import bcrypt from 'bcryptjs'
import { db, eq, users, userIdentities, and, systemSettings } from '~/drizzle/db'
import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
import {
  getAccountLockRemainingTime,
  getIPBlockRemainingTime,
  isAccountLocked,
  isIPBlocked,
  recordLoginFailure,
  recordLoginSuccess,
  recordAccountIpLogin,
  blockUser,
  getUserBlockRemainingTime,
  //导入失败计数查询函数
  getLoginFailureCount
} from '../../services/securityService'
import { getBeijingTime } from '~/utils/timeUtils'
import { getClientIP } from '~~/server/utils/ip-utils'
import { resolveRequirePasswordChange } from '~~/server/utils/system-settings-helper'
import { getPasswordSetupState } from '~~/server/utils/initial-password-policy'

// 导入验证码校验函数
import { verifyAndConsumeCaptcha } from '~~/server/utils/captcha'
import type { SystemSettings } from '~/drizzle/schema'
import { createApiError } from '~~/server/utils/apiError'
import { createAuthSession } from '~~/server/utils/auth-session'

export default defineEventHandler(async (event) => {
  const startTime = Date.now()

  try {
    const body = await readBody(event)
    const clientIp = getClientIP(event)

    let captchaId = ''
    let captchaInput = ''

    if (!body.username || !body.password) {
      throw createApiError(400, 'AUTH_USERNAME_PASSWORD_REQUIRED', '用户名和密码不能为空')
    }

    if (!process.env.JWT_SECRET) {
      console.error('JWT_SECRET environment variable is not set')
      throw createApiError(500, 'AUTH_SERVER_CONFIG_ERROR', '服务器配置错误')
    }

    // 数据库连接检查 - 使用简单的查询测试连接
    try {
      await db.select().from(users).limit(1)
    } catch (error) {
      console.error('Database connection error:', error)
      throw createApiError(503, 'AUTH_DATABASE_UNAVAILABLE', '数据库服务暂时不可用')
    }

    // 检查IP是否被限制
    if (isIPBlocked(clientIp)) {
      const remainingTime = getIPBlockRemainingTime(clientIp)
      throw createApiError(423, 'AUTH_IP_BLOCKED_RETRY_MINUTES', `您的IP地址已被限制访问，请在 ${remainingTime} 分钟后重试`, { params: [remainingTime] })
    }

    // 检查账户是否被锁定
    if (await isAccountLocked(body.username)) {
      const remainingTime = await getAccountLockRemainingTime(body.username)
      throw createApiError(423, 'AUTH_ACCOUNT_LOCKED_MINUTES', `账户已被锁定，请在 ${remainingTime} 分钟后重试`, { params: [remainingTime] })
    }

    // 读取全局配置：是否启用图形验证码
    let captchaEnabled = false
    let captchaProvider = 'graphic'
    let turnstileSecretKey = ''
    let captchaMaxFailures = 3
    try {
      const settings = await db
        .select()
        .from(systemSettings)
        .limit(1)
        .then((rows) => rows[0] as SystemSettings | undefined)

      if (settings?.captchaEnabled) {
        captchaEnabled = true
        captchaProvider = settings.captchaProvider || 'graphic'
        turnstileSecretKey = settings.turnstileSecretKey || ''
        if (settings.captchaMaxFailures) {
          captchaMaxFailures = settings.captchaMaxFailures
        }
      }
    } catch (e) {
      // 查询异常（如表不存在）时默认关闭验证码，保证登录可用
      console.warn('读取验证码配置失败，已暂时禁用:', e)
    }

    // 图形验证码检查
    let needCaptcha = false
    if (captchaEnabled) {
      if (captchaProvider === 'turnstile') {
        needCaptcha = true // Turnstile 每次都验证
      } else {
        const failCount = await getLoginFailureCount(body.username)
        needCaptcha = failCount >= captchaMaxFailures
      }
    }

    // 验证码校验
    if (needCaptcha) {
      if (captchaProvider === 'turnstile') {
        const turnstileToken = body.turnstileToken

        if (!turnstileSecretKey) {
          console.error('Turnstile is enabled but secret key is missing!')
          throw createApiError(500, 'AUTH_CODE_SERVICE_CONFIG_ERROR', '验证码服务配置错误，请联系管理员')
        }

        if (!turnstileToken) {
          throw createApiError(400, 'AUTH_CAPTCHA_REQUIRED', '请完成人机验证', { captchaRequired: true, captchaProvider: 'turnstile' })
        }

        const verifyUrl = 'https://challenges.cloudflare.com/turnstile/v0/siteverify'
        const formData = new URLSearchParams()
        formData.append('secret', turnstileSecretKey)
        formData.append('response', turnstileToken)
        formData.append('remoteip', clientIp)

        try {
          const result: any = await $fetch(verifyUrl, {
            method: 'POST',
            body: formData,
            timeout: 5000
          })

          if (!result.success) {
            console.error('Turnstile verification failed:', result['error-codes'])
            throw createApiError(400, 'AUTH_CAPTCHA_FAILED_OR_EXPIRED', '人机验证失败或已过期，请重试', { captchaRequired: true, captchaProvider: 'turnstile' })
          }
        } catch (err: any) {
          if (err.statusCode === 400) throw err
          console.error('Turnstile verification error:', err)
          throw createApiError(500, 'AUTH_CAPTCHA_SERVICE_UNAVAILABLE', '人机验证服务暂时不可用')
        }
      } else {
        captchaId = body.captchaId
        captchaInput = body.captchaInput
        if (!captchaId || !captchaInput) {
          throw createApiError(400, 'AUTH_IMAGE_CAPTCHA_REQUIRED', '请完成图形验证码', { captchaRequired: true, captchaProvider: 'graphic' })
        }

        const isValid = await verifyAndConsumeCaptcha(captchaId, captchaInput)
        if (!isValid) {
          throw createApiError(400, 'AUTH_CODE_INVALID_OR_EXPIRED', '验证码错误或已过期，请重新输入', { captchaRequired: true, captchaProvider: 'graphic' })
        }
      }
    }

    // 查找用户
    const userResult = await db
      .select({
        id: users.id,
        username: users.username,
        name: users.name,
        grade: users.grade,
        class: users.class,
        password: users.password,
        role: users.role,
        lastLogin: users.lastLogin,
        lastLoginIp: users.lastLoginIp,
        passwordChangedAt: users.passwordChangedAt,
        forcePasswordChange: users.forcePasswordChange,
        tokenVersion: users.tokenVersion,
        status: users.status,
        email: users.email,
        emailVerified: users.emailVerified
      })
      .from(users)
      .where(eq(users.username, body.username))
      .limit(1)

    const user = userResult[0] || null

    if (!user) {
      // 记录登录失败（用户不存在）
      await recordLoginFailure(body.username, clientIp)
      throw createApiError(401, 'AUTH_INVALID_CREDENTIALS', '用户名或密码错误')
    }

    // 验证密码
    const isPasswordValid = await bcrypt.compare(body.password, user.password)
    if (!isPasswordValid) {
      // 记录登录失败（密码错误）
      await recordLoginFailure(body.username, clientIp)
      throw createApiError(401, 'AUTH_INVALID_CREDENTIALS', '用户名或密码错误')
    }

    // 检查用户状态 (移到2FA之前，防止已退学用户进行2FA验证)
    if (user.status === 'withdrawn') {
      throw createApiError(403, 'AUTH_ACCOUNT_WITHDRAWN', '该账号已退学，限制访问')
    } else if (user.status === 'graduate') {
      throw createApiError(403, 'AUTH_ACCOUNT_GRADUATED', '该账号已毕业，限制访问')
    } else if (user.status === 'banned') {
      throw createApiError(403, 'AUTH_ACCOUNT_BANNED', '该账号已被封禁')
    } else if (user.status === 'pending') {
      throw createApiError(403, 'AUTH_USER_PENDING_APPROVAL', '账号待管理员审核，请耐心等待')
    } else if (user.status === 'rejected') {
      throw createApiError(403, 'AUTH_ACCOUNT_CURRENTLY_UNAVAILABLE', '该账号当前不可用')
    }

    // 普通登录不延续绑定流程，避免残留绑定令牌被后续 2FA 校验意外消费
    deleteCookie(event, 'binding-token')

    // 检查是否开启2FA
    const totpIdentity = await db.query.userIdentities.findFirst({
      where: and(eq(userIdentities.userId, user.id), eq(userIdentities.provider, 'totp'))
    })

    if (totpIdentity) {
      // 生成预认证临时令牌
      const tempToken = JWTEnhanced.sign(
        {
          userId: user.id,
          tokenVersion: user.tokenVersion,
          type: 'pre-auth',
          scope: '2fa_pending'
        },
        { expiresIn: '5m' }
      ) // 动态构建验证方式列表
      const methods = ['totp']
      let maskedEmail = ''
      if (user.email && user.emailVerified) {
        methods.push('email')
        // 生成脱敏邮箱提示
        const [local, domain] = user.email.split('@')
        if (local && domain) {
          maskedEmail = local.length <= 2 ? `***@${domain}` : `${local.slice(0, 2)}****@${domain}`
        }
      }
      return {
        success: true,
        requires2FA: true,
        userId: user.id,
        methods,
        maskedEmail,
        tempToken
      }
    }

    await recordLoginSuccess(body.username, clientIp)

    const ipSwitchExceeded = recordAccountIpLogin(body.username, clientIp)
    if (ipSwitchExceeded) {
      blockUser(user.id)
      const ipRemain = getIPBlockRemainingTime(clientIp)
      const userRemain = getUserBlockRemainingTime(user.id)
      throw createApiError(423, 'AUTH_MULTI_IP_PROTECTION', `检测到同一账号短期多IP登录，当前IP限制 ${ipRemain} 分钟，账户保护 ${userRemain} 分钟`, { params: [ipRemain, userRemain] })
    }

    // 更新登录信息
    await db
      .update(users)
      .set({
        lastLogin: getBeijingTime(),
        lastLoginIp: clientIp
      })
      .where(eq(users.id, user.id))
      .catch((err) => console.error('Error updating user login info:', err))

    // 生成JWT
    const { token } = await createAuthSession(event, user, 'password')

    // 自动判断是否需要secure
    const isSecure =
      getRequestURL(event).protocol === 'https:' ||
      getRequestHeader(event, 'x-forwarded-proto') === 'https'

    // 设置cookie
    setCookie(event, 'auth-token', token, {
      httpOnly: true,
      secure: isSecure,
      sameSite: 'lax',
      maxAge: 60 * 60 * 24 * 7, // 7天
      path: '/'
    })

    const processingTime = Date.now() - startTime
    console.log(`Login for ${user.username} processed in ${processingTime}ms`)

    const requirePasswordChange = await resolveRequirePasswordChange(user)
    const passwordSetupState = getPasswordSetupState(user, requirePasswordChange)

    return {
      success: true,
      user: {
        id: user.id,
        username: user.username,
        name: user.name,
        grade: user.grade,
        class: user.class,
        role: user.role,
        email: user.email,
        emailVerified: user.emailVerified,
        forcePasswordChange: user.forcePasswordChange,
        passwordChangedAt: user.passwordChangedAt,
        requirePasswordChange,
        // 兼容旧客户端字段名
        needsPasswordChange: requirePasswordChange,
        ...passwordSetupState
      }
    }
  } catch (error: any) {
    const errorTime = Date.now() - startTime
    console.error(`Login error after ${errorTime}ms:`, error)

    if (error.statusCode) {
      throw error
    }

    throw createApiError(500, 'AUTH_LOGIN_UNKNOWN_ERROR', '登录过程中发生未知错误')
  }
})