const express = require('express')
const router = express.Router()
const jwt = require('jsonwebtoken')
const { User, Admin, AdminLog, LoginLog, VerificationCode } = require('../models')
const ApiResponse = require('../utils/response')
const weChatService = require('../utils/weixin')
const logger = require('../utils/logger')
const { sendVerificationCode } = require('../utils/mail')
const axios = require('axios')

/**
 * 获取客户端IP
 */
const getClientIp = (req) => {
  return req.headers['x-forwarded-for'] ||
    req.headers['x-real-ip'] ||
    req.connection.remoteAddress ||
    req.socket.remoteAddress ||
    '0.0.0.0'
}

/**
 * 解析User-Agent
 */
const parseUserAgent = (userAgent) => {
  if (!userAgent) return { device: '', os: '', browser: '' }
  
  const device = /Mobile|Android|iPhone|iPad|iPod/i.test(userAgent) ? 'mobile' : 'desktop'
  
  let os = ''
  if (/Windows/i.test(userAgent)) os = 'Windows'
  else if (/Mac OS X/i.test(userAgent)) os = 'MacOS'
  else if (/Android/i.test(userAgent)) os = 'Android'
  else if (/iOS|iPhone|iPad|iPod/i.test(userAgent)) os = 'iOS'
  else if (/Linux/i.test(userAgent)) os = 'Linux'
  else os = 'Unknown'
  
  let browser = ''
  if (/MicroMessenger/i.test(userAgent)) browser = 'WeChat'
  else if (/Chrome/i.test(userAgent)) browser = 'Chrome'
  else if (/Safari/i.test(userAgent)) browser = 'Safari'
  else if (/Firefox/i.test(userAgent)) browser = 'Firefox'
  else if (/Edge/i.test(userAgent)) browser = 'Edge'
  else browser = 'Unknown'
  
  return { device, os, browser }
}

/**
 * 记录登录日志
 */
const recordLoginLog = async (userId, openid, type, method, source, req, success = true, failReason = '') => {
  try {
    const ip = getClientIp(req)
    const userAgent = req.headers['user-agent'] || ''
    const { device, os, browser } = parseUserAgent(userAgent)
    
    await LoginLog.create({
      userId,
      openid,
      type,
      method,
      source,
      ip,
      userAgent,
      device,
      os,
      browser,
      success,
      failReason
    })
  } catch (error) {
    logger.error('记录登录日志失败:', error)
  }
}

/**
 * 小程序登录
 * POST /api/auth/login
 */
router.post('/login', async (req, res) => {
  try {
    const { code, userInfo, source = 'miniapp' } = req.body
    
    // 方式1: 通过 code 登录（推荐）
    let openid = null
    if (code) {
      const sessionData = await weChatService.code2Session(code)
      openid = sessionData.openid
      req.body._sessionKey = sessionData.sessionKey || ''
    }
    
    // 方式2: 开发环境直接使用 openid (已废弃，仅用于本地调试)
    if (!openid && process.env.NODE_ENV === 'development' && req.body.openid) {
      openid = req.body.openid
    }
    
    if (!openid) {
      return ApiResponse.error(res, '无法获取用户标识', 400)
    }
    
    // 查找或创建用户
    let user = await User.findOne({ openid })
    let isNewUser = false
    
    if (!user) {
      // 新用户
      user = new User({
        openid,
        nickName: userInfo?.nickName || '星辰旅行者',
        avatarUrl: userInfo?.avatarUrl || '',
        unlockedDims: [1]
      })
      isNewUser = true
      logger.info(`新用户注册: ${openid}`)
    } else {
      // 老用户，更新登录时间
      user.lastLoginAt = new Date()
      if (userInfo?.nickName) user.nickName = userInfo.nickName
      if (userInfo?.avatarUrl) user.avatarUrl = userInfo.avatarUrl
    }
    if (req.body._sessionKey) user.sessionKey = req.body._sessionKey
    
    await user.save()
    
    // 记录登录日志
    await recordLoginLog(
      user._id,
      openid,
      isNewUser ? 'register' : 'login',
      'wechat_miniapp',
      source,
      req,
      true
    )
    
    // 生成 JWT token（可选，小程序通常不需要）
    const token = jwt.sign(
      { openid, userId: user._id },
      process.env.JWT_SECRET,
      { expiresIn: process.env.JWT_EXPIRE }
    )
    
    return ApiResponse.success(res, {
      token,
      openid,
      isNewUser,
      userInfo: {
        nickName: user.nickName,
        avatarUrl: user.avatarUrl
      },
      firstPlayDate: user.createdAt
    }, isNewUser ? '注册成功' : '登录成功')
    
  } catch (error) {
    // 空message的错误也要留下可诊断线索（微信侧errmsg/错误名）
    const detail = (error && (error.message || error.errmsg)) || (error && error.name) || '未知错误'
    logger.error('登录失败:', error, '| detail:', detail)
    return ApiResponse.error(res, detail ? `登录失败：${detail}` : '登录服务异常，请稍后再试', 500)
  }
})

/**
 * WebView 静默登录
 * POST /api/auth/webview-login
 * 用于微信小程序 webview 内嵌 H5 的自动登录
 */
router.post('/webview-login', async (req, res) => {
  try {
    const { code, userInfo } = req.body
    
    if (!code) {
      return ApiResponse.error(res, '缺少登录凭证', 400)
    }
    
    // 通过 code 获取 openid
    let openid = null
    try {
      const sessionData = await weChatService.code2Session(code)
      openid = sessionData.openid
    } catch (error) {
      logger.error('WebView登录获取session失败:', error)
      return ApiResponse.error(res, '登录凭证无效', 401)
    }
    
    if (!openid) {
      return ApiResponse.error(res, '无法获取用户标识', 400)
    }
    
    // 查找或创建用户
    let user = await User.findOne({ openid })
    let isNewUser = false
    
    if (!user) {
      // 新用户 - 使用微信提供的信息创建账户
      user = new User({
        openid,
        nickName: userInfo?.nickName || '星辰旅行者',
        avatarUrl: userInfo?.avatarUrl || '',
        unlockedDims: [1]
      })
      isNewUser = true
      logger.info(`WebView新用户注册: ${openid}`)
    } else {
      // 老用户，更新登录时间和信息
      user.lastLoginAt = new Date()
      if (userInfo?.nickName) user.nickName = userInfo.nickName
      if (userInfo?.avatarUrl) user.avatarUrl = userInfo.avatarUrl
      logger.info(`WebView老用户登录: ${openid}`)
    }
    
    await user.save()
    
    // 记录登录日志
    await recordLoginLog(
      user._id,
      openid,
      isNewUser ? 'register' : 'auto_login',
      'wechat_webview',
      'webview',
      req,
      true
    )
    
    // 生成 JWT token
    const token = jwt.sign(
      { openid, userId: user._id },
      process.env.JWT_SECRET,
      { expiresIn: process.env.JWT_EXPIRE }
    )
    
    return ApiResponse.success(res, {
      token,
      openid,
      isNewUser,
      userInfo: {
        nickName: user.nickName,
        avatarUrl: user.avatarUrl
      },
      firstPlayDate: user.createdAt
    }, isNewUser ? '注册成功' : '自动登录成功')
    
  } catch (error) {
    logger.error('WebView登录失败:', error)
    return ApiResponse.serverError(res, error.message)
  }
})

/**
 * 管理员登录
 * POST /api/auth/admin/login
 */
router.post('/admin/login', async (req, res) => {
  try {
    const { username, password } = req.body
    
    // 查找管理员
    const admin = await Admin.findOne({ username })
    if (!admin) {
      return ApiResponse.error(res, '用户名或密码错误', 401)
    }
    
    // 验证密码
    const isMatch = await admin.validatePassword(password)
    if (!isMatch) {
      return ApiResponse.error(res, '用户名或密码错误', 401)
    }
    
    // 检查状态
    if (admin.status !== 'active') {
      return ApiResponse.error(res, '账户已禁用', 403)
    }
    
    // 更新登录信息
    admin.lastLogin = new Date()
    admin.lastLoginIp = req.ip
    admin.loginCount += 1
    await admin.save()
    
    // 记录日志
    await AdminLog.create({
      adminId: admin._id,
      adminName: admin.username,
      action: 'login',
      resource: 'system',
      ip: req.ip,
      userAgent: req.get('User-Agent')
    })
    
    // 生成 JWT token
    const token = jwt.sign(
      { adminId: admin._id, role: admin.role },
      process.env.JWT_SECRET,
      { expiresIn: process.env.JWT_EXPIRE }
    )
    
    // 获取权限
    const permissions = Admin.getPermissionsByRole(admin.role)
    
    return ApiResponse.success(res, {
      token,
      adminId: admin._id,
      username: admin.username,
      role: admin.role,
      permissions
    }, '登录成功')
    
  } catch (error) {
    logger.error('管理员登录失败:', error)
    return ApiResponse.serverError(res, error.message)
  }
})

/**
 * H5环境用户名密码登录
 * POST /api/auth/user/login
 */
router.post('/user/login', async (req, res) => {
  try {
    const { username, email, password } = req.body
    // 支持邮箱或用户名登录
    const identifier = email || username
    
    // 查找用户（显式包含密码字段）
    const user = await User.findOne({
      $or: [
        { email: identifier },
        { username: identifier }
      ]
    }).select('+password')
    if (!user) {
      return ApiResponse.error(res, '用户名或密码错误', 401)
    }
    
    // 验证密码
    const isMatch = await user.validatePassword(password)
    if (!isMatch) {
      return ApiResponse.error(res, '用户名或密码错误', 401)
    }
    
    // 更新登录时间
    user.lastLoginAt = new Date()
    await user.save()
    
    // 生成 JWT token
    const token = jwt.sign(
      { userId: user._id, openid: user.openid },
      process.env.JWT_SECRET,
      { expiresIn: process.env.JWT_EXPIRE }
    )
    
    return ApiResponse.success(res, {
      token,
      userId: user._id,
      openid: user.openid,
      userInfo: {
        nickName: user.nickName,
        avatarUrl: user.avatarUrl
      },
      firstPlayDate: user.createdAt
    }, '登录成功')
    
  } catch (error) {
      logger.error('用户登录失败:', error)
      return ApiResponse.serverError(res, error.message)
    }
  })

  /**
   * 发送邮箱验证码
   * POST /api/auth/user/send-code
   */
  router.post('/user/send-code', async (req, res) => {
    try {
      const { email } = req.body
      if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
        return ApiResponse.error(res, '邮箱格式不正确', 400)
      }

      // 检查邮箱是否已被注册
      const existing = await User.findOne({ email })
      if (existing) {
        return ApiResponse.error(res, '该邮箱已被注册', 400)
      }

      // 检查发送频率（1分钟内只能发一次）
      const recent = await VerificationCode.findOne({
        email,
        createdAt: { $gte: new Date(Date.now() - 60000) }
      })
      if (recent) {
        return ApiResponse.error(res, '发送过于频繁，请 1 分钟后再试', 429)
      }

      // 生成6位随机验证码
      const code = String(Math.floor(100000 + Math.random() * 900000))

      // 10分钟过期
      const expiresAt = new Date(Date.now() + 10 * 60 * 1000)

      // 使之前的验证码失效
      await VerificationCode.updateMany({ email, used: false }, { $set: { used: true } })

      // 保存新验证码
      await VerificationCode.create({ email, code, expiresAt })

      // 发送邮件
      const result = await sendVerificationCode(email, code)

      if (result.success) {
        return ApiResponse.success(res, {
          devCode: result.devCode || undefined
        }, '验证码已发送')
      } else {
        return ApiResponse.error(res, '验证码发送失败，请稍后重试', 500)
      }
    } catch (error) {
      logger.error('发送验证码失败:', error)
      return ApiResponse.serverError(res, error.message)
    }
  })

  /**
   * H5环境用户注册（需邮箱验证码）
   * POST /api/auth/user/register
   */
router.post('/user/register', async (req, res) => {
  try {
    const { username, email, password, nickName, avatarUrl, verifyCode } = req.body
    const identifier = email || username
    
    if (!identifier) {
      return ApiResponse.error(res, '请输入邮箱或用户名', 400)
    }
    
    if (!email) {
      return ApiResponse.error(res, '邮箱为必填项', 400)
    }
    
    // 验证邮箱验证码
    if (!verifyCode) {
      return ApiResponse.error(res, '请输入邮箱验证码', 400)
    }
    const validCode = await VerificationCode.findOne({
      email,
      code: verifyCode,
      used: false,
      expiresAt: { $gt: new Date() }
    })
    if (!validCode) {
      return ApiResponse.error(res, '验证码无效或已过期', 400)
    }
    
    // 检查邮箱是否已存在
    if (email) {
      const existingEmail = await User.findOne({ email })
      if (existingEmail) {
        return ApiResponse.error(res, '该邮箱已被注册', 400)
      }
    }
    
    // 检查用户名是否已存在
    if (username) {
      const existingUser = await User.findOne({ username })
      if (existingUser) {
        return ApiResponse.error(res, '用户名已存在', 400)
      }
    }
    
    // 标记验证码为已使用
    validCode.used = true
    await validCode.save()
    
    // 自动生成用户名（若未提供）
    const finalUsername = username || email.split('@')[0]
    
    // 创建新用户
    const user = new User({
      username: finalUsername,
      email: email || '',
      password,
      nickName: nickName || '星辰旅行者',
      avatarUrl: avatarUrl || '',
      unlockedDims: [1]
    })
    await user.save()
    
    logger.info(`新用户注册: ${username}`)
    
    // 生成 JWT token
    const token = jwt.sign(
      { userId: user._id },
      process.env.JWT_SECRET,
      { expiresIn: process.env.JWT_EXPIRE }
    )
    
    return ApiResponse.success(res, {
      token,
      userId: user._id,
      userInfo: {
        nickName: user.nickName,
        avatarUrl: user.avatarUrl
      }
    }, '注册成功')
    
  } catch (error) {
    logger.error('用户注册失败:', error)
    return ApiResponse.serverError(res, error.message)
  }
})

/**
 * 获取当前用户信息
 * GET /api/auth/me
 */
router.get('/me', async (req, res) => {
  try {
    const token = req.header('Authorization')?.replace('Bearer ', '')
    
    if (!token) {
      return ApiResponse.unauthorized(res)
    }
    
    const decoded = jwt.verify(token, process.env.JWT_SECRET)
    const user = await User.findById(decoded.userId)

    if (!user) {
      return ApiResponse.notFound(res, '用户不存在')
    }

    return ApiResponse.success(res, user)

  } catch (error) {
    if (error.name === 'JsonWebTokenError' || error.name === 'TokenExpiredError') {
      return ApiResponse.unauthorized(res, '认证令牌无效或已过期')
    }
    logger.error('获取用户信息失败:', error)
    return ApiResponse.serverError(res, error.message)
  }
})

/**
 * WebView Token 交换接口
 * POST /api/auth/webview-token
 * 用于小程序 WebView 内嵌 H5 时，通过 openid 获取登录 token
 * 小程序在 URL 中传递 openid，H5 用这个接口换取 token
 */
router.post('/webview-token', async (req, res) => {
  try {
    const { openid } = req.body
    
    if (!openid) {
      return ApiResponse.error(res, '缺少用户标识', 400)
    }
    
    // 查找用户
    const user = await User.findOne({ openid })
    
    if (!user) {
      return ApiResponse.error(res, '用户不存在', 404)
    }
    
    // 生成新的 JWT token
    const token = jwt.sign(
      { openid, userId: user._id },
      process.env.JWT_SECRET,
      { expiresIn: process.env.JWT_EXPIRE }
    )
    
    // 更新最后登录时间
    user.lastLoginAt = new Date()
    await user.save()
    
    // 记录登录日志
    await recordLoginLog(
      user._id,
      openid,
      'auto_login',
      'wechat_webview',
      'webview_h5',
      req,
      true
    )
    
    logger.info(`WebView Token交换成功: ${openid}`)
    
    return ApiResponse.success(res, {
      token,
      openid,
      userInfo: {
        nickName: user.nickName,
        avatarUrl: user.avatarUrl
      }
    }, '登录成功')
    
  } catch (error) {
    logger.error('WebView Token交换失败:', error)
    return ApiResponse.serverError(res, error.message)
  }
})

module.exports = router