"""
认证服务

处理用户认证相关的业务逻辑。
"""

from datetime import timedelta

import jwt

from sqlalchemy.ext.asyncio import AsyncSession

from app.core.config import settings
from app.core.exceptions import (
    InvalidCredentialsError,
    PasswordValidationError,
    TokenError,
    TokenExpiredError,
    UserDisabledError,
    UserNotFoundError,
)
from app.core.security import (
    create_access_token,
    create_refresh_token,
    decode_token,
    hash_password,
    password_needs_rehash,
    verify_password,
)
from app.models.user import User
from app.repositories.user import UserRepository
from app.schemas.auth import PasswordChangeRequest, TokenResponse
from app.services.user import UserService


class AuthService:
    """认证服务"""

    def __init__(self, session: AsyncSession):
        """
        初始化认证服务
        
        Args:
            session: 数据库会话
        """
        self.session = session
        self.user_repo = UserRepository(session)
        self.user_service = UserService(session)

    async def authenticate(
        self,
        username: str,
        password: str,
    ) -> User:
        """
        验证用户凭证
        
        Args:
            username: 用户名或邮箱
            password: 密码
            
        Returns:
            验证成功的用户对象
            
        Raises:
            InvalidCredentialsError: 凭证无效
            UserDisabledError: 用户被禁用
        """
        # 查找用户（支持用户名或邮箱登录）
        user = await self.user_repo.get_by_username_or_email(username)
        
        if not user:
            # 防止时序攻击：即使用户不存在也进行密码验证
            verify_password(password, "$argon2id$v=19$m=65536,t=3,p=4$dummy$dummy")
            raise InvalidCredentialsError()

        # 验证密码
        if not verify_password(password, user.hashed_password):
            raise InvalidCredentialsError()

        # 检查用户状态
        if not user.is_active:
            raise UserDisabledError()

        # 检查是否需要重新哈希密码（参数升级）
        if password_needs_rehash(user.hashed_password):
            await self.user_repo.update(
                user,
                hashed_password=hash_password(password),
            )
            await self.user_repo.commit()

        return user

    async def login(
        self,
        username: str,
        password: str,
    ) -> tuple[User, TokenResponse]:
        """
        用户登录
        
        Args:
            username: 用户名或邮箱
            password: 密码
            
        Returns:
            (用户对象, 令牌响应)
        """
        user = await self.authenticate(username, password)
        
        # 更新最后登录时间
        await self.user_service.update_last_login(user)
        
        # 生成令牌
        tokens = self._create_tokens(user)
        
        return user, tokens

    def _create_tokens(self, user: User) -> TokenResponse:
        """
        为用户创建访问令牌和刷新令牌
        
        Args:
            user: 用户对象
            
        Returns:
            令牌响应
        """
        access_token = create_access_token(
            subject=user.id,
            extra_claims={
                "username": user.username,
                "is_superuser": user.is_superuser,
            },
        )
        
        refresh_token = create_refresh_token(subject=user.id)
        
        return TokenResponse(
            access_token=access_token,
            refresh_token=refresh_token,
            token_type="Bearer",
            expires_in=settings.access_token_expire_minutes * 60,
        )

    async def refresh_tokens(self, refresh_token: str) -> TokenResponse:
        """
        刷新访问令牌
        
        Args:
            refresh_token: 刷新令牌
            
        Returns:
            新的令牌响应
            
        Raises:
            TokenError: 令牌无效
            TokenExpiredError: 令牌已过期
        """
        try:
            payload = decode_token(refresh_token)
        except jwt.ExpiredSignatureError:
            raise TokenExpiredError()
        except jwt.InvalidTokenError:
            raise TokenError()

        # 验证令牌类型
        if payload.get("type") != "refresh":
            raise TokenError("无效的令牌类型")

        # 获取用户
        user_id = payload.get("sub")
        if not user_id:
            raise TokenError()

        user = await self.user_repo.get_by_id(user_id)
        if not user:
            raise UserNotFoundError(user_id)

        if not user.is_active:
            raise UserDisabledError()

        # 生成新令牌
        return self._create_tokens(user)

    async def change_password(
        self,
        user_id: str,
        password_data: PasswordChangeRequest,
    ) -> None:
        """
        修改用户密码
        
        Args:
            user_id: 用户 ID
            password_data: 密码修改数据
            
        Raises:
            UserNotFoundError: 用户不存在
            InvalidCredentialsError: 当前密码错误
            PasswordValidationError: 新密码不符合要求
        """
        user = await self.user_repo.get_by_id(user_id)
        if not user:
            raise UserNotFoundError(user_id)

        # 验证当前密码
        if not verify_password(password_data.current_password, user.hashed_password):
            raise InvalidCredentialsError("当前密码错误")

        # 验证新密码强度
        self._validate_password_strength(password_data.new_password)

        # 更新密码
        await self.user_repo.update(
            user,
            hashed_password=hash_password(password_data.new_password),
        )
        await self.user_repo.commit()

    def _validate_password_strength(self, password: str) -> None:
        """
        验证密码强度
        
        Args:
            password: 密码
            
        Raises:
            PasswordValidationError: 密码不符合要求
        """
        import re

        errors: list[str] = []

        if len(password) < settings.password_min_length:
            errors.append(f"密码长度不能少于 {settings.password_min_length} 位")

        if len(password) > settings.password_max_length:
            errors.append(f"密码长度不能超过 {settings.password_max_length} 位")

        if settings.password_require_uppercase and not re.search(r"[A-Z]", password):
            errors.append("至少包含一个大写字母")

        if settings.password_require_lowercase and not re.search(r"[a-z]", password):
            errors.append("至少包含一个小写字母")

        if settings.password_require_digit and not re.search(r"\d", password):
            errors.append("至少包含一个数字")

        if settings.password_require_special and not re.search(r"[!@#$%^&*(),.?\":{}|<>]", password):
            errors.append("至少包含一个特殊字符")

        if errors:
            raise PasswordValidationError("；".join(errors))

    async def get_current_user(self, token: str) -> User:
        """
        从令牌获取当前用户
        
        Args:
            token: 访问令牌
            
        Returns:
            用户对象
            
        Raises:
            TokenError: 令牌无效
            TokenExpiredError: 令牌已过期
            UserNotFoundError: 用户不存在
            UserDisabledError: 用户被禁用
        """
        try:
            payload = decode_token(token)
        except jwt.ExpiredSignatureError:
            raise TokenExpiredError()
        except jwt.InvalidTokenError:
            raise TokenError()

        # 验证令牌类型
        if payload.get("type") != "access":
            raise TokenError("无效的令牌类型")

        user_id = payload.get("sub")
        if not user_id:
            raise TokenError()

        user = await self.user_repo.get_by_id(user_id)
        if not user:
            raise UserNotFoundError(user_id)

        if not user.is_active:
            raise UserDisabledError()

        return user