use crate::i18n;
use leptos::prelude::*;
use wasm_bindgen_futures::spawn_local;

use crate::api::{self, LoginResp, Me, PasswordStep, input_value};
use crate::app::AuthPhase;
use crate::components::logo::Logo;

/// Where a sign-in currently stands.
///
/// An account that needs a password *and* a passkey can start with either
/// one, so both halves are a step the form can be parked on. Which half is
/// missing is the server's answer, never a guess here.
#[derive(Clone)]
enum Step {
    /// Name and password, plus the passkey button.
    Start,
    /// The password passed; the passkey is still to come. Nothing to fill in,
    /// the browser's own dialog is already open.
    NeedPasskey,
    /// A passkey passed; this account's password is still to come.
    NeedPassword(PasswordStep),
}

#[component]
pub fn LoginView(
    set_me: WriteSignal<Option<Me>>,
    set_phase: WriteSignal<AuthPhase>,
) -> impl IntoView {
    let (error, set_error) = signal(String::new());
    let (busy, set_busy) = signal(false);
    let (step, set_step) = signal(Step::Start);

    // Both legs can produce any of the three answers, so one place applies
    // them.
    let apply = move |resp: LoginResp| {
        if let Some(challenge) = resp.passkey_challenge {
            set_step.set(Step::NeedPasskey);
            spawn_local(async move {
                match api::passkey_finish(challenge, false).await {
                    // The browser request was cancelled to make room for
                    // another one. Nothing happened, so say nothing.
                    Ok(None) => {}
                    Ok(Some(next)) if next.ok => finish_session(set_me, set_phase, set_error),
                    Ok(Some(_)) => set_error.set(i18n::t(i18n::k::PASSKEY_NOT_USED).into()),
                    Err(e) => set_error.set(e.to_string()),
                }
                set_busy.set(false);
                set_step.set(Step::Start);
            });
            return;
        }
        if let Some(pending) = resp.password_required {
            set_step.set(Step::NeedPassword(pending));
            set_busy.set(false);
            return;
        }
        if resp.ok {
            finish_session(set_me, set_phase, set_error);
        }
        set_busy.set(false);
    };

    let on_submit = move |ev: web_sys::SubmitEvent| {
        ev.prevent_default();
        let pass = input_value("login-pass");
        // The second password step already knows the account, so the name
        // field is not on screen and not needed.
        let (name, state_id) = match step.get() {
            Step::NeedPassword(p) => (None, Some(p.state_id)),
            _ => {
                let n = input_value("login-name").trim().to_string();
                if n.is_empty() {
                    set_error.set(i18n::t(i18n::k::LOGIN_ERROR).into());
                    return;
                }
                (Some(n), None)
            }
        };
        if pass.is_empty() {
            set_error.set(i18n::t(i18n::k::LOGIN_ERROR).into());
            return;
        }
        set_error.set(String::new());
        set_busy.set(true);
        spawn_local(async move {
            match api::login(name, pass, state_id).await {
                Ok(resp) => apply(resp),
                Err(e) => {
                    set_error.set(e.to_string());
                    set_busy.set(false);
                    // The handle was spent on the way in, whether or not the
                    // password was right. Retrying on this step would send a
                    // dead one forever, so go back to the start.
                    if matches!(step.get_untracked(), Step::NeedPassword(_)) {
                        set_step.set(Step::Start);
                    }
                }
            }
        });
    };

    // The name goes along only if one was typed: without it the server issues
    // a discoverable challenge, which is what lets a passkey sign in with an
    // empty form.
    let on_passkey = move |_| {
        if busy.get() {
            return;
        }
        let name = input_value("login-name").trim().to_string();
        set_error.set(String::new());
        set_busy.set(true);
        spawn_local(async move {
            match api::passkey_login((!name.is_empty()).then_some(name), false).await {
                Ok(None) => set_busy.set(false),
                Ok(Some(resp)) => apply(resp),
                Err(e) => {
                    set_error.set(e.to_string());
                    set_busy.set(false);
                }
            }
        });
    };

    // Conditional mediation: the passkey offers itself in the name field's
    // autofill instead of behind a button. The request stays pending until
    // the user picks one, so it must not touch `busy` — the form has to keep
    // working while it waits.
    let supported = crate::passkey::supported();
    if supported {
        spawn_local(async move {
            if !crate::passkey::conditional_supported().await {
                return;
            }
            match api::passkey_login(None, true).await {
                Ok(Some(resp)) if resp.ok => finish_session(set_me, set_phase, set_error),
                Ok(Some(resp)) => {
                    set_busy.set(true);
                    apply(resp);
                }
                // Cancelled, or the page is going away. Either way silent.
                Ok(None) | Err(_) => {}
            }
        });
    }
    // Leaving the page with a conditional request still parked would block
    // the next `navigator.credentials.get`.
    on_cleanup(crate::passkey::cancel);

    view! {
        <div class="center-screen">
            <div class="card auth-card">
                <Logo class="auth-logo".to_string()/>
                <h1>"filebrowser-ng"</h1>
                <p class="muted">
                    {move || match step.get() {
                        Step::NeedPasskey => i18n::t(i18n::k::SECOND_FACTOR_PASSKEY).to_string(),
                        Step::NeedPassword(p) => {
                            i18n::t_fmt(i18n::k::SECOND_FACTOR_PASSWORD, &p.name)
                        }
                        Step::Start => i18n::t(i18n::k::LOGIN_SUBTITLE).to_string(),
                    }}
                </p>
                <form on:submit=on_submit>
                    <Show when=move || matches!(step.get(), Step::Start)>
                        <label class="field">
                            <span>{i18n::tr(i18n::k::NAME)}</span>
                            <input
                                id="login-name"
                                type="text"
                                autofocus=true
                                // `webauthn` is what puts passkeys into this
                                // field's autofill dropdown.
                                autocomplete="username webauthn"
                            />
                        </label>
                    </Show>
                    <Show when=move || !matches!(step.get(), Step::NeedPasskey)>
                        <label class="field">
                            <span>{i18n::tr(i18n::k::PASSWORD)}</span>
                            <input
                                id="login-pass"
                                type="password"
                                autocomplete="current-password"
                            />
                        </label>
                    </Show>
                    <p class="error">{move || error.get()}</p>
                    <Show when=move || !matches!(step.get(), Step::NeedPasskey)>
                        <button class="btn-primary" type="submit" disabled=move || busy.get()>
                            {i18n::tr(i18n::k::SIGN_IN)}
                        </button>
                    </Show>
                </form>
                <Show when=move || supported && matches!(step.get(), Step::Start)>
                    <p class="login-or">{i18n::tr(i18n::k::OR_LABEL)}</p>
                    <button class="btn" disabled=move || busy.get() on:click=on_passkey>
                        {i18n::tr(i18n::k::USE_PASSKEY)}
                    </button>
                    <p class="setting-desc">{i18n::tr(i18n::k::USE_PASSKEY_HINT)}</p>
                </Show>
            </div>
        </div>
    }
}

/// Load `/me` and hand the app over to the signed-in shell.
///
/// The current hash is kept, so a deep link (e.g. `#/users`) survives the
/// sign-in. A non-admin landing on an admin section is redirected to the
/// files view by the shell instead.
fn finish_session(
    set_me: WriteSignal<Option<Me>>,
    set_phase: WriteSignal<AuthPhase>,
    set_error: WriteSignal<String>,
) {
    spawn_local(async move {
        match api::me().await {
            Ok(m) => {
                set_me.set(Some(m));
                set_phase.set(AuthPhase::Authed);
            }
            Err(e) => set_error.set(e.to_string()),
        }
    });
}