pixeluvw_supabase 0.1.0

use crate::core::{Session, SupabaseClient, User};
use crate::error::{Result, SupaError};
use chrono::Utc;
use serde::{Deserialize, Serialize};

/// OTP (One-Time Password) types for authentication.
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum OtpType {
    /// Sign up OTP.
    Signup,
    /// Invite OTP.
    Invite,
    /// Password recovery OTP.
    Recovery,
    /// Magic link for passwordless login.
    Magiclink,
    /// SMS-based OTP.
    Sms,
    /// Email-based OTP.
    Email,
}

/// MFA Factor Type.
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum MfaFactorType {
    /// TOTP (Time-based One-Time Password).
    Totp,
}

/// MFA Factor structure.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct MfaFactor {
    /// Factor ID.
    pub id: String,
    /// Factor Status (verified, unverified).
    pub status: String,
    /// Friendly name.
    pub friendly_name: Option<String>,
    /// Factor Type.
    pub factor_type: MfaFactorType,
    /// Created at.
    pub created_at: String,
    /// Updated at.
    pub updated_at: String,
}

/// Response for MFA creation/enrollment.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct MfaEnrollResponse {
    /// The created factor.
    pub id: String,
    #[serde(rename = "type")]
    pub factor_type: String,
    /// TOTP-specific details.
    pub totp: Option<MfaTotpDetails>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct MfaTotpDetails {
    pub qr_code: String,
    pub secret: String,
    pub uri: String,
}

/// Response for MFA Challenge.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct MfaChallengeResponse {
    pub id: String,
    pub expires_at: String,
}

/// Result of a sign-up operation.
///
/// Supabase returns different responses depending on whether email confirmation is required.
#[derive(Debug, Clone)]
pub enum SignUpResult {
    /// Sign-up completed and user is authenticated (auto-confirm enabled).
    Session(Session),
    /// Sign-up requires email confirmation before the user can sign in.
    ConfirmationPending {
        /// The user that was created (without access token).
        user: User,
    },
}

impl SignUpResult {
    /// Returns the session if sign-up was auto-confirmed.
    pub fn session(&self) -> Option<&Session> {
        match self {
            SignUpResult::Session(s) => Some(s),
            SignUpResult::ConfirmationPending { .. } => None,
        }
    }

    /// Returns the user regardless of confirmation status.
    pub fn user(&self) -> Option<&User> {
        match self {
            SignUpResult::Session(s) => s.user.as_ref(),
            SignUpResult::ConfirmationPending { user } => Some(user),
        }
    }

    /// Returns true if email confirmation is pending.
    pub fn is_confirmation_pending(&self) -> bool {
        matches!(self, SignUpResult::ConfirmationPending { .. })
    }
}

/// Authentication service for Supabase.
///
/// Access via `client.auth()`.
///
/// # Example
///
/// ```rust,no_run
/// use pixeluvw_supabase::SupabaseClient;
///
/// # async fn example() -> Result<(), Box<dyn std::error::Error>> {
/// dotenv::dotenv().ok();
/// let client = SupabaseClient::from_env()?;
///
/// // Sign in
/// let session = client.auth().sign_in_with_password("user@example.com", "password").await?;
///
/// // Store session for authenticated requests
/// client.set_session(session);
///
/// // Sign out
/// client.auth().sign_out().await?;
/// # Ok(())
/// # }
/// ```
#[derive(Clone)]
pub struct AuthService {
    client: SupabaseClient,
}

impl AuthService {
    /// Create a new AuthService.
    ///
    /// Typically you should use `client.auth()` instead of calling this directly.
    pub fn new(client: SupabaseClient) -> Self {
        Self { client }
    }

    /// Sign in with email and password.
    ///
    /// # Arguments
    ///
    /// * `email` - User's email address
    /// * `password` - User's password
    ///
    /// # Returns
    ///
    /// A `Session` containing the access token, refresh token, and user info.
    ///
    /// # Example
    ///
    /// ```rust,no_run
    /// # async fn example(client: pixeluvw_supabase::SupabaseClient) -> Result<(), Box<dyn std::error::Error>> {
    /// let session = client.auth().sign_in_with_password("user@example.com", "pass").await?;
    /// # Ok(())
    /// # }
    /// ```
    pub async fn sign_in_with_password(&self, email: &str, password: &str) -> Result<Session> {
        let payload = serde_json::json!({
            "email": email,
            "password": password,
        });

        let response = self
            .client
            .inner
            .http
            .post(format!(
                "{}/auth/v1/token?grant_type=password",
                self.client.inner.url
            ))
            .header("apikey", &self.client.inner.key)
            .json(&payload)
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("Sign in with password failed: {}", e),
            })?;

        let session: Session = self.client.handle_response(response).await?;
        Ok(session)
    }

    /// Sign up a new user.
    ///
    /// # Arguments
    ///
    /// * `email` - User's email address
    /// * `password` - User's password
    ///
    /// # Returns
    ///
    /// A [`SignUpResult`] which is either:
    /// - `SignUpResult::Session` if auto-confirm is enabled
    /// - `SignUpResult::ConfirmationPending` if email confirmation is required
    ///
    /// # Example
    ///
    /// ```rust,no_run
    /// # async fn example(client: pixeluvw_supabase::SupabaseClient) -> Result<(), Box<dyn std::error::Error>> {
    /// use pixeluvw_supabase::auth::SignUpResult;
    ///
    /// match client.auth().sign_up("user@example.com", "password").await? {
    ///     SignUpResult::Session(session) => {
    ///         println!("Signed in! Token: {}", session.access_token);
    ///     }
    ///     SignUpResult::ConfirmationPending { user } => {
    ///         println!("Please check your email to confirm: {}", user.email.unwrap_or_default());
    ///     }
    /// }
    /// # Ok(())
    /// # }
    /// ```
    pub async fn sign_up(&self, email: &str, password: &str) -> Result<SignUpResult> {
        let payload = serde_json::json!({
            "email": email,
            "password": password,
        });

        let response = self
            .client
            .inner
            .http
            .post(format!("{}/auth/v1/signup", self.client.inner.url))
            .header("apikey", &self.client.inner.key)
            .json(&payload)
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("Sign up failed: {}", e),
            })?;

        if !response.status().is_success() {
            let status = response.status().as_u16();
            let error_text = response.text().await.unwrap_or_default();
            return Err(SupaError::ApiError {
                code: status,
                message: error_text.clone(),
                details: Some(error_text),
            });
        }

        let json: serde_json::Value = response.json().await?;

        // Try to parse as Session first (has access_token)
        if json.get("access_token").is_some() {
            let session: Session = serde_json::from_value(json)?;
            Ok(SignUpResult::Session(session))
        } else {
            // No access_token means confirmation is pending, parse as User
            let user: User = serde_json::from_value(json)?;
            Ok(SignUpResult::ConfirmationPending { user })
        }
    }

    /// Sign in with OTP (One-Time Password) via email or phone.
    ///
    /// This sends an OTP to the provided email or phone number.
    ///
    /// # Arguments
    ///
    /// * `email` - User's email address (optional)
    /// * `phone` - User's phone number (optional)
    /// * `otp_type` - The type of OTP to request (e.g., `Magiclink`, `Sms`, `Email`).
    ///
    /// # Returns
    ///
    /// `Ok(())` if the OTP was successfully sent.
    ///
    /// # Example
    ///
    /// ```rust,no_run
    /// # async fn example(client: pixeluvw_supabase::SupabaseClient) -> Result<(), Box<dyn std::error::Error>> {
    /// use pixeluvw_supabase::auth::OtpType;
    /// client.auth().sign_in_with_otp(Some("user@example.com"), None, OtpType::Magiclink).await?;
    /// # Ok(())
    /// # }
    /// ```
    pub async fn sign_in_with_otp(
        &self,
        email: Option<&str>,
        phone: Option<&str>,
        otp_type: OtpType,
    ) -> Result<()> {
        let mut payload = serde_json::json!({
            "options": {
                "email_redirect_to": None::<String>, // TODO: Make this configurable
            }
        });

        if let Some(e) = email {
            payload["email"] = serde_json::to_value(e)?;
        }
        if let Some(p) = phone {
            payload["phone"] = serde_json::to_value(p)?;
        }

        payload["type"] = serde_json::to_value(otp_type)?;

        let resp = self
            .client
            .inner
            .http
            .post(format!("{}/auth/v1/otp", self.client.inner.url))
            .header("apikey", &self.client.inner.key)
            .json(&payload)
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("Sign in with OTP failed: {}", e),
            })?;

        // OTP endpoint might return empty body or session?
        // Actually /otp usually sends email, returns empty JSON or status 200.
        // If it returns, we just check status. which handle_response does.
        // But handle_response expects T: DeserializeOwned.
        // We can use serde_json::Value
        let _: serde_json::Value = self.client.handle_response(resp).await?;

        Ok(())
    }

    /// Sends a password reset request to an email address.
    ///
    /// This sends a password recovery email to the user.
    ///
    /// # Arguments
    ///
    /// * `email` - User's email address
    /// * `redirect_to` - URL to redirect to after clicking the link (optional)
    ///
    /// # Returns
    ///
    /// `Ok(())` if the recovery email was successfully sent.
    pub async fn reset_password_for_email(
        &self,
        email: &str,
        redirect_to: Option<&str>,
    ) -> Result<()> {
        let mut payload = serde_json::json!({
            "email": email,
        });

        if let Some(r) = redirect_to {
            payload["options"] = serde_json::json!({
                "email_redirect_to": r
            });
        }

        let resp = self
            .client
            .inner
            .http
            .post(format!("{}/auth/v1/recover", self.client.inner.url))
            .header("apikey", &self.client.inner.key)
            .json(&payload)
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("Reset password for email failed: {}", e),
            })?;

        // The endpoint usually returns empty JSON {} on success
        let _: serde_json::Value = self.client.handle_response(resp).await?;
        Ok(())
    }

    /// Sign out the current user.
    pub async fn sign_out(&self) -> Result<()> {
        let token = {
            self.client
                .inner
                .session
                .read()
                .ok()
                .and_then(|lock| lock.as_ref().map(|s| s.access_token.clone()))
        };

        if let Some(token) = token {
            let _ = self
                .client
                .inner
                .http
                .post(format!("{}/auth/v1/logout", self.client.inner.url))
                .header("apikey", &self.client.inner.key)
                .header("Authorization", format!("Bearer {}", token))
                .send()
                .await
                .map_err(|e| SupaError::AuthError {
                    message: format!("Sign out failed: {}", e),
                })?;
        }

        self.client.reset_auth_token();
        Ok(())
    }

    /// Get the currently authenticated user.
    pub async fn get_user(&self) -> Result<User> {
        let token = self
            .client
            .inner
            .session
            .read()
            .ok()
            .and_then(|lock| lock.as_ref().map(|s| s.access_token.clone()))
            .ok_or(SupaError::ClientError {
                message: "Not authenticated".to_string(),
            })?;

        let resp = self
            .client
            .inner
            .http
            .get(format!("{}/auth/v1/user", self.client.inner.url))
            .header("apikey", &self.client.inner.key)
            .header("Authorization", format!("Bearer {}", token))
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("Get user failed: {}", e),
            })?;

        let user: User = self.client.handle_response(resp).await?;
        Ok(user)
    }

    /// Update user attributes.
    pub async fn update_user(&self, attributes: serde_json::Value) -> Result<User> {
        let token = self
            .client
            .inner
            .session
            .read()
            .ok()
            .and_then(|lock| lock.as_ref().map(|s| s.access_token.clone()))
            .ok_or(SupaError::ClientError {
                message: "Not authenticated".to_string(),
            })?;

        let resp = self
            .client
            .inner
            .http
            .put(format!("{}/auth/v1/user", self.client.inner.url))
            .header("apikey", &self.client.inner.key)
            .header("Authorization", format!("Bearer {}", token))
            .json(&attributes)
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("Update user failed: {}", e),
            })?;

        let user: User = self.client.handle_response(resp).await?;
        Ok(user)
    }

    /// Refresh the session using the refresh token.
    pub async fn refresh_access_token(&self, refresh_token: &str) -> Result<Session> {
        let payload = serde_json::json!({
            "refresh_token": refresh_token,
        });

        let resp = self
            .client
            .inner
            .http
            .post(format!(
                "{}/auth/v1/token?grant_type=refresh_token",
                self.client.inner.url
            ))
            .header("apikey", &self.client.inner.key)
            .json(&payload)
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("Refresh token failed: {}", e),
            })?;

        let session: Session = self.client.handle_response(resp).await?;

        // Update the client with the new session
        self.client.set_session(session.clone());

        Ok(session)
    }

    // ============================================================
    //  MFA (Multi-Factor Authentication)
    // ============================================================

    /// Enroll a new MFA factor.
    ///
    /// Currently only supports TOTP.
    pub async fn mfa_enroll(&self, friendly_name: Option<String>) -> Result<MfaEnrollResponse> {
        let token = self.client.get_access_token().await?;

        let payload = serde_json::json!({
            "factor_type": "totp",
            "friendly_name": friendly_name
        });

        let resp = self
            .client
            .inner
            .http
            .post(format!("{}/auth/v1/factors", self.client.inner.url))
            .header("apikey", &self.client.inner.key)
            .header("Authorization", format!("Bearer {}", token))
            .json(&payload)
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("MFA enroll failed: {}", e),
            })?;

        self.client.handle_response(resp).await
    }

    /// Create a challenge for an MFA factor.
    pub async fn mfa_challenge(&self, factor_id: &str) -> Result<MfaChallengeResponse> {
        let token = self.client.get_access_token().await?;

        let resp = self
            .client
            .inner
            .http
            .post(format!(
                "{}/auth/v1/factors/{}/challenge",
                self.client.inner.url, factor_id
            ))
            .header("apikey", &self.client.inner.key)
            .header("Authorization", format!("Bearer {}", token))
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("MFA challenge failed: {}", e),
            })?;

        self.client.handle_response(resp).await
    }

    /// Verify an MFA challenge to complete authentication.
    ///
    /// This behaves like sign-in: it returns a new Session (typically with higher AAL).
    pub async fn mfa_verify(
        &self,
        factor_id: &str,
        challenge_id: &str,
        code: &str,
    ) -> Result<Session> {
        let token = self.client.get_access_token().await?;

        let payload = serde_json::json!({
            "challenge_id": challenge_id,
            "code": code
        });

        let resp = self
            .client
            .inner
            .http
            .post(format!(
                "{}/auth/v1/factors/{}/verify",
                self.client.inner.url, factor_id
            ))
            .header("apikey", &self.client.inner.key)
            .header("Authorization", format!("Bearer {}", token))
            .json(&payload)
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("Verify OTP failed: {}", e),
            })?;

        let mut session: Session = self.client.handle_response(resp).await?;

        // User update already handled by handle_response returning session? No need to calc expires_at if session already has it?
        // Session struct options expires_at. handle_response just deserializes.
        // We probably should centralize expires_at calc in Session deserialization or helper.
        // But for now:
        if session.expires_at.is_none() {
            let now = Utc::now().timestamp();
            session.expires_at = Some(now + session.expires_in);
        }
        self.client.set_session(session.clone());

        Ok(session)
    }

    /// Unenroll (delete) an MFA factor.
    pub async fn mfa_unenroll(&self, factor_id: &str) -> Result<MfaFactor> {
        let token = self.client.get_access_token().await?;

        let response = self
            .client
            .inner
            .http
            .delete(format!(
                "{}/auth/v1/factors/{}",
                self.client.inner.url, factor_id
            ))
            .header("apikey", &self.client.inner.key)
            .header("Authorization", format!("Bearer {}", token))
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("MFA unenroll failed: {}", e),
            })?;

        self.client.handle_response(response).await
    }

    /// List all MFA factors for the user.
    ///
    /// Note: Standard GoTrue API might return this as part of `User` object or `/factors`.
    /// The canonical way is often `GET /auth/v1/factors`.
    pub async fn mfa_list_factors(&self) -> Result<Vec<MfaFactor>> {
        let token = self.client.get_access_token().await?;

        let response = self
            .client
            .inner
            .http
            .get(format!("{}/auth/v1/factors", self.client.inner.url))
            .header("apikey", &self.client.inner.key)
            .header("Authorization", format!("Bearer {}", token))
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("MFA list failed: {}", e),
            })?;

        // The response is usually a list of factors or a wrapper?
        // Let's assume list of MfaFactor.
        // If it fails, we might need to adjust based on real API response.
        self.client.handle_response(response).await
    }
    /// Get the URL for OAuth sign in.
    pub fn sign_in_with_oauth(
        &self,
        provider: Provider,
        redirect_to: Option<&str>,
        scopes: Option<&str>,
    ) -> Result<String> {
        let mut url = self
            .client
            .inner
            .url
            .join(&format!("auth/v1/authorize?provider={}", provider))?;

        if let Some(r) = redirect_to {
            url.query_pairs_mut().append_pair("redirect_to", r);
        }

        if let Some(s) = scopes {
            url.query_pairs_mut().append_pair("scopes", s);
        }

        Ok(url.to_string())
    }

    /// Get the admin authentication service.
    ///
    /// Requires the client to be initialized with the `service_role` key.
    pub fn admin(&self) -> AdminAuthService {
        AdminAuthService::new(self.client.clone())
    }
}

/// Administrative authentication service.
///
/// Requires the client to be initialized with the `service_role` key.
#[derive(Clone)]
pub struct AdminAuthService {
    client: SupabaseClient,
}

impl AdminAuthService {
    pub fn new(client: SupabaseClient) -> Self {
        Self { client }
    }

    /// List all users.
    ///
    /// # Arguments
    ///
    /// * `page` - Page number (1-based) (optional, default 1)
    /// * `per_page` - Users per page (optional, default 50)
    pub async fn list_users(&self, page: Option<u32>, per_page: Option<u32>) -> Result<Vec<User>> {
        let mut url = self
            .client
            .inner
            .url
            .join("auth/v1/admin/users")
            .map_err(SupaError::UrlError)?;

        if let Some(p) = page {
            url.query_pairs_mut().append_pair("page", &p.to_string());
        }
        if let Some(pp) = per_page {
            url.query_pairs_mut()
                .append_pair("per_page", &pp.to_string());
        }

        let resp = self
            .client
            .inner
            .http
            .get(url)
            .header("apikey", &self.client.inner.key)
            .header("Authorization", format!("Bearer {}", self.client.inner.key))
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("List users failed: {}", e),
            })?;

        // Response is usually { users: [...] } or list.
        // GoTrue returns { users: [], aud: "..." }
        #[derive(Deserialize)]
        struct UserListResponse {
            users: Vec<User>,
        }

        // Try parsing as UserListResponse
        let wrapper: UserListResponse = self.client.handle_response(resp).await?;
        Ok(wrapper.users)
    }

    /// Get user by ID.
    pub async fn get_user_by_id(&self, uid: &str) -> Result<User> {
        let resp = self
            .client
            .inner
            .http
            .get(format!(
                "{}/auth/v1/admin/users/{}",
                self.client.inner.url, uid
            ))
            .header("apikey", &self.client.inner.key)
            .header("Authorization", format!("Bearer {}", self.client.inner.key))
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("Get user by ID failed: {}", e),
            })?;

        self.client.handle_response(resp).await
    }

    /// Create a new user (admin).
    ///
    /// Useful for provisioning users without email confirmation.
    pub async fn create_user(&self, params: serde_json::Value) -> Result<User> {
        let resp = self
            .client
            .inner
            .http
            .post(format!("{}/auth/v1/admin/users", self.client.inner.url))
            .header("apikey", &self.client.inner.key)
            .header("Authorization", format!("Bearer {}", self.client.inner.key))
            .json(&params)
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("Create user failed: {}", e),
            })?;

        self.client.handle_response(resp).await
    }

    /// Delete a user.
    pub async fn delete_user(&self, uid: &str) -> Result<()> {
        let resp = self
            .client
            .inner
            .http
            .delete(format!(
                "{}/auth/v1/admin/users/{}",
                self.client.inner.url, uid
            ))
            .header("apikey", &self.client.inner.key)
            .header("Authorization", format!("Bearer {}", self.client.inner.key))
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("Delete user failed: {}", e),
            })?;

        let _: serde_json::Value = self.client.handle_response(resp).await?;
        Ok(())
    }

    /// Send invite by email.
    pub async fn invite_user_by_email(&self, email: &str) -> Result<User> {
        let payload = serde_json::json!({
            "email": email
        });

        let resp = self
            .client
            .inner
            .http
            .post(format!("{}/auth/v1/invite", self.client.inner.url))
            .header("apikey", &self.client.inner.key)
            .header("Authorization", format!("Bearer {}", self.client.inner.key))
            .json(&payload)
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("Invite user failed: {}", e),
            })?;

        self.client.handle_response(resp).await
    }

    /// Update user by ID.
    pub async fn update_user_by_id(
        &self,
        uid: &str,
        attributes: serde_json::Value,
    ) -> Result<User> {
        let resp = self
            .client
            .inner
            .http
            .put(format!(
                "{}/auth/v1/admin/users/{}",
                self.client.inner.url, uid
            ))
            .header("apikey", &self.client.inner.key)
            .header("Authorization", format!("Bearer {}", self.client.inner.key))
            .json(&attributes)
            .send()
            .await
            .map_err(|e| SupaError::AuthError {
                message: format!("Update user by ID failed: {}", e),
            })?;

        self.client.handle_response(resp).await
    }
}

/// OAuth providers supported by Supabase.
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "snake_case")]
pub enum Provider {
    Apple,
    Azure,
    Bitbucket,
    Discord,
    Facebook,
    Github,
    Gitlab,
    Google,
    Keycloak,
    Linkedin,
    Notion,
    Slack,
    Spotify,
    Twitch,
    Twitter,
    Workos,
    Zoom,
    /// Support for other providers not listed here
    #[serde(untagged)]
    External(String),
}

impl std::fmt::Display for Provider {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Provider::Apple => write!(f, "apple"),
            Provider::Azure => write!(f, "azure"),
            Provider::Bitbucket => write!(f, "bitbucket"),
            Provider::Discord => write!(f, "discord"),
            Provider::Facebook => write!(f, "facebook"),
            Provider::Github => write!(f, "github"),
            Provider::Gitlab => write!(f, "gitlab"),
            Provider::Google => write!(f, "google"),
            Provider::Keycloak => write!(f, "keycloak"),
            Provider::Linkedin => write!(f, "linkedin"),
            Provider::Notion => write!(f, "notion"),
            Provider::Slack => write!(f, "slack"),
            Provider::Spotify => write!(f, "spotify"),
            Provider::Twitch => write!(f, "twitch"),
            Provider::Twitter => write!(f, "twitter"),
            Provider::Workos => write!(f, "workos"),
            Provider::Zoom => write!(f, "zoom"),
            Provider::External(s) => write!(f, "{}", s),
        }
    }
}