AuthHandler
func NewAuthHandler(deps model.Dependencies) *AuthHandler {
	return &AuthHandler{
		deps: deps,
	}
}

// LoginRequest represents a login request
type LoginRequest struct {
	Email    string `json:"email"`
	Password string `json:"password"`
}

// LoginResponse represents a login response
type LoginResponse struct {
	Token string       `json:"token"`
	User  UserResponse `json:"user"`
}

// UserResponse represents a user in API responses
type UserResponse struct {
	Email string `json:"email"`
	Role  string `json:"role"`
}

// HandleLogin handles POST /api/v1/auth/login
func (h *AuthHandler) HandleLogin(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodPost {
		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
		return
	}

	var req LoginRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		http.Error(w, "Invalid request body", http.StatusBadRequest)
		return
	}

	// Validate request
	if req.Email == "" || req.Password == "" {
		http.Error(w, "Email and password are required", http.StatusBadRequest)
		return
	}

	// Login via domain service
	user, token, err := h.deps.Domains().Auth().Login(req.Email, req.Password)
	if err != nil {
		http.Error(w, "Invalid credentials", http.StatusUnauthorized)
		return
	}

	// Build response
	role := user.Role
	if role == "" {
		role = "user" // Default fallback
	}
	response := LoginResponse{
		Token: token.Token,
		User: UserResponse{
			Email: user.Email,
			Role:  role,
		},
	}

	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(http.StatusOK)
	if err := json.NewEncoder(w).Encode(response); err != nil {
		// Log error if encoding fails, but response already committed
		_ = err
	}
}

// HandleGetCurrentUser handles GET /api/v1/auth/me
func (h *AuthHandler) HandleGetCurrentUser(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodGet {
		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
		return
	}

	// Create webcontext for this request
	c := webcontext.NewWebContext(w, r)

	// Get user info from context (set by auth middleware)
	userEmail := c.GetUserEmail()
	userRole := c.GetUserRole()

	if !c.UserIsLogged() || userEmail == "" {
		http.Error(w, "Unauthorized", http.StatusUnauthorized)
		return
	}

	// Default role to "user" if not set
	if userRole == "" {
		userRole = "user"
	}

	// Build response
	response := UserResponse{
		Email: userEmail,
		Role:  userRole,
	}

	c.ResponseWriter().Header().Set("Content-Type", "application/json")
	c.ResponseWriter().WriteHeader(http.StatusOK)
	if err := json.NewEncoder(c.ResponseWriter()).Encode(response); err != nil {
		// Log error if encoding fails, but response already committed
		_ = err
	}
}