package com.oliver.kidio.backend.routing

import com.oliver.kidio.backend.domain.models.AuthResponse
import com.oliver.kidio.backend.domain.models.LoginRequest
import com.oliver.kidio.backend.domain.models.RegisterRequest
import com.oliver.kidio.backend.domain.models.User
import com.oliver.kidio.backend.domain.repository.KidioRepository
import com.oliver.kidio.backend.security.JwtService
import com.oliver.kidio.backend.security.isValidPassword
import io.ktor.http.HttpStatusCode
import io.ktor.server.request.*
import io.ktor.server.response.*
import io.ktor.server.routing.*
import org.mindrot.jbcrypt.BCrypt
import java.util.UUID

fun Route.authRoutes(
    repository: KidioRepository,
    jwtService: JwtService,
) {
    post("/api/v1/auth/register") {
        val registerRequest = call.receive<RegisterRequest>()
        if (registerRequest.email.isBlank() || registerRequest.passwordPlain.isBlank()) {
            call.respond(HttpStatusCode.BadRequest, "Bitte füllen Sie alle Felder aus")
            return@post
        }
        if (!isValidPassword(registerRequest.passwordPlain)) {
            call.respond(
                HttpStatusCode.BadRequest,
                "Das Passwort muss mindestens 8 Zeichen lang sein, " +
                    "mindestens einen Großbuchstaben und ein Sonderzeichen enthalten.",
            )
            return@post
        }
        if (registerRequest.parentPin.length != 4) {
            call.respond(HttpStatusCode.BadRequest, "Die Eltern-PIN muss genau 4 Ziffern lang sein")
            return@post
        }
        val existingUser = repository.findByEmail(registerRequest.email)
        if (existingUser != null) {
            call.respond(HttpStatusCode.Conflict, "Ein Benutzer mit dieser E-Mail-Adresse existiert bereits")
            return@post
        }

        val userId = UUID.randomUUID().toString()
        val passwordHash = BCrypt.hashpw(registerRequest.passwordPlain, BCrypt.gensalt())

        repository.registerUser(
            User(
                userId,
                registerRequest.email,
                passwordHash,
                registerRequest.familyName,
                registerRequest.childAge,
                registerRequest.parentPin,
            ),
        )

        val token = jwtService.generateToken(userId)

        call.respond(
            HttpStatusCode.Created,
            mapOf(
                "token" to token,
                "userId" to userId,
                "message" to "Registrierung erfolgreich",
            ),
        )
    }

    post("/api/v1/auth/login") {
        val loginRequest = call.receive<LoginRequest>()
        if (loginRequest.email.isBlank() || loginRequest.passwordPlain.isBlank()) {
            call.respond(HttpStatusCode.BadRequest, "Bitte füllen Sie alle Felder aus")
            return@post
        }
        val getUser = repository.findByEmail(loginRequest.email)
        if (getUser == null || !repository.verifyPassword(loginRequest.passwordPlain, getUser.passwordHash)) {
            call.respond(HttpStatusCode.Unauthorized, "Ungültige Anmeldedaten")
            return@post
        }
        val token = jwtService.generateToken(getUser.id)
        call.respond(
            HttpStatusCode.OK,
            AuthResponse(
                token,
                userId = getUser.id,
                familyName = getUser.familyName,
                childAge = getUser.childAge,
            ),
        )
    }
}