import { Role, RiskStatus, User, Prisma } from "@prisma/client";
import bcrypt from "bcryptjs";
import {
  userRepository,
  UserListParams,
  UserListResult,
} from "./users.repository";
import {
  createPasswordResetToken,
  generateRawToken,
} from "../../lib/passwordReset";
import { sendInvitationEmail } from "../../lib/email";

export interface CreateUserData {
  firstName: string;
  lastName: string;
  email: string;
  password?: string;
  title?: string;
  imageUrl?: string;
  riskStatus?: RiskStatus;
  role?: Role;
  managerId?: string;
}

export interface UpdateUserData {
  firstName?: string;
  lastName?: string;
  email?: string;
  title?: string;
  riskStatus?: RiskStatus;
  imageUrl?: string;
  isLocked?: boolean;
  role?: Role;
  managerId?: string;
}

export interface LoginLogItem {
  id: string;
  name: string;
  email: string;
  lastLoginAt: Date;
  activity: string;
}

export class UserService {
  /**
   * Build where clause for user queries
   */
  private buildWhereClause(params: UserListParams): any {
    const where: any = {};

    where.role =
      params.roleType === "admin"
        ? { in: [Role.ADMIN, Role.MANAGER] }
        : Role.USER;

    if (params.search?.trim()) {
      const tokens = params.search
        .split(/\s+/)
        .map((t) => t.trim())
        .filter(Boolean);

      const searchableFields = ["firstName", "lastName", "email", "title"];

      const andClauses = tokens.map((tok) => ({
        OR: searchableFields.map((field) => ({
          [field]: { contains: tok, mode: "insensitive" },
        })),
      }));

      // If only one token, AND with one item behaves like OR
      where.AND = [...(where.AND || []), ...andClauses];
    }

    if (params.risks?.length) {
      where.riskStatus = { in: params.risks };
    }

    return where;
  }

  /**
   * Get paginated list of users
   */
  async getUsers(params: UserListParams): Promise<UserListResult> {
    const where = this.buildWhereClause(params);
    const total = await userRepository.countUsers(where);

    let items;
    if (params.sortBy === "risk") {
      // Special handling for risk sort
      items = await userRepository.findUsersWithRiskSort(
        where,
        params.search,
        params.sortDir,
        params.page,
        params.limit
      );
    } else {
      // Default Prisma ordering
      let orderBy: any = undefined;
      if (params.sortBy) {
        if (params.sortBy === "name") {
          orderBy = { firstName: params.sortDir };
        } else if (params.sortBy === "email") {
          orderBy = { email: params.sortDir };
        } else if (params.sortBy === "title") {
          orderBy = { title: params.sortDir };
        } else if (params.sortBy === "role") {
          orderBy = { role: params.sortDir };
        }
      }

      items = await userRepository.findManyUsers(
        where,
        orderBy,
        (params.page - 1) * params.limit,
        params.limit
      );
    }

    return { items, total };
  }

  /**
   * Get user login activity logs
   */
  async getUserLogs(
    page: number,
    limit: number,
    search: string
  ): Promise<{ items: LoginLogItem[]; total: number }> {
    const users = await userRepository.findUsersForLogs();

    // Filter by search
    const filtered = users.filter((u) => {
      if (!search) return true;
      const name = `${u.firstName} ${u.lastName}`.toLowerCase();
      return (
        name.includes(search.toLowerCase()) ||
        u.email.toLowerCase().includes(search.toLowerCase())
      );
    });

    // Build dummy logs
    const activities = [
      "Login success",
      "Login failed",
      "2FA challenge passed",
      "Password reset",
      "Logout",
    ];
    const now = Date.now();
    const itemsAll = filtered.map((u, idx) => {
      const offsetMinutes =
        ((idx * 37) % 7_200) + Math.floor(Math.random() * 60);
      const lastLoginAt = new Date(now - offsetMinutes * 60 * 1000);
      const activity = activities[(idx * 13) % activities.length];
      return {
        id: u.id,
        name: `${u.firstName} ${u.lastName}`,
        email: u.email,
        lastLoginAt,
        activity,
      };
    });

    const total = itemsAll.length;
    const start = (page - 1) * limit;
    const end = start + limit;
    const items = itemsAll.slice(start, end);

    return { items, total };
  }

  /**
   * Resend invitation email to a user
   */
  async resendInvitation(userId: string): Promise<void> {
    const user = await userRepository.findUserById(userId);
    if (!user) {
      throw new Error("User not found");
    }
    if (user.role === Role.USER) {
      throw new Error("Invitations are not applicable for end-user accounts");
    }
    if (user.isActivated) {
      throw new Error("User is already activated");
    }
    const { link } = await createPasswordResetToken(user.id);
    await sendInvitationEmail(user.email, link);
  }

  /**
   * Get a single user by ID
   */
  async getUserById(userId: string) {
    const user = await userRepository.findUserById(userId);
    if (!user) {
      throw new Error("User not found");
    }
    return user;
  }

  /**
   * Create a new user with role-based validation
   */
  async createUser(
    data: CreateUserData,
    requesterRole?: Role,
    requesterId?: string
  ): Promise<User> {
    const {
      firstName,
      lastName,
      email,
      password,
      title,
      imageUrl,
      riskStatus = RiskStatus.LOW_RISK,
      role = Role.USER,
      managerId,
    } = data;

    // Validation
    if (!firstName || !lastName || !email) {
      throw new Error("Missing required fields");
    }

    const existing = await userRepository.findUserByEmail(email);
    if (existing) {
      throw new Error("Email already exists");
    }

    // Role-based permissions
    if (requesterRole === Role.ADMIN && role !== Role.USER) {
      throw new Error("Admins may only create end-user accounts");
    }

    // Password and invitation logic
    let passwordToSet = password;
    let shouldInvite = false;

    if (role === Role.USER) {
      if (!passwordToSet) {
        passwordToSet = generateRawToken(16);
      }
    } else {
      if (!passwordToSet) {
        passwordToSet = generateRawToken(16);
        shouldInvite = true;
      }
    }

    // Manager assignment for ADMINs
    let managerIdToSet: string | undefined = undefined;
    if (role === Role.ADMIN) {
      if (requesterRole !== Role.MANAGER) {
        throw new Error("Only Managers can create Admin accounts");
      }

      let targetManagerId = managerId || requesterId;
      if (!targetManagerId) {
        throw new Error("Could not determine manager for the new Admin");
      }

      const targetManager = await userRepository.findUserForValidation(
        targetManagerId
      );
      if (!targetManager || targetManager.role !== Role.MANAGER) {
        throw new Error("managerId must reference an existing Manager");
      }
      managerIdToSet = targetManagerId;
    }

    const hash = await bcrypt.hash(passwordToSet, 10);
    const userData: Prisma.UserCreateInput = {
      firstName,
      lastName,
      email,
      password: hash,
      title: title || "",
      imageUrl,
      riskStatus,
      role,
      isActivated: role === Role.USER ? true : shouldInvite ? false : true,
    };

    // Only set managerId if it's defined
    if (managerIdToSet) {
      userData.manager = { connect: { id: managerIdToSet } };
    }

    const user = await userRepository.createUser(userData);

    // Send invitation email if needed
    if (shouldInvite) {
      try {
        const { link } = await createPasswordResetToken(user.id);
        await sendInvitationEmail(email, link);
      } catch (e) {
        console.warn("Failed to send invitation email:", e);
      }
    }

    return user;
  }

  /**
   * Update a user with role-based validation
   */
  async updateUser(
    userId: string,
    data: UpdateUserData,
    requesterRole?: Role,
    requesterId?: string
  ): Promise<User> {
    const target = await userRepository.findUserById(userId);
    if (!target) {
      throw new Error("User not found");
    }

    // Role-based permission checks
    if (requesterRole === Role.ADMIN) {
      if (data.role && data.role !== Role.USER) {
        throw new Error("Admins may not change role to Admin/Manager");
      }
      if (typeof data.managerId !== "undefined") {
        throw new Error("Admins may not assign or reassign Admins");
      }
    }

    // Manager assignment validation
    let updateData: Prisma.UserUpdateInput = {
      firstName: data.firstName,
      lastName: data.lastName,
      email: data.email,
      title: data.title,
      riskStatus: data.riskStatus,
      imageUrl: data.imageUrl,
      isLocked: data.isLocked,
      role: data.role,
    };

    if (typeof data.managerId !== "undefined") {
      if (requesterRole !== Role.MANAGER) {
        throw new Error("Only Managers can assign/reassign Admins");
      }

      const effectiveRole = data.role ?? target.role;
      if (effectiveRole !== Role.ADMIN) {
        throw new Error("managerId may only be set for Admin accounts");
      }

      const mgrId = data.managerId || requesterId;
      if (!mgrId) {
        throw new Error("Could not determine manager for the Admin");
      }

      const mgr = await userRepository.findUserForValidation(mgrId);
      if (!mgr || mgr.role !== Role.MANAGER) {
        throw new Error("managerId must reference an existing Manager");
      }

      updateData.manager = { connect: { id: mgrId } };
    }

    return await userRepository.updateUser(userId, updateData);
  }

  /**
   * Toggle user lock status
   */
  async toggleUserLock(userId: string): Promise<User> {
    const user = await userRepository.findUserById(userId);
    if (!user) {
      throw new Error("User not found");
    }

    return await userRepository.updateUser(userId, {
      isLocked: !user.isLocked,
    });
  }

  /**
   * Delete a single user with role-based validation
   */
  async deleteUser(userId: string, requesterRole?: Role): Promise<void> {
    const target = await userRepository.findUserById(userId);
    if (!target) {
      throw new Error("User not found");
    }

    if (requesterRole === Role.ADMIN && target.role !== Role.USER) {
      throw new Error("Admins may only delete regular users");
    }

    await userRepository.deleteTodosByCreator(userId);
    await userRepository.deleteUser(userId);
  }

  /**
   * Bulk delete users with role-based validation
   */
  async deleteUsers(userIds: string[], requesterRole?: Role): Promise<void> {
    if (!Array.isArray(userIds) || userIds.length === 0) {
      throw new Error("No user IDs provided");
    }

    // Validate targets for admin constraints
    if (requesterRole === Role.ADMIN) {
      const targets = await userRepository.findUsersByIds(userIds);
      const forbidden = targets
        .filter((t) => t.role !== Role.USER)
        .map((t) => t.id);
      if (forbidden.length > 0) {
        throw new Error("Admins may only delete regular users");
      }
    }

    await userRepository.deleteTodosByCreators(userIds);
    await userRepository.deleteUsers(userIds);
  }
}

export const userService = new UserService();
