package api

import (
	"encoding/json"
	"net/http"
	"strings"

	"github.com/go-chi/chi/v5"
	"github.com/sandrodach/mindsift/internal/auth"
)

func (s *Server) authenticateUserFromReq(r *http.Request) string {
	token := r.URL.Query().Get("token")
	if token == "" {
		if authHdr := r.Header.Get("Authorization"); strings.HasPrefix(authHdr, "Bearer ") {
			token = strings.TrimPrefix(authHdr, "Bearer ")
		}
	}
	if token != "" {
		if strings.HasPrefix(token, "mindsift_sec_") {
			if user, err := s.store.ValidateAPIKeyAndGetUser(token); err == nil && user != nil && user.IsActive {
				return user.ID
			}
		}
		if claims, err := auth.ValidateToken(s.cfg.JWTSecret, token); err == nil && claims != nil {
			if !s.store.IsTokenRevoked(token) {
				if user, err := s.store.GetUserByID(claims.UserID); err == nil && user != nil && user.IsActive {
					if claims.TokenVersion == 0 || claims.TokenVersion == user.TokenVersion {
						return claims.UserID
					}
				}
			}
		}
	}
	return ""
}

func (s *Server) handleWebSocket(w http.ResponseWriter, r *http.Request) {
	// Some corporate proxies and reverse proxies (e.g. OpenResty/Nginx or HTTP/2 intermediaries)
	// strip or alter the Connection header (e.g. "close" or missing) while passing
	// Sec-WebSocket-Key or Upgrade: websocket. Normalize it so Gorilla Upgrader succeeds.
	if r.Header.Get("Sec-Websocket-Key") != "" {
		if !strings.Contains(strings.ToLower(r.Header.Get("Connection")), "upgrade") {
			r.Header.Set("Connection", "Upgrade")
		}
		if !strings.Contains(strings.ToLower(r.Header.Get("Upgrade")), "websocket") {
			r.Header.Set("Upgrade", "websocket")
		}
	}

	roomID := chi.URLParam(r, "listId")
	if roomID == "" {
		roomID = chi.URLParam(r, "spaceId")
	}
	if roomID == "" {
		roomID = r.URL.Query().Get("listId")
	}
	if roomID == "" {
		roomID = r.URL.Query().Get("spaceId")
	}

	userID := s.authenticateUserFromReq(r)
	if userID == "" {
		writeError(w, http.StatusUnauthorized, "Nicht autorisiert – bitte anmelden")
		return
	}
	s.wsHub.ServeWS(w, r, roomID, userID)
}

func (s *Server) handleSSE(w http.ResponseWriter, r *http.Request) {
	roomID := r.URL.Query().Get("listId")
	if roomID == "" {
		roomID = r.URL.Query().Get("spaceId")
	}

	userID := s.authenticateUserFromReq(r)
	if userID == "" {
		writeError(w, http.StatusUnauthorized, "Nicht autorisiert – bitte anmelden")
		return
	}

	var initialRooms []string
	if roomsParam := r.URL.Query().Get("rooms"); roomsParam != "" {
		for _, rm := range strings.Split(roomsParam, ",") {
			rm = strings.TrimSpace(rm)
			if rm != "" {
				initialRooms = append(initialRooms, rm)
			}
		}
	}
	if docID := r.URL.Query().Get("docId"); docID != "" {
		initialRooms = append(initialRooms, "doc:"+strings.TrimSpace(docID))
	}

	s.wsHub.ServeSSE(w, r, roomID, userID, initialRooms)
}

func (s *Server) handleSSERooms(w http.ResponseWriter, r *http.Request) {
	userID := auth.GetUserID(r.Context())
	var req struct {
		SSEID  string `json:"sseId"`
		Room   string `json:"room"`
		DocID  string `json:"docId"`
		Action string `json:"action"` // "join" or "leave"
	}
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
		return
	}
	if req.Room == "" && req.DocID != "" {
		req.Room = "doc:" + req.DocID
	}
	if req.SSEID == "" || req.Room == "" {
		writeError(w, http.StatusBadRequest, "sseId und room erforderlich")
		return
	}

	if req.Action == "leave" {
		s.wsHub.LeaveSSERoomByID(req.SSEID, userID, req.Room)
		writeJSON(w, http.StatusOK, map[string]bool{"success": true})
		return
	}
	if !s.wsHub.JoinSSERoomByID(req.SSEID, userID, req.Room) {
		writeError(w, http.StatusForbidden, "Kein Zugriff auf diesen Raum")
		return
	}
	writeJSON(w, http.StatusOK, map[string]bool{"success": true})
}