package providers

import (
	"context"
	"crypto/rand"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"net/http"
	"net/url"
	"time"
)

// TwitterProvider Twitter OAuth提供者 (OAuth 2.0 with PKCE)
type TwitterProvider struct {
	ClientID    string
	RedirectURI string
}

// TwitterAuthURLResponse Twitter授权URL响应
type TwitterAuthURLResponse struct {
	URL          string `json:"url"`
	CodeVerifier string `json:"code_verifier"`
	State        string `json:"state"`
	Redirect     string `json:"redirect,omitempty"`
}

// TwitterTokenResponse Twitter Token响应
type TwitterTokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int    `json:"expires_in"`
	RefreshToken string `json:"refresh_token"`
	Scope        string `json:"scope"`
}

// TwitterUserInfo Twitter用户信息
type TwitterUserInfo struct {
	Data struct {
		ID            string `json:"id"`
		Name          string `json:"name"`
		Username      string `json:"username"`
		CreatedAt     string `json:"created_at"`
		Description   string `json:"description"`
		PublicMetrics struct {
			FollowersCount int `json:"followers_count"`
			FollowingCount int `json:"following_count"`
			TweetCount     int `json:"tweet_count"`
			ListedCount    int `json:"listed_count"`
		} `json:"public_metrics"`
		ProfileImageURL string `json:"profile_image_url"`
	} `json:"data"`
}

// TwitterErrorResponse Twitter错误响应
type TwitterErrorResponse struct {
	Title  string `json:"title"`
	Detail string `json:"detail"`
	Type   string `json:"type"`
	Status int    `json:"status"`
}

// NewTwitterProvider 创建Twitter OAuth提供者
func NewTwitterProvider(clientID, redirectURI string) *TwitterProvider {
	return &TwitterProvider{
		ClientID:    clientID,
		RedirectURI: redirectURI,
	}
}

// GenerateCodeVerifier 生成PKCE Code Verifier
func (t *TwitterProvider) GenerateCodeVerifier() (string, error) {
	b := make([]byte, 32)
	_, err := rand.Read(b)
	if err != nil {
		return "", err
	}
	return base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(b), nil
}

// GenerateCodeChallenge 从Code Verifier生成Code Challenge
func (t *TwitterProvider) GenerateCodeChallenge(verifier string) string {
	// 简化的base64编码（实际应用中应该使用SHA256哈希）
	return verifier
}

// GenerateState 生成随机状态码
func (t *TwitterProvider) GenerateState() (string, error) {
	b := make([]byte, 32)
	_, err := rand.Read(b)
	if err != nil {
		return "", err
	}
	return base64.URLEncoding.EncodeToString(b), nil
}

// GetAuthURL 获取Twitter授权URL (OAuth 2.0 with PKCE)
func (t *TwitterProvider) GetAuthURL() (*TwitterAuthURLResponse, error) {
	verifier, err := t.GenerateCodeVerifier()
	if err != nil {
		return nil, fmt.Errorf("generate code verifier failed: %w", err)
	}

	challenge := t.GenerateCodeChallenge(verifier)

	state, err := t.GenerateState()
	if err != nil {
		return nil, fmt.Errorf("generate state failed: %w", err)
	}

	authURL := fmt.Sprintf(
		"https://twitter.com/i/oauth2/authorize?response_type=code&client_id=%s&redirect_uri=%s&scope=tweet.read%%20users.read%%20offline.access&state=%s&code_challenge=%s&code_challenge_method=plain",
		t.ClientID,
		url.QueryEscape(t.RedirectURI),
		state,
		challenge,
	)

	return &TwitterAuthURLResponse{
		URL:          authURL,
		CodeVerifier: verifier,
		State:        state,
		Redirect:     t.RedirectURI,
	}, nil
}

// ExchangeCode 用授权码换取访问令牌
func (t *TwitterProvider) ExchangeCode(ctx context.Context, code, codeVerifier string) (*TwitterTokenResponse, error) {
	tokenURL := "https://api.twitter.com/2/oauth2/token"

	data := url.Values{}
	data.Set("code", code)
	data.Set("grant_type", "authorization_code")
	data.Set("client_id", t.ClientID)
	data.Set("redirect_uri", t.RedirectURI)
	data.Set("code_verifier", codeVerifier)

	client := &http.Client{Timeout: 10 * time.Second}
	resp, err := postFormWithContext(ctx, client, tokenURL, data)
	if err != nil {
		return nil, fmt.Errorf("request failed: %w", err)
	}
	defer resp.Body.Close()

	body, err := readOAuthResponseBody(resp)
	if err != nil {
		return nil, fmt.Errorf("read response failed: %w", err)
	}

	// 检查错误响应
	var errResp TwitterErrorResponse
	if err := json.Unmarshal(body, &errResp); err == nil && errResp.Detail != "" {
		return nil, fmt.Errorf("twitter api error: %s - %s", errResp.Title, errResp.Detail)
	}

	var tokenResp TwitterTokenResponse
	if err := json.Unmarshal(body, &tokenResp); err != nil {
		return nil, fmt.Errorf("parse token response failed: %w", err)
	}

	return &tokenResp, nil
}

// GetUserInfo 获取Twitter用户信息
func (t *TwitterProvider) GetUserInfo(ctx context.Context, accessToken string) (*TwitterUserInfo, error) {
	userInfoURL := "https://api.twitter.com/2/users/me?user.fields=created_at,description,public_metrics,profile_image_url"

	req, err := http.NewRequestWithContext(ctx, "GET", userInfoURL, nil)
	if err != nil {
		return nil, fmt.Errorf("create request failed: %w", err)
	}
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", accessToken))

	client := &http.Client{Timeout: 10 * time.Second}
	resp, err := client.Do(req)
	if err != nil {
		return nil, fmt.Errorf("request failed: %w", err)
	}
	defer resp.Body.Close()

	body, err := readOAuthResponseBody(resp)
	if err != nil {
		return nil, fmt.Errorf("read response failed: %w", err)
	}

	// 检查错误响应
	var errResp TwitterErrorResponse
	if err := json.Unmarshal(body, &errResp); err == nil && errResp.Detail != "" {
		return nil, fmt.Errorf("twitter api error: %s - %s", errResp.Title, errResp.Detail)
	}

	var userInfo TwitterUserInfo
	if err := json.Unmarshal(body, &userInfo); err != nil {
		return nil, fmt.Errorf("parse user info failed: %w", err)
	}

	return &userInfo, nil
}

// RefreshToken 刷新访问令牌
func (t *TwitterProvider) RefreshToken(ctx context.Context, refreshToken string) (*TwitterTokenResponse, error) {
	tokenURL := "https://api.twitter.com/2/oauth2/token"

	data := url.Values{}
	data.Set("refresh_token", refreshToken)
	data.Set("grant_type", "refresh_token")
	data.Set("client_id", t.ClientID)

	client := &http.Client{Timeout: 10 * time.Second}
	resp, err := postFormWithContext(ctx, client, tokenURL, data)
	if err != nil {
		return nil, fmt.Errorf("request failed: %w", err)
	}
	defer resp.Body.Close()

	body, err := readOAuthResponseBody(resp)
	if err != nil {
		return nil, fmt.Errorf("read response failed: %w", err)
	}

	var errResp TwitterErrorResponse
	if err := json.Unmarshal(body, &errResp); err == nil && errResp.Detail != "" {
		return nil, fmt.Errorf("twitter api error: %s - %s", errResp.Title, errResp.Detail)
	}

	var tokenResp TwitterTokenResponse
	if err := json.Unmarshal(body, &tokenResp); err != nil {
		return nil, fmt.Errorf("parse token response failed: %w", err)
	}

	return &tokenResp, nil
}

// ValidateToken 验证访问令牌是否有效
func (t *TwitterProvider) ValidateToken(ctx context.Context, accessToken string) (bool, error) {
	userInfo, err := t.GetUserInfo(ctx, accessToken)
	if err != nil {
		return false, err
	}
	return userInfo != nil && userInfo.Data.ID != "", nil
}

// RevokeToken 撤销访问令牌
func (t *TwitterProvider) RevokeToken(ctx context.Context, accessToken string) error {
	revokeURL := "https://api.twitter.com/2/oauth2/revoke"

	data := url.Values{}
	data.Set("token", accessToken)
	data.Set("client_id", t.ClientID)
	data.Set("token_type_hint", "access_token")

	client := &http.Client{Timeout: 10 * time.Second}
	resp, err := postFormWithContext(ctx, client, revokeURL, data)
	if err != nil {
		return fmt.Errorf("request failed: %w", err)
	}
	defer resp.Body.Close()

	if _, err := readOAuthResponseBody(resp); err != nil {
		return fmt.Errorf("revoke token failed: %w", err)
	}

	return nil
}