"use client";

/**
 * AuthenticationSection — the connect-accounts / email / password controls
 * for the /settings/account page.
 *
 * Split out of the old monolithic /settings page so account & security lives
 * on its own dedicated screen. OAuth link flows return to /settings/account
 * (via `next`), and the post-link banner (LinkResult) reads/clears the
 * `?link=` param there.
 */

import { Suspense, useEffect, useState } from "react";
import { useRouter, useSearchParams } from "next/navigation";
import { AlertCircle, Check } from "lucide-react";
import { auth, AuthError } from "@/lib/auth";
import { useAuth } from "@/components/auth/auth-provider";
import { AddEmailModal } from "@/components/auth/add-email-modal";
import { ChangePasswordModal } from "@/components/auth/change-password-modal";
import { Row } from "@/components/settings/settings-ui";

const BFF_BASE = process.env.NEXT_PUBLIC_BFF_URL || "http://localhost:8080";

/** Where OAuth link flows and the result banner return to. */
const RETURN_TO = "/settings/account";

export function AuthenticationSection() {
  const { user } = useAuth();
  const [pwModalOpen, setPwModalOpen] = useState(false);
  const [emailModalOpen, setEmailModalOpen] = useState(false);
  const [linkedProviders, setLinkedProviders] = useState<Set<string> | null>(
    null,
  );

  // Fetch linked providers on mount. A null set means "not yet loaded" — we
  // render the rows as if nothing is connected until the answer comes back,
  // which is fine because the only thing that changes after load is the
  // "Connected" pill swapping in for "Connect".
  useEffect(() => {
    let cancelled = false;
    auth
      .linkedProviders()
      .then(({ providers }) => {
        if (!cancelled) setLinkedProviders(new Set(providers));
      })
      .catch(() => {
        if (!cancelled) setLinkedProviders(new Set());
      });
    return () => {
      cancelled = true;
    };
  }, []);

  function startOAuth(provider: "facebook" | "google") {
    // /link/start — links the provider to the currently-authenticated
    // user (auth cookie travels on the top-level navigation). The login
    // page still uses /start for sign-in / sign-up.
    const u = new URL(`${BFF_BASE}/api/v1/auth/oauth/${provider}/link/start`);
    u.searchParams.set("next", RETURN_TO);
    return u.toString();
  }

  function providerAction(provider: "google" | "facebook") {
    if (linkedProviders?.has(provider)) {
      return <ConnectedPill />;
    }
    return (
      <a
        href={startOAuth(provider)}
        className="text-sm font-medium text-primary hover:underline"
      >
        Connect
      </a>
    );
  }

  // Three contextual states for the email-related rows:
  //   • user has no email                   → "Add your email" row only
  //   • user has email, NOT verified         → "Verify your email" row +
  //                                            "Change your password" row
  //   • user has email, verified             → "Change your password" row
  const needsEmail = !user?.email;
  const needsVerify = !!user?.email && !user.email_verified_at;

  return (
    <>
      {/* Suspense boundary required because LinkResult reads
          useSearchParams — Next.js bails out of SSR otherwise. */}
      <Suspense fallback={null}>
        <LinkResult />
      </Suspense>
      <ul className="divide-y divide-border">
        <Row
          icon={<GoogleGlyph />}
          label="Connect your Google account"
          action={providerAction("google")}
        />
        <Row
          icon={<FacebookGlyph />}
          label="Connect your Facebook account"
          action={providerAction("facebook")}
        />
        {needsEmail ? (
          <Row
            label="Add your email"
            description="Required for password recovery. We'll send a verification link."
            action={
              <button
                type="button"
                onClick={() => setEmailModalOpen(true)}
                className="text-sm font-medium text-primary hover:underline"
              >
                Add email
              </button>
            }
          />
        ) : (
          <>
            {needsVerify ? <VerifyEmailRow email={user!.email!} /> : null}
            <Row
              label="Change your password"
              description="Update the password you use to sign in."
              action={
                <button
                  type="button"
                  onClick={() => setPwModalOpen(true)}
                  className="text-sm font-medium text-primary hover:underline"
                >
                  Change
                </button>
              }
            />
          </>
        )}
      </ul>
      <ChangePasswordModal
        open={pwModalOpen}
        onClose={() => setPwModalOpen(false)}
      />
      <AddEmailModal
        open={emailModalOpen}
        onClose={() => setEmailModalOpen(false)}
      />
    </>
  );
}

function VerifyEmailRow({ email }: { email: string }) {
  const [busy, setBusy] = useState(false);
  const [sent, setSent] = useState(false);
  const [error, setError] = useState<string | null>(null);

  async function onResend() {
    setError(null);
    setBusy(true);
    try {
      await auth.resendVerification();
      setSent(true);
    } catch (err) {
      setError(
        err instanceof AuthError
          ? err.message
          : "Could not send verification email.",
      );
    } finally {
      setBusy(false);
    }
  }

  return (
    <Row
      label="Verify your email"
      description={
        sent
          ? `✓ Verification email sent to ${email}.`
          : error ??
            `We need to confirm ${email} before it can be used for recovery.`
      }
      action={
        sent ? (
          <span className="text-sm text-muted-foreground">Sent</span>
        ) : (
          <button
            type="button"
            onClick={onResend}
            disabled={busy}
            className="text-sm font-medium text-primary hover:underline disabled:opacity-60"
          >
            {busy ? "Sending…" : "Resend"}
          </button>
        )
      }
    />
  );
}

function LinkResult() {
  const params = useSearchParams();
  const router = useRouter();
  const raw = params.get("link");

  // Strip the param from the URL so a refresh doesn't re-show the banner.
  useEffect(() => {
    if (!raw) return;
    const next = new URLSearchParams(params.toString());
    next.delete("link");
    const q = next.toString();
    router.replace(q ? `${RETURN_TO}?${q}` : RETURN_TO);
  }, [raw, params, router]);

  if (!raw) return null;

  // Format: "<provider>:<status>" — `google:ok`, `facebook:claimed`, etc.
  const [provider, status] = raw.split(":", 2);
  const name = provider.charAt(0).toUpperCase() + provider.slice(1);

  if (status === "ok") {
    return (
      <p className="mb-4 inline-flex items-center gap-2 rounded-md bg-emerald-500/10 text-emerald-700 dark:text-emerald-300 px-3 py-2 text-sm">
        <Check className="size-4" />
        Connected your {name} account.
      </p>
    );
  }
  if (status === "claimed") {
    return (
      <p className="mb-4 inline-flex items-center gap-2 rounded-md bg-destructive/10 text-destructive px-3 py-2 text-sm">
        <AlertCircle className="size-4" />
        That {name} account is already linked to another Prabhupāda Says
        account.
      </p>
    );
  }
  return (
    <p className="mb-4 inline-flex items-center gap-2 rounded-md bg-destructive/10 text-destructive px-3 py-2 text-sm">
      <AlertCircle className="size-4" />
      Couldn&apos;t connect your {name} account. Please try again.
    </p>
  );
}

function ConnectedPill() {
  return (
    <span className="inline-flex items-center gap-1 rounded-full bg-emerald-500/10 text-emerald-700 dark:text-emerald-300 px-2 py-0.5 text-xs font-medium">
      <Check className="size-3" />
      Connected
    </span>
  );
}

function GoogleGlyph() {
  return (
    <svg
      className="size-4"
      viewBox="0 0 24 24"
      xmlns="http://www.w3.org/2000/svg"
      aria-hidden
    >
      <path
        fill="#4285F4"
        d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92a5.06 5.06 0 0 1-2.2 3.32v2.76h3.56c2.08-1.92 3.28-4.74 3.28-8.09Z"
      />
      <path
        fill="#34A853"
        d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.56-2.76c-.99.66-2.25 1.06-3.72 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84A11 11 0 0 0 12 23Z"
      />
      <path
        fill="#FBBC05"
        d="M5.84 14.11A6.59 6.59 0 0 1 5.5 12c0-.73.13-1.45.34-2.11V7.05H2.18A11 11 0 0 0 1 12c0 1.78.43 3.46 1.18 4.95l3.66-2.84Z"
      />
      <path
        fill="#EA4335"
        d="M12 5.38c1.62 0 3.06.56 4.21 1.65l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.05l3.66 2.84C6.71 7.31 9.14 5.38 12 5.38Z"
      />
    </svg>
  );
}

function FacebookGlyph() {
  return (
    <svg
      className="size-4"
      viewBox="0 0 24 24"
      xmlns="http://www.w3.org/2000/svg"
      aria-hidden
    >
      <path
        fill="#1877F2"
        d="M24 12a12 12 0 1 0-13.88 11.85V15.47H7.08V12h3.04V9.36c0-3 1.79-4.67 4.53-4.67 1.31 0 2.69.24 2.69.24v2.96H15.83c-1.49 0-1.95.92-1.95 1.87V12h3.32l-.53 3.47h-2.79v8.38A12 12 0 0 0 24 12Z"
      />
    </svg>
  );
}