<?php

namespace App\Controllers;

use Psr\Http\Message\ResponseInterface as Response;
use Psr\Http\Message\ServerRequestInterface as Request;
use App\Services\AuthService;
use App\Messages\MessageConstants;
use App\Messages\MessageHelper;

class AuthController extends BaseController
{
    private AuthService $authService;

    public function __construct()
    {
        $this->authService = $this->getService(AuthService::class);
    }

    /**
     * User login
     */
    public function login(Request $request, Response $response): Response
    {
        try {
            $data = $request->getParsedBody();
            
            if (!isset($data['email']) || !isset($data['password'])) {
                return $this->validationErrorResponse($response, [
                    MessageConstants::FIELD_EMAIL => MessageHelper::required(MessageConstants::FIELD_EMAIL),
                    MessageConstants::FIELD_PASSWORD => MessageHelper::required(MessageConstants::FIELD_PASSWORD)
                ]);
            }

            $result = $this->authService->login($data['email'], $data['password']);

            if (!$result) {
                return $this->unauthorizedResponse($response, MessageConstants::AUTH_INVALID_CREDENTIALS);
            }

            return $this->successResponse($response, $result, MessageConstants::AUTH_LOGIN_SUCCESSFUL);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * User registration
     */
    public function register(Request $request, Response $response): Response
    {
        try {
            $data = $request->getParsedBody();
            
            // Pre-validation for required fields
            $requiredFields = [
                'first_name' => MessageConstants::FIELD_FIRST_NAME,
                'last_name' => MessageConstants::FIELD_LAST_NAME,
                'email' => MessageConstants::FIELD_EMAIL,
                'company_name' => MessageConstants::FIELD_COMPANY_NAME,
                'company_domain' => MessageConstants::FIELD_COMPANY_DOMAIN,
                'password' => MessageConstants::FIELD_PASSWORD,
                'confirm_password' => MessageConstants::FIELD_CONFIRM_PASSWORD
            ];

            $validationErrors = [];

            // Check for missing fields
            foreach ($requiredFields as $field => $fieldConstant) {
                if (!isset($data[$field]) || empty(trim($data[$field]))) {
                    $validationErrors[$field] = MessageHelper::required($fieldConstant);
                }
            }

            // Additional validations if fields are present
            if (isset($data['email']) && !empty($data['email'])) {
                if (!filter_var($data['email'], FILTER_VALIDATE_EMAIL)) {
                    $validationErrors['email'] = MessageHelper::invalid(MessageConstants::FIELD_EMAIL);
                }
            }

            if (isset($data['company_domain']) && !empty($data['company_domain'])) {
                // Basic domain validation (can be enhanced)
                if (!preg_match('/^[a-zA-Z0-9][a-zA-Z0-9-]{0,61}[a-zA-Z0-9]?(\.[a-zA-Z0-9][a-zA-Z0-9-]{0,61}[a-zA-Z0-9]?)*$/', $data['company_domain'])) {
                    $validationErrors['company_domain'] = MessageHelper::invalid(MessageConstants::FIELD_COMPANY_DOMAIN);
                }
            }

            // Password confirmation validation
            if (isset($data['password']) && isset($data['confirm_password'])) {
                if ($data['password'] !== $data['confirm_password']) {
                    $validationErrors['confirm_password'] = MessageHelper::mismatch('passwords');
                }
            }

            // Password strength validation (basic)
            if (isset($data['password']) && !empty($data['password'])) {
                if (strlen($data['password']) < 8) {
                    $validationErrors['password'] = 'Password must be at least 8 characters long';
                }
            }

            // Return validation errors if any
            if (!empty($validationErrors)) {
                return $this->validationErrorResponse($response, $validationErrors);
            }

            $user = $this->authService->register($data);

            return $this->successResponse($response, $user, MessageConstants::AUTH_REGISTRATION_SUCCESSFUL, 201);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * User logout
     */
    public function logout(Request $request, Response $response): Response
    {
        try {
            $userEmail = $this->getUserEmail($request);
            if (!$userEmail) {
                return $this->unauthorizedResponse($response);
            }

            $this->authService->logout($userEmail);

            return $this->successResponse($response, null, MessageConstants::AUTH_LOGOUT_SUCCESSFUL);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * Refresh token
     */
    public function refreshToken(Request $request, Response $response): Response
    {
        try {
            $data = $request->getParsedBody();
            
            if (!isset($data['refresh_token'])) {
                return $this->validationErrorResponse($response, [
                    MessageConstants::FIELD_REFRESH_TOKEN => MessageHelper::required('refresh token')
                ]);
            }

            $result = $this->authService->refreshToken($data['refresh_token']);

            if (!$result) {
                return $this->unauthorizedResponse($response, MessageHelper::invalid('refresh token'));
            }

            return $this->successResponse($response, $result, MessageConstants::AUTH_TOKEN_REFRESHED);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * Forgot password
     */
    public function forgotPassword(Request $request, Response $response): Response
    {
        try {
            $data = $request->getParsedBody();
            
            if (!isset($data['email'])) {
                return $this->validationErrorResponse($response, [
                    MessageConstants::FIELD_EMAIL => MessageHelper::required(MessageConstants::FIELD_EMAIL)
                ]);
            }

            $result = $this->authService->forgotPassword($data['email']);

            return $this->successResponse($response, null, MessageConstants::AUTH_RESET_LINK_SENT);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * Reset password
     */
    public function resetPassword(Request $request, Response $response): Response
    {
        try {
            $data = $request->getParsedBody();
            
            if (!isset($data['token']) || !isset($data['password'])) {
                return $this->validationErrorResponse($response, [
                    MessageConstants::FIELD_TOKEN => MessageHelper::required('reset token'),
                    MessageConstants::FIELD_PASSWORD => MessageHelper::required('new password')
                ]);
            }

            $result = $this->authService->resetPassword($data['token'], $data['password']);

            if (!$result) {
                return $this->badRequestResponse($response, MessageHelper::invalid('reset token') . ' or ' . MessageHelper::expired('reset token'));
            }

            return $this->successResponse($response, null, MessageConstants::AUTH_PASSWORD_RESET_SUCCESSFUL);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * Verify email
     */
    public function verifyEmail(Request $request, Response $response): Response
    {
        try {
            $data = $request->getParsedBody();
            
            if (!isset($data['token'])) {
                return $this->validationErrorResponse($response, [
                    MessageConstants::FIELD_TOKEN => MessageHelper::required('verification token')
                ]);
            }

            $result = $this->authService->verifyEmail($data['token']);

            if (!$result) {
                return $this->badRequestResponse($response, MessageHelper::invalid('verification token') . ' or ' . MessageHelper::expired('verification token'));
            }

            return $this->successResponse($response, null, MessageConstants::AUTH_EMAIL_VERIFIED);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * Resend verification email
     */
    public function resendVerification(Request $request, Response $response): Response
    {
        try {
            $data = $request->getParsedBody();
            
            if (!isset($data['email'])) {
                return $this->validationErrorResponse($response, [
                    MessageConstants::FIELD_EMAIL => MessageHelper::required(MessageConstants::FIELD_EMAIL)
                ]);
            }

            $result = $this->authService->resendVerification($data['email']);

            return $this->successResponse($response, null, MessageConstants::AUTH_VERIFICATION_SENT);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * Get current user
     */
    public function me(Request $request, Response $response): Response
    {
        try {
            $userEmail = $this->getUserEmail($request);
            if (!$userEmail) {
                return $this->unauthorizedResponse($response);
            }

            $user = $this->authService->getCurrentUserByEmail($userEmail);

            if (!$user) {
                return $this->notFoundResponse($response, MessageConstants::USER_NOT_FOUND);
            }

            return $this->successResponse($response, $user);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * Change password
     */
    public function changePassword(Request $request, Response $response): Response
    {
        try {
            $userEmail = $this->getUserEmail($request);
            if (!$userEmail) {
                return $this->unauthorizedResponse($response);
            }

            $data = $request->getParsedBody();
            
            if (!isset($data['current_password']) || !isset($data['new_password'])) {
                return $this->validationErrorResponse($response, [
                    MessageConstants::FIELD_CURRENT_PASSWORD => MessageHelper::required('current password'),
                    MessageConstants::FIELD_NEW_PASSWORD => MessageHelper::required('new password')
                ]);
            }

            $result = $this->authService->changePasswordByEmail($userEmail, $data['current_password'], $data['new_password']);

            if (!$result) {
                return $this->badRequestResponse($response, MessageHelper::incorrect('current password'));
            }

            return $this->successResponse($response, null, MessageConstants::AUTH_PASSWORD_CHANGED);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * Enable two-factor authentication
     */
    public function enableTwoFactor(Request $request, Response $response): Response
    {
        try {
            $userEmail = $this->getUserEmail($request);
            if (!$userEmail) {
                return $this->unauthorizedResponse($response);
            }

            $data = $request->getParsedBody();
            
            if (!isset($data['password'])) {
                return $this->validationErrorResponse($response, [
                    MessageConstants::FIELD_PASSWORD => MessageHelper::required(MessageConstants::FIELD_PASSWORD)
                ]);
            }

            $result = $this->authService->enableTwoFactorByEmail($userEmail, $data['password']);

            if (!$result) {
                return $this->badRequestResponse($response, MessageHelper::incorrect(MessageConstants::FIELD_PASSWORD));
            }

            return $this->successResponse($response, $result, MessageConstants::AUTH_TWO_FACTOR_ENABLED);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * Disable two-factor authentication
     */
    public function disableTwoFactor(Request $request, Response $response): Response
    {
        try {
            $userEmail = $this->getUserEmail($request);
            if (!$userEmail) {
                return $this->unauthorizedResponse($response);
            }

            $data = $request->getParsedBody();
            
            if (!isset($data['password'])) {
                return $this->validationErrorResponse($response, [
                    MessageConstants::FIELD_PASSWORD => MessageHelper::required(MessageConstants::FIELD_PASSWORD)
                ]);
            }

            $result = $this->authService->disableTwoFactorByEmail($userEmail, $data['password']);

            if (!$result) {
                return $this->badRequestResponse($response, MessageHelper::incorrect(MessageConstants::FIELD_PASSWORD));
            }

            return $this->successResponse($response, null, MessageConstants::AUTH_TWO_FACTOR_DISABLED);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * Check authentication status
     */
    public function check(Request $request, Response $response): Response
    {
        try {
            $userEmail = $this->getUserEmail($request);
            if (!$userEmail) {
                return $this->unauthorizedResponse($response);
            }

            $user = $this->authService->getAuthenticatedUserByEmail($userEmail);
            
            return $this->successResponse($response, ['user' => $user], MessageConstants::AUTH_AUTHENTICATION_VALID);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * Refresh token (matches route name)
     */
    public function refresh(Request $request, Response $response): Response
    {
        return $this->refreshToken($request, $response);
    }

    /**
     * Get user sessions
     */
    public function getSessions(Request $request, Response $response): Response
    {
        try {
            $userEmail = $this->getUserEmail($request);
            if (!$userEmail) {
                return $this->unauthorizedResponse($response);
            }

            $sessions = $this->authService->getUserSessionsByEmail($userEmail);
            
            return $this->successResponse($response, $sessions, MessageConstants::AUTH_SESSIONS_RETRIEVED);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * Revoke all sessions
     */
    public function revokeAllSessions(Request $request, Response $response): Response
    {
        try {
            $userEmail = $this->getUserEmail($request);
            if (!$userEmail) {
                return $this->unauthorizedResponse($response);
            }

            $result = $this->authService->revokeAllSessionsByEmail($userEmail);
            
            return $this->successResponse($response, null, MessageConstants::AUTH_SESSIONS_REVOKED);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * Revoke specific session
     */
    public function revokeSession(Request $request, Response $response, array $args): Response
    {
        try {
            $userEmail = $this->getUserEmail($request);
            if (!$userEmail) {
                return $this->unauthorizedResponse($response);
            }

            $publicSessionId = $args['session_id'] ?? null;
            if (!$publicSessionId) {
                return $this->badRequestResponse($response, MessageHelper::required('Session ID'));
            }

            $result = $this->authService->revokeSessionByEmail($userEmail, $publicSessionId);
            
            return $this->successResponse($response, null, MessageConstants::AUTH_SESSION_REVOKED);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * Get user profile
     */
    public function getProfile(Request $request, Response $response): Response
    {
        try {
            $userEmail = $this->getUserEmail($request);
            if (!$userEmail) {
                return $this->unauthorizedResponse($response);
            }

            $profile = $this->authService->getUserProfileByEmail($userEmail);
            
            return $this->successResponse($response, $profile, MessageConstants::AUTH_PROFILE_RETRIEVED);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }

    /**
     * Update user profile
     */
    public function updateProfile(Request $request, Response $response): Response
    {
        try {
            $userEmail = $this->getUserEmail($request);
            if (!$userEmail) {
                return $this->unauthorizedResponse($response);
            }

            $data = $request->getParsedBody();
            $result = $this->authService->updateUserProfileByEmail($userEmail, $data);
            
            return $this->successResponse($response, $result, MessageConstants::AUTH_PROFILE_UPDATED);

        } catch (\Exception $e) {
            return $this->handleException($response, $e);
        }
    }
}