package app

import (
	"context"
	"crypto/subtle"
	"database/sql"
	"embed"
	"encoding/csv"
	"encoding/json"
	"errors"
	"fmt"
	"html/template"
	"io"
	"log"
	"net/http"
	"net/url"
	"os"
	"path/filepath"
	"strconv"
	"strings"
	"time"
	"unicode/utf8"

	"teammate/internal/jalali"
)

//go:embed templates/*.html static/*
var assets embed.FS

type Config struct {
	Addr               string
	BaseURL            string
	DatabasePath       string
	SessionSecure      bool
	GitHubClientID     string
	GitHubClientSecret string
	GoogleClientID     string
	GoogleClientSecret string
}

func ConfigFromEnv() Config {
	return Config{
		Addr:               env("APP_ADDR", ":8080"),
		BaseURL:            strings.TrimRight(env("APP_BASE_URL", "http://localhost:8080"), "/"),
		DatabasePath:       env("DATABASE_PATH", "./data/teammate.db"),
		SessionSecure:      env("SESSION_SECURE", "false") == "true",
		GitHubClientID:     os.Getenv("GITHUB_CLIENT_ID"),
		GitHubClientSecret: os.Getenv("GITHUB_CLIENT_SECRET"),
		GoogleClientID:     os.Getenv("GOOGLE_CLIENT_ID"),
		GoogleClientSecret: os.Getenv("GOOGLE_CLIENT_SECRET"),
	}
}

func env(name, fallback string) string {
	if v := os.Getenv(name); v != "" {
		return v
	}
	return fallback
}

type Server struct {
	cfg       Config
	store     *Store
	templates *template.Template
	http      *http.Server
}

type PageData struct {
	Title           string
	User            *User
	CSRF            string
	Flash           string
	Error           string
	Today           string
	TodayJalali     string
	Attendance      *Attendance
	Calendar        Calendar
	Requests        []Request
	PendingCount    int
	Stats           Stats
	OAuthGitHub     bool
	OAuthGoogle     bool
	ReportStart     string
	ReportEnd       string
	SelectedSection string
	Users           []User
	Day             DayDetail
}

type Stats struct{ Present, Remote, Leave int }

type DayDetail struct {
	Gregorian string
	Jalali    string
	Weekday   string
	DayNote   string
	Prev      string
	Next      string
	Present   int
	Remote    int
	Absent    int
	Members   []RosterMember
}

type RosterMember struct {
	User     User
	Status   string
	Label    string
	Detail   string
	CheckIn  string
	CheckOut string
}

type Calendar struct {
	Year, Month int
	MonthName   string
	MonthNameFA string
	Prev, Next  string
	Cells       []CalendarCell
}

type CalendarCell struct {
	Day, Weekday int
	Gregorian    string
	InMonth      bool
	IsToday      bool
	IsFriday     bool
	Holiday      string
	Status       string
	StartRequest bool
}

func New(cfg Config) (*Server, error) {
	if err := os.MkdirAll(filepath.Dir(cfg.DatabasePath), 0o750); err != nil {
		return nil, err
	}
	store, err := OpenStore(cfg.DatabasePath)
	if err != nil {
		return nil, err
	}
	funcs := template.FuncMap{
		"timeHM": func(t sql.NullTime) string {
			if !t.Valid {
				return "—"
			}
			return t.Time.Local().Format("15:04")
		},
		"dateFA": func(raw string) string {
			t, err := time.Parse("2006-01-02", raw)
			if err != nil {
				return raw
			}
			return jalali.FromTime(t).String()
		},
		"kindLabel": func(v string) string {
			if v == "remote" {
				return "Remote day"
			}
			return "Time off"
		},
		"statusLabel": func(v string) string {
			return strings.ToUpper(v[:1]) + v[1:]
		},
		"initial": func(v string) string {
			r, _ := utf8.DecodeRuneInString(v)
			return string(r)
		},
	}
	tmpl, err := template.New("root").Funcs(funcs).ParseFS(assets, "templates/*.html")
	if err != nil {
		store.Close()
		return nil, err
	}
	s := &Server{cfg: cfg, store: store, templates: tmpl}
	mux := http.NewServeMux()
	s.routes(mux)
	s.http = &http.Server{
		Addr:              cfg.Addr,
		Handler:           s.securityHeaders(s.withUser(mux)),
		ReadHeaderTimeout: 5 * time.Second,
		ReadTimeout:       15 * time.Second,
		WriteTimeout:      30 * time.Second,
		IdleTimeout:       60 * time.Second,
	}
	return s, nil
}

func (s *Server) ListenAndServe() error {
	err := s.http.ListenAndServe()
	if errors.Is(err, http.ErrServerClosed) {
		return nil
	}
	return err
}

func (s *Server) Close() error { return s.store.Close() }

func (s *Server) routes(mux *http.ServeMux) {
	mux.Handle("GET /static/", http.FileServer(http.FS(assets)))
	mux.HandleFunc("GET /healthz", s.health)
	mux.HandleFunc("GET /login", s.loginPage)
	mux.HandleFunc("POST /login", s.login)
	mux.HandleFunc("GET /register", s.registerPage)
	mux.HandleFunc("POST /register", s.register)
	mux.HandleFunc("POST /logout", s.requireAuth(s.csrf(s.logout)))
	mux.HandleFunc("GET /auth/{provider}", s.oauthStart)
	mux.HandleFunc("GET /auth/{provider}/callback", s.oauthCallback)
	mux.HandleFunc("GET /", s.requireAuth(s.dashboard))
	mux.HandleFunc("GET /day", s.requireAuth(s.dayPage))
	mux.HandleFunc("GET /calendar", s.requireAuth(s.calendarPartial))
	mux.HandleFunc("POST /attendance/check-in", s.requireAuth(s.csrf(s.checkIn)))
	mux.HandleFunc("POST /attendance/check-out", s.requireAuth(s.csrf(s.checkOut)))
	mux.HandleFunc("GET /requests", s.requireAuth(s.requestsPage))
	mux.HandleFunc("POST /requests", s.requireAuth(s.csrf(s.createRequest)))
	mux.HandleFunc("POST /requests/{id}/cancel", s.requireAuth(s.csrf(s.cancelRequest)))
	mux.HandleFunc("GET /admin/requests", s.requireAdmin(s.adminPage))
	mux.HandleFunc("POST /admin/requests/{id}/review", s.requireAdmin(s.csrf(s.reviewRequest)))
	mux.HandleFunc("GET /admin/users", s.requireAdmin(s.usersPage))
	mux.HandleFunc("POST /admin/users", s.requireAdmin(s.csrf(s.createUser)))
	mux.HandleFunc("GET /reports", s.requireAdmin(s.reportPage))
	mux.HandleFunc("GET /reports/attendance.csv", s.requireAdmin(s.reportCSV))
}

func (s *Server) dayPage(w http.ResponseWriter, r *http.Request) {
	rawDate := r.URL.Query().Get("date")
	if rawDate == "" {
		rawDate = time.Now().Format("2006-01-02")
	}
	day, ok := parseUserDate(rawDate)
	errorMessage := r.URL.Query().Get("error")
	if !ok {
		day = time.Now().Format("2006-01-02")
		errorMessage = "Choose a valid Persian date."
	}
	selected, _ := time.Parse("2006-01-02", day)
	rows, err := s.store.DayRoster(day)
	if err != nil {
		http.Error(w, "could not load the team day view", http.StatusInternalServerError)
		return
	}
	jalaliDate := jalali.FromTime(selected)
	detail := DayDetail{
		Gregorian: day,
		Jalali:    jalaliDate.String(),
		Weekday:   selected.Format("Monday"),
		Prev:      jalali.FromTime(selected.AddDate(0, 0, -1)).String(),
		Next:      jalali.FromTime(selected.AddDate(0, 0, 1)).String(),
	}
	if holiday := persianHoliday(jalaliDate.Month, jalaliDate.Day); holiday != "" {
		detail.DayNote = holiday
	} else if selected.Weekday() == time.Friday {
		detail.DayNote = "Friday weekend"
	}
	today := time.Now().Format("2006-01-02")
	for _, row := range rows {
		member := RosterMember{User: row.User, CheckIn: row.CheckIn, CheckOut: row.CheckOut}
		switch {
		case row.Mode == "office":
			member.Status, member.Label = "present", "Present"
			member.Detail = attendanceDetail(row.CheckIn, row.CheckOut, "Office")
			detail.Present++
		case row.Mode == "remote":
			member.Status, member.Label = "remote", "Remote"
			member.Detail = attendanceDetail(row.CheckIn, row.CheckOut, "Remote")
			detail.Remote++
		case row.RequestKind == "leave":
			member.Status, member.Label, member.Detail = "absent", "Absent", "Approved time off"
			detail.Absent++
		case row.RequestKind == "remote":
			member.Status, member.Label, member.Detail = "remote", "Remote", "Approved remote day"
			detail.Remote++
		case detail.DayNote != "":
			member.Status, member.Label, member.Detail = "absent", "Absent", detail.DayNote
			detail.Absent++
		case day >= today:
			member.Status, member.Label = "present", "Present"
			if day == today {
				member.Detail = "Expected at the office today"
			} else {
				member.Detail = "Expected at the office"
			}
			detail.Present++
		default:
			member.Status, member.Label, member.Detail = "absent", "Absent", "No attendance recorded"
			detail.Absent++
		}
		detail.Members = append(detail.Members, member)
	}
	s.render(w, "day.html", PageData{
		Title: "Team day", User: currentUser(r), CSRF: csrfToken(r), Day: detail,
		Error: errorMessage, SelectedSection: "day",
	})
}

func attendanceDetail(checkIn, checkOut, location string) string {
	if checkOut != "" {
		return fmt.Sprintf("%s · %s–%s", location, checkIn, checkOut)
	}
	if checkIn != "" {
		return fmt.Sprintf("%s · checked in %s", location, checkIn)
	}
	return location
}

func (s *Server) health(w http.ResponseWriter, r *http.Request) {
	ctx, cancel := context.WithTimeout(r.Context(), time.Second)
	defer cancel()
	if err := s.store.Ping(ctx); err != nil {
		http.Error(w, `{"status":"unhealthy"}`, http.StatusServiceUnavailable)
		return
	}
	w.Header().Set("Content-Type", "application/json")
	_, _ = io.WriteString(w, `{"status":"ok"}`)
}

func (s *Server) render(w http.ResponseWriter, name string, data PageData) {
	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	if err := s.templates.ExecuteTemplate(w, name, data); err != nil {
		log.Printf("render %s: %v", name, err)
	}
}

func (s *Server) loginPage(w http.ResponseWriter, r *http.Request) {
	if currentUser(r) != nil {
		http.Redirect(w, r, "/", http.StatusSeeOther)
		return
	}
	s.render(w, "login.html", PageData{
		Title: "Sign in", Error: r.URL.Query().Get("error"),
		OAuthGitHub: s.cfg.GitHubClientID != "", OAuthGoogle: s.cfg.GoogleClientID != "",
	})
}

func (s *Server) login(w http.ResponseWriter, r *http.Request) {
	if err := r.ParseForm(); err != nil {
		http.Error(w, "bad request", http.StatusBadRequest)
		return
	}
	identifier := r.FormValue("identifier")
	if identifier == "" {
		identifier = r.FormValue("username")
	}
	u, err := s.store.Authenticate(identifier, r.FormValue("password"))
	if err != nil {
		http.Redirect(w, r, "/login?error="+url.QueryEscape(err.Error()), http.StatusSeeOther)
		return
	}
	s.startSession(w, u.ID)
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

func (s *Server) registerPage(w http.ResponseWriter, r *http.Request) {
	if currentUser(r) != nil {
		http.Redirect(w, r, "/", http.StatusSeeOther)
		return
	}
	s.render(w, "register.html", PageData{
		Title: "Create account", Error: r.URL.Query().Get("error"),
		OAuthGitHub: s.cfg.GitHubClientID != "", OAuthGoogle: s.cfg.GoogleClientID != "",
	})
}

func (s *Server) register(w http.ResponseWriter, r *http.Request) {
	if err := r.ParseForm(); err != nil {
		http.Error(w, "bad request", http.StatusBadRequest)
		return
	}
	if r.FormValue("password") != r.FormValue("password_confirm") {
		http.Redirect(w, r, "/register?error=Passwords+do+not+match", http.StatusSeeOther)
		return
	}
	userID, err := s.store.CreateUser(
		r.FormValue("username"), r.FormValue("password"), r.FormValue("display_name"),
		r.FormValue("email"), "member",
	)
	if err != nil {
		http.Redirect(w, r, "/register?error="+url.QueryEscape(err.Error()), http.StatusSeeOther)
		return
	}
	s.startSession(w, userID)
	http.Redirect(w, r, "/?flash=Welcome+to+Hamkar", http.StatusSeeOther)
}

func (s *Server) startSession(w http.ResponseWriter, userID int64) {
	token, _, err := s.store.CreateSession(userID)
	if err != nil {
		http.Error(w, "could not create session", http.StatusInternalServerError)
		return
	}
	http.SetCookie(w, &http.Cookie{
		Name: "teammate_session", Value: token, Path: "/", HttpOnly: true,
		Secure: s.cfg.SessionSecure, SameSite: http.SameSiteLaxMode, MaxAge: 30 * 24 * 60 * 60,
	})
}

func (s *Server) logout(w http.ResponseWriter, r *http.Request) {
	if c, err := r.Cookie("teammate_session"); err == nil {
		s.store.DeleteSession(c.Value)
	}
	http.SetCookie(w, &http.Cookie{Name: "teammate_session", Path: "/", MaxAge: -1, HttpOnly: true})
	http.Redirect(w, r, "/login", http.StatusSeeOther)
}

func (s *Server) dashboard(w http.ResponseWriter, r *http.Request) {
	u := currentUser(r)
	now := time.Now()
	today := now.Format("2006-01-02")
	a, _ := s.store.TodayAttendance(u.ID, today)
	cal := s.buildCalendar(u.ID, r.URL.Query().Get("month"))
	start := jalali.ToGregorian(cal.Year, cal.Month, 1).Format("2006-01-02")
	end := jalali.ToGregorian(cal.Year, cal.Month, jalali.DaysInMonth(cal.Year, cal.Month)).Format("2006-01-02")
	present, remote, leave, _ := s.store.Stats(u.ID, start, end)
	requests, _ := s.store.Requests(u.ID, false, "")
	if len(requests) > 4 {
		requests = requests[:4]
	}
	pending, _ := s.store.Requests(u.ID, u.Role == "admin", "pending")
	s.render(w, "dashboard.html", PageData{
		Title: "Dashboard", User: u, CSRF: csrfToken(r), Flash: r.URL.Query().Get("flash"),
		Error: r.URL.Query().Get("error"),
		Today: today, TodayJalali: jalali.FromTime(now).String(), Attendance: a,
		Calendar: cal, Requests: requests, PendingCount: len(pending),
		Stats: Stats{present, remote, leave}, SelectedSection: "dashboard",
	})
}

func (s *Server) calendarPartial(w http.ResponseWriter, r *http.Request) {
	s.render(w, "calendar.html", PageData{User: currentUser(r), Calendar: s.buildCalendar(currentUser(r).ID, r.URL.Query().Get("month"))})
}

func (s *Server) buildCalendar(userID int64, selected string) Calendar {
	today := jalali.FromTime(time.Now())
	year, month := today.Year, today.Month
	if selected != "" {
		if _, err := fmt.Sscanf(selected, "%d-%d", &year, &month); err != nil || month < 1 || month > 12 {
			year, month = today.Year, today.Month
		}
	}
	first := jalali.ToGregorian(year, month, 1)
	last := jalali.ToGregorian(year, month, jalali.DaysInMonth(year, month))
	attendance, _ := s.store.AttendanceBetween(userID, first.Format("2006-01-02"), last.Format("2006-01-02"))
	requests, _ := s.store.Requests(userID, false, "approved")
	// Persian weeks begin Saturday. Go's Sunday=0, so Saturday maps to zero.
	offset := (int(first.Weekday()) + 1) % 7
	cells := make([]CalendarCell, offset, offset+jalali.DaysInMonth(year, month))
	for d := 1; d <= jalali.DaysInMonth(year, month); d++ {
		g := jalali.ToGregorian(year, month, d)
		raw := g.Format("2006-01-02")
		cell := CalendarCell{Day: d, Weekday: (offset + d - 1) % 7, Gregorian: raw, InMonth: true, IsToday: raw == time.Now().Format("2006-01-02")}
		cell.IsFriday = g.Weekday() == time.Friday
		cell.Holiday = persianHoliday(month, d)
		if a, ok := attendance[raw]; ok {
			cell.Status = a.Mode
		}
		for _, req := range requests {
			if raw >= req.StartDate && raw <= req.EndDate {
				cell.Status = req.Kind
			}
		}
		cells = append(cells, cell)
	}
	prevY, prevM, nextY, nextM := year, month-1, year, month+1
	if prevM == 0 {
		prevY, prevM = year-1, 12
	}
	if nextM == 13 {
		nextY, nextM = year+1, 1
	}
	return Calendar{
		Year: year, Month: month, MonthName: jalali.MonthNames[month], MonthNameFA: jalali.MonthNamesFA[month],
		Prev: fmt.Sprintf("%04d-%02d", prevY, prevM), Next: fmt.Sprintf("%04d-%02d", nextY, nextM), Cells: cells,
	}
}

func persianHoliday(month, day int) string {
	holidays := map[string]string{
		"1-1": "Nowruz", "1-2": "Nowruz", "1-3": "Nowruz", "1-4": "Nowruz",
		"1-12": "Islamic Republic Day", "1-13": "Nature Day",
		"3-14": "Demise of Imam Khomeini", "3-15": "Khordad Uprising",
		"11-22": "Revolution Day", "12-29": "Oil Nationalization Day",
	}
	return holidays[fmt.Sprintf("%d-%d", month, day)]
}

func (s *Server) checkIn(w http.ResponseWriter, r *http.Request) {
	u := currentUser(r)
	if err := s.store.CheckIn(u.ID, time.Now().Format("2006-01-02"), r.FormValue("mode")); err != nil {
		s.redirectError(w, r, err)
		return
	}
	http.Redirect(w, r, "/?flash=Checked+in+successfully", http.StatusSeeOther)
}

func (s *Server) checkOut(w http.ResponseWriter, r *http.Request) {
	if err := s.store.CheckOut(currentUser(r).ID, time.Now().Format("2006-01-02")); err != nil {
		s.redirectError(w, r, err)
		return
	}
	http.Redirect(w, r, "/?flash=Checked+out+successfully", http.StatusSeeOther)
}

func (s *Server) requestsPage(w http.ResponseWriter, r *http.Request) {
	requests, err := s.store.Requests(currentUser(r).ID, false, "")
	if err != nil {
		http.Error(w, "could not load requests", http.StatusInternalServerError)
		return
	}
	s.render(w, "requests.html", PageData{
		Title: "My requests", User: currentUser(r), CSRF: csrfToken(r), Requests: requests,
		Today: time.Now().Format("2006-01-02"), Error: r.URL.Query().Get("error"), Flash: r.URL.Query().Get("flash"),
		SelectedSection: "requests",
	})
}

func (s *Server) createRequest(w http.ResponseWriter, r *http.Request) {
	start, startOK := parseUserDate(r.FormValue("start_date"))
	end, endOK := parseUserDate(r.FormValue("end_date"))
	if !startOK || !endOK || end < start {
		s.redirectRequestError(w, r, errors.New("choose a valid date range"))
		return
	}
	if err := s.store.CreateRequest(currentUser(r).ID, r.FormValue("kind"), start, end, r.FormValue("reason")); err != nil {
		s.redirectRequestError(w, r, err)
		return
	}
	http.Redirect(w, r, "/requests?flash=Request+sent+for+approval", http.StatusSeeOther)
}

func parseUserDate(raw string) (string, bool) {
	var y, m, d int
	if _, err := fmt.Sscanf(strings.TrimSpace(raw), "%d-%d-%d", &y, &m, &d); err != nil {
		return "", false
	}
	if y >= 1700 {
		t, err := time.Parse("2006-01-02", fmt.Sprintf("%04d-%02d-%02d", y, m, d))
		return t.Format("2006-01-02"), err == nil
	}
	if y < 1200 || m < 1 || m > 12 || d < 1 || d > jalali.DaysInMonth(y, m) {
		return "", false
	}
	return jalali.ToGregorian(y, m, d).Format("2006-01-02"), true
}

func validDate(raw string) bool {
	_, err := time.Parse("2006-01-02", raw)
	return err == nil
}

func (s *Server) cancelRequest(w http.ResponseWriter, r *http.Request) {
	id, _ := strconv.ParseInt(r.PathValue("id"), 10, 64)
	_ = s.store.CancelRequest(id, currentUser(r).ID)
	http.Redirect(w, r, "/requests?flash=Request+cancelled", http.StatusSeeOther)
}

func (s *Server) adminPage(w http.ResponseWriter, r *http.Request) {
	requests, err := s.store.Requests(currentUser(r).ID, true, r.URL.Query().Get("status"))
	if err != nil {
		http.Error(w, "could not load requests", http.StatusInternalServerError)
		return
	}
	s.render(w, "admin.html", PageData{
		Title: "Approvals", User: currentUser(r), CSRF: csrfToken(r), Requests: requests,
		Error: r.URL.Query().Get("error"), Flash: r.URL.Query().Get("flash"), SelectedSection: "admin",
	})
}

func (s *Server) reviewRequest(w http.ResponseWriter, r *http.Request) {
	id, _ := strconv.ParseInt(r.PathValue("id"), 10, 64)
	err := s.store.ReviewRequest(r.Context(), id, currentUser(r).ID, r.FormValue("decision"), r.FormValue("note"))
	if err != nil {
		http.Redirect(w, r, "/admin/requests?error="+url.QueryEscape(err.Error()), http.StatusSeeOther)
		return
	}
	http.Redirect(w, r, "/admin/requests?flash=Request+reviewed", http.StatusSeeOther)
}

func (s *Server) usersPage(w http.ResponseWriter, r *http.Request) {
	users, err := s.store.Users()
	if err != nil {
		http.Error(w, "could not load teammates", http.StatusInternalServerError)
		return
	}
	s.render(w, "users.html", PageData{
		Title: "Teammates", User: currentUser(r), CSRF: csrfToken(r), Users: users,
		Error: r.URL.Query().Get("error"), Flash: r.URL.Query().Get("flash"), SelectedSection: "users",
	})
}

func (s *Server) createUser(w http.ResponseWriter, r *http.Request) {
	_, err := s.store.CreateUser(r.FormValue("username"), r.FormValue("password"), r.FormValue("display_name"), r.FormValue("email"), r.FormValue("role"))
	if err != nil {
		http.Redirect(w, r, "/admin/users?error="+url.QueryEscape(err.Error()), http.StatusSeeOther)
		return
	}
	http.Redirect(w, r, "/admin/users?flash=Teammate+account+created", http.StatusSeeOther)
}

func (s *Server) reportPage(w http.ResponseWriter, r *http.Request) {
	now := time.Now()
	start := now.AddDate(0, -1, 0).Format("2006-01-02")
	s.render(w, "reports.html", PageData{
		Title: "Reports", User: currentUser(r), CSRF: csrfToken(r), ReportStart: start,
		ReportEnd: now.Format("2006-01-02"), SelectedSection: "reports",
	})
}

func (s *Server) reportCSV(w http.ResponseWriter, r *http.Request) {
	start, end := r.URL.Query().Get("start"), r.URL.Query().Get("end")
	if !validDate(start) || !validDate(end) || end < start {
		http.Error(w, "invalid report date range", http.StatusBadRequest)
		return
	}
	rows, err := s.store.ReportRows(start, end)
	if err != nil {
		http.Error(w, "could not generate report", http.StatusInternalServerError)
		return
	}
	defer rows.Close()
	w.Header().Set("Content-Type", "text/csv; charset=utf-8")
	w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="attendance-%s-to-%s.csv"`, start, end))
	_, _ = w.Write([]byte{0xEF, 0xBB, 0xBF}) // Excel-friendly UTF-8 BOM.
	cw := csv.NewWriter(w)
	_ = cw.Write([]string{"Name", "Username", "Date", "Persian date", "Check in", "Check out", "Work mode", "Approved request"})
	for rows.Next() {
		var name, username, day, in, out, mode, request string
		if err := rows.Scan(&name, &username, &day, &in, &out, &mode, &request); err != nil {
			continue
		}
		t, _ := time.Parse("2006-01-02", day)
		_ = cw.Write([]string{name, username, day, jalali.FromTime(t).String(), in, out, mode, request})
	}
	cw.Flush()
}

func (s *Server) redirectError(w http.ResponseWriter, r *http.Request, err error) {
	http.Redirect(w, r, "/?error="+url.QueryEscape(err.Error()), http.StatusSeeOther)
}

func (s *Server) redirectRequestError(w http.ResponseWriter, r *http.Request, err error) {
	http.Redirect(w, r, "/requests?error="+url.QueryEscape(err.Error()), http.StatusSeeOther)
}

type contextKey string

const userKey contextKey = "user"
const csrfKey contextKey = "csrf"

func currentUser(r *http.Request) *User {
	u, _ := r.Context().Value(userKey).(*User)
	return u
}

func csrfToken(r *http.Request) string {
	v, _ := r.Context().Value(csrfKey).(string)
	return v
}

func (s *Server) withUser(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		c, err := r.Cookie("teammate_session")
		if err == nil {
			if u, csrf, err := s.store.Session(c.Value); err == nil {
				ctx := r.Context()
				ctx = context.WithValue(ctx, userKey, u)
				ctx = context.WithValue(ctx, csrfKey, csrf)
				r = r.WithContext(ctx)
			}
		}
		next.ServeHTTP(w, r)
	})
}

func (s *Server) requireAuth(next http.HandlerFunc) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		if currentUser(r) == nil {
			http.Redirect(w, r, "/login", http.StatusSeeOther)
			return
		}
		next(w, r)
	}
}

func (s *Server) requireAdmin(next http.HandlerFunc) http.HandlerFunc {
	return s.requireAuth(func(w http.ResponseWriter, r *http.Request) {
		if currentUser(r).Role != "admin" {
			http.Error(w, "admin access required", http.StatusForbidden)
			return
		}
		next(w, r)
	})
}

func (s *Server) csrf(next http.HandlerFunc) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		if err := r.ParseForm(); err != nil || subtle.ConstantTimeCompare([]byte(r.FormValue("csrf")), []byte(csrfToken(r))) != 1 {
			http.Error(w, "invalid security token; reload the page and try again", http.StatusForbidden)
			return
		}
		next(w, r)
	}
}

func (s *Server) securityHeaders(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("X-Content-Type-Options", "nosniff")
		w.Header().Set("X-Frame-Options", "DENY")
		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
		w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self' https://unpkg.com; style-src 'self' https://cdn.jsdelivr.net; font-src 'self' https://cdn.jsdelivr.net data:; img-src 'self' data: https:; connect-src 'self'")
		next.ServeHTTP(w, r)
	})
}

type oauthProvider struct {
	authorize, token, profile, clientID, secret, scope string
}

func (s *Server) provider(name string) (oauthProvider, bool) {
	switch name {
	case "github":
		return oauthProvider{"https://github.com/login/oauth/authorize", "https://github.com/login/oauth/access_token", "https://api.github.com/user", s.cfg.GitHubClientID, s.cfg.GitHubClientSecret, "read:user user:email"}, s.cfg.GitHubClientID != ""
	case "google":
		return oauthProvider{"https://accounts.google.com/o/oauth2/v2/auth", "https://oauth2.googleapis.com/token", "https://openidconnect.googleapis.com/v1/userinfo", s.cfg.GoogleClientID, s.cfg.GoogleClientSecret, "openid email profile"}, s.cfg.GoogleClientID != ""
	default:
		return oauthProvider{}, false
	}
}

func (s *Server) oauthStart(w http.ResponseWriter, r *http.Request) {
	name := r.PathValue("provider")
	p, ok := s.provider(name)
	if !ok {
		http.Redirect(w, r, "/login?error=OAuth+provider+is+not+configured", http.StatusSeeOther)
		return
	}
	state, _ := randomToken(24)
	http.SetCookie(w, &http.Cookie{Name: "oauth_state", Value: state, Path: "/auth/", HttpOnly: true, Secure: s.cfg.SessionSecure, SameSite: http.SameSiteLaxMode, MaxAge: 600})
	q := url.Values{
		"client_id": {p.clientID}, "redirect_uri": {s.cfg.BaseURL + "/auth/" + name + "/callback"},
		"response_type": {"code"}, "scope": {p.scope}, "state": {state},
	}
	http.Redirect(w, r, p.authorize+"?"+q.Encode(), http.StatusTemporaryRedirect)
}

func (s *Server) oauthCallback(w http.ResponseWriter, r *http.Request) {
	name := r.PathValue("provider")
	p, ok := s.provider(name)
	state, err := r.Cookie("oauth_state")
	if !ok || err != nil || state.Value == "" || subtle.ConstantTimeCompare([]byte(state.Value), []byte(r.URL.Query().Get("state"))) != 1 {
		http.Redirect(w, r, "/login?error=Invalid+OAuth+state", http.StatusSeeOther)
		return
	}
	form := url.Values{
		"client_id": {p.clientID}, "client_secret": {p.secret}, "code": {r.URL.Query().Get("code")},
		"redirect_uri": {s.cfg.BaseURL + "/auth/" + name + "/callback"}, "grant_type": {"authorization_code"},
	}
	req, _ := http.NewRequestWithContext(r.Context(), http.MethodPost, p.token, strings.NewReader(form.Encode()))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.Header.Set("Accept", "application/json")
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		s.oauthFail(w, r)
		return
	}
	defer resp.Body.Close()
	var token struct {
		AccessToken string `json:"access_token"`
	}
	if json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&token) != nil || token.AccessToken == "" {
		s.oauthFail(w, r)
		return
	}
	profileReq, _ := http.NewRequestWithContext(r.Context(), http.MethodGet, p.profile, nil)
	profileReq.Header.Set("Authorization", "Bearer "+token.AccessToken)
	profileReq.Header.Set("Accept", "application/json")
	profileResp, err := http.DefaultClient.Do(profileReq)
	if err != nil {
		s.oauthFail(w, r)
		return
	}
	defer profileResp.Body.Close()
	var profile map[string]any
	decoder := json.NewDecoder(io.LimitReader(profileResp.Body, 1<<20))
	decoder.UseNumber()
	if decoder.Decode(&profile) != nil {
		s.oauthFail(w, r)
		return
	}
	id := fmt.Sprint(profile["id"])
	if name == "google" {
		id = fmt.Sprint(profile["sub"])
	}
	login, _ := profile["login"].(string)
	email, _ := profile["email"].(string)
	display, _ := profile["name"].(string)
	avatar, _ := profile["avatar_url"].(string)
	if name == "google" {
		avatar, _ = profile["picture"].(string)
		login = strings.Split(email, "@")[0]
	}
	userID, err := s.store.UpsertOAuthUser(name, id, login, email, display, avatar)
	if err != nil {
		s.oauthFail(w, r)
		return
	}
	s.startSession(w, userID)
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

func (s *Server) oauthFail(w http.ResponseWriter, r *http.Request) {
	http.Redirect(w, r, "/login?error=Could+not+sign+in+with+OAuth", http.StatusSeeOther)
}