const express = require("express");
const bcrypt = require("bcryptjs");
const jwt = require("jsonwebtoken");
const crypto = require("crypto");
const User = require("../models/User");
const Movie = require("../models/Movie");
const Setting = require("../models/Setting");
const PlaybackProgress = require("../models/PlaybackProgress");
const axios = require("axios");

const router = express.Router();

// Set password for verification

const woof =
  typeof process.env.DOG_NAMES === "string"
    ? process.env.DOG_NAMES.split(",").map((s) => s.trim()).filter(Boolean)
    : [];

const ACTIVE_YEAR_KEY = "active_oscar_year";

// Fetch movie details from OMDb API
async function fetchMovieDetailsFromOmdb(imdb_id) {
  const apiKey = typeof process.env.OMDB_API === "string" ? process.env.OMDB_API.trim() : "";
  if (!apiKey) {
    const err = new Error("OMDb n'est pas configuré (env OMDB_API manquante).");
    err.code = "OMDB_NOT_CONFIGURED";
    throw err;
  }
  const omdbUrl = `https://www.omdbapi.com/?i=${encodeURIComponent(imdb_id)}&apikey=${apiKey}`;
  
  try {
    const response = await axios.get(omdbUrl);
    if (response.data.Response === "True") {
      return {
        title: response.data.Title.replace(/'/g, "")
      };
    } else {
      throw new Error('Movie not found on OMDb API');
    }
  } catch (error) {
    throw new Error(`Error fetching movie details: ${error.message}`);
  }
}

// Middleware to verify token
function verifyToken(req, res, next) {
  const token = req.headers['authorization'] && req.headers['authorization'].startsWith('Bearer ') 
    ? req.headers['authorization'].split(' ')[1] 
    : null;

  if (!token) {
    return res.status(403).json({ message: "No token provided, access denied." });
  }

  jwt.verify(token, process.env.JWT_SECRET, (err, decoded) => {
    if (err) {
      return res.status(401).json({ message: "Invalid or expired token" });
    }
    req.user = decoded;  // Store decoded user info for use in routes
    next();
  });
}

function parseOscarYear(raw) {
  if (raw === undefined || raw === null || raw === "") return null;
  const n = Number(raw);
  if (!Number.isInteger(n)) return null;
  if (n < 1900 || n > 3000) return null;
  return n;
}

function isAdminFromDecoded(decoded) {
  return !!decoded?.admin;
}

function signUserToken(user) {
  const isAdmin = user.role === 69;
  const expiresIn = typeof process.env.JWT_EXPIRES_IN === "string" && process.env.JWT_EXPIRES_IN.trim()
    ? process.env.JWT_EXPIRES_IN.trim()
    : "8h";
  return jwt.sign(
    {
      id: user._id,
      name: user.name,
      admin: isAdmin,
      mustChangePassword: !!user.mustChangePassword,
    },
    process.env.JWT_SECRET,
    { expiresIn }
  );
}

function generateTempPassword() {
  // 12 chars, URL-safe (no spaces/specials that break copy/paste)
  return crypto.randomBytes(9).toString("base64url");
}

const TEMP_PASSWORD_TTL_MS = 24 * 60 * 60 * 1000; // 24h

async function getOrInitActiveYear() {
  const existing = await Setting.findOne({ key: ACTIVE_YEAR_KEY });
  if (existing && typeof existing.value === "number") return existing.value;

  // Initialize from latest movie year if available, else from current year.
  const latestMovie = await Movie.findOne({ year: { $type: "number" } })
    .sort({ year: -1 })
    .select("year");

  const fallbackYear = latestMovie?.year || new Date().getFullYear();
  const year = parseOscarYear(fallbackYear) || new Date().getFullYear();

  await Setting.findOneAndUpdate(
    { key: ACTIVE_YEAR_KEY },
    { $set: { value: year } },
    { upsert: true, new: true }
  );

  return year;
}

// Get user stats with watched movie titles and details from the movies collection
router.get("/stats", verifyToken, async (req, res) => {
  try {
    // Fetch all users (only needed fields)
    const users = await User.find().select("name watchedMovies").lean();
    
    // If a year is explicitly provided, use it; otherwise default to the global active year.
    const year = parseOscarYear(req.query.year) || await getOrInitActiveYear();

    // Fetch movies (optionally filtered by year)
    const allMovies = await Movie.find({ year })
      .select("imdb_id title poster rating category year")
      .lean();
    const totalMoviesCount = allMovies.length;

    if (totalMoviesCount === 0) {
      return res.status(400).json({ message: "Aucun films disponible." });
    }

    // Build stats for each user
    const userStats = users.map((user) => {
      const movieByImdbId = new Map(allMovies.map((m) => [m.imdb_id, m]));

      // Join watched movies with movie details for the selected year (keep watchedDate)
      const watchedRaw = Array.isArray(user?.watchedMovies) ? user.watchedMovies : [];
      const watchedMoviesDetails = watchedRaw
        .map((wm) => {
          const imdbId = typeof wm?.imdb_id === "string" ? wm.imdb_id : "";
          if (!imdbId) return null;
          const movie = movieByImdbId.get(imdbId);
          if (!movie) return null;
          return {
            imdb_id: movie.imdb_id,
            title: movie.title || "",
            poster: movie.poster || "",
            rating: movie.rating || "",
            category: movie.category || "",
            year: Number.isInteger(movie.year) ? movie.year : year,
            watchedDate: wm?.watchedDate ? new Date(wm.watchedDate).toISOString() : null,
          };
        })
        .filter(Boolean);

      const watchedCount = watchedMoviesDetails.length;
      const watchedRatio = ((watchedCount / totalMoviesCount) * 100).toFixed(1);

      return {
        name: user.name,
        year,
        watchedCount,
        totalMoviesCount,
        watchedRatio: `${watchedRatio}%`,
        watchedMovies: watchedMoviesDetails // Include movie details
      };
    });

    res.json(userStats);
  } catch (err) {
    console.error("Erreur dans l'extraction des statistiques sur les utilisateurs :", err);
    res.status(500).json({ error: "Internal server error" });
  }
});

// Get users who have 100% completion per year (across all years in DB)
// Returns: { years: number[], totals: { [year]: number }, completersByYear: { [year]: {name, watchedCount, totalMoviesCount}[] } }
router.get("/completions", verifyToken, async (req, res) => {
  try {
    const yearsRaw = await Movie.distinct("year");
    const years = (Array.isArray(yearsRaw) ? yearsRaw : [])
      .map((y) => Number(y))
      .filter((y) => parseOscarYear(y))
      .sort((a, b) => b - a);

    if (years.length === 0) {
      return res.status(200).json({ years: [], totals: {}, completersByYear: {} });
    }

    // Fetch imdb_id + year for all movies that have a valid year
    const movies = await Movie.find({ year: { $in: years } }).select("imdb_id year").lean();

    const imdbIdsByYear = new Map();
    const totals = {};

    movies.forEach((m) => {
      const year = Number(m?.year);
      if (!parseOscarYear(year)) return;
      const imdb = typeof m?.imdb_id === "string" ? m.imdb_id : "";
      if (!imdb) return;
      if (!imdbIdsByYear.has(year)) imdbIdsByYear.set(year, new Set());
      imdbIdsByYear.get(year).add(imdb);
    });

    for (const y of years) {
      const set = imdbIdsByYear.get(y);
      totals[String(y)] = set ? set.size : 0;
    }

    const users = await User.find().select("name watchedMovies.imdb_id").lean();

    const completersByYear = {};
    for (const y of years) {
      const total = totals[String(y)] || 0;
      if (total <= 0) {
        completersByYear[String(y)] = [];
        continue;
      }
      const yearSet = imdbIdsByYear.get(y) || new Set();

      const completers = [];
      users.forEach((u) => {
        const watched = Array.isArray(u?.watchedMovies) ? u.watchedMovies : [];
        const watchedSet = new Set(
          watched
            .map((wm) => (typeof wm?.imdb_id === "string" ? wm.imdb_id : ""))
            .filter(Boolean)
        );

        let count = 0;
        for (const imdb of watchedSet) {
          if (yearSet.has(imdb)) count += 1;
        }

        if (count === total) {
          completers.push({
            name: u?.name || "(sans nom)",
            watchedCount: count,
            totalMoviesCount: total,
          });
        }
      });

      completers.sort((a, b) => String(a.name).localeCompare(String(b.name), "fr", { sensitivity: "base" }));
      completersByYear[String(y)] = completers;
    }

    return res.status(200).json({ years, totals, completersByYear });
  } catch (err) {
    console.error("Erreur dans l'extraction des completers:", err);
    return res.status(500).json({ error: "Internal server error" });
  }
});

// Register User
router.post("/register", async (req, res) => {
  const { name, email, password, verifoof } = req.body;
  const dogCheckEnabled = woof.length > 0;

  function registerVerification() {
    // If DOG_NAMES isn't configured, skip the "dog name" verification entirely.
    if (!dogCheckEnabled) return true;
    return woof.includes(verifoof);
  }

  try {
    const nameNorm = typeof name === "string" ? name.trim() : "";
    const emailNorm = typeof email === "string" ? email.trim() : "";

    if (!nameNorm) {
      throw new Error("Le nom est obligatoire");
    }
    if (!emailNorm) {
      throw new Error("L'email est obligatoire");
    }
    // Basic sanity check (not a full RFC validator)
    if (!/^\S+@\S+\.\S+$/.test(emailNorm)) {
      throw new Error("Email invalide.");
    }
    if (!password) {
      throw new Error("Le mot de passe est obligatoire et ne peut être indéfini");
    }
    if (dogCheckEnabled && !verifoof) {
      throw new Error("Le nom du chien doit être défini");
    }
    if (!registerVerification()) {
      return res.status(400).json({ message: "Mauvais nom de chien" });
    }

    const existingUser = await User.findOne({ email: emailNorm });
    if (existingUser) {
      return res.status(409).json({ message: "L'email existe déjà, veuillez en choisir un autre." });
    }
    
    // Hash password and create user
    const hashedPassword = await bcrypt.hash(password, 10);
    // SECURITY: never accept role escalation from a public endpoint.
    const user = new User({ name: nameNorm, email: emailNorm, password: hashedPassword, role: 0 });
    await user.save();

    res.status(201).json({ message: "L'utilisateur s'est enregistré avec succès !" });
  } catch (err) {
    return res.status(400).json({ message: err?.message || "Erreur interne" });
  }
});

// Login User
router.post("/login", async (req, res) => {
  const { email, password } = req.body;

  try {
    const user = await User.findOne({ email });
    if (!user) return res.status(404).json({ message: "L'utilisateur n'a pas été trouvé" });

    // If this account is in "temp password" mode and the temp password has expired, block login.
    if (user.mustChangePassword && user.tempPasswordExpiresAt && user.tempPasswordExpiresAt instanceof Date) {
      if (Date.now() > user.tempPasswordExpiresAt.getTime()) {
        return res.status(401).json({
          message: "Le mot de passe temporaire a expiré. Demandez à un admin de réinitialiser votre mot de passe.",
        });
      }
    }

    const isMatch = await bcrypt.compare(password, user.password);
    if (!isMatch) return res.status(401).json({ message: "Informations d'identification non valides" });

    console.log("[debug] " + user.name + " logged in")

    const token = signUserToken(user);
    res.status(200).json({ token, mustChangePassword: !!user.mustChangePassword });
  } catch (err) {
    res.status(400).json({ error: err.message });
  }
});

// Admin: reset a user's password to a random temp password and force change on next login.
router.post("/admin/reset-temp-password", verifyToken, async (req, res) => {
  if (!isAdminFromDecoded(req.user)) {
    return res.status(403).json({ message: "You do not have admin privileges" });
  }

  const { email, userId } = req.body || {};
  const emailNorm = typeof email === "string" ? email.trim() : "";
  const idNorm = typeof userId === "string" ? userId.trim() : "";

  if (!emailNorm && !idNorm) {
    return res.status(400).json({ message: "Email ou userId requis." });
  }

  try {
    const user = emailNorm ? await User.findOne({ email: emailNorm }) : await User.findById(idNorm);
    if (!user) return res.status(404).json({ message: "User not found" });

    const tempPassword = generateTempPassword();
    const hashedPassword = await bcrypt.hash(tempPassword, 10);
    const expiresAt = new Date(Date.now() + TEMP_PASSWORD_TTL_MS);

    user.password = hashedPassword;
    user.mustChangePassword = true;
    user.tempPasswordIssuedAt = new Date();
    user.tempPasswordExpiresAt = expiresAt;
    await user.save();

    return res.status(200).json({
      message: "Mot de passe temporaire généré. L'utilisateur devra le changer à sa prochaine connexion.",
      tempPassword,
      expiresAt: expiresAt.toISOString(),
      user: { id: String(user._id), name: user.name, email: user.email },
    });
  } catch (err) {
    return res.status(500).json({ error: err.message });
  }
});

// Admin: list users (safe fields only)
router.get("/admin/list", verifyToken, async (req, res) => {
  if (!isAdminFromDecoded(req.user)) {
    return res.status(403).json({ message: "You do not have admin privileges" });
  }

  try {
    const users = await User.find()
      .select("name email role mustChangePassword")
      .sort({ name: 1, email: 1 });

    return res.status(200).json(
      users.map((u) => ({
        id: String(u._id),
        name: u.name,
        email: u.email,
        admin: u.role === 69,
        mustChangePassword: !!u.mustChangePassword,
      }))
    );
  } catch (err) {
    return res.status(500).json({ error: err.message });
  }
});

// Admin: create a user with a random temp password (forces change on first login).
router.post("/admin/create", verifyToken, async (req, res) => {
  if (!isAdminFromDecoded(req.user)) {
    return res.status(403).json({ message: "You do not have admin privileges" });
  }

  const { name, email, admin } = req.body || {};
  const nameNorm = typeof name === "string" ? name.trim() : "";
  const emailNorm = typeof email === "string" ? email.trim() : "";
  const makeAdmin = !!admin;

  if (!nameNorm) {
    return res.status(400).json({ message: "Nom requis." });
  }
  if (!emailNorm) {
    return res.status(400).json({ message: "Email requis." });
  }
  // Basic sanity check (not a full RFC validator)
  if (!/^\S+@\S+\.\S+$/.test(emailNorm)) {
    return res.status(400).json({ message: "Email invalide." });
  }

  try {
    const existingUser = await User.findOne({ email: emailNorm });
    if (existingUser) {
      return res.status(409).json({ message: "L'email existe déjà, veuillez en choisir un autre." });
    }

    const tempPassword = generateTempPassword();
    const hashedPassword = await bcrypt.hash(tempPassword, 10);
    const expiresAt = new Date(Date.now() + TEMP_PASSWORD_TTL_MS);

    const user = new User({
      name: nameNorm,
      email: emailNorm,
      password: hashedPassword,
      role: makeAdmin ? 69 : 0,
      mustChangePassword: true,
      tempPasswordIssuedAt: new Date(),
      tempPasswordExpiresAt: expiresAt,
    });

    await user.save();

    return res.status(201).json({
      message: "Utilisateur créé. Mot de passe temporaire généré.",
      tempPassword,
      expiresAt: expiresAt.toISOString(),
      user: { id: String(user._id), name: user.name, email: user.email, admin: user.role === 69, mustChangePassword: true },
    });
  } catch (err) {
    return res.status(500).json({ error: err.message });
  }
});

// Admin: delete a user (and related playback progress)
router.post("/admin/delete", verifyToken, async (req, res) => {
  if (!isAdminFromDecoded(req.user)) {
    return res.status(403).json({ message: "You do not have admin privileges" });
  }

  const { email, userId } = req.body || {};
  const emailNorm = typeof email === "string" ? email.trim() : "";
  const idNorm = typeof userId === "string" ? userId.trim() : "";

  if (!emailNorm && !idNorm) {
    return res.status(400).json({ message: "Email ou userId requis." });
  }

  try {
    const user = emailNorm ? await User.findOne({ email: emailNorm }) : await User.findById(idNorm);
    if (!user) return res.status(404).json({ message: "User not found" });

    // Safety: prevent deleting yourself from the admin UI.
    if (String(user._id) === String(req.user?.id || "")) {
      return res.status(400).json({ message: "Impossible de supprimer ton propre compte." });
    }

    // Safety: prevent deleting admin accounts via the UI endpoint.
    if (user.role === 69) {
      return res.status(400).json({ message: "Impossible de supprimer un compte admin via cette interface." });
    }

    await PlaybackProgress.deleteMany({ userId: user._id });
    await User.deleteOne({ _id: user._id });

    return res.status(200).json({
      message: "Utilisateur supprimé.",
      user: { id: String(user._id), name: user.name, email: user.email },
    });
  } catch (err) {
    return res.status(500).json({ error: err.message });
  }
});

// User: change password (used after temp-password login). Returns a fresh token.
router.post("/change-password", verifyToken, async (req, res) => {
  const { newPassword } = req.body || {};
  const pw = typeof newPassword === "string" ? newPassword : "";

  if (!pw || pw.length < 8) {
    return res.status(400).json({ message: "Le nouveau mot de passe doit contenir au moins 8 caractères." });
  }

  try {
    const user = await User.findById(req.user?.id);
    if (!user) return res.status(404).json({ message: "User not found" });

    const hashedPassword = await bcrypt.hash(pw, 10);
    user.password = hashedPassword;
    user.mustChangePassword = false;
    user.tempPasswordIssuedAt = null;
    user.tempPasswordExpiresAt = null;
    await user.save();

    const token = signUserToken(user);
    return res.status(200).json({ message: "Mot de passe mis à jour.", token });
  } catch (err) {
    return res.status(500).json({ error: err.message });
  }
});

// Protected route to get movies (example)
router.get("/movies", verifyToken, async (req, res) => {
  // Only authorized users will reach this point
  const movies = await Movie.find();  // Assuming Movie model exists
  res.json(movies);
});

module.exports = router;