using System.Diagnostics;
using System.Net;
using System.Net.Sockets;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;

namespace Charac.Client;

internal static class OidcLogin
{
    public static async Task<string> LoginAsync(HttpClient client, string issuer, string clientId,
        string discoveryUrl,
        CancellationToken cancellationToken = default)
    {
        if (!Uri.TryCreate(issuer, UriKind.Absolute, out var issuerUri) ||
            issuerUri.Scheme != Uri.UriSchemeHttps || string.IsNullOrWhiteSpace(clientId))
            throw new InvalidOperationException("The Server returned invalid OIDC settings.");

        if (!Uri.TryCreate(discoveryUrl, UriKind.Absolute, out var discoveryUri) ||
            discoveryUri.Scheme != Uri.UriSchemeHttps)
            throw new InvalidOperationException("The Server returned an invalid OIDC discovery URL.");
        using var discoveryResponse = await client.GetAsync(discoveryUri, cancellationToken);
        discoveryResponse.EnsureSuccessStatusCode();
        using var discovery = await JsonDocument.ParseAsync(
            await discoveryResponse.Content.ReadAsStreamAsync(cancellationToken), cancellationToken: cancellationToken);
        var metadata = discovery.RootElement;
        if (metadata.GetProperty("issuer").GetString() != issuer)
            throw new InvalidOperationException("OIDC discovery issuer does not match the Server configuration.");
        var authorize = HttpsEndpoint(metadata.GetProperty("authorization_endpoint").GetString());
        var token = HttpsEndpoint(metadata.GetProperty("token_endpoint").GetString());

        using var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        var port = ((IPEndPoint)listener.LocalEndpoint).Port;
        var redirectUri = $"http://127.0.0.1:{port}/callback";
        var verifier = Base64Url(RandomNumberGenerator.GetBytes(32));
        var challenge = Base64Url(SHA256.HashData(Encoding.ASCII.GetBytes(verifier)));
        var state = Base64Url(RandomNumberGenerator.GetBytes(32));
        var query = new Dictionary<string, string>
        {
            ["response_type"] = "code",
            ["client_id"] = clientId,
            ["redirect_uri"] = redirectUri,
            ["scope"] = "openid",
            ["state"] = state,
            ["code_challenge"] = challenge,
            ["code_challenge_method"] = "S256"
        };
        var authorizationUri = new UriBuilder(authorize)
        {
            Query = string.Join('&', query.Select(pair =>
                $"{Uri.EscapeDataString(pair.Key)}={Uri.EscapeDataString(pair.Value)}"))
        }.Uri;
        Console.WriteLine($"Open this URL to sign in: {authorizationUri}");
        try
        {
            Process.Start(new ProcessStartInfo(authorizationUri.ToString()) { UseShellExecute = true });
        }
        catch (Exception exception) when (exception is System.ComponentModel.Win32Exception or
            PlatformNotSupportedException or InvalidOperationException)
        {
            Console.WriteLine("Open the URL manually in a browser on this device.");
        }

        using var timeout = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
        timeout.CancelAfter(TimeSpan.FromMinutes(3));
        var code = await ReceiveCodeAsync(listener, state, timeout.Token);
        using var body = new FormUrlEncodedContent(new Dictionary<string, string>
        {
            ["grant_type"] = "authorization_code",
            ["client_id"] = clientId,
            ["code"] = code,
            ["redirect_uri"] = redirectUri,
            ["code_verifier"] = verifier
        });
        using var tokenResponse = await client.PostAsync(token, body, cancellationToken);
        if (!tokenResponse.IsSuccessStatusCode)
            throw new InvalidOperationException(await DescribeTokenErrorAsync(tokenResponse, cancellationToken));
        using var tokenDocument = await JsonDocument.ParseAsync(
            await tokenResponse.Content.ReadAsStreamAsync(cancellationToken), cancellationToken: cancellationToken);
        if (tokenDocument.RootElement.GetProperty("token_type").GetString() is not { } tokenType ||
            !string.Equals(tokenType, "Bearer", StringComparison.OrdinalIgnoreCase) ||
            tokenDocument.RootElement.GetProperty("access_token").GetString() is not { Length: > 0 } accessToken)
            throw new InvalidOperationException("OIDC token response did not contain a bearer access token.");
        return accessToken;
    }

    private static async Task<string> ReceiveCodeAsync(TcpListener listener, string expectedState,
        CancellationToken cancellationToken)
    {
        using var connection = await listener.AcceptTcpClientAsync(cancellationToken);
        await using var stream = connection.GetStream();
        using var reader = new StreamReader(stream, Encoding.ASCII, leaveOpen: true);
        var requestLine = await reader.ReadLineAsync(cancellationToken);
        if (requestLine is null || requestLine.Length > 8192 || !requestLine.StartsWith("GET ", StringComparison.Ordinal))
            throw new InvalidOperationException("The OIDC callback request is invalid.");
        string? header;
        do
        {
            header = await reader.ReadLineAsync(cancellationToken);
            if (header is { Length: > 8192 })
                throw new InvalidOperationException("The OIDC callback request is too large.");
        } while (header is { Length: > 0 });

        var path = requestLine.Split(' ', 3)[1];
        if (!Uri.TryCreate("http://127.0.0.1" + path, UriKind.Absolute, out var callback) ||
            callback.AbsolutePath != "/callback")
            throw new InvalidOperationException("The OIDC callback path is invalid.");
        var values = callback.Query.TrimStart('?').Split('&', StringSplitOptions.RemoveEmptyEntries)
            .Select(part => part.Split('=', 2))
            .ToDictionary(parts => Uri.UnescapeDataString(parts[0]),
                parts => Uri.UnescapeDataString(parts.Length == 2 ? parts[1] : ""));
        values.TryGetValue("code", out var code);
        var valid = values.TryGetValue("state", out var state) &&
            CryptographicOperations.FixedTimeEquals(Encoding.ASCII.GetBytes(state),
                Encoding.ASCII.GetBytes(expectedState)) &&
            !string.IsNullOrWhiteSpace(code);
        var page = CallbackPage
            .Replace("__FONT_REGULAR__", ReadFontBase64("Regular"), StringComparison.Ordinal)
            .Replace("__FONT_BOLD__", ReadFontBase64("Bold"), StringComparison.Ordinal)
            .Replace("__STATE__", valid ? "success" : "failure", StringComparison.Ordinal)
            .Replace("__ICON__", valid ? "✓" : "!", StringComparison.Ordinal)
            .Replace("__TITLE__", valid ? "已收到授权码" : "授权回调未通过验证", StringComparison.Ordinal)
            .Replace("__MESSAGE__", valid
                ? "请返回终端，等待 RAC 完成登录。现在可以关闭此页面。"
                : "请关闭此页面，在终端重新发起登录。", StringComparison.Ordinal);
        var content = Encoding.UTF8.GetBytes(page);
        var headers = Encoding.ASCII.GetBytes(
            $"HTTP/1.1 {(valid ? "200 OK" : "400 Bad Request")}\r\n" +
            "Content-Type: text/html; charset=utf-8\r\n" +
            $"Content-Length: {content.Length}\r\n" +
            "Cache-Control: no-store\r\n" +
            "Referrer-Policy: no-referrer\r\n" +
            "X-Content-Type-Options: nosniff\r\n" +
            "Content-Security-Policy: default-src 'none'; font-src data:; style-src 'unsafe-inline'; script-src 'unsafe-inline'; base-uri 'none'; form-action 'none'\r\n" +
            "Connection: close\r\n\r\n");
        await stream.WriteAsync(headers, cancellationToken);
        await stream.WriteAsync(content, cancellationToken);
        if (!valid)
            throw new InvalidOperationException("OIDC callback state or authorization code is invalid.");
        return code!;
    }

    private static async Task<string> DescribeTokenErrorAsync(HttpResponseMessage response,
        CancellationToken cancellationToken)
    {
        var message = $"OIDC token exchange failed (HTTP {(int)response.StatusCode})";
        try
        {
            using var document = await JsonDocument.ParseAsync(
                await response.Content.ReadAsStreamAsync(cancellationToken), cancellationToken: cancellationToken);
            if (document.RootElement.ValueKind != JsonValueKind.Object ||
                !document.RootElement.TryGetProperty("error", out var error) ||
                error.ValueKind != JsonValueKind.String)
                return message;

            var code = error.GetString();
            if (string.IsNullOrEmpty(code) || code.Length > 80 ||
                !code.All(character => char.IsAsciiLetterOrDigit(character) || character is '_' or '-'))
                return message;

            message += $": {code}";
            if (document.RootElement.TryGetProperty("error_description", out var description) &&
                description.ValueKind == JsonValueKind.String)
            {
                var detail = description.GetString();
                if (!string.IsNullOrWhiteSpace(detail))
                {
                    detail = new string(detail.Take(300).Select(character =>
                        char.IsControl(character) ? ' ' : character).ToArray());
                    message += $" ({detail})";
                }
            }
        }
        catch (JsonException)
        {
            // A non-JSON proxy or provider error still reports the HTTP status.
        }

        return message;
    }

    private static Uri HttpsEndpoint(string? value)
    {
        if (!Uri.TryCreate(value, UriKind.Absolute, out var uri) ||
            uri.Scheme != Uri.UriSchemeHttps || uri.UserInfo.Length != 0)
            throw new InvalidOperationException("OIDC discovery returned an invalid HTTPS endpoint.");
        return uri;
    }

    private static string Base64Url(byte[] bytes) => Convert.ToBase64String(bytes)
        .TrimEnd('=').Replace('+', '-').Replace('/', '_');

    private static string ReadFontBase64(string weight)
    {
        using var stream = typeof(OidcLogin).Assembly.GetManifestResourceStream(
            $"Charac.Fonts.IBMPlexMono-{weight}.woff2") ??
            throw new InvalidOperationException("The bundled callback font is missing.");
        using var buffer = new MemoryStream();
        stream.CopyTo(buffer);
        return Convert.ToBase64String(buffer.ToArray());
    }
    private const string CallbackPage = """
        <!doctype html>
        <html lang="zh-CN">
        <head>
          <meta charset="utf-8">
          <meta name="viewport" content="width=device-width, initial-scale=1">
          <meta name="color-scheme" content="dark">
          <title>RAC · 授权回调</title>
          <style>
            @font-face { font-family: "IBM Plex Mono"; font-style: normal; font-weight: 400; font-display: swap;
                         src: url("data:font/woff2;base64,__FONT_REGULAR__") format("woff2"); }
            @font-face { font-family: "IBM Plex Mono"; font-style: normal; font-weight: 700; font-display: swap;
                         src: url("data:font/woff2;base64,__FONT_BOLD__") format("woff2"); }
            :root { font-family: "IBM Plex Mono", "Microsoft YaHei", "PingFang SC", system-ui, sans-serif; color: #172b3d; background: #1c2732; }
            * { box-sizing: border-box; }
            body { min-height: 100vh; min-height: 100svh; margin: 0; display: grid; place-items: center; padding: 32px 20px;
                   background-image: linear-gradient(#a8d8f508 1px, transparent 1px),
                                     linear-gradient(90deg, #a8d8f508 1px, transparent 1px);
                   background-size: 32px 32px; }
            .card { --accent: #a8d8f5; width: min(100%, 760px); border: 2px solid #10202f;
                    background: #eeeade; box-shadow: -8px -8px 0 var(--accent), 12px 12px 0 #10202f; }
            .failure { --accent: #e44e43; }
            .header { display: flex; align-items: center; justify-content: space-between; gap: 24px;
                      padding: 22px 28px; background: #10202f; color: #eeeade; }
            .brand { display: flex; align-items: center; gap: 18px; }
            .mark { padding: 6px 8px; background: #a8d8f5; color: #10202f;
                    font: 700 27px/1.15 "IBM Plex Mono", monospace; letter-spacing: -.07em; }
            .label { font: 700 11px/1.6 "IBM Plex Mono", "Microsoft YaHei", monospace; letter-spacing: .12em; }
            .index { color: var(--accent); white-space: nowrap; }
            .content { padding: clamp(26px, 6vw, 48px); }
            .status { display: flex; align-items: center; gap: 10px; }
            .symbol { display: grid; place-items: center; width: 26px; height: 26px; background: var(--accent);
                      color: #10202f; font-size: 18px; font-weight: 800; }
            h1 { margin: 24px 0 18px; font-size: clamp(28px, 5vw, 44px); font-weight: 800;
                 letter-spacing: -.04em; line-height: 1.25; overflow-wrap: anywhere; }
            p { margin: 0; max-width: 34em; color: #485767; font-size: 16px; line-height: 1.8; }
            .footer { display: flex; align-items: center; gap: 16px; padding: 18px 28px;
                      border-top: 2px solid #172b3d; background: #e0e3df; }
            .footer::before { content: ""; width: 8px; height: 8px; flex: 0 0 8px; background: #365d7a; }
            .note { color: #485767; font-size: 12px; }
            @media (max-width: 480px) {
              .header { padding: 18px 20px; gap: 12px; }
              .brand { gap: 12px; }
              .index { display: none; }
              .footer { padding: 16px 20px; }
            }
          </style>
        </head>
        <body>
          <main class="card __STATE__">
            <header class="header">
              <div class="brand"><span class="mark">RAC</span><span class="label">WORKSPACE<br>ACCESS</span></div>
              <span class="label index" aria-hidden="true">AUTH / 01</span>
            </header>
            <div class="content">
              <div class="status"><span class="symbol" aria-hidden="true">__ICON__</span><span class="label">授权回调 / AUTHORIZATION</span></div>
              <h1>__TITLE__</h1>
              <p>__MESSAGE__</p>
            </div>
            <footer class="footer"><p class="note">此页面由本机客户端提供。登录结果以终端显示为准。</p></footer>
          </main>
          <script>history.replaceState(null, '', '/callback');</script>
        </body>
        </html>
        """;
}