using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using Microsoft.IdentityModel.Tokens;

public class TokenService
{
    private readonly IConfiguration _config;

    public TokenService(IConfiguration config)
    {
        _config = config;
    }

    public string GenerateAccessToken(
        int userId, string name, string email,
        IEnumerable<string> roles)
    {
        var key = new SymmetricSecurityKey(
            Encoding.UTF8.GetBytes(
                _config["Jwt:Key"]!));

        var credentials = new SigningCredentials(
            key, SecurityAlgorithms.HmacSha256);

        // Claims — «начинка» токена
        var claims = new List<Claim>
        {
            new(JwtRegisteredClaimNames.Sub,
                userId.ToString()),
            new(JwtRegisteredClaimNames.Name, name),
            new(JwtRegisteredClaimNames.Email, email),
            new(JwtRegisteredClaimNames.Jti,
                Guid.NewGuid().ToString()),
        };

        // Кожна роль — окремий claim
        foreach (var role in roles)
            claims.Add(new(ClaimTypes.Role, role));

        var token = new JwtSecurityToken(
            issuer: _config["Jwt:Issuer"],
            audience: _config["Jwt:Audience"],
            claims: claims,
            expires: DateTime.UtcNow
                .AddMinutes(15),      // ⏱️ 15 хвилин!
            signingCredentials: credentials);

        return new JwtSecurityTokenHandler()
            .WriteToken(token);
    }

    public string GenerateRefreshToken()
    {
        // Refresh token — просто випадковий рядок
        // (не JWT! зберігається в БД)
        return Convert.ToBase64String(
            System.Security.Cryptography
                .RandomNumberGenerator.GetBytes(64));
    }
}

public static class AuthEndpoints
{
    public static WebApplication MapAuthEndpoints(
        this WebApplication app)
    {
        var group = app.MapGroup("/auth")
            .WithTags("Authentication");

        group.MapPost("/login", Login);
        group.MapPost("/refresh", Refresh);
        group.MapPost("/logout", Logout)
            .RequireAuthorization();

        return app;
    }

    private static IResult Login(
        LoginRequest req,
        TokenService tokenService,
        UserRepository userRepo)
    {
        // 1. Знаходимо користувача
        var user = userRepo.FindByEmail(req.Email);
        if (user is null)
            return Results.Json(
                new ProblemDetails
                {
                    Title = "Invalid credentials",
                    Status = 401,
                    Detail = "Invalid email or password."
                }, statusCode: 401);

        // 2. Перевіряємо пароль
        if (!BCrypt.Net.BCrypt.Verify(
                req.Password, user.PasswordHash))
            return Results.Json(
                new ProblemDetails
                {
                    Title = "Invalid credentials",
                    Status = 401,
                    Detail = "Invalid email or password."
                }, statusCode: 401);

        // 3. Генеруємо токени
        var accessToken = tokenService
            .GenerateAccessToken(
                user.Id, user.Name,
                user.Email, user.Roles);

        var refreshToken = tokenService
            .GenerateRefreshToken();

        // 4. Зберігаємо refresh token у БД
        userRepo.SaveRefreshToken(
            user.Id, refreshToken,
            DateTime.UtcNow.AddDays(7));

        // 5. Повертаємо обидва токени
        return Results.Ok(new AuthResponse(
            AccessToken: accessToken,
            RefreshToken: refreshToken,
            ExpiresIn: 900));  // 15 хв = 900 сек
    }

    // ... Refresh та Logout далі
}

record LoginRequest(string Email, string Password);

record AuthResponse(
    string AccessToken,
    string RefreshToken,
    int ExpiresIn);

private static IResult Refresh(
    RefreshRequest req,
    TokenService tokenService,
    UserRepository userRepo)
{
    // 1. Знаходимо refresh token у БД
    var stored = userRepo.FindRefreshToken(
        req.RefreshToken);

    if (stored is null)
        return Results.Json(
            new ProblemDetails
            {
                Title = "Invalid refresh token",
                Status = 401,
                Detail = "Refresh token not found " +
                    "or revoked."
            }, statusCode: 401);

    // 2. Перевіряємо чи не прострочений
    if (stored.ExpiresAt < DateTime.UtcNow)
    {
        // Видаляємо прострочений токен
        userRepo.RevokeRefreshToken(
            req.RefreshToken);

        return Results.Json(
            new ProblemDetails
            {
                Title = "Refresh token expired",
                Status = 401,
                Detail = "Please login again."
            }, statusCode: 401);
    }

    // 3. Отримуємо користувача
    var user = userRepo.FindById(stored.UserId);
    if (user is null)
        return Results.Json(
            new ProblemDetails
            {
                Title = "User not found",
                Status = 401
            }, statusCode: 401);

    // 4. Генеруємо НОВІ токени (ротація!)
    var newAccessToken = tokenService
        .GenerateAccessToken(
            user.Id, user.Name,
            user.Email, user.Roles);

    var newRefreshToken = tokenService
        .GenerateRefreshToken();

    // 5. Замінюємо старий refresh на новий
    userRepo.RevokeRefreshToken(req.RefreshToken);
    userRepo.SaveRefreshToken(
        user.Id, newRefreshToken,
        DateTime.UtcNow.AddDays(7));

    return Results.Ok(new AuthResponse(
        AccessToken: newAccessToken,
        RefreshToken: newRefreshToken,
        ExpiresIn: 900));
}

record RefreshRequest(string RefreshToken);

private static IResult Logout(
    LogoutRequest req,
    UserRepository userRepo)
{
    // Просто видаляємо refresh token з БД
    userRepo.RevokeRefreshToken(req.RefreshToken);

    return Results.Ok(new { message = "Logged out" });
}

record LogoutRequest(string RefreshToken);

{
    "Jwt": {
        "Issuer": "MyApi",
        "Audience": "MyApp",
        "AccessTokenExpirationMinutes": 15,
        "RefreshTokenExpirationDays": 7
    }
}

public string GenerateAccessToken(/* ... */)
{
    var minutes = int.Parse(
        _config["Jwt:AccessTokenExpirationMinutes"]
            ?? "15");

    var token = new JwtSecurityToken(
        issuer: _config["Jwt:Issuer"],
        audience: _config["Jwt:Audience"],
        claims: claims,
        expires: DateTime.UtcNow
            .AddMinutes(minutes),
        signingCredentials: credentials);

    return new JwtSecurityTokenHandler()
        .WriteToken(token);
}