using BoardApp.Session;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Negotiate;
using Microsoft.AspNetCore.Server.IISIntegration;
using Microsoft.Extensions.Logging;
using System.Security.Claims;

namespace BoardApp.Services;

/// <summary>
/// 在已通过 Windows / Negotiate 身份（HttpContext.User）后，做 LDAP 校验并写入 Board Session。
/// </summary>
public sealed class AdAuthenticationService
{
    private readonly LdapAuthService _ldap;
    private readonly ILogger<AdAuthenticationService> _log;

    public AdAuthenticationService(
        LdapAuthService ldap,
        ILogger<AdAuthenticationService> log)
    {
        _ldap = ldap;
        _log = log;
    }

    public sealed record AdLoginResult(bool Ok, string? Error, string? Redirect, string? Username);

    public static string? NormalizeWindowsIdentityName(string? raw)
    {
        var s = (raw ?? "").Trim();
        if (s.Length == 0) return null;
        var idx = s.IndexOf('\\');
        if (idx >= 0 && idx + 1 < s.Length) return s[(idx + 1)..];
        var at = s.IndexOf('@');
        if (at > 0) return s[..at];
        return s;
    }

    /// <summary>
    /// 从已认证的 Windows 主体解析 sAMAccountName（用于 LDAP 过滤 {{username}}）。
    /// 部分环境下 <see cref="IIdentity.Name"/> 为空，需读 WindowsAccountName / UPN 声明。
    /// </summary>
    public static string? TryGetWindowsSamAccountName(ClaimsPrincipal login)
    {
        if (login.Identity?.IsAuthenticated != true)
            return null;

        var fromId = NormalizeWindowsIdentityName(login.Identity?.Name);
        if (!string.IsNullOrWhiteSpace(fromId))
            return fromId;

        var winAcc = login.FindFirst(ClaimTypes.WindowsAccountName)?.Value;
        var fromWin = NormalizeWindowsIdentityName(winAcc);
        if (!string.IsNullOrWhiteSpace(fromWin))
            return fromWin;

        var upn = login.FindFirst(ClaimTypes.Upn)?.Value;
        return NormalizeWindowsIdentityName(upn);
    }

    /// <summary>
    /// 在 Kestrel 上通常只注册了 Negotiate，未注册 IIS scheme；
    /// 若直接调用 <see cref="AuthenticationHttpContextExtensions.AuthenticateAsync(HttpContext, string)"/> 会抛
    /// <see cref="InvalidOperationException"/>（无对应处理器），导致一键登录 HTTP 500。
    /// </summary>
    private static async Task<ClaimsPrincipal?> TryAuthenticateSchemeAsync(HttpContext httpContext, string scheme)
    {
        try
        {
            var r = await httpContext.AuthenticateAsync(scheme);
            if (r.Succeeded && r.Principal?.Identity?.IsAuthenticated == true)
                return r.Principal;
        }
        catch (InvalidOperationException)
        {
            // 未注册该认证 scheme（例如本机 Kestrel 无 IIS 集成处理器）
        }

        return null;
    }

    /// <summary>
    /// 依次尝试当前 User、IIS Windows、Negotiate。
    /// IIS / Kestrel 均可：未注册的 scheme 会被跳过，不会抛错。
    /// </summary>
    public static async Task<ClaimsPrincipal?> ResolveWindowsPrincipalAsync(
        HttpContext httpContext,
        ClaimsPrincipal? userFromContext)
    {
        if (userFromContext?.Identity?.IsAuthenticated == true)
            return userFromContext;

        var fromIis = await TryAuthenticateSchemeAsync(httpContext, IISDefaults.AuthenticationScheme);
        if (fromIis is not null)
            return fromIis;

        var fromNeg = await TryAuthenticateSchemeAsync(httpContext, NegotiateDefaults.AuthenticationScheme);
        if (fromNeg is not null)
            return fromNeg;

        return null;
    }

    /// <summary>
    /// login 为已通过认证主体（IIS Windows 或 Negotiate AuthenticateAsync 成功）。
    /// </summary>
    public async Task<AdLoginResult> AdLoginAsync(
        HttpContext httpContext,
        ClaimsPrincipal login,
        string? next,
        string pathBase)
    {
        if (login?.Identity?.IsAuthenticated != true)
        {
            return new AdLoginResult(false, "未通过 Windows 集成身份验证", null, null);
        }

        var winName = TryGetWindowsSamAccountName(login!);
        if (string.IsNullOrWhiteSpace(winName))
        {
            return new AdLoginResult(false, "无法解析域账号", null, null);
        }

        var appCfg = httpContext.Items["BoardAppConfig"] as Config.AppConfig;
        var skipAd = appCfg?.SkipLdapAuthForDebug == true;
        if (!skipAd)
        {
            var r = await _ldap.VerifyUserForIntegratedLogin(winName);
            if (!r.Ok)
            {
                var msg = r.Reason switch
                {
                    LdapAuthService.LdapVerifyFailReason.UserNotFound => "域账号在目录中不存在或无权访问",
                    LdapAuthService.LdapVerifyFailReason.NotInAllowedGroup => "该域账号不在允许访问的组内",
                    LdapAuthService.LdapVerifyFailReason.ConnectionError => "目录服务不可用，请稍后重试",
                    _ => "无法完成目录校验"
                };
                _log.LogWarning("Negotiate 用户 {User} LDAP 校验失败: {Reason}", winName, r.Reason);
                return new AdLoginResult(false, msg, null, null);
            }
        }

        httpContext.Session.SetJson("user", new SessionUser { Username = winName });
        await httpContext.Session.CommitAsync();

        var safeNext = string.IsNullOrWhiteSpace(next)
            ? pathBase + "/"
            : (next.StartsWith(pathBase + "/", StringComparison.Ordinal) && !next.Contains("//", StringComparison.Ordinal)
                ? next
                : pathBase + "/");

        return new AdLoginResult(true, null, safeNext, winName);
    }
}