using Hutopy.Infrastructure.Security;
using Hutopy.Modules.Identity.Configuration;
using Hutopy.Modules.Identity.Data;
using Microsoft.Extensions.Options;

namespace Hutopy.Modules.Identity.Handlers;

[PublicAPI]
public record LoginRequest(
    string Email,
    string Password);

[PublicAPI]
public record LoginResponse(
    string AccessToken,
    string RefreshToken);

[PublicAPI]
public class LoginHandler(
    UserManager userManager,
    IOptionsSnapshot<JwtOptions> jwtOptions)
    : Endpoint<LoginRequest, LoginResponse>
{
    public override void Configure()
    {
        AllowAnonymous();
        Post("/api/users/login");
        Options(o => o.WithTags("Users"));
    }

    public override async Task HandleAsync(
        LoginRequest request,
        CancellationToken ct)
    {
        // Find user by email
        var user = await userManager.FindByEmailAsync(request.Email);
        if (user is null)
        {
            await SendStringAsync(
                "Invalid email or password",
                401,
                cancellation: ct);
            return;
        }

        // Verify password
        var isPasswordValid = await userManager.CheckPasswordAsync(user, request.Password);
        if (!isPasswordValid)
        {
            await SendStringAsync(
                "Invalid email or password",
                401,
                cancellation: ct);
            return;
        }

        // Generate new refresh token
        user.RefreshToken = RefreshTokenGenerator.Next();
        user.RefreshTokenExpiryTime = DateTime.UtcNow.Add(jwtOptions.Value.RefreshTokenLifetime);
        await userManager.UpdateAsync(user);

        // Generate JWT token
        var accessToken = JwtTokenHelper.GenerateJwtToken(
            expiresIn: jwtOptions.Value.Lifetime,
            issuer: jwtOptions.Value.Issuer,
            audience: jwtOptions.Value.Audience,
            key: jwtOptions.Value.Key,
            userId: user.Id.ToString(),
            email: user.Email ?? string.Empty,
            alias: user.Alias,
            firstname: user.Firstname ?? string.Empty,
            lastname: user.Lastname ?? string.Empty,
            portraitUrl: user.PortraitUrl);

        await SendOkAsync(
            new LoginResponse(accessToken, user.RefreshToken),
            cancellation: ct);
    }
}