using System.IdentityModel.Tokens.Jwt;
using System.Net;
using System.Security.Claims;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Text.Json;
using bdEmtusa;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.IdentityModel.Tokens;
using SwaggerAutenticacion.Clases;

namespace SwaggerAntifraude.Controllers
{
    [Route("api/[controller]")]
    [ApiController]
    public class AuthController : ControllerBase
    {
        private readonly IConfiguration _configuration;

        public AuthController(IConfiguration configuration)
        {
            _configuration = configuration;
        }

        [AllowAnonymous]
        [HttpPost("login")]
        public IActionResult Login([FromBody] DatosAuth datos)
        {
            if (!ModelState.IsValid)
                return BadRequest(ModelState);

            var token = AuthenticateUser(datos);

            if (token == null)
                return Unauthorized("Nombre de usuario o contraseña incorrectos.");

            if (token.Equals("no autorizado"))
            {
                return Unauthorized("Usuario no autorizado");
            }

            return Ok(BuildLoginResponse(token));
        }

        private string GenerateJwtToken(DatosAuth auth)
        {
            var jwtSettings = _configuration.GetSection("Jwt");
            var key = Encoding.UTF8.GetBytes(jwtSettings["Key"]!);

            var claims = new[]
            {
                new Claim(JwtRegisteredClaimNames.Sub, auth.nombreExterno),
                new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
                //new Claim(ClaimTypes.Role, persona.ADMINISTRARPTYREGISTRO == true ? "Supervisor" : "Lectura")
            };

            var tokenDescriptor = new SecurityTokenDescriptor
            {
                Subject = new ClaimsIdentity(claims),
                Expires = DateTime.UtcNow.AddMinutes(double.Parse(jwtSettings["ExpiresInMinutes"]!)),
                Issuer = jwtSettings["Issuer"],
                Audience = jwtSettings["Audience"],
                SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
            };

            var tokenHandler = new JwtSecurityTokenHandler();
            var token = tokenHandler.CreateToken(tokenDescriptor);
            return tokenHandler.WriteToken(token);
        }

        private static object BuildLoginResponse( string token)
        {
            return new
            {
                Token = token,
                //User = new
                //{
                //    persona.NIF,
                //    persona.NOMBRE,
                //    persona.APELLIDOS,
                //    persona.ADMINISTRARPTYREGISTRO
                //}
            };
        }

        private string AuthenticateUser(DatosAuth datos)
        {
            using (var context = tscEmtusa.NuevoContexto(SoloLectura: true))
            {
                var login = context.configuracion.First(x => x.codigo == "auth.login").valor;
                var pass = context.configuracion.First(x => x.codigo == "auth.pass").valor;

                if (datos.nombreExterno != "emtusanot" || datos.pwExterno != "tsemt2026#..")
                {
                    return ("Credenciales incorrectas");
                }

                var jwtToken = GenerateJwtToken(datos);
                return jwtToken;
            }
        }
    }
}