package service

import (
	"bytes"
	"context"
	"crypto/tls"
	"encoding/base64"
	"errors"
	"fmt"
	"io"
	"log/slog"
	"net/http"
	"net/url"
	"path"
	"strings"
	"time"
	"unicode/utf8"

	"github.com/go-ldap/ldap/v3"
	"github.com/google/uuid"
	"github.com/pocket-id/pocket-id/backend/internal/storage"
	"github.com/pocket-id/pocket-id/backend/internal/utils"
	"golang.org/x/text/unicode/norm"
	"gorm.io/gorm"

	"github.com/pocket-id/pocket-id/backend/internal/common"
	"github.com/pocket-id/pocket-id/backend/internal/dto"
	"github.com/pocket-id/pocket-id/backend/internal/model"
)

type LdapService struct {
	db               *gorm.DB
	httpClient       *http.Client
	appConfigService *AppConfigService
	userService      *UserService
	groupService     *UserGroupService
	fileStorage      storage.FileStorage
}

type savePicture struct {
	userID   string
	username string
	picture  string
}

func NewLdapService(db *gorm.DB, httpClient *http.Client, appConfigService *AppConfigService, userService *UserService, groupService *UserGroupService, fileStorage storage.FileStorage) *LdapService {
	return &LdapService{
		db:               db,
		httpClient:       httpClient,
		appConfigService: appConfigService,
		userService:      userService,
		groupService:     groupService,
		fileStorage:      fileStorage,
	}
}

func (s *LdapService) createClient() (*ldap.Conn, error) {
	dbConfig := s.appConfigService.GetDbConfig()

	if !dbConfig.LdapEnabled.IsTrue() {
		return nil, fmt.Errorf("LDAP is not enabled")
	}

	// Setup LDAP connection
	client, err := ldap.DialURL(dbConfig.LdapUrl.Value, ldap.DialWithTLSConfig(&tls.Config{
		InsecureSkipVerify: dbConfig.LdapSkipCertVerify.IsTrue(), //nolint:gosec
	}))
	if err != nil {
		return nil, fmt.Errorf("failed to connect to LDAP: %w", err)
	}

	// Bind as service account
	err = client.Bind(dbConfig.LdapBindDn.Value, dbConfig.LdapBindPassword.Value)
	if err != nil {
		return nil, fmt.Errorf("failed to bind to LDAP: %w", err)
	}
	return client, nil
}

func (s *LdapService) SyncAll(ctx context.Context) error {
	// Setup LDAP connection
	client, err := s.createClient()
	if err != nil {
		return fmt.Errorf("failed to create LDAP client: %w", err)
	}
	defer client.Close()

	// Start a transaction
	tx := s.db.Begin()
	defer func() {
		tx.Rollback()
	}()

	savePictures, deleteFiles, err := s.SyncUsers(ctx, tx, client)
	if err != nil {
		return fmt.Errorf("failed to sync users: %w", err)
	}

	err = s.SyncGroups(ctx, tx, client)
	if err != nil {
		return fmt.Errorf("failed to sync groups: %w", err)
	}

	// Commit the changes
	err = tx.Commit().Error
	if err != nil {
		return fmt.Errorf("failed to commit changes to database: %w", err)
	}

	// Now that we've committed the transaction, we can perform operations on the storage layer
	// First, save all new pictures
	for _, sp := range savePictures {
		err = s.saveProfilePicture(ctx, sp.userID, sp.picture)
		if err != nil {
			// This is not a fatal error
			slog.Warn("Error saving profile picture for LDAP user", slog.String("username", sp.username), slog.Any("error", err))
		}
	}

	// Delete all old files
	for _, path := range deleteFiles {
		err = s.fileStorage.Delete(ctx, path)
		if err != nil {
			// This is not a fatal error
			slog.Error("Failed to delete file after LDAP sync", slog.String("path", path), slog.Any("error", err))
		}
	}

	return nil
}

//nolint:gocognit
func (s *LdapService) SyncGroups(ctx context.Context, tx *gorm.DB, client *ldap.Conn) error {
	dbConfig := s.appConfigService.GetDbConfig()

	searchAttrs := []string{
		dbConfig.LdapAttributeGroupName.Value,
		dbConfig.LdapAttributeGroupUniqueIdentifier.Value,
		dbConfig.LdapAttributeGroupMember.Value,
	}

	searchReq := ldap.NewSearchRequest(
		dbConfig.LdapBase.Value,
		ldap.ScopeWholeSubtree,
		0, 0, 0, false,
		dbConfig.LdapUserGroupSearchFilter.Value,
		searchAttrs,
		[]ldap.Control{},
	)
	result, err := client.Search(searchReq)
	if err != nil {
		return fmt.Errorf("failed to query LDAP: %w", err)
	}

	// Create a mapping for groups that exist
	ldapGroupIDs := make(map[string]struct{}, len(result.Entries))

	for _, value := range result.Entries {
		ldapId := convertLdapIdToString(value.GetAttributeValue(dbConfig.LdapAttributeGroupUniqueIdentifier.Value))

		// Skip groups without a valid LDAP ID
		if ldapId == "" {
			slog.Warn("Skipping LDAP group without a valid unique identifier", slog.String("attribute", dbConfig.LdapAttributeGroupUniqueIdentifier.Value))
			continue
		}

		ldapGroupIDs[ldapId] = struct{}{}

		// Try to find the group in the database
		var databaseGroup model.UserGroup
		err = tx.
			WithContext(ctx).
			Where("ldap_id = ?", ldapId).
			First(&databaseGroup).
			Error
		if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
			// This could error with ErrRecordNotFound and we want to ignore that here
			return fmt.Errorf("failed to query for LDAP group ID '%s': %w", ldapId, err)
		}

		// Get group members and add to the correct Group
		groupMembers := value.GetAttributeValues(dbConfig.LdapAttributeGroupMember.Value)
		membersUserId := make([]string, 0, len(groupMembers))
		for _, member := range groupMembers {
			username := getDNProperty(dbConfig.LdapAttributeUserUsername.Value, member)

			// If username extraction fails, try to query LDAP directly for the user
			if username == "" {
				// Query LDAP to get the user by their DN
				userSearchReq := ldap.NewSearchRequest(
					member,
					ldap.ScopeBaseObject,
					0, 0, 0, false,
					"(objectClass=*)",
					[]string{dbConfig.LdapAttributeUserUsername.Value, dbConfig.LdapAttributeUserUniqueIdentifier.Value},
					[]ldap.Control{},
				)

				userResult, err := client.Search(userSearchReq)
				if err != nil || len(userResult.Entries) == 0 {
					slog.WarnContext(ctx, "Could not resolve group member DN", slog.String("member", member), slog.Any("error", err))
					continue
				}

				username = userResult.Entries[0].GetAttributeValue(dbConfig.LdapAttributeUserUsername.Value)
				if username == "" {
					slog.WarnContext(ctx, "Could not extract username from group member DN", slog.String("member", member))
					continue
				}
			}

			username = norm.NFC.String(username)

			var databaseUser model.User
			err = tx.
				WithContext(ctx).
				Where("username = ? AND ldap_id IS NOT NULL", username).
				First(&databaseUser).
				Error
			if errors.Is(err, gorm.ErrRecordNotFound) {
				// The user collides with a non-LDAP user, so we skip it
				continue
			} else if err != nil {
				return fmt.Errorf("failed to query for existing user '%s': %w", username, err)
			}

			membersUserId = append(membersUserId, databaseUser.ID)
		}

		syncGroup := dto.UserGroupCreateDto{
			Name:         value.GetAttributeValue(dbConfig.LdapAttributeGroupName.Value),
			FriendlyName: value.GetAttributeValue(dbConfig.LdapAttributeGroupName.Value),
			LdapID:       ldapId,
		}
		dto.Normalize(syncGroup)

		err = syncGroup.Validate()
		if err != nil {
			slog.WarnContext(ctx, "LDAP user group object is not valid", slog.Any("error", err))
			continue
		}

		if databaseGroup.ID == "" {
			newGroup, err := s.groupService.createInternal(ctx, syncGroup, tx)
			if err != nil {
				return fmt.Errorf("failed to create group '%s': %w", syncGroup.Name, err)
			}

			_, err = s.groupService.updateUsersInternal(ctx, newGroup.ID, membersUserId, tx)
			if err != nil {
				return fmt.Errorf("failed to sync users for group '%s': %w", syncGroup.Name, err)
			}
		} else {
			_, err = s.groupService.updateInternal(ctx, databaseGroup.ID, syncGroup, true, tx)
			if err != nil {
				return fmt.Errorf("failed to update group '%s': %w", syncGroup.Name, err)
			}

			_, err = s.groupService.updateUsersInternal(ctx, databaseGroup.ID, membersUserId, tx)
			if err != nil {
				return fmt.Errorf("failed to sync users for group '%s': %w", syncGroup.Name, err)
			}
		}
	}

	// Get all LDAP groups from the database
	var ldapGroupsInDb []model.UserGroup
	err = tx.
		WithContext(ctx).
		Find(&ldapGroupsInDb, "ldap_id IS NOT NULL").
		Select("ldap_id").
		Error
	if err != nil {
		return fmt.Errorf("failed to fetch groups from database: %w", err)
	}

	// Delete groups that no longer exist in LDAP
	for _, group := range ldapGroupsInDb {
		if _, exists := ldapGroupIDs[*group.LdapID]; exists {
			continue
		}

		err = tx.
			WithContext(ctx).
			Delete(&model.UserGroup{}, "ldap_id = ?", group.LdapID).
			Error
		if err != nil {
			return fmt.Errorf("failed to delete group '%s': %w", group.Name, err)
		}

		slog.Info("Deleted group", slog.String("group", group.Name))
	}

	return nil
}

//nolint:gocognit
func (s *LdapService) SyncUsers(ctx context.Context, tx *gorm.DB, client *ldap.Conn) (savePictures []savePicture, deleteFiles []string, err error) {
	dbConfig := s.appConfigService.GetDbConfig()

	searchAttrs := []string{
		"memberOf",
		"sn",
		"cn",
		dbConfig.LdapAttributeUserUniqueIdentifier.Value,
		dbConfig.LdapAttributeUserUsername.Value,
		dbConfig.LdapAttributeUserEmail.Value,
		dbConfig.LdapAttributeUserFirstName.Value,
		dbConfig.LdapAttributeUserLastName.Value,
		dbConfig.LdapAttributeUserProfilePicture.Value,
		dbConfig.LdapAttributeUserDisplayName.Value,
	}

	// Filters must start and finish with ()!
	searchReq := ldap.NewSearchRequest(
		dbConfig.LdapBase.Value,
		ldap.ScopeWholeSubtree,
		0, 0, 0, false,
		dbConfig.LdapUserSearchFilter.Value,
		searchAttrs,
		[]ldap.Control{},
	)

	result, err := client.Search(searchReq)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to query LDAP: %w", err)
	}

	// Create a mapping for users that exist
	ldapUserIDs := make(map[string]struct{}, len(result.Entries))
	savePictures = make([]savePicture, 0, len(result.Entries))

	for _, value := range result.Entries {
		ldapId := convertLdapIdToString(value.GetAttributeValue(dbConfig.LdapAttributeUserUniqueIdentifier.Value))

		// Skip users without a valid LDAP ID
		if ldapId == "" {
			slog.Warn("Skipping LDAP user without a valid unique identifier", slog.String("attribute", dbConfig.LdapAttributeUserUniqueIdentifier.Value))
			continue
		}

		ldapUserIDs[ldapId] = struct{}{}

		// Get the user from the database
		var databaseUser model.User
		err = tx.
			WithContext(ctx).
			Where("ldap_id = ?", ldapId).
			First(&databaseUser).
			Error

		// If a user is found (even if disabled), enable them since they're now back in LDAP
		if databaseUser.ID != "" && databaseUser.Disabled {
			err = tx.
				WithContext(ctx).
				Model(&model.User{}).
				Where("id = ?", databaseUser.ID).
				Update("disabled", false).
				Error

			if err != nil {
				return nil, nil, fmt.Errorf("failed to enable user %s: %w", databaseUser.Username, err)
			}
		}

		if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
			// This could error with ErrRecordNotFound and we want to ignore that here
			return nil, nil, fmt.Errorf("failed to query for LDAP user ID '%s': %w", ldapId, err)
		}

		// Check if user is admin by checking if they are in the admin group
		isAdmin := false
		for _, group := range value.GetAttributeValues("memberOf") {
			if getDNProperty(dbConfig.LdapAttributeGroupName.Value, group) == dbConfig.LdapAttributeAdminGroup.Value {
				isAdmin = true
				break
			}
		}

		newUser := dto.UserCreateDto{
			Username:    value.GetAttributeValue(dbConfig.LdapAttributeUserUsername.Value),
			Email:       utils.PtrOrNil(value.GetAttributeValue(dbConfig.LdapAttributeUserEmail.Value)),
			FirstName:   value.GetAttributeValue(dbConfig.LdapAttributeUserFirstName.Value),
			LastName:    value.GetAttributeValue(dbConfig.LdapAttributeUserLastName.Value),
			DisplayName: value.GetAttributeValue(dbConfig.LdapAttributeUserDisplayName.Value),
			IsAdmin:     isAdmin,
			LdapID:      ldapId,
		}

		if newUser.DisplayName == "" {
			newUser.DisplayName = strings.TrimSpace(newUser.FirstName + " " + newUser.LastName)
		}

		dto.Normalize(newUser)

		err = newUser.Validate()
		if err != nil {
			slog.WarnContext(ctx, "LDAP user object is not valid", slog.Any("error", err))
			continue
		}

		userID := databaseUser.ID
		if databaseUser.ID == "" {
			createdUser, err := s.userService.createUserInternal(ctx, newUser, true, tx)
			if errors.Is(err, &common.AlreadyInUseError{}) {
				slog.Warn("Skipping creating LDAP user", slog.String("username", newUser.Username), slog.Any("error", err))
				continue
			} else if err != nil {
				return nil, nil, fmt.Errorf("error creating user '%s': %w", newUser.Username, err)
			}
			userID = createdUser.ID
		} else {
			_, err = s.userService.updateUserInternal(ctx, databaseUser.ID, newUser, false, true, tx)
			if errors.Is(err, &common.AlreadyInUseError{}) {
				slog.Warn("Skipping updating LDAP user", slog.String("username", newUser.Username), slog.Any("error", err))
				continue
			} else if err != nil {
				return nil, nil, fmt.Errorf("error updating user '%s': %w", newUser.Username, err)
			}
		}

		// Save profile picture
		pictureString := value.GetAttributeValue(dbConfig.LdapAttributeUserProfilePicture.Value)
		if pictureString != "" {
			// Storage operations must be executed outside of a transaction
			savePictures = append(savePictures, savePicture{
				userID:   databaseUser.ID,
				username: userID,
				picture:  pictureString,
			})
		}
	}

	// Get all LDAP users from the database
	var ldapUsersInDb []model.User
	err = tx.
		WithContext(ctx).
		Find(&ldapUsersInDb, "ldap_id IS NOT NULL").
		Select("id, username, ldap_id, disabled").
		Error
	if err != nil {
		return nil, nil, fmt.Errorf("failed to fetch users from database: %w", err)
	}

	// Mark users as disabled or delete users that no longer exist in LDAP
	deleteFiles = make([]string, 0, len(ldapUserIDs))
	for _, user := range ldapUsersInDb {
		// Skip if the user ID exists in the fetched LDAP results
		if _, exists := ldapUserIDs[*user.LdapID]; exists {
			continue
		}

		if dbConfig.LdapSoftDeleteUsers.IsTrue() {
			err = s.userService.disableUserInternal(ctx, tx, user.ID)
			if err != nil {
				return nil, nil, fmt.Errorf("failed to disable user %s: %w", user.Username, err)
			}

			slog.Info("Disabled user", slog.String("username", user.Username))
		} else {
			err = s.userService.deleteUserInternal(ctx, tx, user.ID, true)
			if err != nil {
				target := &common.LdapUserUpdateError{}
				if errors.As(err, &target) {
					return nil, nil, fmt.Errorf("failed to delete user %s: LDAP user must be disabled before deletion", user.Username)
				}
				return nil, nil, fmt.Errorf("failed to delete user %s: %w", user.Username, err)
			}

			slog.Info("Deleted user", slog.String("username", user.Username))

			// Storage operations must be executed outside of a transaction
			deleteFiles = append(deleteFiles, path.Join("profile-pictures", user.ID+".png"))
		}
	}

	return savePictures, deleteFiles, nil
}

func (s *LdapService) saveProfilePicture(parentCtx context.Context, userId string, pictureString string) error {
	var reader io.ReadSeeker

	_, err := url.ParseRequestURI(pictureString)
	if err == nil {
		ctx, cancel := context.WithTimeout(parentCtx, 15*time.Second)
		defer cancel()

		var req *http.Request
		req, err = http.NewRequestWithContext(ctx, http.MethodGet, pictureString, nil)
		if err != nil {
			return fmt.Errorf("failed to create request: %w", err)
		}

		var res *http.Response
		res, err = s.httpClient.Do(req)
		if err != nil {
			return fmt.Errorf("failed to download profile picture: %w", err)
		}
		defer res.Body.Close()

		data, err := io.ReadAll(res.Body)
		if err != nil {
			return fmt.Errorf("failed to read profile picture: %w", err)
		}

		reader = bytes.NewReader(data)
	} else if decodedPhoto, err := base64.StdEncoding.DecodeString(pictureString); err == nil {
		// If the photo is a base64 encoded string, decode it
		reader = bytes.NewReader(decodedPhoto)
	} else {
		// If the photo is a string, we assume that it's a binary string
		reader = bytes.NewReader([]byte(pictureString))
	}

	// Update the profile picture
	err = s.userService.UpdateProfilePicture(parentCtx, userId, reader)
	if err != nil {
		return fmt.Errorf("failed to update profile picture: %w", err)
	}

	return nil
}

// getDNProperty returns the value of a property from a LDAP identifier
// See: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ldap/distinguished-names
func getDNProperty(property string, str string) string {
	// Example format is "CN=username,ou=people,dc=example,dc=com"
	// First we split at the comma
	property = strings.ToLower(property)
	l := len(property) + 1
	for _, v := range strings.Split(str, ",") {
		v = strings.TrimSpace(v)
		if len(v) > l && strings.ToLower(v)[0:l] == property+"=" {
			return v[l:]
		}
	}

	// CN not found, return an empty string
	return ""
}

// convertLdapIdToString converts LDAP IDs to valid UTF-8 strings.
// LDAP servers may return binary UUIDs (16 bytes) or other non-UTF-8 data.
func convertLdapIdToString(ldapId string) string {
	if utf8.ValidString(ldapId) {
		return norm.NFC.String(ldapId)
	}

	// Try to parse as binary UUID (16 bytes)
	if len(ldapId) == 16 {
		if parsedUUID, err := uuid.FromBytes([]byte(ldapId)); err == nil {
			return parsedUUID.String()
		}
	}

	// As a last resort, encode as base64 to make it UTF-8 safe
	return base64.StdEncoding.EncodeToString([]byte(ldapId))
}