LernApp/src/main/kotlin/com/oliver/kidio/backend/plugins/Routing.kt

package com.oliver.kidio.backend.plugins

import com.oliver.kidio.backend.*
import com.oliver.kidio.backend.domain.repository.KidioRepository
import com.oliver.kidio.backend.security.JwtService
import io.ktor.http.HttpStatusCode
import io.ktor.server.application.*
import io.ktor.server.auth.authenticate
import io.ktor.server.auth.principal
import io.ktor.server.plugins.openapi.*
import io.ktor.server.request.*
import io.ktor.server.response.*
import io.ktor.server.routing.*
import org.mindrot.jbcrypt.BCrypt
import java.util.UUID

fun isValidPassword(password: String): Boolean {
    if (password.length < 8) return false

    val hasUppercase = password.any { it.isUpperCase() }
    val hasEmoji =
        password.any { char ->
            val type = Character.getType(char).toByte()
            type == Character.SURROGATE ||
                type == Character.OTHER_SYMBOL ||
                char.code in 0x1F600..0x1F64F ||
                char.code in 0x1F300..0x1F5FF ||
                char.code in 0x1F680..0x1F6FF ||
                char.code in 0x2600..0x26FF
        }

    val hasSpecialChar = password.any { !it.isLetterOrDigit() && !hasEmoji }

    return hasUppercase && hasSpecialChar && !hasEmoji
}

fun Application.configureRouting(
    repository: KidioRepository,
    jwtService: JwtService,
) {
    routing {
        openAPI(path = "openapi")

        post("/api/v1/auth/register") {
            val registerRequest = call.receive<RegisterRequest>()
            if (registerRequest.email.isBlank() || registerRequest.passwordPlain.isBlank()) {
                call.respond(HttpStatusCode.BadRequest, "Bitte füllen Sie alle Felder aus")
                return@post
            }
            if (!isValidPassword(registerRequest.passwordPlain)) {
                call.respond(
                    HttpStatusCode.BadRequest,
                    "Das Passwort muss mindestens 8 Zeichen lang sein, " +
                        "mindestens einen Großbuchstaben und ein Sonderzeichen enthalten.",
                )
                return@post
            }
            if (registerRequest.parentPin.length != 4) {
                call.respond(HttpStatusCode.BadRequest, "Die Eltern-PIN muss genau 4 Ziffern lang sein")
                return@post
            }
            val existingUser = repository.findByEmail(registerRequest.email)
            if (existingUser != null) {
                call.respond(HttpStatusCode.Conflict, "Ein Benutzer mit dieser E-Mail-Adresse existiert bereits")
                return@post
            }

            // Backend generiert die eindeutige User-ID
            val userId = UUID.randomUUID().toString()
            val passwordHash = BCrypt.hashpw(registerRequest.passwordPlain, BCrypt.gensalt())

            // datenbank insert hinzufügen
            repository.registerUser(
                User(
                    userId,
                    registerRequest.email,
                    passwordHash,
                    registerRequest.familyName,
                    registerRequest.childAge,
                    registerRequest.parentPin,
                ),
            )

            val token = jwtService.generateToken(userId)

            call.respond(
                HttpStatusCode.Created,
                mapOf(
                    "token" to token,
                    "userId" to userId,
                    "message" to "Registrierung erfolgreich",
                ),
            )
        }
        // Health-Check
        get("/api/v1/health") {
            call.respond(mapOf("status" to "OK", "message" to "Kidio Backend läuft!"))
        }

        post("/api/v1/auth/login") {
            val loginRequest = call.receive<LoginRequest>()
            if (loginRequest.email.isBlank() || loginRequest.passwordPlain.isBlank()) {
                call.respond(HttpStatusCode.BadRequest, "Bitte füllen Sie alle Felder aus")
                return@post
            }
            val getUser = repository.findByEmail(loginRequest.email)
            if (getUser == null || !repository.verifyPassword(loginRequest.passwordPlain, getUser.passwordHash)) {
                call.respond(HttpStatusCode.Unauthorized, "Ungültige Anmeldedaten")
                return@post
            }
            val token = jwtService.generateToken(getUser.id)
            call.respond(
                HttpStatusCode.OK,
                AuthResponse(
                    token,
                    userId = getUser.id,
                    familyName = getUser.familyName,
                    childAge = getUser.childAge,
                ),
            )
            return@post
        }

        authenticate("auth-jwt") {
            // 1. Alle verfügbaren Aufgaben abrufen (mit optionaler Filterung nach Fach und Alter)
            get("/api/v1/tasks") {
                val principal = call.principal<UserPrincipal>()
                val userId = principal?.userId

                val subject = call.request.queryParameters["subject"]

                // Expliziter Query-Parameter 'age' ODER Fallback auf das Alter des Users
                val queryAge = call.request.queryParameters["age"]?.toIntOrNull()
                val userAge = userId?.let { repository.getUserById(it)?.childAge }
                val effectiveAge = queryAge ?: userAge

                val limit = call.request.queryParameters["limit"]?.toIntOrNull() ?: 10

                val tasks = repository.getTasks(subject = subject, age = effectiveAge, limit = limit)
                call.respond(tasks)
            }

            // 2. Antwort auf eine Aufgabe überprüfen
            post("/api/v1/tasks/verify") {
                val request = call.receive<TaskVerifyRequest>()
                val principal = call.principal<UserPrincipal>()
                val userId = principal?.userId
                if (userId == null) {
                    call.respond(
                        HttpStatusCode.Unauthorized,
                        mapOf("error" to "Ungültiges oder abgelaufenes Token"),
                    )
                    return@post
                }
                val taskInfo = repository.getTaskAnswerAndReward(request.taskId)
                if (taskInfo == null) {
                    call.respond(
                        TaskVerifyResponse(
                            isCorrect = false,
                            earnedMinutes = 0,
                            message = "Aufgabe nicht gefunden!",
                        ),
                    )
                    return@post
                }

                val (correctAnswer, reward) = taskInfo
                val isCorrect = request.selectedAnswer.trim() == correctAnswer.trim()

                if (isCorrect) {
                    val currentScreentime = repository.getScreentime(userId)
                    val newSeconds = currentScreentime + (reward * 60)
                    repository.updateScreentime(userId, newSeconds)

                    call.respond(
                        TaskVerifyResponse(
                            isCorrect = true,
                            earnedMinutes = reward,
                            message = "Super gemacht! Du hast $reward Minuten gewonnen.",
                        ),
                    )
                } else {
                    call.respond(
                        TaskVerifyResponse(
                            isCorrect = false,
                            earnedMinutes = 0,
                            message = "Schade, das war leider falsch. Versuche es nochmal!",
                        ),
                    )
                }
            }

            get("/api/v1/screentime") {
                val principal = call.principal<UserPrincipal>()
                val userid =
                    principal?.userId
                        ?: run {
                            call.respond(HttpStatusCode.Unauthorized, mapOf("error" to "Ungültiger Token"))
                            return@get
                        }
                val remainingSeconds = repository.getScreentime(userid)
                call.respond(
                    HttpStatusCode.OK,
                    SyncResponse(
                        remainingSeconds = remainingSeconds,
                        isBlocked = remainingSeconds <= 0,
                    ),
                )
            }

            // 3. Bildschirmzeit synchronisieren
            post("/api/v1/screentime/sync") {
                val request = call.receive<SyncRequest>()

                // Wir holen die echte, fälschungssichere userId aus dem Login-Token:
                val principal = call.principal<UserPrincipal>()
                val userId =
                    principal?.userId ?: request.userId // Fallback auf request.userId, falls token noch fehlt

                val currentSeconds = repository.getScreentime(userId)
                var newSeconds = currentSeconds - request.usedSecondsSinceLastSync
                if (newSeconds < 0) newSeconds = 0

                repository.updateScreentime(userId, newSeconds)

                call.respond(
                    SyncResponse(
                        remainingSeconds = newSeconds,
                        isBlocked = newSeconds <= 0,
                    ),
                )
            }
        }
    }
}