import { createCookieSessionStorage, redirect, Session } from "react-router";
import { loadRequiredWebConfig, resolveSessionCookiePolicy } from "@toolctrl/config";
import { getMyTenants, getTenant } from "./db/tenants.db.server";
import { randomBytes, timingSafeEqual } from "crypto";
import { getUser } from "./db/users.db.server";
import { getActiveSessionByToken } from "~/services/auth/sessionStore.server";
import { endServerSession } from "~/services/auth/sessionLifecycle.server";
import { createScopedLogger } from "./logger.server";

const sessionLogger = createScopedLogger("session");

export const IMPERSONATION_SESSION_TTL_MS = 60 * 60 * 1000;

export type ImpersonationSessionValidationReason =
  | "not_impersonating"
  | "missing_actor"
  | "missing_started_at"
  | "malformed_started_at"
  | "future_started_at"
  | "stale_started_at"
  | "wrong_actor"
  | "valid";

export type ImpersonationSessionValidation = {
  valid: boolean;
  reason: ImpersonationSessionValidationReason;
  actorUserId?: string;
  startedAt?: string;
};

export type UserSession = {
  userId: string;
  lightOrDarkMode: string;
  lng: string;
  csrf?: string;
  cookies: { category: string; allowed: boolean }[];
  metrics?: {
    enabled: boolean;
    logToConsole: boolean;
    saveToDatabase: boolean;
    ignoreUrls: string[];
  };
  impersonatingFromUserId?: string;
  impersonatingStartedAt?: string;
  theme?: string;
  /**
   * Phase 01 / #27 — set at login time when the password the user just
   * submitted no longer satisfies the current password policy. Drives the
   * dashboard soft-banner. Never gates the login itself.
   */
  passwordPolicyOutdated?: boolean;
  /**
   * R-P2a S4b — opaker Token der serverseitigen Session (UserSession-Zeile). Additiv: das Cookie
   * bleibt primaerer Auth-Mechanismus; ist der Token gesetzt, honoriert requireUserId Revoke/
   * "ueberall abmelden". Alte Cookies ohne Token bleiben unberuehrt.
   */
  sessionToken?: string;
  /**
   * D1 (2FA-Login-Gate) — Zwischenzustand zwischen Passwort-OK und TOTP-Verifikation. Traegt das
   * Cookie `pendingMfaUserId` (NICHT `userId`!), hat der Nutzer das Passwort bestanden, aber noch
   * keinen zweiten Faktor geliefert. `requireUserId` liest weiterhin nur `userId` und gewaehrt
   * deshalb KEINEN Zugriff, solange nur der Pending-Zustand gesetzt ist. `pendingMfaRedirectTo`
   * haelt das rohe redirectTo, damit die Verify-Route nach Erfolg ans Ziel weiterleiten kann.
   */
  pendingMfaUserId?: string;
  pendingMfaRedirectTo?: string;
};

export const PENDING_MFA_USER_ID_KEY = "pendingMfaUserId";
export const PENDING_MFA_REDIRECT_KEY = "pendingMfaRedirectTo";

export type SetLoggedUserResult = {
  userId: string;
  defaultTenantId: string;
  /**
   * The tenant resolved during setLoggedUser, if any. Returned so callers can
   * avoid a second `getTenant(userSession.defaultTenantId)` round-trip
   * immediately after sign-in / impersonation.
   */
  defaultTenant: Awaited<ReturnType<typeof getTenant>> | null;
};

export async function setLoggedUser(user: { id: string; email: string; defaultTenantId: string | null }): Promise<SetLoggedUserResult> {
  if (user.defaultTenantId) {
    const tenant = await getTenant(user.defaultTenantId);
    if (tenant) {
      return {
        userId: user.id,
        defaultTenantId: tenant.id,
        defaultTenant: tenant,
      };
    }
  }

  const userTenants = await getMyTenants(user.id);
  const fallback = userTenants[0] ?? null;

  return {
    userId: user.id,
    defaultTenantId: fallback?.id ?? "",
    defaultTenant: null,
  };
}

export function createImpersonationStartedAt(now: Date = new Date()) {
  return now.toISOString();
}

export function validateImpersonationSessionState(
  state: { impersonatingFromUserId?: unknown; impersonatingStartedAt?: unknown; userId?: unknown },
  options: { now?: Date; expectedActorUserId?: string } = {}
): ImpersonationSessionValidation {
  const actorUserId = typeof state.impersonatingFromUserId === "string" ? state.impersonatingFromUserId : undefined;
  const startedAt = typeof state.impersonatingStartedAt === "string" ? state.impersonatingStartedAt : undefined;

  if (!actorUserId && !startedAt) {
    return { valid: false, reason: "not_impersonating" };
  }
  if (!actorUserId) {
    return { valid: false, reason: "missing_actor" };
  }
  if (options.expectedActorUserId && actorUserId !== options.expectedActorUserId) {
    return { valid: false, reason: "wrong_actor" };
  }
  if (!startedAt) {
    return { valid: false, reason: "missing_started_at" };
  }

  const issuedAtMs = Date.parse(startedAt);
  if (!Number.isFinite(issuedAtMs)) {
    return { valid: false, reason: "malformed_started_at" };
  }

  const nowMs = options.now?.getTime() ?? Date.now();
  if (issuedAtMs > nowMs) {
    return { valid: false, reason: "future_started_at" };
  }
  if (nowMs - issuedAtMs > IMPERSONATION_SESSION_TTL_MS) {
    return { valid: false, reason: "stale_started_at" };
  }

  return { valid: true, reason: "valid", actorUserId, startedAt };
}

const webConfig = loadRequiredWebConfig();

export const storage = createCookieSessionStorage({
  cookie: {
    ...resolveSessionCookiePolicy({
      nodeEnv: webConfig.nodeEnv,
      routing: webConfig.routing,
      name: "RJ_session",
      maxAge: 60 * 60 * 24 * 30,
    }),
    secrets: webConfig.sessionSecret ? [webConfig.sessionSecret] : [],
  },
});

export function getUserSession(request: Request) {
  return storage.getSession(request.headers.get("Cookie"));
}

export async function getUserInfo(request: Request): Promise<UserSession> {
  const session = await getUserSession(request);
  const userId = session.get("userId") ?? null;
  const lightOrDarkMode = session.get("lightOrDarkMode") ?? "";
  const lng = ["de", "en"].includes(session.get("lng") ?? "") ? session.get("lng") : "de";
  const csrf = session.get("csrf");
  const metrics = session.get("metrics") ?? { enabled: false, logToConsole: false, saveToDatabase: false, ignoreUrls: [] };
  const cookies = session.get("cookies") ?? [];
  const impersonatingFromUserId = session.get("impersonatingFromUserId");
  const impersonatingStartedAt = session.get("impersonatingStartedAt");
  const impersonationValidation = validateImpersonationSessionState({ impersonatingFromUserId, impersonatingStartedAt, userId });
  const theme = session.get("theme");
  const passwordPolicyOutdated = session.get("passwordPolicyOutdated") === true;
  const sessionToken = session.get("sessionToken");
  const pendingMfaUserId = session.get(PENDING_MFA_USER_ID_KEY);
  const pendingMfaRedirectTo = session.get(PENDING_MFA_REDIRECT_KEY);
  return {
    userId,
    lightOrDarkMode,
    lng,
    csrf,
    metrics,
    cookies,
    impersonatingFromUserId: impersonationValidation.valid ? impersonatingFromUserId : undefined,
    impersonatingStartedAt: impersonationValidation.valid ? impersonatingStartedAt : undefined,
    theme,
    passwordPolicyOutdated: passwordPolicyOutdated || undefined,
    sessionToken: typeof sessionToken === "string" ? sessionToken : undefined,
    pendingMfaUserId: typeof pendingMfaUserId === "string" ? pendingMfaUserId : undefined,
    pendingMfaRedirectTo: typeof pendingMfaRedirectTo === "string" ? pendingMfaRedirectTo : undefined,
  };
}

/**
 * D1 (2FA-Login-Gate) — schreibt den Pending-MFA-Zustand in das SIGNIERTE Session-Cookie und gibt
 * den Set-Cookie-String zurueck. Bewusst KEINE Session: `userId`/`sessionToken` werden entfernt,
 * gesetzt wird nur `pendingMfaUserId` (+ rohes `pendingMfaRedirectTo`). Das bestehende Cookie wird
 * weiterverwendet, damit der bereits ausgehandelte `csrf`-Token erhalten bleibt und die Verify-Route
 * die CSRF-Pruefung besteht.
 */
export async function commitPendingMfaLoginCookie(request: Request, { userId, redirectTo }: { userId: string; redirectTo?: string }) {
  const session = await getUserSession(request);
  session.unset("userId");
  session.unset("sessionToken");
  session.set(PENDING_MFA_USER_ID_KEY, userId);
  if (typeof redirectTo === "string" && redirectTo.length > 0) {
    session.set(PENDING_MFA_REDIRECT_KEY, redirectTo);
  } else {
    session.unset(PENDING_MFA_REDIRECT_KEY);
  }
  return storage.commitSession(session);
}

export async function requireUserId(request: Request, redirectTo: string = new URL(request.url).pathname) {
  const session = await getUserSession(request);
  const userId = session.get("userId");
  if (!userId || typeof userId !== "string") {
    const searchParams = new URLSearchParams([["redirectTo", redirectTo]]);
    throw redirect(`/login?${searchParams}`);
  }
  await assertServerSessionNotRevoked(session, redirectTo);
  return userId;
}

// R-P2a S4b — additive Revoke-Durchsetzung: traegt das Cookie einen serverseitigen Session-Token,
// wird die UserSession-Zeile geprueft; ist sie revoked/abgelaufen, gilt der Nutzer als abgemeldet
// (Cookie zerstoeren + zur Login-Seite). Fail-open: ein Store-Fehler meldet NICHT ab (ein DB-Blip
// soll keinen Massen-Logout ausloesen). Alte Cookies ohne Token bleiben unberuehrt.
async function assertServerSessionNotRevoked(session: Session, redirectTo: string) {
  const sessionToken = session.get("sessionToken");
  if (typeof sessionToken !== "string" || sessionToken.length === 0) {
    return;
  }
  let active = true;
  try {
    active = (await getActiveSessionByToken(sessionToken)) !== null;
  } catch (error) {
    sessionLogger.warn(
      { op: "session.revokeCheck.failed", err: { name: error instanceof Error ? error.name : "Error" } },
      "Server-session revoke check raised; failing open (treating session as valid)."
    );
    return;
  }
  if (!active) {
    const searchParams = new URLSearchParams([["redirectTo", redirectTo]]);
    throw redirect(`/login?${searchParams}`, { headers: { "Set-Cookie": await storage.destroySession(session) } });
  }
}

export async function requireUser({ request }: { request: Request }) {
  const userId = await requireUserId(request);
  const user = await getUser(userId);
  if (!user) {
    throw redirect("/login");
  }
  return user;
}

export async function logout(request: Request) {
  const session = await getUserSession(request);
  // R-P2a S4b — die serverseitige Session-Zeile mit beenden (best-effort), damit ein abgemeldetes
  // Geraet auch in der Geraeteliste verschwindet und der Token nicht weiterlebt.
  const sessionToken = session.get("sessionToken");
  if (typeof sessionToken === "string" && sessionToken.length > 0) {
    await endServerSession(sessionToken).catch((error: unknown) => {
      sessionLogger.warn(
        { op: "session.logout.revokeFailed", err: { name: error instanceof Error ? error.name : "Error" } },
        "Logout could not revoke the server session row; cookie is destroyed regardless."
      );
    });
  }
  return redirect("/login", {
    headers: {
      "Set-Cookie": await storage.destroySession(session),
    },
  });
}

export async function createUserSession(userSession: UserSession, redirectTo: string = "") {
  const session = await storage.getSession();
  session.set("userId", userSession.userId);
  session.set("lightOrDarkMode", userSession.lightOrDarkMode);
  session.set("lng", userSession.lng);
  session.set("csrf", userSession.csrf);
  session.set("metrics", userSession.metrics);
  session.set("cookies", userSession.cookies);
  const impersonationValidation = validateImpersonationSessionState(userSession);
  session.set("impersonatingFromUserId", impersonationValidation.valid ? userSession.impersonatingFromUserId : undefined);
  session.set("impersonatingStartedAt", impersonationValidation.valid ? userSession.impersonatingStartedAt : undefined);
  session.set("theme", userSession.theme);
  session.set("passwordPolicyOutdated", userSession.passwordPolicyOutdated === true ? true : undefined);
  session.set("sessionToken", userSession.sessionToken);
  // D1 — ein vollwertiger Login loescht den Pending-MFA-Zustand. createUserSession baut zwar ein
  // frisches Cookie (ohne diese Keys), das explizite Loeschen dokumentiert die Invariante und
  // schuetzt, falls hier kuenftig eine bestehende Session weiterverwendet wuerde.
  session.unset(PENDING_MFA_USER_ID_KEY);
  session.unset(PENDING_MFA_REDIRECT_KEY);
  return redirect(redirectTo, {
    headers: {
      "Set-Cookie": await storage.commitSession(session),
    },
  });
}

export async function commitSession(session: Session) {
  return await storage.commitSession(session);
}

export function generateCSRFToken() {
  // 32 bytes = 256 bits of entropy (NIST-recommended for CSRF tokens). The
  // previous 100-byte payload was overkill and bloated every cookie/response.
  // Hex encoding keeps the token URL/header safe without padding chars.
  return randomBytes(32).toString("hex");
}

export function setCSRFToken(session: Session, csrf: string = generateCSRFToken()) {
  session.set("csrf", csrf);
  return csrf;
}

function getStringCSRFToken(value: unknown) {
  if (typeof value !== "string") {
    return undefined;
  }

  const token = value.trim();
  return token.length > 0 ? token : undefined;
}

export type ValidateCSRFTokenOptions = {
  /**
   * Already-parsed form data from the caller. When provided, the helper will
   * NEVER touch the request body. This is the safe pattern for action handlers
   * that have already consumed `request.formData()` to read form fields —
   * cloning a consumed body raises `TypeError: unusable` at runtime (the
   * B-009 follow-up bug).
   */
  formData?: FormData;
  /**
   * Skip the body fallback entirely. The header must carry a valid token.
   * Used by background or bot-driven contexts (e.g. lighthouse session
   * capture) where the body is reserved for a different purpose.
   */
  headerOnly?: boolean;
};

async function getCSRFTokenFromRequest(request: Request, options?: ValidateCSRFTokenOptions) {
  const headerToken = getStringCSRFToken(request.headers.get("x-csrf-token") ?? request.headers.get("csrf-token"));
  if (headerToken) {
    return headerToken;
  }

  if (options?.headerOnly) {
    return undefined;
  }

  if (options?.formData) {
    // Caller already parsed the body — read the token from the injected
    // FormData and short-circuit. Never clone the request: its underlying
    // stream is already consumed.
    return getStringCSRFToken(options.formData.get("csrf"));
  }

  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
  if (contentType.includes("multipart/form-data") || contentType.includes("application/x-www-form-urlencoded")) {
    try {
      const formData = await request.clone().formData();
      const token = getStringCSRFToken(formData.get("csrf"));
      if (token) {
        return token;
      }
    } catch {
      // Fall through to text parsing for malformed or non-standard requests.
    }
  }

  let rawBody: string;
  try {
    rawBody = await request.clone().text();
  } catch {
    // The request body was already consumed by the caller without supplying
    // `options.formData`. Surface a clear error instead of leaking the opaque
    // `TypeError: unusable` from undici.
    throw new Error("CSRF body already consumed; pass { formData } to validateCSRFToken.");
  }
  if (!rawBody) {
    return undefined;
  }

  if (contentType.includes("application/json")) {
    try {
      const parsed = JSON.parse(rawBody) as { csrf?: unknown };
      const token = getStringCSRFToken(parsed.csrf);
      if (token) {
        return token;
      }
    } catch {
      // Fall through to URLSearchParams for clients that send form bodies with
      // incomplete content-type headers.
    }
  }

  return getStringCSRFToken(new URLSearchParams(rawBody).get("csrf"));
}

export async function validateCSRFToken(request: Request, options?: ValidateCSRFTokenOptions) {
  const session = await getUserSession(request);
  const sessionToken = session.get("csrf");
  const requestToken = await getCSRFTokenFromRequest(request, options);

  if (!sessionToken) throw new Error("CSRF Session Token not included.");
  if (!requestToken) throw new Error("CSRF Request Token not included.");
  if (!timingSafeStringEqual(requestToken, sessionToken)) throw new Error("CSRF tokens do not match, try refreshing the page.");
}

function timingSafeStringEqual(a: string, b: string) {
  const aBuffer = Buffer.from(a);
  const bBuffer = Buffer.from(b);
  if (aBuffer.byteLength !== bBuffer.byteLength) {
    return false;
  }
  return timingSafeEqual(aBuffer, bBuffer);
}