import { NextRequest, NextResponse } from 'next/server'
import { prisma } from '@/lib/prisma'
import {
  getDingtalkAppAccessToken,
  getDingtalkWorkNoticeAppAccessToken,
} from '@/lib/dingtalk-client'
import { ensurePerformanceSurveyEmployeeProfileForUser } from '@/lib/performance-survey-report-sync'
import {
  getAuthSessionCookieCandidates,
  getAuthSessionCookieName,
  resolveSecureAuthCookieFromRequest,
} from '@/lib/auth-cookie'
import bcrypt from 'bcryptjs'
import { encode } from 'next-auth/jwt'
import type { Role } from '@prisma/client'
import { randomBytes } from 'crypto'
import {
  createDingtalkProfileToken,
  DINGTALK_PROFILE_TOKEN_MAX_AGE_SECONDS,
  getDingtalkProfileCookieName,
  getDingtalkProfileCookiePath,
} from '@/lib/dingtalk-profile-token'

type DingtalkUserInfo = {
  name?: string | null
  avatar?: string | null
  mobile?: string | null
  email?: string | null
}

type DingtalkLoginAppSource = 'login' | 'workNotice'

type DingtalkNextAuthUser = {
  id: string
  email: string
  username: string
  realName?: string | null
  role: Role
  department: string
  managedDepartment?: string | null
  avatar?: string | null
  isSuperAdmin?: boolean | null
}

let configValidated = false

async function createDingtalkOnlyPasswordHash() {
  return bcrypt.hash(randomBytes(32).toString('hex'), 10)
}

function validateDingtalkConfig(
  appSource: DingtalkLoginAppSource = 'login',
): { clientId: string; clientSecret: string } | null {
  const clientId = appSource === 'workNotice'
    ? process.env.DINGTALK_WORK_NOTICE_CLIENT_ID ||
      process.env.DINGTALK_WORK_NOTICE_APP_KEY ||
      process.env.DINGTALK_CLIENT_ID
    : process.env.DINGTALK_CLIENT_ID
  const clientSecret = appSource === 'workNotice'
    ? process.env.DINGTALK_WORK_NOTICE_CLIENT_SECRET ||
      process.env.DINGTALK_WORK_NOTICE_APP_SECRET ||
      process.env.DINGTALK_CLIENT_SECRET
    : process.env.DINGTALK_CLIENT_SECRET

  if (!clientId || !clientSecret) {
    if (!configValidated) {
      console.error('[Dingtalk] 配置错误：缺少必需的环境变量')
      console.error(
        appSource === 'workNotice'
          ? '[Dingtalk] 请配置 DINGTALK_WORK_NOTICE_CLIENT_ID 和 DINGTALK_WORK_NOTICE_CLIENT_SECRET'
          : '[Dingtalk] 请配置 DINGTALK_CLIENT_ID 和 DINGTALK_CLIENT_SECRET',
      )
      configValidated = true
    }
    return null
  }

  if (!configValidated) {
    console.log('[Dingtalk] 钉钉配置已加载')
    configValidated = true
  }

  return { clientId, clientSecret }
}

function getDingtalkConfig(
  appSource: DingtalkLoginAppSource = 'login',
): { clientId: string; clientSecret: string } {
  const config = validateDingtalkConfig(appSource)
  if (!config) {
    throw new Error(
      appSource === 'workNotice'
        ? '钉钉工作通知免登未配置，请联系管理员配置 DINGTALK_WORK_NOTICE_CLIENT_ID 和 DINGTALK_WORK_NOTICE_CLIENT_SECRET'
        : '钉钉登录未配置，请联系管理员配置 DINGTALK_CLIENT_ID 和 DINGTALK_CLIENT_SECRET',
    )
  }
  return config
}

async function getUserAccessToken(code: string, appSource: DingtalkLoginAppSource = 'login') {
  const config = getDingtalkConfig(appSource)
  const response = await fetch('https://api.dingtalk.com/v1.0/oauth2/userAccessToken', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      clientId: config.clientId,
      clientSecret: config.clientSecret,
      code,
      grantType: 'authorization_code',
    }),
  })

  if (!response.ok) {
    const errorText = await response.text()
    console.error('获取用户访问令牌HTTP错误:', response.status, errorText)
    throw new Error(`获取用户访问令牌失败: HTTP ${response.status}`)
  }

  const data = await response.json()
  if (data.code && data.code !== '0') {
    console.error('获取用户访问令牌API错误:', data)
    throw new Error(`获取用户访问令牌失败: ${data.message || '未知错误'}`)
  }

  return data
}

async function getUnionId(token: string) {
  const response = await fetch('https://api.dingtalk.com/v1.0/contact/users/me', {
    headers: { 'x-acs-dingtalk-access-token': token },
  })

  if (!response.ok) {
    throw new Error('获取unionId失败')
  }

  const data = await response.json()
  if (!data.unionId) {
    console.error('获取unionId返回数据异常:', data)
    throw new Error('获取unionId失败: 返回数据中没有unionId')
  }

  return data.unionId
}

async function getUserIdByUnionId(unionId: string, appToken: string) {
  const response = await fetch(
    `https://oapi.dingtalk.com/topapi/user/getbyunionid?access_token=${appToken}`,
    {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ unionid: unionId }),
    },
  )

  if (!response.ok) {
    throw new Error('根据unionId获取userId失败')
  }

  const data = await response.json()
  if (data.errcode !== 0) {
    console.error('钉钉API错误:', data)
    throw new Error(`获取userId失败: ${data.errmsg || '未知错误'}`)
  }

  if (!data.result?.userid) {
    console.error('钉钉API返回数据异常:', data)
    throw new Error('获取userId失败: 返回数据格式错误')
  }

  return data.result.userid
}

async function getUserIdByH5AuthCode(code: string, appToken: string) {
  const response = await fetch(
    `https://oapi.dingtalk.com/topapi/v2/user/getuserinfo?access_token=${appToken}`,
    {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ code }),
    },
  )

  if (!response.ok) {
    throw new Error(`通过免登码获取用户失败: HTTP ${response.status}`)
  }

  const data = await response.json()
  if (data.errcode !== 0) {
    console.error('钉钉免登API错误:', data)
    throw new Error(`通过免登码获取用户失败: ${data.errmsg || '未知错误'}`)
  }

  const userId = data.result?.userid || data.result?.userId || data.userid || data.userId
  if (!userId) {
    console.error('钉钉免登API返回数据异常:', data)
    throw new Error('通过免登码获取用户失败: 返回数据中没有userId')
  }

  return String(userId)
}

async function getUserInfo(userId: string, appToken: string): Promise<DingtalkUserInfo> {
  const response = await fetch(
    `https://oapi.dingtalk.com/topapi/v2/user/get?access_token=${appToken}`,
    {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ userid: userId }),
    },
  )

  if (!response.ok) {
    throw new Error('获取用户信息失败')
  }

  const data = await response.json()
  if (data.errcode !== 0) {
    console.error('钉钉API错误:', data)
    throw new Error(`获取用户信息失败: ${data.errmsg || '未知错误'}`)
  }

  if (!data.result) {
    console.error('钉钉API返回数据异常:', data)
    throw new Error('获取用户信息失败: 返回数据格式错误')
  }

  return data.result
}

function generateRandomEmail(): string {
  const randomStr = Math.random().toString(36).substring(2, 10)
  return `dingtalk_${randomStr}@temp.com`
}

function warmPerformanceSurveyProfile(user: {
  id: string
  dingtalkUserId: string | null
  email: string
  username: string
  realName: string | null
}) {
  void ensurePerformanceSurveyEmployeeProfileForUser({
    userId: user.id,
    dingtalkUserId: user.dingtalkUserId,
    email: user.email,
    username: user.username,
    realName: user.realName,
    displayName: user.realName || user.username,
  }).catch((error) => {
    console.warn('[performance-survey] 钉钉登录后预热人员档案失败:', error)
  })
}

async function createAuthenticatedResponse(
  request: NextRequest,
  user: {
    id: string
    email: string
    username: string
    realName?: string | null
    role: Role
    department: string
    managedDepartment?: string | null
    avatar?: string | null
    isSuperAdmin?: boolean | null
  },
  options?: {
    cookieSameSite?: 'lax' | 'none'
  },
) {
  const secret = process.env.NEXTAUTH_SECRET
  if (!secret) {
    throw new Error('登录会话未配置 NEXTAUTH_SECRET')
  }

  const maxAge = 7 * 24 * 60 * 60
  const secureCookie = resolveSecureAuthCookieFromRequest(request)
  const cookieName = getAuthSessionCookieName(secureCookie)
  const cookieNames = secureCookie
    ? getAuthSessionCookieCandidates(true)
    : [cookieName]
  const sameSite = options?.cookieSameSite === 'none' && secureCookie ? 'none' : 'lax'
  const sessionToken = await encode({
    secret,
    maxAge,
    token: {
      sub: user.id,
      id: user.id,
      email: user.email,
      name: user.username,
      role: user.role,
      avatar: user.avatar || null,
      isSuperAdmin: user.isSuperAdmin ?? false,
      department: user.department || '',
      managedDepartment: user.managedDepartment || null,
    },
  })

  const response = NextResponse.json({
    success: true,
    needCompleteProfile: false,
    message: '登录成功',
    sessionCreated: true,
    user: {
      id: user.id,
      username: user.username,
      email: user.email,
      realName: user.realName,
      avatar: user.avatar,
      role: user.role,
      department: user.department,
    },
  })

  response.cookies.set(cookieName, sessionToken, {
    httpOnly: true,
    sameSite,
    secure: secureCookie,
    path: '/',
    maxAge,
  })

  for (const name of cookieNames) {
    if (name === cookieName) {
      continue
    }

    response.cookies.set(name, sessionToken, {
      httpOnly: true,
      sameSite,
      secure: secureCookie,
      path: '/',
      maxAge,
    })
  }

  return response
}

async function createOrUpdateUserSession(
  request: NextRequest,
  userId: string,
  userInfo: DingtalkUserInfo,
  options?: {
    cookieSameSite?: 'lax' | 'none'
  },
) {
  const displayName = String(userInfo.name || '').trim()
  if (!displayName) {
    throw new Error('钉钉返回的用户名称为空')
  }

  let user = await prisma.user.findFirst({
    where: { dingtalkUserId: userId },
  })

  let needCompleteProfile = false
  if (!user) {
    const existingUserByName = await prisma.user.findUnique({
      where: { username: displayName },
    })

    if (existingUserByName && !existingUserByName.dingtalkUserId) {
      console.log('找到同名用户，自动关联钉钉账号:', existingUserByName.username)
      user = await prisma.user.update({
        where: { id: existingUserByName.id },
        data: {
          dingtalkUserId: userId,
          loginType: 'dingtalk',
          realName: displayName,
          avatar: userInfo.avatar || existingUserByName.avatar,
          phone: userInfo.mobile || existingUserByName.phone,
        },
      })
      console.log('账号关联成功:', user.username)
    } else {
      console.log('创建新用户（使用钉钉姓名）:', displayName)

      let emailToUse = userInfo.email || generateRandomEmail()
      const emailExists = await prisma.user.findUnique({ where: { email: emailToUse } })
      if (emailExists) {
        emailToUse = generateRandomEmail()
      }

      user = await prisma.user.create({
        data: {
          username: displayName,
          email: emailToUse,
          password: await createDingtalkOnlyPasswordHash(),
          realName: displayName,
          avatar: userInfo.avatar || null,
          phone: userInfo.mobile || null,
          department: '',
          role: 'USER',
          isActive: false,
          status: 'pending',
          loginType: 'dingtalk',
          dingtalkUserId: userId,
        },
      })

      needCompleteProfile = true
      console.log('用户创建成功:', user.id)
    }
  } else {
    console.log('更新现有用户:', user.username)
    user = await prisma.user.update({
      where: { id: user.id },
      data: {
        realName: displayName,
        avatar: userInfo.avatar || user.avatar,
        phone: userInfo.mobile || user.phone,
      },
    })
  }

  if (needCompleteProfile) {
    warmPerformanceSurveyProfile(user)
    const response = NextResponse.json({
      success: true,
      needCompleteProfile: true,
      message: '请选择您的部门',
      user: {
        id: user.id,
        username: user.username,
        email: user.email,
        realName: user.realName,
        avatar: user.avatar,
        role: user.role,
        department: user.department,
        isActive: user.isActive,
      },
    })
    const secureCookie = resolveSecureAuthCookieFromRequest(request)
    response.cookies.set(
      getDingtalkProfileCookieName(request),
      await createDingtalkProfileToken(user.id),
      {
        httpOnly: true,
        sameSite: options?.cookieSameSite === 'none' && secureCookie ? 'none' : 'lax',
        secure: secureCookie,
        path: getDingtalkProfileCookiePath(),
        maxAge: DINGTALK_PROFILE_TOKEN_MAX_AGE_SECONDS,
      },
    )
    return response
  }

  const userStatus = (user as any).status || (user.isActive ? 'active' : 'pending')
  const isUserActive = userStatus === 'active'

  if (!isUserActive) {
    warmPerformanceSurveyProfile(user)
    return NextResponse.json(
      {
        success: false,
        message: '您的账号尚未激活，请联系管理员激活后再登录',
      },
      { status: 403 },
    )
  }

  if (userStatus === 'suspended' || userStatus === 'archived') {
    return NextResponse.json(
      {
        success: false,
        message: '您的账号已被暂停或归档，无法登录',
      },
      { status: 403 },
    )
  }

  const clientIp =
    request.headers.get('x-forwarded-for') ||
    request.headers.get('x-real-ip') ||
    null

  await prisma.user.update({
    where: { id: user.id },
    data: {
      lastLoginAt: new Date(),
      lastLoginIp: clientIp,
      loginCount: { increment: 1 },
      status: 'active',
      isActive: true,
    },
  }).catch((error) => {
    console.error('记录登录审计信息失败:', error)
  })

  warmPerformanceSurveyProfile(user)

  return createAuthenticatedResponse(request, {
    id: user.id,
    email: user.email,
    username: user.username,
    realName: user.realName,
    role: user.role,
    department: user.department,
    managedDepartment: user.managedDepartment,
    avatar: user.avatar,
    isSuperAdmin: (user as any).isSuperAdmin ?? false,
  }, options)
}

function getAppAccessToken(appSource: DingtalkLoginAppSource) {
  return appSource === 'workNotice'
    ? getDingtalkWorkNoticeAppAccessToken()
    : getDingtalkAppAccessToken()
}

async function resolveDingtalkUserForSession(
  userId: string,
  userInfo: DingtalkUserInfo,
  clientIp?: string | null,
): Promise<DingtalkNextAuthUser> {
  const displayName = String(userInfo.name || '').trim()
  if (!displayName) {
    throw new Error('钉钉返回的用户名称为空')
  }

  let user = await prisma.user.findFirst({
    where: { dingtalkUserId: userId },
  })

  if (!user) {
    const existingUserByName = await prisma.user.findUnique({
      where: { username: displayName },
    })

    if (existingUserByName && !existingUserByName.dingtalkUserId) {
      console.log('找到同名用户，自动关联钉钉账号:', existingUserByName.username)
      user = await prisma.user.update({
        where: { id: existingUserByName.id },
        data: {
          dingtalkUserId: userId,
          loginType: 'dingtalk',
          realName: displayName,
          avatar: userInfo.avatar || existingUserByName.avatar,
          phone: userInfo.mobile || existingUserByName.phone,
        },
      })
      console.log('账号关联成功:', user.username)
    } else {
      console.log('创建新用户（使用钉钉姓名）:', displayName)

      let emailToUse = userInfo.email || generateRandomEmail()
      const emailExists = await prisma.user.findUnique({ where: { email: emailToUse } })
      if (emailExists) {
        emailToUse = generateRandomEmail()
      }

      user = await prisma.user.create({
        data: {
          username: displayName,
          email: emailToUse,
          password: await createDingtalkOnlyPasswordHash(),
          realName: displayName,
          avatar: userInfo.avatar || null,
          phone: userInfo.mobile || null,
          department: '',
          role: 'USER',
          isActive: false,
          status: 'pending',
          loginType: 'dingtalk',
          dingtalkUserId: userId,
        },
      })

      warmPerformanceSurveyProfile(user)
      throw new Error('您的账号尚未激活，请联系管理员激活后再登录')
    }
  } else {
    console.log('更新现有用户:', user.username)
    user = await prisma.user.update({
      where: { id: user.id },
      data: {
        realName: displayName,
        avatar: userInfo.avatar || user.avatar,
        phone: userInfo.mobile || user.phone,
      },
    })
  }

  const userStatus = (user as any).status || (user.isActive ? 'active' : 'pending')
  const isUserActive = userStatus === 'active'

  if (!isUserActive) {
    warmPerformanceSurveyProfile(user)
    throw new Error('您的账号尚未激活，请联系管理员激活后再登录')
  }

  if (userStatus === 'suspended' || userStatus === 'archived') {
    throw new Error('您的账号已被暂停或归档，无法登录')
  }

  await prisma.user.update({
    where: { id: user.id },
    data: {
      lastLoginAt: new Date(),
      lastLoginIp: clientIp || null,
      loginCount: { increment: 1 },
      status: 'active',
      isActive: true,
    },
  }).catch((error) => {
    console.error('记录登录审计信息失败:', error)
  })

  warmPerformanceSurveyProfile(user)

  return {
    id: user.id,
    email: user.email,
    username: user.username,
    realName: user.realName,
    role: user.role,
    department: user.department,
    managedDepartment: user.managedDepartment,
    avatar: user.avatar,
    isSuperAdmin: (user as any).isSuperAdmin ?? false,
  }
}

export async function authorizeDingtalkH5UserForNextAuth(
  code: string,
  options?: { appSource?: DingtalkLoginAppSource; clientIp?: string | null },
) {
  console.log('开始钉钉H5免登NextAuth登录流程')
  const appSource = options?.appSource || 'login'

  const appAccessToken = await getAppAccessToken(appSource)
  console.log('获取应用访问令牌成功')

  const userId = await getUserIdByH5AuthCode(code, appAccessToken)
  console.log('通过免登码获取userId成功:', userId)

  const userInfo = await getUserInfo(userId, appAccessToken)
  console.log('获取用户信息成功:', userInfo.name)

  return resolveDingtalkUserForSession(userId, userInfo, options?.clientIp || null)
}

export async function loginDingtalkUserByOAuthCode(
  request: NextRequest,
  code: string,
  options?: { appSource?: DingtalkLoginAppSource },
) {
  console.log('开始钉钉OAuth登录流程')
  const appSource = options?.appSource || 'login'

  const tokenData = await getUserAccessToken(code, appSource)
  if (!tokenData?.accessToken) {
    console.error('获取用户访问令牌返回数据异常:', tokenData)
    return NextResponse.json(
      { success: false, message: '获取用户访问令牌失败：返回数据格式错误' },
      { status: 500 },
    )
  }

  console.log('获取用户访问令牌成功')
  const appAccessToken = await getAppAccessToken(appSource)
  console.log('获取应用访问令牌成功')

  const unionId = await getUnionId(tokenData.accessToken)
  console.log('获取unionId成功:', unionId)

  const userId = await getUserIdByUnionId(unionId, appAccessToken)
  console.log('获取userId成功:', userId)

  const userInfo = await getUserInfo(userId, appAccessToken)
  console.log('获取用户信息成功:', userInfo.name)

  return createOrUpdateUserSession(request, userId, userInfo)
}

export async function loginDingtalkUserByH5AuthCode(
  request: NextRequest,
  code: string,
  options?: { appSource?: DingtalkLoginAppSource },
) {
  console.log('开始钉钉H5免登流程')
  const appSource = options?.appSource || 'login'

  const appAccessToken = await getAppAccessToken(appSource)
  console.log('获取应用访问令牌成功')

  const userId = await getUserIdByH5AuthCode(code, appAccessToken)
  console.log('通过免登码获取userId成功:', userId)

  const userInfo = await getUserInfo(userId, appAccessToken)
  console.log('获取用户信息成功:', userInfo.name)

  return createOrUpdateUserSession(request, userId, userInfo, {
    cookieSameSite: 'none',
  })
}