"""认证模块"""
from datetime import datetime, timedelta
from typing import Optional

from redis import exceptions as redis_exceptions
from fastapi import Depends, HTTPException, status, Request
from fastapi.security import OAuth2PasswordBearer
from jose import JWTError, jwt

from app.core.context import current_user_dept_id
from sqlalchemy.orm import Session

from app.core.config import settings
from app.core.database import get_db
from app.core.redis_client import get_sync_redis_client
from app.crud.user import user_crud
from app.services.web_auth_roles import resolve_web_role_for_user

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/public/login")

REFRESH_TOKEN_EXPIRE_DAYS = 7
REFRESH_TOKEN_EXPIRE_SECONDS = int(timedelta(days=REFRESH_TOKEN_EXPIRE_DAYS).total_seconds())


def _session_key(session_id: str) -> str:
    return f"auth:sessions:{session_id}"


def _refresh_key(refresh_jti: str) -> str:
    return f"auth:refresh:{refresh_jti}"


def _redis_call_safe(fn):
    """同步 Redis 调用；失败时返回 None 供调用方降级。"""
    r = get_sync_redis_client()
    if r is None:
        return None
    try:
        return fn(r)
    except (redis_exceptions.TimeoutError, redis_exceptions.ConnectionError, redis_exceptions.RedisError):
        return None


def store_session(session_id: str, user_id: str) -> None:
    """写入会话（用于强制失效）"""
    _redis_call_safe(lambda r: r.set(_session_key(session_id), user_id, ex=REFRESH_TOKEN_EXPIRE_SECONDS))


def revoke_session(session_id: str) -> None:
    """撤销会话（登出/强制失效）"""
    _redis_call_safe(lambda r: r.delete(_session_key(session_id)))


def extend_session(session_id: str) -> None:
    """刷新会话 TTL（已登录用户每次 API 校验通过后滑动续期）"""
    if not session_id:
        return
    _redis_call_safe(lambda r: r.expire(_session_key(session_id), REFRESH_TOKEN_EXPIRE_SECONDS))


def is_session_valid(session_id: str) -> bool:
    """检查会话是否仍然有效"""
    if get_sync_redis_client() is None:
        return True
    if not session_id:
        return False
    exists = _redis_call_safe(lambda r: r.exists(_session_key(session_id)))
    if exists is None:
        return True
    return exists > 0


def store_refresh_token(refresh_jti: str, user_id: str) -> None:
    """写入 refreshToken（用于 one-time 使用/吊销）"""
    _redis_call_safe(
        lambda r: r.set(_refresh_key(refresh_jti), user_id, ex=REFRESH_TOKEN_EXPIRE_SECONDS)
    )


def is_refresh_token_valid(refresh_jti: str) -> bool:
    if get_sync_redis_client() is None:
        return True
    if not refresh_jti:
        return False
    exists = _redis_call_safe(lambda r: r.exists(_refresh_key(refresh_jti)))
    if exists is None:
        return True
    return exists > 0


def revoke_refresh_token(refresh_jti: str) -> None:
    _redis_call_safe(lambda r: r.delete(_refresh_key(refresh_jti)))


def create_access_token(
    data: dict,
    session_id: str,
    token_jti: str,
    expires_delta: Optional[timedelta] = None,
) -> str:
    """创建JWT访问令牌"""
    to_encode = data.copy()
    if expires_delta:
        expire = datetime.utcnow() + expires_delta
    else:
        expire = datetime.utcnow() + timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
    to_encode.update(
        {
            "exp": expire,
            "type": "access",
            "sid": session_id,
            "jti": token_jti,
        }
    )
    encoded_jwt = jwt.encode(to_encode, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
    return encoded_jwt


def create_refresh_token(data: dict, session_id: str, refresh_jti: str) -> str:
    """创建刷新令牌"""
    to_encode = data.copy()
    expire = datetime.utcnow() + timedelta(days=REFRESH_TOKEN_EXPIRE_DAYS)
    to_encode.update(
        {
            "exp": expire,
            "type": "refresh",
            "sid": session_id,
            "jti": refresh_jti,
        }
    )
    encoded_jwt = jwt.encode(to_encode, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
    return encoded_jwt


def decode_token(token: str) -> dict:
    """解码JWT令牌"""
    try:
        payload = jwt.decode(token, settings.SECRET_KEY, algorithms=[settings.ALGORITHM])
        return payload
    except JWTError:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="无效的认证凭据",
            headers={"WWW-Authenticate": "Bearer"},
        )


def get_current_user_by_token(token: str, db: Session) -> dict:
    """根据 token 获取当前用户（包含 Redis 会话校验；会话滑动续期）"""
    payload = decode_token(token)

    user_id: str = payload.get("sub")
    session_id: str = payload.get("sid")

    if not is_session_valid(session_id):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Token无效或已过期",
        )

    extend_session(session_id)

    if user_id is None:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="无效的认证凭据",
        )

    user = user_crud.get(db, user_id)
    if not user or getattr(user, "del_flag", 0) != 0:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="用户不存在或已删除",
        )

    if getattr(user, "status", "1") != "1":
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="用户已被禁用",
        )

    web_role = resolve_web_role_for_user(db, user.id)

    phone = (getattr(user, "phone_no", None) or "").strip() or None
    email = (getattr(user, "email", None) or "").strip() or None
    avatar = getattr(user, "avatar", None)

    current_user_dept_id.set(user.dept_id or "")

    tenant_no = (getattr(user, "tenant_no", None) or "").strip() or settings.DEFAULT_TENANT_NO

    return {
        "user_id": user.id,
        "username": user.user_no,
        "real_name": user.nick_name,
        "role": web_role,
        "region_id": user.dept_id,
        "tenant_no": tenant_no,
        "phone": phone,
        "email": email,
        "avatar_url": avatar,
        "is_active": user.status == "1",
    }


def get_current_user(
    token: str = Depends(oauth2_scheme),
    db: Session = Depends(get_db),
) -> dict:
    """获取当前用户（sync 依赖，配合 sync 路由在线程池执行，避免阻塞事件循环）。"""
    return get_current_user_by_token(token, db)


def get_current_user_simple(token: str = Depends(oauth2_scheme)) -> dict:
    """简化版获取当前用户（不查数据库）"""
    payload = decode_token(token)
    user_id: str = payload.get("sub")
    if user_id is None:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="无效的认证凭据",
        )
    current_user_dept_id.set(payload.get("region_id") or "")
    return {
        "user_id": user_id,
        "username": payload.get("username"),
        "role": payload.get("role"),
        "region_id": payload.get("region_id"),
        "real_name": payload.get("real_name"),
    }


def get_client_ip(request: Request) -> str:
    """获取客户端IP"""
    forwarded = request.headers.get("X-Forwarded-For")
    if forwarded:
        return forwarded.split(",")[0].strip()
    return request.client.host if request.client else "unknown"