const { app, BrowserWindow, ipcMain, shell, safeStorage } = require('electron');
const path = require('path');
const fs = require('fs');
const authClient = require('./backend/authClient.cjs');
const httpClient = require('./backend/httpClient.cjs');
const employeesClient = require('./backend/employeesClient.cjs');
const usersClient = require('./backend/usersClient.cjs');

app.commandLine.appendSwitch('lang', 'de');

let mainWindow;
const isDev = !app.isPackaged;

let session = { accessToken: null, expiresAt: null, user: null, mustChangePassword: false };
let refreshTimer = null;
const REFRESH_BUFFER_MS = 2 * 60 * 1000;

function sessionFilePath() { return path.join(app.getPath('userData'), 'session.enc'); }

function saveRefreshToken(rawToken) {
  if (!safeStorage.isEncryptionAvailable()) return;
  fs.writeFileSync(sessionFilePath(), safeStorage.encryptString(rawToken));
}
function loadRefreshToken() {
  const file = sessionFilePath();
  if (!fs.existsSync(file) || !safeStorage.isEncryptionAvailable()) return null;
  try {
    return safeStorage.decryptString(fs.readFileSync(file));
  } catch {
    return null;
  }
}
function clearRefreshToken() {
  const file = sessionFilePath();
  if (fs.existsSync(file)) fs.unlinkSync(file);
}

// Nur für die Anzeige "angemeldet als ..." im Renderer - die Signaturprüfung passiert
// serverseitig bei jedem authentifizierten Aufruf, hier wird nichts sicherheitsrelevantes entschieden.
function decodeJwtClaims(token) {
  try {
    const payload = token.split('.')[1];
    return JSON.parse(Buffer.from(payload, 'base64url').toString('utf-8'));
  } catch {
    return {};
  }
}
function userFromAccessToken(accessToken) {
  const claims = decodeJwtClaims(accessToken);
  return {
    username: claims['name'] || claims['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'] || null,
    role: claims['role'] || claims['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role'] || null
  };
}

function broadcastSession() {
  if (mainWindow && !mainWindow.isDestroyed()) {
    mainWindow.webContents.send('auth:sessionChanged', {
      isAuthenticated: !!session.accessToken,
      user: session.user,
      mustChangePassword: session.mustChangePassword
    });
  }
}

function scheduleRefresh() {
  if (refreshTimer) clearTimeout(refreshTimer);
  if (!session.expiresAt) return;
  const delay = Math.max(new Date(session.expiresAt).getTime() - Date.now() - REFRESH_BUFFER_MS, 5000);
  refreshTimer = setTimeout(refreshSilently, delay);
}

function applySession(tokenPair) {
  session = {
    accessToken: tokenPair.accessToken,
    expiresAt: tokenPair.expiresAt,
    user: userFromAccessToken(tokenPair.accessToken),
    mustChangePassword: !!tokenPair.mustChangePassword
  };
  saveRefreshToken(tokenPair.refreshToken);
  scheduleRefresh();
  broadcastSession();
  refreshPermissions();
}

// Rechte kommen nicht aus dem JWT (das trägt nur den Rollennamen), sondern aus /api/auth/me -
// läuft nach dem schnellen JWT-basierten Zwischenstand nach und broadcastet erneut, sobald da.
async function refreshPermissions() {
  const accessToken = session.accessToken;
  if (!accessToken) return;
  const profile = await authClient.me(accessToken);
  if (!profile.ok || session.accessToken !== accessToken) return;
  session.user = { username: profile.username, role: profile.role, permissions: profile.permissions };
  broadcastSession();
}

function clearSession() {
  session = { accessToken: null, expiresAt: null, user: null, mustChangePassword: false };
  clearRefreshToken();
  if (refreshTimer) clearTimeout(refreshTimer);
  refreshTimer = null;
  broadcastSession();
}

// Proaktiver Timer kurz vor Ablauf UND Fallback bei 401 (z.B. nach Standby) - siehe Plan.
async function refreshSilently() {
  const rawRefreshToken = loadRefreshToken();
  if (!rawRefreshToken) {
    clearSession();
    return false;
  }
  const result = await authClient.refresh(rawRefreshToken);
  if (!result.ok) {
    clearSession();
    return false;
  }
  applySession(result);
  return true;
}

async function bootstrapSession() {
  const rawRefreshToken = loadRefreshToken();
  if (!rawRefreshToken) return;
  const result = await authClient.refresh(rawRefreshToken);
  if (result.ok) {
    applySession(result);
  } else {
    clearRefreshToken();
  }
}

// Ruft callFn(accessToken) auf und wiederholt einmal nach Silent-Refresh bei 401 -
// gemeinsame Grundlage für den generischen api:*-Proxy und die <kategorie>Client.cjs-Aufrufe.
async function withAuthRetry(callFn) {
  if (!session.accessToken) return { ok: false, status: 401, data: null };
  let result = await callFn(session.accessToken);
  if (result.status === 401 && (await refreshSilently())) {
    result = await callFn(session.accessToken);
  }
  return result;
}

function authorizedRequest(method, resourcePath, body) {
  return withAuthRetry((accessToken) => httpClient.request(method, resourcePath, { body, accessToken }));
}

function ensureDir(dir) { if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true }); }
function appRoot() {
  const base = path.join(app.getPath('documents'), 'Omsorg Business Controls Pro');
  ensureDir(base);
  ensureDir(path.join(base, 'database'));
  ensureDir(path.join(base, 'documents'));
  ensureDir(path.join(base, 'documents', 'employees'));
  ensureDir(path.join(base, 'documents', 'customers'));
  ensureDir(path.join(base, 'backups'));
  return base;
}
function dbPath() { return path.join(appRoot(), 'database', 'omsorg-local-db.json'); }
function defaultData() {
  return {
    version: '0.1.1',
    createdAt: new Date().toISOString(),
    users: [
      { id:'u1', name:'Sabina Dautovic', role:'Geschäftsführung' },
      { id:'u2', name:'Malik Neumann', role:'Geschäftsführung' },
      { id:'u3', name:'Sabrina Berggötz', role:'Disposition' }
    ],
    employees: [
      { id:'e1', name:'Dirk Artmann', qualification:'3-jährige Pflegefachkraft', status:'Aktiv' },
      { id:'e2', name:'Carina Vetter', qualification:'3-jährige Pflegefachkraft', status:'Aktiv' },
      { id:'e3', name:'Dilara Anders', qualification:'1-jährige Pflegekraft', status:'Aktiv' },
      { id:'e4', name:'Pascal Galliot', qualification:'1-jährige Pflegekraft', status:'Aktiv' }
    ],
    customers: [],
    assignments: [],
    notes: []
  };
}
function readDb() {
  const file = dbPath();
  if (!fs.existsSync(file)) fs.writeFileSync(file, JSON.stringify(defaultData(), null, 2));
  return JSON.parse(fs.readFileSync(file, 'utf-8'));
}
function writeDb(data) { fs.writeFileSync(dbPath(), JSON.stringify(data, null, 2)); return data; }
function createWindow() {
  mainWindow = new BrowserWindow({
    width: 1440,
    height: 920,
    minWidth: 1100,
    minHeight: 760,
    title: 'Omsorg Business Controls Pro',
    backgroundColor: '#08111f',
    webPreferences: {
      preload: path.join(__dirname, 'preload.cjs'),
      contextIsolation: true,
      nodeIntegration: false
    }
  });
  if (isDev) mainWindow.loadURL('http://127.0.0.1:5173');
  else mainWindow.loadFile(path.join(__dirname, '../dist/index.html'));
}
app.whenReady().then(async () => {
  appRoot();
  createWindow();
  await bootstrapSession();
  broadcastSession();
});
app.on('window-all-closed', () => { if (process.platform !== 'darwin') app.quit(); });
app.on('activate', () => { if (BrowserWindow.getAllWindows().length === 0) createWindow(); });

ipcMain.handle('db:get', () => readDb());
ipcMain.handle('db:set', (_event, data) => writeDb(data));
ipcMain.handle('app:paths', () => ({ root: appRoot(), db: dbPath() }));
ipcMain.handle('app:openRoot', () => shell.openPath(appRoot()));
ipcMain.handle('backup:create', () => {
  const root = appRoot();
  const stamp = new Date().toISOString().replace(/[:.]/g, '-');
  const backupFile = path.join(root, 'backups', `backup-${stamp}.json`);
  fs.copyFileSync(dbPath(), backupFile);
  return backupFile;
});

ipcMain.handle('auth:login', async (_event, { username, password }) => {
  const result = await authClient.login(username, password);
  if (!result.ok) {
    const error = result.status === 0
      ? 'network_error'
      : result.status === 429
        ? 'too_many_attempts'
        : 'invalid_credentials';
    return { success: false, error };
  }
  applySession(result);
  return { success: true, user: session.user, mustChangePassword: session.mustChangePassword };
});

ipcMain.handle('auth:logout', async () => {
  const rawRefreshToken = loadRefreshToken();
  if (rawRefreshToken) {
    try { await authClient.logout(rawRefreshToken); } catch { /* best effort */ }
  }
  clearSession();
  return { success: true };
});

ipcMain.handle('auth:getSession', () => ({
  isAuthenticated: !!session.accessToken,
  user: session.user,
  mustChangePassword: session.mustChangePassword
}));

ipcMain.handle('auth:requestPasswordReset', async (_event, { username }) => {
  const result = await authClient.requestPasswordReset(username);
  if (!result.ok) return { success: false, error: 'network_error' };
  return { success: true, status: result.status };
});

ipcMain.handle('auth:verifyPasswordResetCode', async (_event, { username, pin }) => {
  const result = await authClient.verifyPasswordResetCode(username, pin);
  if (!result.ok) return { success: false, error: result.error || 'invalid_or_expired' };
  return { success: true, resetToken: result.resetToken };
});

ipcMain.handle('auth:resetPassword', async (_event, { resetToken, newPassword }) => {
  const result = await authClient.resetPassword(resetToken, newPassword);
  return { success: result.ok };
});

// Erfolgreicher Wechsel widerruft serverseitig alle Sessions (siehe UserService.ChangeOwnPasswordAsync) -
// der aktuelle Access-Token ist danach tot, also Session lokal beenden statt weiterzumachen.
ipcMain.handle('auth:changePassword', async (_event, { currentPassword, newPassword }) => {
  if (!session.accessToken) return { success: false, error: 'not_authenticated' };
  const result = await authClient.changePassword(session.accessToken, currentPassword, newPassword);
  if (!result.ok) {
    return { success: false, error: result.status === 401 ? 'invalid_current_password' : 'unknown' };
  }
  clearSession();
  return { success: true };
});

// Generischer Proxy für Ressourcen ohne eigene <kategorie>Client.cjs-Datei (siehe Plan).
ipcMain.handle('api:get', (_event, resourcePath) => authorizedRequest('GET', resourcePath));
ipcMain.handle('api:post', (_event, resourcePath, body) => authorizedRequest('POST', resourcePath, body));

ipcMain.handle('employees:list', (_event, params) => withAuthRetry((accessToken) => employeesClient.listEmployees(accessToken, params)));
ipcMain.handle('employees:create', (_event, payload) =>
  withAuthRetry((accessToken) => employeesClient.createEmployee(accessToken, payload))
);
ipcMain.handle('employees:update', (_event, id, payload) =>
  withAuthRetry((accessToken) => employeesClient.updateEmployee(accessToken, id, payload))
);

ipcMain.handle('users:list', () => withAuthRetry((accessToken) => usersClient.listUsers(accessToken)));
ipcMain.handle('users:create', (_event, payload) =>
  withAuthRetry((accessToken) => usersClient.createUser(accessToken, payload))
);