package galleries

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"net/http"
	"strings"
	"time"

	"github.com/example/sndit/backend/internal/auth"
	"github.com/example/sndit/backend/internal/media"
	"github.com/example/sndit/backend/internal/storage"
	"github.com/google/uuid"
	"golang.org/x/crypto/bcrypt"
)

const signedURLDuration = time.Hour

type Handler struct {
	repository *Repository
	media      *media.Repository
	storage    storage.Storage
	auth       *auth.Service
}

func NewHandler(repository *Repository, mediaRepository *media.Repository, objectStorage storage.Storage, authService *auth.Service) *Handler {
	return &Handler{
		repository: repository,
		media:      mediaRepository,
		storage:    objectStorage,
		auth:       authService,
	}
}

func (h *Handler) RegisterProtectedRoutes(mux *http.ServeMux, require func(http.Handler) http.Handler) {
	mux.Handle("GET /api/galleries", require(http.HandlerFunc(h.List)))
	mux.Handle("POST /api/galleries", require(http.HandlerFunc(h.Create)))
	mux.Handle("GET /api/galleries/{id}", require(http.HandlerFunc(h.Get)))
	mux.Handle("PATCH /api/galleries/{id}", require(http.HandlerFunc(h.Update)))
	mux.Handle("DELETE /api/galleries/{id}", require(http.HandlerFunc(h.Delete)))
	mux.Handle("POST /api/galleries/{id}/publish", require(http.HandlerFunc(h.Publish)))
	mux.Handle("POST /api/galleries/{id}/unpublish", require(http.HandlerFunc(h.Unpublish)))
	mux.Handle("GET /api/galleries/{id}/preview", require(http.HandlerFunc(h.Preview)))
}

func (h *Handler) RegisterPublicRoutes(mux *http.ServeMux) {
	mux.HandleFunc("GET /api/public/galleries/{slug}", h.Public)
	mux.HandleFunc("POST /api/public/galleries/{slug}/authenticate", h.AuthenticatePublic)
	mux.HandleFunc("POST /api/public/galleries/{slug}/media/{mediaId}/favorite", h.Favorite)
	mux.HandleFunc("DELETE /api/public/galleries/{slug}/media/{mediaId}/favorite", h.Unfavorite)
}

type createRequest struct {
	Title       string `json:"title"`
	ClientName  string `json:"clientName"`
	Description string `json:"description"`
}

type updateRequest struct {
	Title              *string         `json:"title"`
	ClientName         *string         `json:"clientName"`
	Description        *string         `json:"description"`
	Password           *string         `json:"password"`
	ClearPassword      bool            `json:"clearPassword"`
	DownloadsEnabled   *bool           `json:"downloadsEnabled"`
	FavoritesEnabled   *bool           `json:"favoritesEnabled"`
	DownloadAllEnabled *bool           `json:"downloadAllEnabled"`
	WatermarkEnabled   *bool           `json:"watermarkEnabled"`
	ExpiresAt          *string         `json:"expiresAt"`
	CoverMediaID       *string         `json:"coverMediaId"`
	ThemeConfig        json.RawMessage `json:"themeConfig"`
	BrandingConfig     json.RawMessage `json:"brandingConfig"`
}

type publicPasswordRequest struct {
	Password string `json:"password"`
}

func (h *Handler) List(w http.ResponseWriter, r *http.Request) {
	user, ok := auth.UserFromContext(r.Context())
	if !ok {
		writeError(w, http.StatusUnauthorized, "authentication required")
		return
	}
	summaries, err := h.repository.ListForUser(r.Context(), user.ID)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "could not load galleries")
		return
	}
	for index := range summaries {
		if summaries[index].CoverMediaID == "" {
			continue
		}
		coverID, err := uuid.Parse(summaries[index].CoverMediaID)
		if err != nil {
			continue
		}
		cover, err := h.media.GetForUser(r.Context(), user.ID, coverID)
		if err != nil {
			continue
		}
		summaries[index].CoverURL, _ = h.mediaURL(r.Context(), cover, false)
	}
	writeJSON(w, http.StatusOK, map[string]any{"galleries": summaries})
}

func (h *Handler) Create(w http.ResponseWriter, r *http.Request) {
	user, ok := auth.UserFromContext(r.Context())
	if !ok {
		writeError(w, http.StatusUnauthorized, "authentication required")
		return
	}
	var request createRequest
	if !decodeJSON(w, r, &request) {
		return
	}
	request.Title = strings.TrimSpace(request.Title)
	request.ClientName = strings.TrimSpace(request.ClientName)
	if request.Title == "" || len(request.Title) > 180 || request.ClientName == "" || len(request.ClientName) > 180 {
		writeError(w, http.StatusBadRequest, "title and client name are required")
		return
	}

	record, err := h.repository.Create(r.Context(), user.ID, newSlug(request.Title), request.Title, request.ClientName, strings.TrimSpace(request.Description))
	if err != nil {
		writeError(w, http.StatusInternalServerError, "could not create gallery")
		return
	}
	writeJSON(w, http.StatusCreated, map[string]any{"gallery": h.detail(record, nil)})
}

func (h *Handler) Get(w http.ResponseWriter, r *http.Request) {
	user, ok := auth.UserFromContext(r.Context())
	if !ok {
		writeError(w, http.StatusUnauthorized, "authentication required")
		return
	}
	record, err := h.recordForUser(r, user.ID)
	if err != nil {
		writeGalleryError(w, err)
		return
	}
	items, err := h.media.ListByGallery(r.Context(), record.ID)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "could not load gallery media")
		return
	}
	views, err := h.mediaViews(r.Context(), items, "", true)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "could not sign media URLs")
		return
	}
	writeJSON(w, http.StatusOK, map[string]any{"gallery": h.detail(record, views)})
}

func (h *Handler) Preview(w http.ResponseWriter, r *http.Request) {
	user, ok := auth.UserFromContext(r.Context())
	if !ok {
		writeError(w, http.StatusUnauthorized, "authentication required")
		return
	}
	record, err := h.recordForUser(r, user.ID)
	if err != nil {
		writeGalleryError(w, err)
		return
	}
	gallery, err := h.publicPayload(r.Context(), r, record, true, true, "")
	if err != nil {
		writeError(w, http.StatusInternalServerError, "could not build gallery preview")
		return
	}
	gallery.Preview = true
	writeJSON(w, http.StatusOK, map[string]any{"gallery": gallery})
}

func (h *Handler) Update(w http.ResponseWriter, r *http.Request) {
	user, ok := auth.UserFromContext(r.Context())
	if !ok {
		writeError(w, http.StatusUnauthorized, "authentication required")
		return
	}
	current, err := h.recordForUser(r, user.ID)
	if err != nil {
		writeGalleryError(w, err)
		return
	}
	var request updateRequest
	if !decodeJSON(w, r, &request) {
		return
	}

	input := UpdateInput{
		Title:              current.Title,
		ClientName:         current.ClientName,
		Description:        current.Description,
		DownloadsEnabled:   current.DownloadsEnabled,
		FavoritesEnabled:   current.FavoritesEnabled,
		DownloadAllEnabled: current.DownloadAllEnabled,
		WatermarkEnabled:   current.WatermarkEnabled,
		ExpiresAt:          stringPointer(current.ExpiresAt),
		CoverMediaID:       stringPointer(current.CoverMediaID),
		ThemeConfig:        current.ThemeConfig,
		BrandingConfig:     current.BrandingConfig,
	}
	if current.PasswordHash != "" {
		input.PasswordHash = &current.PasswordHash
	}
	if request.Title != nil {
		input.Title = strings.TrimSpace(*request.Title)
	}
	if request.ClientName != nil {
		input.ClientName = strings.TrimSpace(*request.ClientName)
	}
	if request.Description != nil {
		input.Description = strings.TrimSpace(*request.Description)
	}
	if input.Title == "" || input.ClientName == "" || len(input.Title) > 180 || len(input.ClientName) > 180 {
		writeError(w, http.StatusBadRequest, "title and client name are required")
		return
	}
	if request.Password != nil {
		if strings.TrimSpace(*request.Password) == "" {
			input.ClearPassword = true
		} else if len(*request.Password) < 4 {
			writeError(w, http.StatusBadRequest, "gallery password must be at least 4 characters")
			return
		} else {
			hash, err := bcrypt.GenerateFromPassword([]byte(*request.Password), bcrypt.DefaultCost)
			if err != nil {
				writeError(w, http.StatusInternalServerError, "could not secure gallery password")
				return
			}
			hashed := string(hash)
			input.PasswordHash = &hashed
			input.ClearPassword = false
		}
	}
	if request.ClearPassword {
		input.ClearPassword = true
		input.PasswordHash = nil
	}
	if request.DownloadsEnabled != nil {
		input.DownloadsEnabled = *request.DownloadsEnabled
	}
	if request.FavoritesEnabled != nil {
		input.FavoritesEnabled = *request.FavoritesEnabled
	}
	if request.DownloadAllEnabled != nil {
		input.DownloadAllEnabled = *request.DownloadAllEnabled
	}
	if request.WatermarkEnabled != nil {
		input.WatermarkEnabled = *request.WatermarkEnabled
	}
	if request.ExpiresAt != nil {
		value := strings.TrimSpace(*request.ExpiresAt)
		if value != "" {
			if _, err := time.Parse(time.RFC3339, value); err != nil {
				writeError(w, http.StatusBadRequest, "expiry must be an ISO timestamp")
				return
			}
		}
		input.ExpiresAt = &value
	}
	if request.CoverMediaID != nil {
		value := strings.TrimSpace(*request.CoverMediaID)
		if value != "" {
			coverID, err := uuid.Parse(value)
			if err != nil {
				writeError(w, http.StatusBadRequest, "invalid cover media id")
				return
			}
			cover, err := h.media.GetForUser(r.Context(), user.ID, coverID)
			if err != nil || cover.GalleryID != current.ID {
				writeError(w, http.StatusBadRequest, "cover media does not belong to this gallery")
				return
			}
		}
		input.CoverMediaID = &value
	}
	if len(request.ThemeConfig) > 0 {
		if !json.Valid(request.ThemeConfig) {
			writeError(w, http.StatusBadRequest, "theme config must be valid JSON")
			return
		}
		input.ThemeConfig = request.ThemeConfig
	}
	if len(request.BrandingConfig) > 0 {
		if !json.Valid(request.BrandingConfig) {
			writeError(w, http.StatusBadRequest, "branding config must be valid JSON")
			return
		}
		input.BrandingConfig = request.BrandingConfig
	}

	record, err := h.repository.Update(r.Context(), user.ID, current.ID, input)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "could not update gallery")
		return
	}
	items, err := h.media.ListByGallery(r.Context(), record.ID)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "could not load gallery media")
		return
	}
	views, err := h.mediaViews(r.Context(), items, "", true)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "could not sign media URLs")
		return
	}
	writeJSON(w, http.StatusOK, map[string]any{"gallery": h.detail(record, views)})
}

func (h *Handler) Publish(w http.ResponseWriter, r *http.Request) {
	h.setStatus(w, r, StatusPublished)
}

func (h *Handler) Unpublish(w http.ResponseWriter, r *http.Request) {
	h.setStatus(w, r, StatusDraft)
}

func (h *Handler) setStatus(w http.ResponseWriter, r *http.Request, status string) {
	user, ok := auth.UserFromContext(r.Context())
	if !ok {
		writeError(w, http.StatusUnauthorized, "authentication required")
		return
	}
	record, err := h.recordForUser(r, user.ID)
	if err != nil {
		writeGalleryError(w, err)
		return
	}
	record, err = h.repository.SetStatus(r.Context(), user.ID, record.ID, status)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "could not update gallery status")
		return
	}
	writeJSON(w, http.StatusOK, map[string]any{"gallery": h.detail(record, nil)})
}

func (h *Handler) Delete(w http.ResponseWriter, r *http.Request) {
	user, ok := auth.UserFromContext(r.Context())
	if !ok {
		writeError(w, http.StatusUnauthorized, "authentication required")
		return
	}
	id, err := pathUUID(r, "id")
	if err != nil {
		writeGalleryError(w, err)
		return
	}
	if err := h.repository.Delete(r.Context(), user.ID, id); err != nil {
		writeGalleryError(w, err)
		return
	}
	w.WriteHeader(http.StatusNoContent)
}

func (h *Handler) Public(w http.ResponseWriter, r *http.Request) {
	slug := strings.TrimSpace(r.PathValue("slug"))
	record, err := h.repository.GetPublicBySlug(r.Context(), slug)
	if err != nil || record.IsExpired() {
		writeError(w, http.StatusNotFound, "gallery not found")
		return
	}
	if record.PasswordHash != "" && !h.auth.HasGalleryAccess(r, record.Slug) {
		gallery := h.lockedPayload(record)
		writeJSON(w, http.StatusOK, gallery)
		return
	}
	visitorID := ""
	if record.FavoritesEnabled {
		visitorID = h.auth.EnsureVisitor(w, r)
	}
	gallery, err := h.publicPayload(r.Context(), r, record, false, false, visitorID)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "could not load gallery")
		return
	}
	writeJSON(w, http.StatusOK, gallery)
}

func (h *Handler) AuthenticatePublic(w http.ResponseWriter, r *http.Request) {
	slug := strings.TrimSpace(r.PathValue("slug"))
	record, err := h.repository.GetPublicBySlug(r.Context(), slug)
	if err != nil || record.IsExpired() {
		writeError(w, http.StatusNotFound, "gallery not found")
		return
	}
	var request publicPasswordRequest
	if !decodeJSON(w, r, &request) {
		return
	}
	if record.PasswordHash == "" || bcrypt.CompareHashAndPassword([]byte(record.PasswordHash), []byte(request.Password)) != nil {
		writeError(w, http.StatusUnauthorized, "incorrect gallery password")
		return
	}
	h.auth.GrantGalleryAccess(w, record.Slug)
	visitorID := ""
	if record.FavoritesEnabled {
		visitorID = h.auth.EnsureVisitor(w, r)
	}
	gallery, err := h.publicPayload(r.Context(), r, record, false, false, visitorID)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "could not load gallery")
		return
	}
	writeJSON(w, http.StatusOK, gallery)
}

func (h *Handler) Favorite(w http.ResponseWriter, r *http.Request) {
	h.setFavorite(w, r, true)
}

func (h *Handler) Unfavorite(w http.ResponseWriter, r *http.Request) {
	h.setFavorite(w, r, false)
}

func (h *Handler) setFavorite(w http.ResponseWriter, r *http.Request, favorited bool) {
	record, err := h.publicRecordForRequest(r)
	if err != nil {
		writeError(w, http.StatusNotFound, "gallery not found")
		return
	}
	if !record.FavoritesEnabled {
		writeError(w, http.StatusForbidden, "favorites are disabled")
		return
	}
	mediaID, err := pathUUID(r, "mediaId")
	if err != nil {
		writeError(w, http.StatusBadRequest, "invalid media id")
		return
	}
	item, err := h.media.GetByID(r.Context(), mediaID)
	if err != nil || item.GalleryID != record.ID {
		writeError(w, http.StatusNotFound, "media not found")
		return
	}
	visitorID := h.auth.EnsureVisitor(w, r)
	if err := h.media.SetFavorite(r.Context(), record.ID, mediaID, visitorID, favorited); err != nil {
		writeError(w, http.StatusInternalServerError, "could not update favorite")
		return
	}
	writeJSON(w, http.StatusOK, map[string]bool{"favorited": favorited})
}

func (h *Handler) publicRecordForRequest(r *http.Request) (GalleryRecord, error) {
	record, err := h.repository.GetPublicBySlug(r.Context(), strings.TrimSpace(r.PathValue("slug")))
	if err != nil || record.IsExpired() {
		return GalleryRecord{}, ErrNotFound
	}
	if record.PasswordHash != "" && !h.auth.HasGalleryAccess(r, record.Slug) {
		return GalleryRecord{}, ErrNotFound
	}
	return record, nil
}

func (h *Handler) publicPayload(ctx context.Context, _ *http.Request, record GalleryRecord, preview, includeOriginal bool, visitorID string) (Public, error) {
	items, err := h.media.ListByGallery(ctx, record.ID)
	if err != nil {
		return Public{}, err
	}
	views, err := h.mediaViews(ctx, items, visitorID, includeOriginal)
	if err != nil {
		return Public{}, err
	}
	gallery := Public{
		Slug:               record.Slug,
		Title:              record.Title,
		ClientName:         record.ClientName,
		Description:        record.Description,
		ThemeConfig:        record.ThemeConfig,
		BrandingConfig:     record.BrandingConfig,
		DownloadsEnabled:   record.DownloadsEnabled,
		FavoritesEnabled:   record.FavoritesEnabled,
		DownloadAllEnabled: record.DownloadAllEnabled,
		WatermarkEnabled:   record.WatermarkEnabled,
		ExpiresAt:          record.ExpiresAt,
		Media:              views,
	}
	for index := range items {
		if record.CoverMediaID != "" && items[index].ID.String() == record.CoverMediaID {
			gallery.Cover = &views[index]
			break
		}
	}
	if gallery.Cover == nil {
		for index := range items {
			if media.IsImage(items[index]) && views[index].PreviewURL != "" {
				gallery.Cover = &views[index]
				break
			}
		}
	}
	return gallery, nil
}

func (h *Handler) lockedPayload(record GalleryRecord) map[string]any {
	return map[string]any{
		"slug":             record.Slug,
		"title":            record.Title,
		"clientName":       record.ClientName,
		"description":      record.Description,
		"themeConfig":      record.ThemeConfig,
		"brandingConfig":   record.BrandingConfig,
		"requiresPassword": true,
		"media":            []media.Public{},
	}
}

func (h *Handler) recordForUser(r *http.Request, userID uuid.UUID) (GalleryRecord, error) {
	id, err := pathUUID(r, "id")
	if err != nil {
		return GalleryRecord{}, err
	}
	return h.repository.GetForUser(r.Context(), userID, id)
}

func (h *Handler) detail(record GalleryRecord, items []media.Public) Detail {
	if items == nil {
		items = []media.Public{}
	}
	return Detail{
		ID:                 record.ID.String(),
		Slug:               record.Slug,
		Title:              record.Title,
		ClientName:         record.ClientName,
		Description:        record.Description,
		Status:             record.Status,
		DownloadsEnabled:   record.DownloadsEnabled,
		FavoritesEnabled:   record.FavoritesEnabled,
		DownloadAllEnabled: record.DownloadAllEnabled,
		WatermarkEnabled:   record.WatermarkEnabled,
		ExpiresAt:          record.ExpiresAt,
		CoverMediaID:       record.CoverMediaID,
		ThemeConfig:        record.ThemeConfig,
		BrandingConfig:     record.BrandingConfig,
		CreatedAt:          record.CreatedAt,
		PublishedAt:        record.PublishedAt,
		Media:              items,
	}
}

func (h *Handler) mediaViews(ctx context.Context, items []media.Record, visitorID string, includeOriginal bool) ([]media.Public, error) {
	views := make([]media.Public, 0, len(items))
	for _, item := range items {
		view := media.Public{
			ID:               item.ID,
			OriginalFilename: item.OriginalFilename,
			MimeType:         item.MimeType,
			FileSize:         item.FileSize,
			ProcessingStatus: item.ProcessingStatus,
			Width:            item.Width,
			Height:           item.Height,
			DurationSeconds:  item.DurationSeconds,
			SortOrder:        item.SortOrder,
		}
		if item.ProcessingStatus == media.StatusReady {
			var err error
			view.ThumbnailURL, err = h.mediaVariantURL(ctx, item, item.ThumbnailKey)
			if err != nil {
				return nil, err
			}
			view.PreviewURL, err = h.mediaURL(ctx, item, false)
			if err != nil {
				return nil, err
			}
			if includeOriginal {
				view.OriginalURL, err = h.mediaURL(ctx, item, true)
				if err != nil {
					return nil, err
				}
			}
		}
		if visitorID != "" {
			var err error
			view.Favorited, err = h.media.IsFavorited(ctx, item.GalleryID, item.ID, visitorID)
			if err != nil {
				return nil, err
			}
		}
		views = append(views, view)
	}
	return views, nil
}

func (h *Handler) mediaURL(ctx context.Context, item media.Record, original bool) (string, error) {
	if item.ExternalURL != "" {
		return item.ExternalURL, nil
	}
	key := item.PreviewKey
	if original {
		key = item.StorageKey
	}
	return h.mediaVariantURL(ctx, item, key)
}

func (h *Handler) mediaVariantURL(ctx context.Context, item media.Record, key string) (string, error) {
	if item.ExternalURL != "" {
		return item.ExternalURL, nil
	}
	if key == "" {
		return "", fmt.Errorf("media object is not ready")
	}
	return h.storage.CreateDownloadURL(ctx, key, signedURLDuration)
}

func newSlug(title string) string {
	var builder strings.Builder
	lastWasSeparator := true
	for _, character := range strings.ToLower(title) {
		if (character >= 'a' && character <= 'z') || (character >= '0' && character <= '9') {
			builder.WriteRune(character)
			lastWasSeparator = false
			continue
		}
		if builder.Len() > 0 && !lastWasSeparator {
			builder.WriteByte('-')
			lastWasSeparator = true
		}
	}
	slug := strings.Trim(builder.String(), "-")
	if slug == "" {
		slug = "gallery"
	}
	suffix := strings.ReplaceAll(uuid.NewString(), "-", "")[:8]
	return slug + "-" + suffix
}

func pathUUID(r *http.Request, name string) (uuid.UUID, error) {
	id, err := uuid.Parse(r.PathValue(name))
	if err != nil {
		return uuid.Nil, fmt.Errorf("invalid %s", name)
	}
	return id, nil
}

func stringPointer(value string) *string {
	if value == "" {
		return nil
	}
	copy := value
	return &copy
}

func decodeJSON(w http.ResponseWriter, r *http.Request, target any) bool {
	if !strings.HasPrefix(r.Header.Get("Content-Type"), "application/json") {
		writeError(w, http.StatusUnsupportedMediaType, "content type must be application/json")
		return false
	}
	decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20))
	decoder.DisallowUnknownFields()
	if err := decoder.Decode(target); err != nil {
		writeError(w, http.StatusBadRequest, "invalid JSON body")
		return false
	}
	return true
}

func writeGalleryError(w http.ResponseWriter, err error) {
	if errors.Is(err, ErrNotFound) || strings.HasPrefix(err.Error(), "invalid ") {
		writeError(w, http.StatusNotFound, "gallery not found")
		return
	}
	writeError(w, http.StatusInternalServerError, "could not load gallery")
}

func writeError(w http.ResponseWriter, status int, message string) {
	writeJSON(w, status, map[string]string{"error": message})
}

func writeJSON(w http.ResponseWriter, status int, value any) {
	w.Header().Set("Content-Type", "application/json; charset=utf-8")
	w.WriteHeader(status)
	_ = json.NewEncoder(w).Encode(value)
}