using Gateway.Data;
using Gateway.Security;
using Microsoft.AspNetCore.Mvc;
using System.Text.Json;

namespace Gateway.Controllers;

/// <summary>
/// Campaign wizard endpoints.
/// 
/// SECURITY: Every wizard operation validates ownership (wizard → client).
/// ClientId is always injected server-side.
/// </summary>
[ApiController]
[Route("api/wizard")]
public sealed class WizardController : ControllerBase
{
    private readonly SqlService _sql;
    private readonly ClientContext _client;
    private readonly AuthorizationGuard _guard;
    private readonly ILogger<WizardController> _log;

    public WizardController(SqlService sql, ClientContext client, AuthorizationGuard guard, ILogger<WizardController> log)
    {
        _sql = sql;
        _client = client;
        _guard = guard;
        _log = log;
    }

    /// <summary>
    /// Get active categories + objectives for wizard Step 1.
    /// Client-authenticated (not admin). Read-only.
    /// Calls spAdminTemplateConfig with action 'public.config'.
    /// </summary>
    [HttpGet("config")]
    public async Task<IActionResult> GetConfig(CancellationToken ct)
    {
        var (ok, err) = _guard.RequireAuth();
        if (!ok) return Unauthorized(new { ok = false, error = err });

        try
        {
            var resp = await _sql.ExecProcAsync(
                SqlNames.Procs.TemplateConfig,
                "public.config",
                "{}",
                ct: ct
            );

            if (string.IsNullOrWhiteSpace(resp))
                return StatusCode(500, new { ok = false, error = "Config service unavailable" });

            return Content(resp, "application/json");
        }
        catch (Exception ex)
        {
            _log.LogError(ex, "Wizard config error");
            return StatusCode(500, new { ok = false, error = "Config service error" });
        }
    }

    /// <summary>Create a new wizard (no ownership check — creates for current client).</summary>
    [HttpPost]
    public async Task<IActionResult> Create([FromBody] CreateWizardRequest? request, CancellationToken ct)
    {
        var (ok, err) = _guard.RequireAuth();
        if (!ok) return Unauthorized(new { ok = false, error = err });

        var rqst = JsonSerializer.Serialize(new
        {
            clientId = _client.ClientId,    // ← SERVER-SIDE
            userId = _client.UserId,
            name = request?.Name,
            url = request?.Url
        });

        return await ExecAndReturn("create", rqst, ct);
    }

    /// <summary>Get wizard by ID (ownership verified).</summary>
    [HttpGet("{wizardId}")]
    public async Task<IActionResult> Get(string wizardId, CancellationToken ct)
    {
        var ownership = await _guard.VerifyWizardOwnerAsync(wizardId, ct);
        if (!ownership.IsAllowed)
            return NotFound(new { ok = false, error = ownership.Error });

        // Return already-fetched entity
        if (!string.IsNullOrWhiteSpace(ownership.EntityJson))
            return Content(ownership.EntityJson, "application/json");

        var rqst = JsonSerializer.Serialize(new { wizardId });
        return await ExecAndReturn("get", rqst, ct);
    }

    /// <summary>List wizards for current client (always scoped).</summary>
    [HttpGet]
    public async Task<IActionResult> List([FromQuery] string? status, [FromQuery] int? limit, CancellationToken ct)
    {
        var (ok, err) = _guard.RequireAuth();
        if (!ok) return Unauthorized(new { ok = false, error = err });

        var rqst = JsonSerializer.Serialize(new
        {
            clientId = _client.ClientId,    // ← scoped to authenticated client
            status,
            limit
        });

        return await ExecAndReturn("listByClient", rqst, ct);
    }

    /// <summary>Update step data (ownership verified, steps 1-4 only).</summary>
    [HttpPut("{wizardId}/step/{step:int}")]
    public async Task<IActionResult> UpdateStep(string wizardId, int step, [FromBody] UpdateStepRequest? request, CancellationToken ct)
    {
        if (step < 1 || step > 5)
            return BadRequest(new { ok = false, error = "Step must be 1-5" });

        var ownership = await _guard.VerifyWizardOwnerAsync(wizardId, ct);
        if (!ownership.IsAllowed)
            return NotFound(new { ok = false, error = ownership.Error });

        var rqst = JsonSerializer.Serialize(new
        {
            wizardId,
            step,
            data = request?.Data,
            name = request?.Name
        });

        return await ExecAndReturn("updateStep", rqst, ct);
    }

    /// <summary>Navigate to step (ownership verified).</summary>
    [HttpPatch("{wizardId}/step/{step:int}")]
    public async Task<IActionResult> SetStep(string wizardId, int step, CancellationToken ct)
    {
        var ownership = await _guard.VerifyWizardOwnerAsync(wizardId, ct);
        if (!ownership.IsAllowed)
            return NotFound(new { ok = false, error = ownership.Error });

        var rqst = JsonSerializer.Serialize(new { wizardId, step });
        return await ExecAndReturn("setStep", rqst, ct);
    }

    /// <summary>Get wizard summary for review (ownership verified).</summary>
    [HttpGet("{wizardId}/summary")]
    public async Task<IActionResult> GetSummary(string wizardId, CancellationToken ct)
    {
        var ownership = await _guard.VerifyWizardOwnerAsync(wizardId, ct);
        if (!ownership.IsAllowed)
            return NotFound(new { ok = false, error = ownership.Error });

        var rqst = JsonSerializer.Serialize(new { wizardId });
        return await ExecAndReturn("getSummary", rqst, ct);
    }

    /// <summary>Submit wizard (ownership verified).</summary>
    [HttpPost("{wizardId}/submit")]
    public async Task<IActionResult> Submit(string wizardId, [FromBody] SubmitWizardRequest? request, CancellationToken ct)
    {
        var ownership = await _guard.VerifyWizardOwnerAsync(wizardId, ct);
        if (!ownership.IsAllowed)
            return NotFound(new { ok = false, error = ownership.Error });

        var rqst = JsonSerializer.Serialize(new
        {
            wizardId,
            campaignId = (string?)null,
            network = request?.Network ?? "google"
        });

        return await ExecAndReturn("submit", rqst, ct);
    }

    /// <summary>Update wizard status (ownership verified, transition rules applied).</summary>
    [HttpPatch("{wizardId}/status")]
    public async Task<IActionResult> UpdateStatus(string wizardId, [FromBody] UpdateStatusRequest? request, CancellationToken ct)
    {
        if (string.IsNullOrWhiteSpace(request?.Status))
            return BadRequest(new { ok = false, error = "status is required" });

        var ownership = await _guard.VerifyWizardOwnerAsync(wizardId, ct);
        if (!ownership.IsAllowed)
            return NotFound(new { ok = false, error = ownership.Error });

        // Wizard status transitions: only allow cancel from draft
        var current = ownership.CurrentStatus ?? "draft";
        var requested = request.Status.ToLowerInvariant();
        var isAdmin = string.Equals(_client.Role, "admin", StringComparison.OrdinalIgnoreCase);

        if (!isAdmin && requested != "cancelled")
            return BadRequest(new { ok = false, error = $"Cannot change wizard status to '{requested}'" });

        var rqst = JsonSerializer.Serialize(new { wizardId, status = request.Status });
        return await ExecAndReturn("updateStatus", rqst, ct);
    }

    /// <summary>Delete wizard (ownership verified).</summary>
    [HttpDelete("{wizardId}")]
    public async Task<IActionResult> Delete(string wizardId, [FromQuery] bool force = false, CancellationToken ct = default)
    {
        var ownership = await _guard.VerifyWizardOwnerAsync(wizardId, ct);
        if (!ownership.IsAllowed)
            return NotFound(new { ok = false, error = ownership.Error });

        var rqst = JsonSerializer.Serialize(new { wizardId, force });
        return await ExecAndReturn("delete", rqst, ct);
    }

    /// <summary>
    /// Get audience-adjusted channel mix recommendation.
    /// Calls spAllocationRecommend with audience factors.
    /// </summary>
    [HttpPost("recommend")]
    public async Task<IActionResult> Recommend([FromBody] RecommendRequest? request, CancellationToken ct)
    {
        var (ok, err) = _guard.RequireAuth();
        if (!ok) return Unauthorized(new { ok = false, error = err });

        if (string.IsNullOrWhiteSpace(request?.BusinessCategory) || string.IsNullOrWhiteSpace(request?.Objective))
            return BadRequest(new { ok = false, error = "businessCategory and objective are required" });

        try
        {
            var rqst = JsonSerializer.Serialize(new
            {
                businessCategory = request.BusinessCategory,
                objective = request.Objective,
                ageSkew = request.AgeSkew,
                marketScope = request.MarketScope
            });

            var resp = await _sql.ExecProcAsync(
                SqlNames.Procs.AllocationRecommend,
                "recommend",
                rqst,
                ct: ct
            );

            if (string.IsNullOrWhiteSpace(resp))
                return StatusCode(500, new { ok = false, error = "Recommendation service unavailable" });

            return Content(resp, "application/json");
        }
        catch (Exception ex)
        {
            _log.LogError(ex, "Recommend error");
            return StatusCode(500, new { ok = false, error = "Recommendation service error" });
        }
    }

    // ────────────────────────────────────────────────
    // Helper
    // ────────────────────────────────────────────────

    private async Task<IActionResult> ExecAndReturn(string action, string rqst, CancellationToken ct)
    {
        try
        {
            var resp = await _sql.ExecProcAsync("dbo.spCampaignWizard", action, rqst, ct: ct);

            if (string.IsNullOrWhiteSpace(resp))
                return StatusCode(500, new { ok = false, error = "Wizard service unavailable" });

            using var doc = JsonDocument.Parse(resp);
            var root = doc.RootElement;

            if (root.TryGetProperty("ok", out var okProp) && !okProp.GetBoolean())
            {
                var error = root.TryGetProperty("error", out var errProp) ? errProp.GetString() : "Unknown error";
                if (error?.Contains("not found", StringComparison.OrdinalIgnoreCase) == true)
                    return NotFound(JsonSerializer.Deserialize<object>(resp));
                return BadRequest(JsonSerializer.Deserialize<object>(resp));
            }

            return Content(resp, "application/json");
        }
        catch (Exception ex)
        {
            _log.LogError(ex, "Wizard {Action} error", action);
            return StatusCode(500, new { ok = false, error = "Wizard service error" });
        }
    }
}

// ── DTOs ──

public sealed class CreateWizardRequest { public string? Name { get; set; } public string? Url { get; set; } }
public sealed class UpdateStepRequest { public object? Data { get; set; } public string? Name { get; set; } }
public sealed class SubmitWizardRequest { public string? Network { get; set; } }
public sealed class UpdateStatusRequest { public string? Status { get; set; } }
public sealed class RecommendRequest
{
    public string? BusinessCategory { get; set; }
    public string? Objective { get; set; }
    public string? AgeSkew { get; set; }
    public string? MarketScope { get; set; }
}