package subsonic

import (
	"encoding/hex"
	"strconv"
	"strings"

	vsauth "git.noroutes.net/NoRoutes/vibetunes/internal/auth"
	"git.noroutes.net/NoRoutes/vibetunes/internal/database"
)

func init() {
	register("getUser", handleGetUser)
	register("getUsers", handleGetUsers)
	register("createUser", handleCreateUser)
	register("updateUser", handleUpdateUser)
	register("deleteUser", handleDeleteUser)
	register("changePassword", handleChangePassword)
}

func userToModel(rc *Context, u *database.User) User {
	db := rc.Server.DB
	m := User{
		Username:            u.Username,
		Email:               u.Email,
		ScrobblingEnabled:   true,
		AdminRole:           u.IsAdmin,
		SettingsRole:        u.Allows(u.Permissions.Settings),
		DownloadRole:        u.Allows(u.Permissions.Download),
		UploadRole:          u.Allows(u.Permissions.Upload),
		PlaylistRole:        u.Allows(u.Permissions.Playlist),
		CoverArtRole:        u.Allows(u.Permissions.CoverArt),
		CommentRole:         u.Allows(u.Permissions.Comment),
		PodcastRole:         u.Allows(u.Permissions.Podcast),
		StreamRole:          u.Allows(u.Permissions.Stream),
		JukeboxRole:         u.Allows(u.Permissions.Jukebox),
		ShareRole:           u.Allows(u.Permissions.Share),
		VideoConversionRole: u.Allows(u.Permissions.VideoConversion),
	}
	if fm, err := loadFolderMap(db); err == nil {
		allowedIDs, _ := database.AllowedMusicFolderIDs(db, u.ID)
		if len(allowedIDs) == 0 {
			for _, f := range fm.folders {
				n, _ := strconv.Atoi(fm.IntID(f.ID))
				m.Folder = append(m.Folder, n)
			}
		} else {
			for _, id := range allowedIDs {
				n, _ := strconv.Atoi(fm.IntID(id))
				m.Folder = append(m.Folder, n)
			}
		}
	}
	return m
}

func handleGetUser(rc *Context) *apiError {
	username, aerr := rc.Params.Required("username")
	if aerr != nil {
		return aerr
	}
	if username != rc.User.Username && !rc.User.IsAdmin {
		return errUnauthorized("viewing another user's account")
	}
	target, err := database.GetUserByUsername(rc.Server.DB, username)
	if err != nil {
		return errNotFound("User")
	}
	model := userToModel(rc, target)
	rc.Response = newResponse()
	rc.Response.User = &model
	return nil
}

func handleGetUsers(rc *Context) *apiError {
	if !rc.User.IsAdmin {
		return errUnauthorized("listing users")
	}
	users, err := database.ListUsers(rc.Server.DB)
	if err != nil {
		return newError(ErrGeneric, err.Error())
	}
	out := &Users{}
	for _, u := range users {
		out.User = append(out.User, userToModel(rc, u))
	}
	rc.Response = newResponse()
	rc.Response.Users = out
	return nil
}

// permissionsFromParams builds a Permissions set for a brand-new user:
// any role param not present defaults to false (an explicit opt-in
// model for account creation).
func permissionsFromParams(p params) database.Permissions {
	get := func(name string) bool { return p.Bool(name, false) }
	return database.Permissions{
		Settings:        get("settingsRole"),
		Stream:          get("streamRole"),
		Download:        get("downloadRole"),
		Upload:          get("uploadRole"),
		Playlist:        get("playlistRole"),
		CoverArt:        get("coverArtRole"),
		Comment:         get("commentRole"),
		Podcast:         get("podcastRole"),
		Share:           get("shareRole"),
		Jukebox:         get("jukeboxRole"),
		VideoConversion: get("videoConversionRole"),
	}
}

// mergePermissionsFromParams overlays only the role params actually
// present in the request onto existing, so updateUser calls that omit
// some roles (e.g. a client only toggling one checkbox) don't silently
// revoke the rest.
func mergePermissionsFromParams(p params, existing database.Permissions) database.Permissions {
	set := func(name string, cur bool) bool {
		if !p.Has(name) {
			return cur
		}
		return p.Bool(name, cur)
	}
	return database.Permissions{
		Settings:        set("settingsRole", existing.Settings),
		Stream:          set("streamRole", existing.Stream),
		Download:        set("downloadRole", existing.Download),
		Upload:          set("uploadRole", existing.Upload),
		Playlist:        set("playlistRole", existing.Playlist),
		CoverArt:        set("coverArtRole", existing.CoverArt),
		Comment:         set("commentRole", existing.Comment),
		Podcast:         set("podcastRole", existing.Podcast),
		Share:           set("shareRole", existing.Share),
		Jukebox:         set("jukeboxRole", existing.Jukebox),
		VideoConversion: set("videoConversionRole", existing.VideoConversion),
	}
}

func decodePassword(raw string) string {
	if strings.HasPrefix(raw, "enc:") {
		if decoded, err := hex.DecodeString(strings.TrimPrefix(raw, "enc:")); err == nil {
			return string(decoded)
		}
	}
	return raw
}

func handleCreateUser(rc *Context) *apiError {
	if !rc.User.IsAdmin {
		return errUnauthorized("creating users")
	}
	username, aerr := rc.Params.Required("username")
	if aerr != nil {
		return aerr
	}
	rawPassword, aerr := rc.Params.Required("password")
	if aerr != nil {
		return aerr
	}
	email := rc.Params.Get("email")
	isAdmin := rc.Params.Bool("adminRole", false)

	user, err := database.CreateUser(rc.Server.DB, username, email, "", isAdmin)
	if err != nil {
		return newError(ErrGeneric, "could not create user: "+err.Error())
	}
	if err := vsauth.SetUserPassword(rc.Server.DB, rc.Server.EncryptionKey, user.ID, decodePassword(rawPassword)); err != nil {
		return newError(ErrGeneric, err.Error())
	}
	if err := database.SetUserPermissions(rc.Server.DB, user.ID, permissionsFromParams(rc.Params)); err != nil {
		return newError(ErrGeneric, err.Error())
	}
	if folderIDs := rc.Params.GetAll("musicFolderId"); len(folderIDs) > 0 {
		if err := applyFolderRestriction(rc, user.ID, folderIDs); err != nil {
			return err
		}
	}

	rc.Response = newResponse()
	return nil
}

func applyFolderRestriction(rc *Context, userID string, folderIntIDs []string) *apiError {
	fm, err := loadFolderMap(rc.Server.DB)
	if err != nil {
		return newError(ErrGeneric, err.Error())
	}
	var ids []string
	for _, s := range folderIntIDs {
		if f := fm.ByIntID(s); f != nil {
			ids = append(ids, f.ID)
		}
	}
	if err := database.SetAllowedMusicFolders(rc.Server.DB, userID, ids); err != nil {
		return newError(ErrGeneric, err.Error())
	}
	return nil
}

func handleUpdateUser(rc *Context) *apiError {
	if !rc.User.IsAdmin {
		return errUnauthorized("modifying users")
	}
	username, aerr := rc.Params.Required("username")
	if aerr != nil {
		return aerr
	}
	target, err := database.GetUserByUsername(rc.Server.DB, username)
	if err != nil {
		return errNotFound("User")
	}

	if email := rc.Params.Get("email"); email != "" {
		if err := database.SetUserEmail(rc.Server.DB, target.ID, email); err != nil {
			return newError(ErrGeneric, err.Error())
		}
	}
	if rc.Params.Has("adminRole") {
		if err := database.SetUserAdmin(rc.Server.DB, target.ID, rc.Params.Bool("adminRole", target.IsAdmin)); err != nil {
			return newError(ErrGeneric, err.Error())
		}
	}
	if rc.Params.Has("password") {
		if err := vsauth.SetUserPassword(rc.Server.DB, rc.Server.EncryptionKey, target.ID, decodePassword(rc.Params.Get("password"))); err != nil {
			return newError(ErrGeneric, err.Error())
		}
	}
	merged := mergePermissionsFromParams(rc.Params, target.Permissions)
	if err := database.SetUserPermissions(rc.Server.DB, target.ID, merged); err != nil {
		return newError(ErrGeneric, err.Error())
	}
	if folderIDs := rc.Params.GetAll("musicFolderId"); len(folderIDs) > 0 {
		if aerr := applyFolderRestriction(rc, target.ID, folderIDs); aerr != nil {
			return aerr
		}
	}

	rc.Response = newResponse()
	return nil
}

func handleDeleteUser(rc *Context) *apiError {
	if !rc.User.IsAdmin {
		return errUnauthorized("deleting users")
	}
	username, aerr := rc.Params.Required("username")
	if aerr != nil {
		return aerr
	}
	target, err := database.GetUserByUsername(rc.Server.DB, username)
	if err != nil {
		return errNotFound("User")
	}
	if target.ID == rc.User.ID {
		return newError(ErrGeneric, "cannot delete your own account")
	}
	if err := database.DeleteUser(rc.Server.DB, target.ID); err != nil {
		return newError(ErrGeneric, err.Error())
	}
	rc.Response = newResponse()
	return nil
}

func handleChangePassword(rc *Context) *apiError {
	username, aerr := rc.Params.Required("username")
	if aerr != nil {
		return aerr
	}
	rawPassword, aerr := rc.Params.Required("password")
	if aerr != nil {
		return aerr
	}
	if username != rc.User.Username && !rc.User.IsAdmin {
		return errUnauthorized("changing another user's password")
	}
	target, err := database.GetUserByUsername(rc.Server.DB, username)
	if err != nil {
		return errNotFound("User")
	}
	if err := vsauth.SetUserPassword(rc.Server.DB, rc.Server.EncryptionKey, target.ID, decodePassword(rawPassword)); err != nil {
		return newError(ErrGeneric, err.Error())
	}
	rc.Response = newResponse()
	return nil
}