//! Page: admin user management (`/admin/users`). Non-admins get 404.

use forge_core::names::{normalize_name, validate_username};
use forge_core::store::user_delete::{DeletionReport, GHOST_USERNAME};
use forge_core::{AuditAction, Session, Store, User};
use serde::Deserialize;
use topcoat::Result;
use topcoat::context::{Cx, app_context};
use topcoat::router::content::Form;
use topcoat::router::error::{forbidden, not_found, see_other};
use topcoat::router::{page, path_param_segment};
use topcoat::view::{View, component, view};

use crate::audit::{self, Actor, Target};
use crate::auth::{check_csrf, current_user, hash_password_async};
use crate::i18n::admin::{self as g, K};
use crate::i18n::{self, Key, Lang};
use crate::state::AppState;
use crate::views::{alert, enc, shell, user_facing_message};

const MIN_PASSWORD_CHARS: usize = 12;
const MAX_PASSWORD_BYTES: usize = 1024;

#[derive(Deserialize)]
struct CreateUserForm {
    #[serde(default)]
    csrf: String,
    #[serde(default)]
    username: String,
    #[serde(default)]
    email: String,
    #[serde(default)]
    password: String,
    /// Checkbox: present with any value when checked.
    #[serde(default)]
    is_admin: Option<String>,
}

#[derive(Deserialize)]
struct DeleteForm {
    #[serde(default)]
    csrf: String,
    #[serde(default)]
    confirm_username: String,
}

/// The ghost account is reserved and never shown as a deletable user.
fn is_ghost(user: &User) -> bool {
    normalize_name(&user.username) == GHOST_USERNAME
}

#[component]
async fn users_view(
    lang: Lang,
    csrf: &str,
    viewer_id: &str,
    users: Vec<User>,
    error: Option<String>,
) -> Result<impl View> {
    Ok(view! {
        <section class="page-head">
            <h1>(g::t(lang, K::Users))</h1>
            <p><a href="/admin/audit">(g::t(lang, K::AuditLog))</a> " · " <a href="/admin/backups">(g::t(lang, K::Backups))</a> " · " <a href="/admin/replication">(g::t(lang, K::Replication))</a> " · " <a href="/admin/mail">(g::t(lang, K::Mail))</a> " · " <a href="/admin/runners">(g::t(lang, K::Runners))</a> " · " <a href="/admin/invites">(g::t(lang, K::Invites))</a></p>
        </section>
        <section class="card">
            <div class="table-wrap">
                <table class="table">
                    <thead>
                        <tr><th>(i18n::t(lang, Key::Username))</th><th>(i18n::t(lang, Key::Email))</th><th>(g::t(lang, K::Role))</th><th>(i18n::t(lang, Key::Created))</th><th></th></tr>
                    </thead>
                    <tbody>
                        for user in users.into_iter() {
                            <tr>
                                <td>(user.username.clone())</td>
                                <td>(user.email.clone().unwrap_or_default())</td>
                                <td>(if user.is_org() { g::t(lang, K::RoleOrganization) } else if user.is_admin { g::t(lang, K::RoleAdmin) } else { g::t(lang, K::RoleUser) })</td>
                                <td class="small">(user.created_at.clone())</td>
                                <td>
                                    if user.id != viewer_id && !is_ghost(&user) {
                                        <a class="danger" href=(format!("/admin/users/{}/delete", enc(&user.id)))>(i18n::t(lang, Key::Delete))</a>
                                    }
                                </td>
                            </tr>
                        }
                    </tbody>
                </table>
            </div>
        </section>
        <section class="card">
            <h2>(g::t(lang, K::CreateAUser))</h2>
            if let Some(message) = error {
                alert(message: message.as_str())
            }
            <form method="post" action="/admin/users" class="stack">
                <input type="hidden" name="csrf" value=(csrf)>
                <label>
                    <span>(i18n::t(lang, Key::Username))</span>
                    <input type="text" name="username" required=(true) autocomplete="off">
                </label>
                <label>
                    <span>(i18n::t(lang, Key::EmailOptional))</span>
                    <input type="email" name="email" autocomplete="off">
                </label>
                <label>
                    <span>(i18n::t(lang, Key::Password))</span>
                    <input type="password" name="password" required=(true) autocomplete="new-password">
                    <small class="muted">(g::t(lang, K::AtLeast12Chars))</small>
                </label>
                <label class="inline">
                    <input type="checkbox" name="is_admin" value="yes">
                    <span>(g::t(lang, K::Administrator))</span>
                </label>
                <button type="submit" class="primary">(g::t(lang, K::CreateUser))</button>
            </form>
        </section>
    })
}

#[page("/admin/users")]
async fn users_page(cx: &Cx) -> Result<impl View> {
    let viewer = admin_only(cx).await?;
    let lang = i18n::lang(cx, Some(&viewer.0));
    let users = app_context::<AppState>(cx).store.list_users().await?;
    let csrf = viewer.1.csrf_token.clone();
    let title = g::t(lang, K::Users);
    Ok(view! {
        shell(title: title, viewer: Some(&viewer), users_view(lang: lang, csrf: csrf.as_str(), viewer_id: viewer.0.id.as_str(), users: users, error: None))
    })
}

#[page(POST "/admin/users")]
async fn users_create(cx: &Cx, Form(form): Form<CreateUserForm>) -> Result<impl View> {
    let viewer = admin_only(cx).await?;
    if !check_csrf(&viewer.1, &form.csrf) {
        return Err(forbidden().into());
    }
    let lang = i18n::lang(cx, Some(&viewer.0));
    let store = &app_context::<AppState>(cx).store;

    // Ok(Ok(user)) created; Ok(Err(message)) rejected with a user-facing message.
    let outcome: Result<std::result::Result<User, String>> = create_user(store, &form, lang).await;
    match outcome? {
        Ok(created) => {
            audit::record(
                store,
                Some(cx),
                Actor::User(&viewer.0),
                AuditAction::UserCreated,
                Target {
                    kind: "user",
                    id: &created.id,
                    name: &created.username,
                },
                serde_json::json!({ "admin": created.is_admin }),
            )
            .await;
            Err(see_other("/admin/users").into())
        }
        Err(message) => {
            let users = store.list_users().await?;
            let csrf = viewer.1.csrf_token.clone();
            let title = g::t(lang, K::Users);
            Ok(view! {
                shell(title: title, viewer: Some(&viewer), users_view(lang: lang, csrf: csrf.as_str(), viewer_id: viewer.0.id.as_str(), users: users, error: Some(message)))
            })
        }
    }
}

/// The signed-in admin, or 404 for anonymous users and non-admins alike.
pub(crate) async fn admin_only(cx: &Cx) -> Result<(User, Session)> {
    match current_user(cx).await? {
        Some(viewer) if viewer.0.is_admin => Ok(viewer),
        _ => Err(not_found().into()),
    }
}

/// Validates the form and creates the user. The inner `Err` is a user-facing rejection.
async fn create_user(
    store: &forge_core::Store,
    form: &CreateUserForm,
    lang: Lang,
) -> Result<std::result::Result<User, String>> {
    let username = match validate_username(&form.username) {
        Ok((name, _)) => name,
        Err(e) => {
            return Ok(Err(user_facing_message(&e)
                .unwrap_or_else(|| g::t(lang, K::ErrInvalidUsername).to_owned())));
        }
    };
    if form.password.chars().count() < MIN_PASSWORD_CHARS {
        return Ok(Err(g::password_min_error(lang, MIN_PASSWORD_CHARS)));
    }
    if form.password.len() > MAX_PASSWORD_BYTES {
        return Ok(Err(g::t(lang, K::ErrPasswordTooLong).to_owned()));
    }
    let email = form.email.trim();
    let email = (!email.is_empty()).then_some(email);
    let hash = hash_password_async(form.password.clone()).await?;
    match store
        .create_user(&username, email, &hash, form.is_admin.is_some())
        .await
    {
        Ok(created) => Ok(Ok(created)),
        Err(e) => match user_facing_message(&e) {
            Some(message) => Ok(Err(message)),
            None => Err(e.into()),
        },
    }
}

/// Rows moved and removed by a deletion, as `"<n> <label>"` lines, skipping empty kinds.
fn impact_lines(rows: &[(&'static str, u64)]) -> Vec<String> {
    rows.iter()
        .filter(|(_, n)| *n > 0)
        .map(|(label, n)| format!("{n} {label}"))
        .collect()
}

/// What a deletion would move and remove, or the reason it is refused.
struct Impact {
    moved: Vec<String>,
    removed: Vec<String>,
}

/// The owned repositories of `target` (listed when non-empty) and either its impact or the
/// refusal message. Changes nothing and does not create the ghost account.
async fn review_target(
    store: &Store,
    target: &User,
    lang: Lang,
) -> Result<(Vec<String>, std::result::Result<Impact, String>)> {
    let repos = store
        .list_repos_by_owner(&target.id)
        .await?
        .into_iter()
        .map(|repo| format!("{}/{}", repo.owner_name, repo.name))
        .collect();
    let ghost_id = store.user_by_username(GHOST_USERNAME).await?.map(|g| g.id);
    let outcome = match store
        .deletion_preview(&target.id, ghost_id.as_deref())
        .await
    {
        Ok(DeletionReport {
            reassigned,
            removed,
        }) => Ok(Impact {
            moved: impact_lines(&reassigned),
            removed: impact_lines(&removed),
        }),
        Err(e) => Err(user_facing_message(&e)
            .unwrap_or_else(|| g::t(lang, K::ErrAccountCannotBeDeleted).to_owned())),
    };
    Ok((repos, outcome))
}

#[component]
async fn delete_body(
    lang: Lang,
    csrf: &str,
    target: User,
    repos: Vec<String>,
    impact: Option<Impact>,
    refusal: Option<String>,
    error: Option<String>,
) -> Result<impl View> {
    let has_repos = !repos.is_empty();
    let action = format!("/admin/users/{}/delete", enc(&target.id));
    let prompt = g::type_to_confirm(lang, &target.username);
    Ok(view! {
        <section class="page-head">
            <h1>(g::t(lang, K::DeleteUser))</h1>
        </section>
        <section class="card">
            if let Some(message) = error {
                alert(message: message.as_str())
            }
            if let Some(message) = refusal {
                alert(message: message.as_str())
            }
            <p>(g::t(lang, K::DeletesAccount))<strong>(target.username.as_str())</strong>(g::t(lang, K::DeleteAccountRest))</p>
            if has_repos {
                <p>(g::t(lang, K::TransferOrDeleteFirst))</p>
                <ul class="item-list">
                    for name in repos.into_iter() {
                        <li>(name)</li>
                    }
                </ul>
            }
            if let Some(impact) = impact {
                <h2>(g::t(lang, K::WhatHappens))</h2>
                <p>(g::t(lang, K::MovedToGhost))</p>
                <ul class="item-list">
                    for line in impact.moved.into_iter() {
                        <li>(line)</li>
                    }
                </ul>
                <p>(g::t(lang, K::RemovedWithAccount))</p>
                <ul class="item-list">
                    for line in impact.removed.into_iter() {
                        <li>(line)</li>
                    }
                </ul>
                <form method="post" action=(action.as_str()) class="stack">
                    <input type="hidden" name="csrf" value=(csrf)>
                    <label>
                        <span>(prompt.as_str())</span>
                        <input type="text" name="confirm_username" autocomplete="off" required=(true)>
                    </label>
                    <button type="submit" class="danger">(g::t(lang, K::DeleteUser))</button>
                </form>
            }
            <p><a href="/admin/users">(g::t(lang, K::BackToUsers))</a></p>
        </section>
    })
}

#[page("/admin/users/{user_id}/delete")]
async fn user_delete_page(cx: &Cx) -> Result<impl View> {
    let viewer = admin_only(cx).await?;
    let lang = i18n::lang(cx, Some(&viewer.0));
    let store = &app_context::<AppState>(cx).store;
    let target_id = path_param_segment(cx, "user_id").to_owned();
    let Some(target) = store.user_by_id(&target_id).await? else {
        return Err(not_found().into());
    };
    if target.id == viewer.0.id {
        return Err(see_other("/settings/security").into());
    }
    if is_ghost(&target) {
        return Err(not_found().into());
    }
    let (repos, outcome) = review_target(store, &target, lang).await?;
    let (impact, refusal) = match outcome {
        Ok(impact) => (Some(impact), None),
        Err(message) => (None, Some(message)),
    };
    let csrf = viewer.1.csrf_token.clone();
    let title = g::t(lang, K::DeleteUser);
    Ok(view! {
        shell(title: title, viewer: Some(&viewer), delete_body(lang: lang, csrf: csrf.as_str(), target: target, repos: repos, impact: impact, refusal: refusal, error: None))
    })
}

#[page(POST "/admin/users/{user_id}/delete")]
async fn user_delete(cx: &Cx, Form(form): Form<DeleteForm>) -> Result<impl View> {
    let viewer = admin_only(cx).await?;
    if !check_csrf(&viewer.1, &form.csrf) {
        return Err(forbidden().into());
    }
    let lang = i18n::lang(cx, Some(&viewer.0));
    let store = &app_context::<AppState>(cx).store;
    let target_id = path_param_segment(cx, "user_id").to_owned();
    let Some(target) = store.user_by_id(&target_id).await? else {
        return Err(not_found().into());
    };
    if target.id == viewer.0.id {
        return Err(see_other("/settings/security").into());
    }
    if is_ghost(&target) {
        return Err(not_found().into());
    }
    let error = if form.confirm_username != target.username {
        Some(g::t(lang, K::ErrTypeUsernameExactly).to_owned())
    } else {
        let ghost = store.ensure_ghost_user().await?;
        match store.delete_user(&target.id, &ghost.id).await {
            Ok(_) => {
                audit::record(
                    store,
                    Some(cx),
                    Actor::User(&viewer.0),
                    AuditAction::UserDeleted,
                    Target {
                        kind: "user",
                        id: &target.id,
                        name: &target.username,
                    },
                    serde_json::json!({ "reassigned_to": GHOST_USERNAME }),
                )
                .await;
                return Err(see_other("/admin/users").into());
            }
            Err(e) => match user_facing_message(&e) {
                Some(message) => Some(message),
                None => return Err(e.into()),
            },
        }
    };
    let (repos, outcome) = review_target(store, &target, lang).await?;
    let (impact, refusal) = match outcome {
        Ok(impact) => (Some(impact), None),
        Err(message) => (None, Some(message)),
    };
    let csrf = viewer.1.csrf_token.clone();
    let title = g::t(lang, K::DeleteUser);
    Ok(view! {
        shell(title: title, viewer: Some(&viewer), delete_body(lang: lang, csrf: csrf.as_str(), target: target, repos: repos, impact: impact, refusal: refusal, error: error))
    })
}