"""认证服务模块 - 密码哈希、令牌管理、会话管理、默认管理员创建"""

import hashlib
import logging
import secrets
from datetime import datetime, timedelta

from sqlalchemy import select
from sqlalchemy.ext.asyncio import AsyncSession

from app.config import settings
from app.models.user import Session, User

logger = logging.getLogger(__name__)


def hash_password(password: str) -> str:
    """使用 SHA256 + 随机盐 对密码进行哈希。"""
    salt = secrets.token_hex(16)
    hashed = hashlib.sha256(f"{salt}{password}".encode()).hexdigest()
    return f"{salt}:{hashed}"


def verify_password(password: str, password_hash: str) -> bool:
    """验证密码是否与哈希值匹配。

    兼容两种分隔符格式：
    - 新版: salt:hash（冒号分隔）
    - 旧版: salt$hash（美元符号分隔，从原版迁移的数据）
    """
    # 尝试冒号分隔（新版）
    if ":" in password_hash:
        salt, expected = password_hash.split(":", 1)
    elif "$" in password_hash:
        # 美元符号分隔（旧版迁移数据）
        salt, expected = password_hash.split("$", 1)
    else:
        return False
    actual = hashlib.sha256(f"{salt}{password}".encode()).hexdigest()
    return secrets.compare_digest(actual, expected)


async def create_token(user_id: int, db: AsyncSession) -> str:
    """为用户创建会话令牌并持久化。

    Returns:
        生成的令牌字符串。
    """
    token = secrets.token_urlsafe(32)
    session = Session(
        user_id=user_id,
        token=token,
        expires_at=datetime.utcnow() + timedelta(hours=settings.jwt_expire_hours),
        is_valid=True,
    )
    db.add(session)
    await db.commit()
    return token


async def verify_token(token: str, db: AsyncSession) -> User | None:
    """验证令牌有效性，返回对应的 User 对象或 None。"""
    stmt = select(Session).where(
        Session.token == token,
        Session.is_valid == True,  # noqa: E712
        Session.expires_at > datetime.utcnow(),
    )
    result = await db.execute(stmt)
    session = result.scalar_one_or_none()
    if not session:
        return None

    stmt_user = select(User).where(User.id == session.user_id)
    result_user = await db.execute(stmt_user)
    user = result_user.scalar_one_or_none()
    if not user or not user.is_active:
        return None

    return user


async def authenticate_user(
    db: AsyncSession, username: str, password: str
) -> User | None:
    """验证用户名和密码，返回 User 对象或 None。"""
    stmt = select(User).where(User.username == username)
    result = await db.execute(stmt)
    user = result.scalar_one_or_none()
    if not user or not verify_password(password, user.password_hash):
        return None
    return user


async def invalidate_session(token: str, db: AsyncSession) -> None:
    """使指定令牌失效。"""
    stmt = select(Session).where(Session.token == token)
    result = await db.execute(stmt)
    session = result.scalar_one_or_none()
    if session:
        session.is_valid = False
        await db.flush()


async def update_last_login(user: User, db: AsyncSession) -> None:
    """更新用户最后登录时间。"""
    user.last_login = datetime.utcnow()
    await db.flush()


async def create_default_admin(db: AsyncSession) -> None:
    """如果数据库中不存在管理员账户 lxy_root，则创建默认管理员。"""
    stmt = select(User).where(User.username == "lxy_root")
    result = await db.execute(stmt)
    admin = result.scalar_one_or_none()
    if not admin:
        user = User(
            username="lxy_root",
            password_hash=hash_password("admin123"),
            email="admin@system.local",
            role="admin",
            is_active=True,
        )
        db.add(user)
        await db.commit()
        logger.info("默认管理员账户已创建: lxy_root / admin123")