package app

import (
	"context"
	"crypto/sha256"
	"database/sql"
	"encoding/base64"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"strconv"
	"strings"
	"time"
)

const (
	adminOAuthStateTTL = 10 * time.Minute
	adminOAuthCodeTTL  = 5 * time.Minute
	adminOAuthBodyMax  = 1 << 20
)

var adminOAuthProviderNames = map[string]string{
	"wechat": "微信",
	"qq":     "QQ",
	"github": "GitHub",
	"google": "Google",
}

var adminOAuthAllowedHosts = map[string]map[string]bool{
	"wechat": {"open.weixin.qq.com": true, "api.weixin.qq.com": true},
	"qq":     {"graph.qq.com": true},
	"github": {"github.com": true, "api.github.com": true},
	"google": {"accounts.google.com": true, "oauth2.googleapis.com": true, "openidconnect.googleapis.com": true},
}

type adminOAuthProvider struct {
	Code             string
	Name             string
	ClientID         string
	ClientSecret     string
	AuthorizationURL string
	TokenURL         string
	OpenIDURL        string
	UserInfoURL      string
	Scope            string
	RedirectURI      string
}

type adminOAuthIdentity struct {
	Subject     string
	Email       string
	DisplayName string
	AvatarURL   string
}

type adminOAuthLoginCode struct {
	Provider    string
	Subject     string
	Email       string
	DisplayName string
	AvatarURL   string
	AdminUserID sql.NullInt64
}

func oauthHash(value string) []byte {
	hash := sha256.Sum256([]byte(value))
	return hash[:]
}

func pkceChallenge(verifier string) string {
	hash := sha256.Sum256([]byte(verifier))
	return base64.RawURLEncoding.EncodeToString(hash[:])
}

func (a *App) adminOAuthProvider(ctx context.Context, code string) (adminOAuthProvider, error) {
	name, ok := adminOAuthProviderNames[code]
	if !ok {
		return adminOAuthProvider{}, errors.New("不支持的第三方登录渠道")
	}
	prefix := "oauth." + code + "."
	provider := adminOAuthProvider{
		Code:             code,
		Name:             name,
		ClientID:         strings.TrimSpace(a.configPlain(ctx, prefix+"client_id", "")),
		ClientSecret:     strings.TrimSpace(a.configPlain(ctx, prefix+"client_secret", "")),
		AuthorizationURL: strings.TrimSpace(a.configPlain(ctx, prefix+"authorization_url", "")),
		TokenURL:         strings.TrimSpace(a.configPlain(ctx, prefix+"token_url", "")),
		OpenIDURL:        strings.TrimSpace(a.configPlain(ctx, prefix+"openid_url", "")),
		UserInfoURL:      strings.TrimSpace(a.configPlain(ctx, prefix+"userinfo_url", "")),
		Scope:            strings.TrimSpace(a.configPlain(ctx, prefix+"scope", "")),
		RedirectURI:      strings.TrimSpace(a.configPlain(ctx, prefix+"redirect_uri", "")),
	}
	if provider.ClientID == "" || provider.ClientSecret == "" || provider.AuthorizationURL == "" || provider.TokenURL == "" || provider.UserInfoURL == "" || provider.Scope == "" || provider.RedirectURI == "" {
		return adminOAuthProvider{}, fmt.Errorf("%s登录配置不完整", name)
	}
	if code == "qq" && provider.OpenIDURL == "" {
		return adminOAuthProvider{}, errors.New("QQ 登录 OpenID 地址未配置")
	}
	for label, raw := range map[string]string{
		"授权地址":   provider.AuthorizationURL,
		"令牌地址":   provider.TokenURL,
		"用户信息地址": provider.UserInfoURL,
	} {
		if err := validateAdminOAuthEndpoint(code, raw); err != nil {
			return adminOAuthProvider{}, fmt.Errorf("%s%s无效：%w", name, label, err)
		}
	}
	if provider.OpenIDURL != "" {
		if err := validateAdminOAuthEndpoint(code, provider.OpenIDURL); err != nil {
			return adminOAuthProvider{}, fmt.Errorf("%s OpenID 地址无效：%w", name, err)
		}
	}
	if err := a.validateAdminOAuthRedirectURL(provider.RedirectURI); err != nil {
		return adminOAuthProvider{}, fmt.Errorf("%s回调地址无效：%w", name, err)
	}
	return provider, nil
}

func validateAdminOAuthEndpoint(provider, raw string) error {
	parsed, err := url.Parse(raw)
	if err != nil || parsed.Scheme != "https" || parsed.Hostname() == "" || parsed.User != nil {
		return errors.New("必须是合法的 HTTPS 地址")
	}
	if !adminOAuthAllowedHosts[provider][strings.ToLower(parsed.Hostname())] {
		return errors.New("域名不在该渠道的官方白名单内")
	}
	if port := parsed.Port(); port != "" && port != "443" {
		return errors.New("仅允许使用标准 HTTPS 端口")
	}
	return nil
}

func (a *App) validateAdminOAuthRedirectURL(raw string) error {
	parsed, err := url.Parse(raw)
	if err != nil || parsed.Hostname() == "" || parsed.User != nil || (parsed.Scheme != "https" && parsed.Scheme != "http") {
		return errors.New("必须是合法的 HTTP(S) 地址")
	}
	if parsed.Scheme == "http" {
		host := strings.ToLower(parsed.Hostname())
		if a.config.Environment == "production" || (host != "localhost" && host != "127.0.0.1" && host != "::1") {
			return errors.New("仅本地开发允许 HTTP，生产环境必须使用 HTTPS")
		}
	}
	return nil
}

func (a *App) adminOAuthFrontendURL(ctx context.Context) (string, error) {
	raw := strings.TrimSpace(a.configPlain(ctx, "oauth.admin.frontend_callback_url", ""))
	if raw == "" {
		return "", errors.New("管理端登录结果页未配置")
	}
	if err := a.validateAdminOAuthRedirectURL(raw); err != nil {
		return "", fmt.Errorf("管理端登录结果页无效：%w", err)
	}
	return raw, nil
}

func (a *App) enabledAdminOAuthProviders(ctx context.Context) ([]adminOAuthProvider, error) {
	providers := make([]adminOAuthProvider, 0, len(adminOAuthProviderNames))
	for _, code := range []string{"wechat", "qq", "github", "google"} {
		if !a.configBool(ctx, "oauth."+code+".enabled", false) {
			continue
		}
		provider, err := a.adminOAuthProvider(ctx, code)
		if err != nil {
			return nil, err
		}
		providers = append(providers, provider)
	}
	return providers, nil
}

func (a *App) oauthConfigurationReady(ctx context.Context) bool {
	adminProviders, err := a.enabledAdminOAuthProviders(ctx)
	if err != nil {
		return false
	}
	userProviders, err := a.enabledUserOAuthProviders(ctx)
	if err != nil {
		return false
	}
	if len(adminProviders) > 0 {
		if _, err := a.adminOAuthFrontendURL(ctx); err != nil {
			return false
		}
	}
	if len(userProviders) > 0 {
		if _, err := a.userOAuthFrontendURL(ctx); err != nil {
			return false
		}
	}
	_, err = a.enabledAppOAuthProviders(ctx)
	return err == nil
}

func (a *App) validateAdminOAuthConfigValues(ctx context.Context, values map[string]string, clearSecrets map[string]bool) error {
	value := func(key string) string {
		if clearSecrets[key] {
			return ""
		}
		if candidate, exists := values[key]; exists {
			if candidate != "" || !strings.HasSuffix(key, "client_secret") {
				return strings.TrimSpace(candidate)
			}
		}
		return strings.TrimSpace(a.configPlain(ctx, key, ""))
	}
	for _, client := range []struct{ prefix, callback, name string }{
		{"oauth.", "oauth.admin.frontend_callback_url", "管理端"},
		{"oauth.user.", "oauth.user.frontend_callback_url", "H5"},
	} {
		for _, code := range []string{"wechat", "qq", "github", "google"} {
			if value(client.prefix+code+".enabled") == "true" {
				if err := a.validateAdminOAuthRedirectURL(value(client.callback)); err != nil {
					return fmt.Errorf("%s 登录结果页无效：%w", client.name, err)
				}
				break
			}
		}
	}
	for _, code := range []string{"wechat", "qq", "github", "google"} {
		adminEnabled := strings.ToLower(value("oauth."+code+".enabled")) == "true"
		userEnabled := strings.ToLower(value("oauth.user."+code+".enabled")) == "true"
		appEnabled := value("oauth.app."+code+".enabled") == "true"
		if appEnabled {
			if code == "github" {
				if value("oauth.app.frontend_callback_url") != appOAuthCallbackURL {
					return errors.New("App 回调地址必须为 " + appOAuthCallbackURL)
				}
			} else if err := validateNativeOAuthConfig(code, value); err != nil {
				return err
			}
		}
		if !adminEnabled && !userEnabled && !(appEnabled && code == "github") {
			continue
		}
		prefix := "oauth." + code + "."
		required := []string{"client_id", "client_secret", "authorization_url", "token_url", "userinfo_url", "scope", "redirect_uri"}
		if code == "qq" {
			required = append(required, "openid_url")
		}
		for _, suffix := range required {
			if value(prefix+suffix) == "" {
				return fmt.Errorf("%s登录的%s不能为空", adminOAuthProviderNames[code], suffix)
			}
		}
		for label, raw := range map[string]string{
			"授权地址":   value(prefix + "authorization_url"),
			"令牌地址":   value(prefix + "token_url"),
			"用户信息地址": value(prefix + "userinfo_url"),
		} {
			if err := validateAdminOAuthEndpoint(code, raw); err != nil {
				return fmt.Errorf("%s%s无效：%w", adminOAuthProviderNames[code], label, err)
			}
		}
		if code == "qq" {
			if err := validateAdminOAuthEndpoint(code, value(prefix+"openid_url")); err != nil {
				return fmt.Errorf("QQ OpenID 地址无效：%w", err)
			}
		}
		if err := a.validateAdminOAuthRedirectURL(value(prefix + "redirect_uri")); err != nil {
			return fmt.Errorf("%s回调地址无效：%w", adminOAuthProviderNames[code], err)
		}
	}
	return nil
}

func (a *App) adminOAuthProviders(w http.ResponseWriter, r *http.Request) {
	items := make([]map[string]string, 0, len(adminOAuthProviderNames))
	for _, code := range []string{"wechat", "qq", "github", "google"} {
		if !a.configBool(r.Context(), "oauth."+code+".enabled", false) {
			continue
		}
		provider, err := a.adminOAuthProvider(r.Context(), code)
		if err != nil {
			// A broken channel must not hide other correctly configured channels.
			continue
		}
		items = append(items, map[string]string{"code": provider.Code, "name": provider.Name})
	}
	reply(w, map[string]any{"items": items})
}

func (a *App) adminOAuthStart(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Provider string `json:"provider"`
	}
	if decode(r, &req) != nil {
		fail(w, http.StatusBadRequest, 20001, "请选择第三方登录渠道")
		return
	}
	req.Provider = strings.ToLower(strings.TrimSpace(req.Provider))
	if !a.rateLimit(w, r, "admin_oauth_start", clientIP(r), 30, 10*time.Minute) {
		return
	}
	if !a.configBool(r.Context(), "oauth."+req.Provider+".enabled", false) {
		fail(w, http.StatusBadRequest, 20001, "该登录方式未启用")
		return
	}
	provider, err := a.adminOAuthProvider(r.Context(), req.Provider)
	if err != nil {
		fail(w, http.StatusBadRequest, 20001, "该登录方式配置不完整")
		return
	}
	state := randomToken()
	verifier := ""
	if provider.Code == "github" || provider.Code == "google" {
		verifier = randomToken() + randomToken()
	}
	_, err = a.db.ExecContext(r.Context(), `INSERT INTO admin_oauth_states(state_hash,provider,code_verifier,expires_at) VALUES(?,?,?,?)`, oauthHash(state), provider.Code, verifier, time.Now().Add(adminOAuthStateTTL))
	if err != nil {
		fail(w, http.StatusInternalServerError, 50001, "创建第三方登录请求失败")
		return
	}
	a.cleanupAdminOAuthRecords(r.Context())

	authorizationURL, _ := url.Parse(provider.AuthorizationURL)
	query := authorizationURL.Query()
	if provider.Code == "wechat" {
		query.Set("appid", provider.ClientID)
	} else {
		query.Set("client_id", provider.ClientID)
	}
	query.Set("redirect_uri", provider.RedirectURI)
	query.Set("response_type", "code")
	query.Set("scope", provider.Scope)
	query.Set("state", state)
	if verifier != "" {
		query.Set("code_challenge", pkceChallenge(verifier))
		query.Set("code_challenge_method", "S256")
	}
	authorizationURL.RawQuery = query.Encode()
	if provider.Code == "wechat" {
		authorizationURL.Fragment = "wechat_redirect"
	}
	reply(w, map[string]string{"authorizationUrl": authorizationURL.String(), "provider": provider.Code})
}

func (a *App) adminOAuthCallback(w http.ResponseWriter, r *http.Request) {
	frontendURL, frontendErr := a.adminOAuthFrontendURL(r.Context())
	if frontendErr != nil {
		fail(w, http.StatusServiceUnavailable, 50001, "第三方登录回调未配置")
		return
	}
	state := strings.TrimSpace(r.URL.Query().Get("state"))
	if state == "" {
		a.redirectAdminOAuthResult(w, r, frontendURL, "", "登录状态无效或已过期")
		return
	}
	var providerCode, verifier string
	err := a.db.QueryRowContext(r.Context(), `SELECT provider,code_verifier FROM admin_oauth_states WHERE state_hash=? AND used_at IS NULL AND expires_at>NOW(3)`, oauthHash(state)).Scan(&providerCode, &verifier)
	if err != nil {
		a.redirectAdminOAuthResult(w, r, frontendURL, "", "登录状态无效或已过期")
		return
	}
	result, err := a.db.ExecContext(r.Context(), `UPDATE admin_oauth_states SET used_at=NOW(3) WHERE state_hash=? AND used_at IS NULL AND expires_at>NOW(3)`, oauthHash(state))
	if err != nil {
		a.redirectAdminOAuthResult(w, r, frontendURL, "", "第三方登录处理失败")
		return
	}
	affected, _ := result.RowsAffected()
	if affected != 1 {
		a.redirectAdminOAuthResult(w, r, frontendURL, "", "登录状态已被使用")
		return
	}
	if providerError := strings.TrimSpace(r.URL.Query().Get("error")); providerError != "" {
		a.redirectAdminOAuthResult(w, r, frontendURL, "", "第三方授权已取消或失败")
		return
	}
	code := strings.TrimSpace(r.URL.Query().Get("code"))
	if code == "" {
		a.redirectAdminOAuthResult(w, r, frontendURL, "", "第三方平台未返回授权码")
		return
	}
	if !a.configBool(r.Context(), "oauth."+providerCode+".enabled", false) {
		a.redirectAdminOAuthResult(w, r, frontendURL, "", "该登录方式已停用")
		return
	}
	provider, err := a.adminOAuthProvider(r.Context(), providerCode)
	if err != nil {
		a.redirectAdminOAuthResult(w, r, frontendURL, "", "该登录方式配置不可用")
		return
	}
	identity, err := a.fetchAdminOAuthIdentity(r.Context(), provider, code, verifier)
	if err != nil {
		a.redirectAdminOAuthResult(w, r, frontendURL, "", "获取第三方账号信息失败")
		return
	}
	var adminUserID sql.NullInt64
	_ = a.db.QueryRowContext(r.Context(), `SELECT admin_user_id FROM admin_oauth_identities WHERE provider=? AND subject=?`, provider.Code, identity.Subject).Scan(&adminUserID)
	loginCode := randomToken()
	_, err = a.db.ExecContext(r.Context(), `INSERT INTO admin_oauth_login_codes(code_hash,provider,subject,email,display_name,avatar_url,admin_user_id,expires_at) VALUES(?,?,?,?,?,?,?,?)`, oauthHash(loginCode), provider.Code, identity.Subject, identity.Email, identity.DisplayName, identity.AvatarURL, adminUserID, time.Now().Add(adminOAuthCodeTTL))
	if err != nil {
		a.redirectAdminOAuthResult(w, r, frontendURL, "", "创建登录凭证失败")
		return
	}
	a.redirectAdminOAuthResult(w, r, frontendURL, loginCode, "")
}

func (a *App) redirectAdminOAuthResult(w http.ResponseWriter, r *http.Request, frontendURL, code, message string) {
	target, err := url.Parse(frontendURL)
	if err != nil {
		fail(w, http.StatusInternalServerError, 50001, "登录结果页地址无效")
		return
	}
	query := target.Query()
	if code != "" {
		query.Set("oauthCode", code)
	} else {
		query.Set("oauthError", message)
	}
	target.RawQuery = query.Encode()
	http.Redirect(w, r, target.String(), http.StatusFound)
}

func (a *App) adminOAuthExchange(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Code string `json:"code"`
	}
	if decode(r, &req) != nil || strings.TrimSpace(req.Code) == "" {
		fail(w, http.StatusBadRequest, 20001, "第三方登录凭证无效")
		return
	}
	if !a.rateLimit(w, r, "admin_oauth_exchange", clientIP(r), 20, 10*time.Minute) {
		return
	}
	loginCode, err := a.readAdminOAuthLoginCode(r.Context(), strings.TrimSpace(req.Code), false)
	if err != nil {
		fail(w, http.StatusBadRequest, 20001, "第三方登录凭证无效或已过期")
		return
	}
	if !loginCode.AdminUserID.Valid {
		reply(w, map[string]any{
			"requiresLink": true,
			"provider":     loginCode.Provider,
			"providerName": adminOAuthProviderNames[loginCode.Provider],
			"displayName":  loginCode.DisplayName,
			"email":        loginCode.Email,
			"avatarUrl":    loginCode.AvatarURL,
		})
		return
	}
	adminID, realName, err := a.consumeAdminOAuthCode(r.Context(), strings.TrimSpace(req.Code), loginCode.AdminUserID.Int64)
	if err != nil {
		fail(w, http.StatusUnauthorized, 10001, err.Error())
		return
	}
	payload, err := a.newAdminSession(r.Context(), w, r, adminID, realName)
	if err != nil {
		fail(w, http.StatusInternalServerError, 50001, "创建管理会话失败")
		return
	}
	payload["requiresLink"] = false
	reply(w, payload)
}

func (a *App) adminOAuthLink(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Code     string `json:"code"`
		Username string `json:"username"`
		Password string `json:"password"`
	}
	if decode(r, &req) != nil || strings.TrimSpace(req.Code) == "" || strings.TrimSpace(req.Username) == "" || req.Password == "" {
		fail(w, http.StatusBadRequest, 20001, "请输入管理员账号和密码完成绑定")
		return
	}
	username := strings.TrimSpace(req.Username)
	if !a.rateLimit(w, r, "admin_oauth_link_ip", clientIP(r), 10, 15*time.Minute) || !a.rateLimit(w, r, "admin_oauth_link_user", strings.ToLower(username), 10, 15*time.Minute) {
		return
	}
	loginCode, err := a.readAdminOAuthLoginCode(r.Context(), strings.TrimSpace(req.Code), true)
	if err != nil {
		fail(w, http.StatusBadRequest, 20001, "第三方登录凭证无效或已过期")
		return
	}
	var adminID int64
	var passwordHash, realName string
	var status int
	err = a.db.QueryRowContext(r.Context(), `SELECT id,password_hash,real_name,status FROM admin_users WHERE username=?`, username).Scan(&adminID, &passwordHash, &realName, &status)
	if err != nil || !checkPassword(passwordHash, req.Password) {
		// 这里返回 400，避免前端全局 401 拦截器丢弃尚可重试的一次性绑定码。
		fail(w, http.StatusBadRequest, 10001, "管理员账号或密码错误")
		return
	}
	if status != 1 {
		fail(w, http.StatusForbidden, 10006, "管理员账号已停用")
		return
	}
	tx, err := a.db.BeginTx(r.Context(), &sql.TxOptions{Isolation: sql.LevelReadCommitted})
	if err != nil {
		fail(w, http.StatusInternalServerError, 50001, "绑定第三方账号失败")
		return
	}
	defer func() { _ = tx.Rollback() }()
	result, err := tx.ExecContext(r.Context(), `UPDATE admin_oauth_login_codes SET used_at=NOW(3),admin_user_id=? WHERE code_hash=? AND used_at IS NULL AND expires_at>NOW(3)`, adminID, oauthHash(strings.TrimSpace(req.Code)))
	if err != nil {
		fail(w, http.StatusInternalServerError, 50001, "绑定第三方账号失败")
		return
	}
	affected, _ := result.RowsAffected()
	if affected != 1 {
		fail(w, http.StatusBadRequest, 20001, "第三方登录凭证已被使用")
		return
	}
	_, err = tx.ExecContext(r.Context(), `INSERT INTO admin_oauth_identities(provider,subject,admin_user_id,email,display_name,avatar_url,last_login_at) VALUES(?,?,?,?,?,?,NOW(3))`, loginCode.Provider, loginCode.Subject, adminID, loginCode.Email, loginCode.DisplayName, loginCode.AvatarURL)
	if err != nil {
		fail(w, http.StatusConflict, 20001, "该第三方账号或管理员账号已绑定此渠道")
		return
	}
	if _, err = tx.ExecContext(r.Context(), `UPDATE admin_users SET last_login_at=NOW(3) WHERE id=?`, adminID); err != nil {
		fail(w, http.StatusInternalServerError, 50001, "绑定第三方账号失败")
		return
	}
	if err = tx.Commit(); err != nil {
		fail(w, http.StatusInternalServerError, 50001, "绑定第三方账号失败")
		return
	}
	auditPayload, _ := json.Marshal(map[string]any{"provider": loginCode.Provider, "externalSubjectHash": fmt.Sprintf("%x", sha256.Sum256([]byte(loginCode.Subject)))})
	_, _ = a.db.ExecContext(r.Context(), `INSERT INTO admin_audit_logs(admin_user_id,action,target_type,target_id,request_data,ip) VALUES(?,?,?,?,?,?)`, adminID, "bind_oauth_identity", "admin_user", adminID, auditPayload, clientIP(r))
	payload, err := a.newAdminSession(r.Context(), w, r, adminID, realName)
	if err != nil {
		fail(w, http.StatusInternalServerError, 50001, "创建管理会话失败")
		return
	}
	payload["requiresLink"] = false
	reply(w, payload)
}

func (a *App) readAdminOAuthLoginCode(ctx context.Context, code string, requireUnlinked bool) (adminOAuthLoginCode, error) {
	var result adminOAuthLoginCode
	query := `SELECT provider,subject,email,display_name,avatar_url,admin_user_id FROM admin_oauth_login_codes WHERE code_hash=? AND used_at IS NULL AND expires_at>NOW(3)`
	if requireUnlinked {
		query += ` AND admin_user_id IS NULL`
	}
	err := a.db.QueryRowContext(ctx, query, oauthHash(code)).Scan(&result.Provider, &result.Subject, &result.Email, &result.DisplayName, &result.AvatarURL, &result.AdminUserID)
	return result, err
}

func (a *App) consumeAdminOAuthCode(ctx context.Context, code string, adminID int64) (int64, string, error) {
	var realName string
	var status int
	if err := a.db.QueryRowContext(ctx, `SELECT real_name,status FROM admin_users WHERE id=?`, adminID).Scan(&realName, &status); err != nil || status != 1 {
		return 0, "", errors.New("管理员账号不存在或已停用")
	}
	result, err := a.db.ExecContext(ctx, `UPDATE admin_oauth_login_codes SET used_at=NOW(3) WHERE code_hash=? AND admin_user_id=? AND used_at IS NULL AND expires_at>NOW(3)`, oauthHash(code), adminID)
	if err != nil {
		return 0, "", errors.New("第三方登录处理失败")
	}
	affected, _ := result.RowsAffected()
	if affected != 1 {
		return 0, "", errors.New("第三方登录凭证无效或已使用")
	}
	_, _ = a.db.ExecContext(ctx, `UPDATE admin_users SET last_login_at=NOW(3) WHERE id=?`, adminID)
	_, _ = a.db.ExecContext(ctx, `UPDATE admin_oauth_identities SET last_login_at=NOW(3) WHERE admin_user_id=?`, adminID)
	return adminID, realName, nil
}

func (a *App) cleanupAdminOAuthRecords(ctx context.Context) {
	_, _ = a.db.ExecContext(ctx, `DELETE FROM admin_oauth_states WHERE expires_at<DATE_SUB(NOW(3),INTERVAL 1 DAY) LIMIT 500`)
	_, _ = a.db.ExecContext(ctx, `DELETE FROM admin_oauth_login_codes WHERE expires_at<DATE_SUB(NOW(3),INTERVAL 1 DAY) LIMIT 500`)
}

func (a *App) oauthHTTPClient() *http.Client {
	return &http.Client{
		Timeout: 8 * time.Second,
		CheckRedirect: func(req *http.Request, via []*http.Request) error {
			// Token/UserInfo endpoints are fixed official endpoints and must not
			// redirect credentials or bearer tokens to another host.
			return http.ErrUseLastResponse
		},
	}
}

func (a *App) fetchAdminOAuthIdentity(ctx context.Context, provider adminOAuthProvider, code, verifier string) (adminOAuthIdentity, error) {
	accessToken, tokenOpenID, err := a.exchangeAdminOAuthToken(ctx, provider, code, verifier)
	if err != nil {
		return adminOAuthIdentity{}, err
	}
	switch provider.Code {
	case "github":
		var payload struct {
			ID        int64  `json:"id"`
			Login     string `json:"login"`
			Name      string `json:"name"`
			Email     string `json:"email"`
			AvatarURL string `json:"avatar_url"`
		}
		if err = a.oauthBearerJSON(ctx, provider.UserInfoURL, accessToken, &payload); err != nil || payload.ID <= 0 {
			return adminOAuthIdentity{}, errors.New("GitHub 用户信息无效")
		}
		displayName := strings.TrimSpace(payload.Name)
		if displayName == "" {
			displayName = payload.Login
		}
		return adminOAuthIdentity{Subject: strconv.FormatInt(payload.ID, 10), Email: payload.Email, DisplayName: displayName, AvatarURL: payload.AvatarURL}, nil
	case "google":
		var payload struct {
			Subject  string `json:"sub"`
			Email    string `json:"email"`
			Name     string `json:"name"`
			Picture  string `json:"picture"`
			Verified bool   `json:"email_verified"`
		}
		if err = a.oauthBearerJSON(ctx, provider.UserInfoURL, accessToken, &payload); err != nil || strings.TrimSpace(payload.Subject) == "" {
			return adminOAuthIdentity{}, errors.New("Google 用户信息无效")
		}
		if !payload.Verified {
			payload.Email = ""
		}
		return adminOAuthIdentity{Subject: payload.Subject, Email: payload.Email, DisplayName: payload.Name, AvatarURL: payload.Picture}, nil
	case "wechat":
		values := url.Values{"access_token": {accessToken}, "openid": {tokenOpenID}, "lang": {"zh_CN"}}
		var payload struct {
			OpenID    string `json:"openid"`
			Nickname  string `json:"nickname"`
			AvatarURL string `json:"headimgurl"`
			ErrorCode int    `json:"errcode"`
		}
		if err = a.oauthGetJSON(ctx, provider.UserInfoURL, values, &payload); err != nil || payload.ErrorCode != 0 || payload.OpenID == "" {
			return adminOAuthIdentity{}, errors.New("微信用户信息无效")
		}
		return adminOAuthIdentity{Subject: payload.OpenID, DisplayName: payload.Nickname, AvatarURL: payload.AvatarURL}, nil
	case "qq":
		openid, err := a.fetchQQOpenID(ctx, provider.OpenIDURL, accessToken)
		if err != nil {
			return adminOAuthIdentity{}, err
		}
		values := url.Values{"access_token": {accessToken}, "oauth_consumer_key": {provider.ClientID}, "openid": {openid}, "format": {"json"}}
		var payload struct {
			ReturnCode int    `json:"ret"`
			Message    string `json:"msg"`
			Nickname   string `json:"nickname"`
			AvatarURL  string `json:"figureurl_qq_2"`
		}
		if err = a.oauthGetJSON(ctx, provider.UserInfoURL, values, &payload); err != nil || payload.ReturnCode != 0 {
			return adminOAuthIdentity{}, errors.New("QQ 用户信息无效")
		}
		return adminOAuthIdentity{Subject: openid, DisplayName: payload.Nickname, AvatarURL: payload.AvatarURL}, nil
	default:
		return adminOAuthIdentity{}, errors.New("不支持的第三方登录渠道")
	}
}

func (a *App) exchangeAdminOAuthToken(ctx context.Context, provider adminOAuthProvider, code, verifier string) (string, string, error) {
	if provider.Code == "wechat" {
		values := url.Values{"appid": {provider.ClientID}, "secret": {provider.ClientSecret}, "code": {code}, "grant_type": {"authorization_code"}}
		var payload struct {
			AccessToken string `json:"access_token"`
			OpenID      string `json:"openid"`
			ErrorCode   int    `json:"errcode"`
		}
		if err := a.oauthGetJSON(ctx, provider.TokenURL, values, &payload); err != nil || payload.ErrorCode != 0 || payload.AccessToken == "" || payload.OpenID == "" {
			return "", "", errors.New("微信令牌交换失败")
		}
		return payload.AccessToken, payload.OpenID, nil
	}
	values := url.Values{
		"client_id":     {provider.ClientID},
		"client_secret": {provider.ClientSecret},
		"code":          {code},
		"redirect_uri":  {provider.RedirectURI},
		"grant_type":    {"authorization_code"},
	}
	if verifier != "" {
		values.Set("code_verifier", verifier)
	}
	request, _ := http.NewRequestWithContext(ctx, http.MethodPost, provider.TokenURL, strings.NewReader(values.Encode()))
	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	request.Header.Set("Accept", "application/json")
	response, err := a.oauthHTTPClient().Do(request)
	if err != nil {
		return "", "", err
	}
	defer response.Body.Close()
	body, err := io.ReadAll(io.LimitReader(response.Body, adminOAuthBodyMax))
	if err != nil || response.StatusCode < 200 || response.StatusCode >= 300 {
		return "", "", errors.New("第三方令牌服务请求失败")
	}
	var payload struct {
		AccessToken      string `json:"access_token"`
		Error            string `json:"error"`
		ErrorDescription string `json:"error_description"`
	}
	if json.Unmarshal(body, &payload) != nil || payload.AccessToken == "" {
		parsed, parseErr := url.ParseQuery(string(body))
		if parseErr != nil {
			return "", "", errors.New("第三方令牌响应无效")
		}
		payload.AccessToken = parsed.Get("access_token")
		payload.Error = parsed.Get("error")
	}
	if payload.Error != "" || payload.AccessToken == "" {
		return "", "", errors.New("第三方平台拒绝了令牌请求")
	}
	return payload.AccessToken, "", nil
}

func (a *App) oauthBearerJSON(ctx context.Context, endpoint, accessToken string, out any) error {
	request, _ := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
	request.Header.Set("Authorization", "Bearer "+accessToken)
	request.Header.Set("Accept", "application/json")
	request.Header.Set("User-Agent", "XingYu-Admin-OAuth/1.0")
	return a.oauthDoJSON(request, out)
}

func (a *App) oauthGetJSON(ctx context.Context, endpoint string, values url.Values, out any) error {
	parsed, err := url.Parse(endpoint)
	if err != nil {
		return err
	}
	query := parsed.Query()
	for key, items := range values {
		for _, item := range items {
			query.Add(key, item)
		}
	}
	parsed.RawQuery = query.Encode()
	request, _ := http.NewRequestWithContext(ctx, http.MethodGet, parsed.String(), nil)
	request.Header.Set("Accept", "application/json")
	request.Header.Set("User-Agent", "XingYu-Admin-OAuth/1.0")
	return a.oauthDoJSON(request, out)
}

func (a *App) oauthDoJSON(request *http.Request, out any) error {
	response, err := a.oauthHTTPClient().Do(request)
	if err != nil {
		return err
	}
	defer response.Body.Close()
	if response.StatusCode < 200 || response.StatusCode >= 300 {
		return fmt.Errorf("第三方平台返回 HTTP %d", response.StatusCode)
	}
	decoder := json.NewDecoder(io.LimitReader(response.Body, adminOAuthBodyMax))
	return decoder.Decode(out)
}

func (a *App) fetchQQOpenID(ctx context.Context, endpoint, accessToken string) (string, error) {
	parsed, _ := url.Parse(endpoint)
	query := parsed.Query()
	query.Set("access_token", accessToken)
	query.Set("fmt", "json")
	parsed.RawQuery = query.Encode()
	request, _ := http.NewRequestWithContext(ctx, http.MethodGet, parsed.String(), nil)
	request.Header.Set("Accept", "application/json")
	response, err := a.oauthHTTPClient().Do(request)
	if err != nil {
		return "", err
	}
	defer response.Body.Close()
	body, err := io.ReadAll(io.LimitReader(response.Body, adminOAuthBodyMax))
	if err != nil || response.StatusCode < 200 || response.StatusCode >= 300 {
		return "", errors.New("QQ OpenID 请求失败")
	}
	text := strings.TrimSpace(string(body))
	if strings.HasPrefix(text, "callback") {
		start, end := strings.Index(text, "("), strings.LastIndex(text, ")")
		if start >= 0 && end > start {
			text = text[start+1 : end]
		}
	}
	var payload struct {
		OpenID string `json:"openid"`
		Error  int    `json:"error"`
	}
	if json.Unmarshal([]byte(text), &payload) != nil || payload.Error != 0 || payload.OpenID == "" {
		return "", errors.New("QQ OpenID 响应无效")
	}
	return payload.OpenID, nil
}