package api

import (
	"bytes"
	"context"
	"encoding/json"
	"errors"
	"io"
	"net/http"
	"sync"
	"time"
)

// adminClient authenticates to PocketBase as a superuser service account and is
// used only for admin user-management (list/create/delete users). It caches the
// superuser token and transparently re-authenticates when PocketBase rejects it.
//
// This is the one place the server holds elevated PocketBase credentials; every
// admin endpoint that uses it first verifies the *caller* is an app admin.
type adminClient struct {
	baseURL  string
	email    string
	password string
	client   *http.Client

	mu    sync.Mutex
	token string
}

func newAdminClient(baseURL, email, password string) *adminClient {
	return &adminClient{
		baseURL:  baseURL,
		email:    email,
		password: password,
		client:   &http.Client{Timeout: 15 * time.Second},
	}
}

func (a *adminClient) configured() bool {
	if a == nil {
		return false
	}
	_, email, password := a.creds()
	return email != "" && password != ""
}

// creds snapshots the current base URL + service-account credentials under lock,
// so a concurrent reconfigure() can't tear them mid-request.
func (a *adminClient) creds() (baseURL, email, password string) {
	a.mu.Lock()
	defer a.mu.Unlock()
	return a.baseURL, a.email, a.password
}

// reconfigure retargets the service account at a new PocketBase and/or new
// credentials, invalidating any cached superuser token.
func (a *adminClient) reconfigure(baseURL, email, password string) {
	a.mu.Lock()
	a.baseURL = baseURL
	a.email = email
	a.password = password
	a.token = "" // force re-auth against the new target
	a.mu.Unlock()
}

func (a *adminClient) authenticate(ctx context.Context) (string, error) {
	baseURL, email, password := a.creds()
	tok, _, err := superuserAuth(ctx, a.client, baseURL, email, password)
	if err != nil {
		return "", err
	}
	a.mu.Lock()
	a.token = tok
	a.mu.Unlock()
	return tok, nil
}

// superuserAuth performs a PocketBase superuser auth-with-password and returns
// the token and HTTP status. Shared by the live client and the settings
// connection-test so both classify failures identically.
func superuserAuth(ctx context.Context, client *http.Client, baseURL, email, password string) (string, int, error) {
	body, _ := json.Marshal(map[string]string{"identity": email, "password": password})
	req, _ := http.NewRequestWithContext(ctx, http.MethodPost,
		baseURL+"/api/collections/_superusers/auth-with-password", bytes.NewReader(body))
	req.Header.Set("Content-Type", "application/json")

	resp, err := client.Do(req)
	if err != nil {
		return "", 0, err
	}
	defer resp.Body.Close()
	data, _ := io.ReadAll(resp.Body)
	if resp.StatusCode != http.StatusOK {
		return "", resp.StatusCode, errors.New("superuser auth failed: " + string(data))
	}
	var out struct {
		Token string `json:"token"`
	}
	if err := json.Unmarshal(data, &out); err != nil || out.Token == "" {
		return "", resp.StatusCode, errors.New("superuser auth: no token")
	}
	return out.Token, resp.StatusCode, nil
}

func (a *adminClient) cachedToken() string {
	a.mu.Lock()
	defer a.mu.Unlock()
	return a.token
}

// do performs an admin request, (re)authenticating as needed. It returns the
// upstream response body and status. On a 401 it re-authenticates once and
// retries, so an expired cached token is self-healing.
func (a *adminClient) do(ctx context.Context, method, path string, payload any) ([]byte, int, error) {
	token := a.cachedToken()
	if token == "" {
		var err error
		if token, err = a.authenticate(ctx); err != nil {
			return nil, 0, err
		}
	}

	baseURL, _, _ := a.creds()
	send := func(tok string) ([]byte, int, error) {
		var body io.Reader
		if payload != nil {
			b, _ := json.Marshal(payload)
			body = bytes.NewReader(b)
		}
		req, _ := http.NewRequestWithContext(ctx, method, baseURL+path, body)
		req.Header.Set("Authorization", tok)
		if payload != nil {
			req.Header.Set("Content-Type", "application/json")
		}
		resp, err := a.client.Do(req)
		if err != nil {
			return nil, 0, err
		}
		defer resp.Body.Close()
		data, _ := io.ReadAll(resp.Body)
		return data, resp.StatusCode, nil
	}

	data, status, err := send(token)
	if err != nil {
		return nil, 0, err
	}
	if status == http.StatusUnauthorized {
		if token, err = a.authenticate(ctx); err != nil {
			return nil, 0, err
		}
		return send(token)
	}
	return data, status, nil
}