package upstreamimpl

import (
	"bytes"
	"context"
	"crypto/sha256"
	"encoding/base64"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"strings"
	"time"

	sharedtoken "git.5iot.com/iotlcm-public/iotlcm-upstream-chan/internal/token"
)

const apikaTokenPath = "/iot-api/iot-card-info/getRefreshToken"

type ApikaTokenConfig struct {
	BaseURL   string
	Path      string
	AppKey    string
	AppSecret string
	AppID     string
	Timeout   time.Duration
}

type ApikaTokenProvider struct {
	baseURL   string
	path      string
	appKey    string
	appSecret string
	appID     string
	client    *http.Client
}

type apikaTokenResponse struct {
	Code int    `json:"code"`
	Msg  string `json:"msg"`
	Data struct {
		ShareToken string `json:"shareToken"`
	} `json:"data"`
}

type apikaFetcher struct{ provider *ApikaTokenProvider }

func NewApikaTokenProvider(config ApikaTokenConfig) *ApikaTokenProvider {
	timeout := config.Timeout
	if timeout <= 0 {
		timeout = defaultUpstreamHTTPTimeout
	}
	return &ApikaTokenProvider{
		baseURL: strings.TrimRight(strings.TrimSpace(config.BaseURL), "/"),
		path:    strings.TrimSpace(normalizeProviderPath(config.Path, apikaTokenPath)),
		appKey:  strings.TrimSpace(config.AppKey), appSecret: config.AppSecret,
		appID: strings.TrimSpace(config.AppID), client: &http.Client{Timeout: timeout},
	}
}

func apikaSignature(appKey, appSecret string) string {
	data := "{" + appKey + "}:" + "{" + appSecret + "}"
	sum := sha256.Sum256([]byte(data))
	hexValue := strings.ToUpper(hex.EncodeToString(sum[:]))
	return base64.StdEncoding.EncodeToString([]byte(hexValue))
}

func (f apikaFetcher) FetchToken(ctx context.Context, _ string) (sharedtoken.OneLinkToken, error) {
	return f.provider.Fetch(ctx)
}

func (p *ApikaTokenProvider) Fetch(ctx context.Context) (sharedtoken.OneLinkToken, error) {
	if p == nil || p.client == nil {
		return sharedtoken.OneLinkToken{}, fmt.Errorf("apika token provider is not initialized")
	}
	if p.baseURL == "" {
		return sharedtoken.OneLinkToken{}, fmt.Errorf("apika token base URL is required")
	}
	if p.appKey == "" || strings.TrimSpace(p.appSecret) == "" || p.appID == "" {
		return sharedtoken.OneLinkToken{}, fmt.Errorf("apika appKey, appSecret and appid are required")
	}
	signature := apikaSignature(p.appKey, p.appSecret)
	payload, err := json.Marshal(struct {
		AppID     string `json:"appid"`
		AppKey    string `json:"appKey"`
		AppSecret string `json:"appSecret"`
		Signature string `json:"signature"`
	}{AppID: p.appID, AppKey: p.appKey, AppSecret: p.appSecret, Signature: signature})
	if err != nil {
		return sharedtoken.OneLinkToken{}, fmt.Errorf("encode apika token request: %w", err)
	}
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, joinProviderURL(p.baseURL, p.path), bytes.NewReader(payload))
	if err != nil {
		return sharedtoken.OneLinkToken{}, fmt.Errorf("create apika token request: %w", err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("appKey", p.appKey)
	req.Header.Set("appSecret", p.appSecret)
	req.Header.Set("signature", signature)
	resp, err := p.client.Do(req)
	if err != nil {
		return sharedtoken.OneLinkToken{}, fmt.Errorf("request apika token: %w", err)
	}
	defer resp.Body.Close()
	body, err := io.ReadAll(io.LimitReader(resp.Body, 4*1024*1024+1))
	if err != nil {
		return sharedtoken.OneLinkToken{}, fmt.Errorf("read apika token response: %w", err)
	}
	if len(body) > 4*1024*1024 {
		return sharedtoken.OneLinkToken{}, fmt.Errorf("apika token response is too large")
	}
	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
		return sharedtoken.OneLinkToken{}, fmt.Errorf("apika token HTTP status %d", resp.StatusCode)
	}
	var output apikaTokenResponse
	if err := json.Unmarshal(body, &output); err != nil {
		return sharedtoken.OneLinkToken{}, fmt.Errorf("decode apika token response: %w", err)
	}
	if output.Code != http.StatusOK {
		return sharedtoken.OneLinkToken{}, fmt.Errorf("apika token failed: code=%d msg=%s", output.Code, strings.TrimSpace(output.Msg))
	}
	value := strings.TrimSpace(output.Data.ShareToken)
	if value == "" {
		return sharedtoken.OneLinkToken{}, fmt.Errorf("apika shareToken is empty")
	}
	now := time.Now()
	return sharedtoken.OneLinkToken{Value: value, CreatedAt: now, ExpiresAt: now.Add(5 * time.Minute)}, nil
}