package service

import (
	"bytes"
	"context"
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"encoding/gob"
	"errors"
	"io"

	"golang.org/x/crypto/bcrypt"

	"git.sr.ht/~gabrielgio/img/pkg/database/repository"
)

type AuthController struct {
	authRepository repository.AuthRepository
	userRepository repository.UserRepository
	key            []byte
}

func NewAuthController(
	authRepository repository.AuthRepository,
	userRepository repository.UserRepository,
	key []byte,
) *AuthController {
	return &AuthController{
		authRepository: authRepository,
		userRepository: userRepository,
		key:            key,
	}
}

func (c *AuthController) Login(ctx context.Context, username, password []byte) ([]byte, error) {
	id, err := c.authRepository.GetIDByUsername(ctx, string(username))
	if err != nil {
		return nil, err
	}

	hashedPassword, err := c.authRepository.GetPassword(ctx, id)
	if err != nil {
		return nil, err
	}

	if err := bcrypt.CompareHashAndPassword(hashedPassword, password); err != nil {
		return nil, err
	}

	token := &Token{
		UserID:   id,
		Username: string(username),
	}
	return WriteToken(token, c.key)
}

// InitialRegister register a initial user, it will validate if there is another
// user stored already. If so an error `InvlidaInput` will be returned
func (c *AuthController) InitialRegister(ctx context.Context, username, password []byte, path []byte) error {
	exist, err := c.userRepository.Any(ctx)
	if err != nil {
		return err
	}

	if exist {
		return InvlidInput
	}

	hash, err := bcrypt.GenerateFromPassword(password, bcrypt.MinCost)
	if err != nil {
		return err
	}

	_, err = c.userRepository.Create(ctx, &repository.CreateUser{
		Username: string(username),
		Password: hash,
		IsAdmin:  true,
		Path:     string(path),
	})

	return err
}

type Token struct {
	UserID   uint
	Username string
}

func ReadToken(data []byte, key []byte) (*Token, error) {
	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}

	aesgcm, err := cipher.NewGCM(block)
	if err != nil {
		panic(err.Error())
	}

	nonceSize := aesgcm.NonceSize()
	if len(data) < nonceSize {
		return nil, errors.New("nonce size greater than data's size")
	}

	nonce, ciphertext := data[:nonceSize], data[nonceSize:]
	plaintext, err := aesgcm.Open(nil, nonce, ciphertext, nil)
	if err != nil {
		return nil, err
	}

	r := bytes.NewReader(plaintext)
	var token Token
	dec := gob.NewDecoder(r)
	if err = dec.Decode(&token); err != nil {
		return nil, err
	}
	return &token, nil
}

func WriteToken(token *Token, key []byte) ([]byte, error) {
	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}

	aesgcm, err := cipher.NewGCM(block)
	if err != nil {
		return nil, err
	}

	var buffer bytes.Buffer
	enc := gob.NewEncoder(&buffer)
	if err := enc.Encode(token); err != nil {
		return nil, err
	}
	nonce := make([]byte, aesgcm.NonceSize())
	if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
		return nil, err
	}

	ciphertext := aesgcm.Seal(nonce, nonce, buffer.Bytes(), nil)
	return ciphertext, nil
}