package controller

import (
	"net/http"

	"metazone.cc/metalab/internal/common"
	"metazone.cc/metalab/internal/model"

	"github.com/gin-gonic/gin"
)

// clientIP 获取客户端真实 IP（考虑反向代理）
func clientIP(c *gin.Context) string {
	if fwd := c.GetHeader("X-Forwarded-For"); fwd != "" {
		return fwd
	}
	if real := c.GetHeader("X-Real-IP"); real != "" {
		return real
	}
	return c.ClientIP()
}

// Login 登录 API（含双维度限流）
func (ac *AuthController) Login(c *gin.Context) {
	var req model.LoginRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		common.Error(c, http.StatusBadRequest, "请检查输入")
		return
	}

	email := req.Email
	ip := clientIP(c)

	// --- 限流：账户维度 ---
	acctResult, recordAccount := ac.rateLimiter.AllowAccount(email)
	if acctResult.Blocked {
		common.Error(c, http.StatusTooManyRequests, acctResult.Message)
		return
	}

	// --- 限流：IP 维度 ---
	ipResult, recordIP := ac.rateLimiter.AllowIP(ip)
	if ipResult.Blocked {
		common.Error(c, http.StatusTooManyRequests, ipResult.Message)
		return
	}

	user, err := ac.authService.Login(req, ip)
	if err != nil {
		// 记录失败 → 两个维度各 +1
		if recordAccount != nil {
			recordAccount()
		}
		if recordIP != nil {
			recordIP()
		}

		switch err {
		case common.ErrInvalidCred:
			common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
		case common.ErrUserBanned:
			common.Error(c, http.StatusForbidden, "账号已被封禁")
		case common.ErrUserLocked:
			common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
		case common.ErrMaintenanceMode:
			common.Error(c, http.StatusForbidden, "社区正在维护中，仅站长可登录")
		case common.ErrNeedsConfirmRestore:
			// 注销账号登录 → 需要二次确认恢复
			c.JSON(http.StatusOK, gin.H{
				"success": true,
				"action":  "confirm_restore",
				"message": "你的账号正在注销中，登录将中止注销流程",
			})
		default:
			common.Error(c, http.StatusInternalServerError, "登录失败，请稍后重试")
		}
		return
	}

	// 登录成功 → 清除失败计数
	ac.rateLimiter.Clear(email, ip)

	// 创建服务端 session
	sid, err := ac.sessionManager.Create(user, req.RememberMe, ip, c.GetHeader("User-Agent"))
	if err != nil {
		common.Error(c, http.StatusInternalServerError, "登录失败，请稍后重试")
		return
	}

	common.SetSessionCookie(c, sid, req.RememberMe, ac.cfg)

	common.OkWithMessage(c, user, "登录成功")
}

// ConfirmRestore 二次确认恢复已注销账号
func (ac *AuthController) ConfirmRestore(c *gin.Context) {
	var req model.LoginRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		common.Error(c, http.StatusBadRequest, "请检查输入")
		return
	}

	user, err := ac.authService.ConfirmRestore(req, clientIP(c))
	if err != nil {
		switch err {
		case common.ErrInvalidCred:
			common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
		default:
			common.Error(c, http.StatusInternalServerError, "操作失败，请稍后重试")
		}
		return
	}

	sid, err := ac.sessionManager.Create(user, req.RememberMe, clientIP(c), c.GetHeader("User-Agent"))
	if err != nil {
		common.Error(c, http.StatusInternalServerError, "操作失败，请稍后重试")
		return
	}

	common.SetSessionCookie(c, sid, req.RememberMe, ac.cfg)
	common.OkWithMessage(c, user, "账号已恢复，欢迎回来")
}
