import bcrypt from 'bcryptjs'
import { db, eq, users, userIdentities } from '~/drizzle/db'
import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
import { createAuthSession } from '~~/server/utils/create-auth-session'
import { verifyBindingToken } from '~~/server/utils/oauth-token'
import { emailVerificationCodes } from '~~/server/api/user/email/send-code.post'

export default defineEventHandler(async (event) => {
  const body = await readBody(event)

  if (!body.username || !body.password) {
    throw createError({
      statusCode: 400,
      message: '姓名/用户名和密码不能为空'
    })
  }

  // 验证姓名/用户名只能包含汉字
  const chineseRegex = /^[\u4e00-\u9fa5]+$/
  if (!chineseRegex.test(body.username)) {
    throw createError({
      statusCode: 400,
      message: '姓名/用户名只能包含汉字'
    })
  }

  const rawEmail = typeof body.email === 'string' ? body.email.trim() : ''
  const email = rawEmail ? rawEmail.toLowerCase() : null
  
  if (email) {
    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
    if (!emailRegex.test(email)) {
      throw createError({
        statusCode: 400,
        message: '邮箱格式不正确'
      })
    }

    const existingEmailUser = await db
      .select({ id: users.id })
      .from(users)
      .where(eq(users.email, email))
      .limit(1)

    if (existingEmailUser.length > 0) {
      throw createError({
        statusCode: 409,
        message: '邮箱已被绑定'
      })
    }

    // 验证验证码
    if (!body.emailCode) {
      throw createError({
        statusCode: 400,
        message: '请提供邮箱验证码'
      })
    }

    const storedData = emailVerificationCodes.get(email)
    if (!storedData) {
      throw createError({ statusCode: 400, message: '请先获取邮箱验证码' })
    }
    if (Date.now() > storedData.expiresAt) {
      emailVerificationCodes.delete(email)
      throw createError({ statusCode: 400, message: '验证码已过期，请重新获取' })
    }
    if (storedData.code !== body.emailCode.trim()) {
      throw createError({ statusCode: 400, message: '邮箱验证码不正确' })
    }
  }

  // 验证用户名唯一性
  const existingUser = await db
    .select({ id: users.id })
    .from(users)
    .where(eq(users.username, body.username))
    .limit(1)

  if (existingUser.length > 0) {
    throw createError({
      statusCode: 409,
      message: '用户名已被注册'
    })
  }

  // 加密密码
  const saltRounds = 10
  const hashedPassword = await bcrypt.hash(body.password, saltRounds)

  // 插入新用户
  const [newUser] = await db.insert(users).values({
    username: body.username,
    name: body.username, // 默认将昵称设置为账号名
    password: hashedPassword,
    email,
    emailVerified: !!email, // 邮箱存在则表示已验证
    grade: body.grade || null,
    class: body.class || null,
    studentId: body.studentId || null,
    role: 'USER',
    status: 'active'
  }).returning({
    id: users.id,
    username: users.username,
    role: users.role
  })

  if (email) {
    emailVerificationCodes.delete(email)
  }

  // 签发 JWT Token
  const { token, jti } = JWTEnhanced.generateTokenWithJti(newUser.id, newUser.role)
  await createAuthSession(event, { userId: newUser.id, jti, loginMethod: 'password' })

  /*
   * 可选：注册的同时把这个微信绑到新账号上。
   *
   * 场景（小程序）：微信一键登录 → 服务端说「这个微信还没绑过账号」→ 前端跳到注册页 →
   * 注册成功后应当**顺手绑定**，而不是让用户注册完再自己去绑一次。
   *
   * 设计取舍：
   *   · 绑不上**不能让注册失败**（账号已经建好了，回滚更糟）——
   *     只返回 wechatBound=false + 原因，前端提示「可稍后在账号管理里绑定」；
   *   · 令牌无效/过期同理；
   *   · 唯一约束冲突（同一个微信已绑过别的账号）也放过，按"已绑定"处理。
   */
  let wechatBound = false
  let wechatBindError = ''
  const bindToken = typeof body.bindToken === 'string' ? body.bindToken : ''
  if (bindToken) {
    try {
      const payload = verifyBindingToken(bindToken)
      try {
        await db.insert(userIdentities).values({
          userId: newUser.id,
          provider: payload.provider,
          providerUserId: payload.providerUserId,
          providerUsername: payload.providerUsername
        })
        wechatBound = true
      } catch (e: any) {
        // 23505 = Postgres 唯一约束冲突：这个第三方身份已经绑过了
        if (e?.code === '23505') {
          wechatBound = true
        } else {
          throw e
        }
      }
    } catch (e: any) {
      wechatBindError = '微信绑定会话已过期，可稍后在「账号管理」里重新绑定'
      console.error('[register] 注册时绑定第三方身份失败:', e?.message || e)
    }
  }

  const isSecure =
    getRequestURL(event).protocol === 'https:' ||
    getRequestHeader(event, 'x-forwarded-proto') === 'https'

  setCookie(event, 'auth-token', token, {
    httpOnly: true,
    secure: isSecure,
    sameSite: 'lax',
    maxAge: 60 * 60 * 24 * 7, // 7天
    path: '/'
  })

  return {
    success: true,
    // 供小程序等非浏览器客户端使用：后续请求带 Authorization: Bearer <token>
    token,
    wechatBound,
    wechatBindError,
    user: {
      id: newUser.id,
      username: newUser.username,
      role: newUser.role
    }
  }
})