//! Transactional administrator operations. Login/reset races are guarded by generation CAS.
use super::{now, random_secret, secret_hash, Session, SessionToken, SESSION_SECONDS};
use crate::db::{audit_tx, Store};
use anyhow::{ensure, Result};
use sqlx::Row;

#[derive(Debug, Clone)]
pub struct AdminRecord {
    pub username: String,
    pub password_hash: String,
    pub generation: i64,
}
impl Store {
    pub async fn admin_record(&self) -> Result<Option<AdminRecord>> {
        sqlx::query("SELECT username, password_hash, generation FROM administrator WHERE id = 1")
            .fetch_optional(&self.pool)
            .await?
            .map(|row| {
                Ok(AdminRecord {
                    username: row.try_get("username")?,
                    password_hash: row.try_get("password_hash")?,
                    generation: row.try_get("generation")?,
                })
            })
            .transpose()
    }
    pub async fn initialize_admin(&self, username: &str, hash: &str, source: &str) -> Result<bool> {
        let mut tx = self.pool.begin().await?;
        let inserted = sqlx::query("INSERT OR IGNORE INTO administrator(id, username, password_hash, generation, created_at) VALUES(1, ?, ?, 1, ?)")
            .bind(username).bind(hash).bind(now()).execute(&mut *tx).await?;
        if inserted.rows_affected() != 1 {
            return Ok(false);
        }
        audit_tx(&mut tx, username, "admin.initialize", source).await?;
        tx.commit().await?;
        Ok(true)
    }
    /// One persisted global bucket for the single administration listener.
    /// Fixed upper bound: 10 attempts per 60-second window, including successful attempts.
    /// Unknown usernames use the same bucket and password work as known usernames.
    pub async fn consume_auth_attempt(&self, time: i64) -> Result<bool> {
        let changed = sqlx::query("UPDATE auth_throttle SET attempts = CASE WHEN window_start <= ? THEN 1 ELSE attempts + 1 END, window_start = CASE WHEN window_start <= ? THEN ? ELSE window_start END WHERE id = 1 AND (window_start <= ? OR attempts < 10)")
            .bind(time - 60).bind(time - 60).bind(time).bind(time - 60)
            .execute(&self.pool).await?;
        Ok(changed.rows_affected() == 1)
    }
    /// The first UPDATE obtains SQLite's write lock and validates the credential generation.
    /// A reset committed during password verification prevents insertion of a stale session.
    pub async fn create_session(
        &self,
        generation: i64,
        kind: &str,
        previous: Option<&str>,
    ) -> Result<Option<SessionToken>> {
        self.create_session_with_lifetime(generation, kind, previous, SESSION_SECONDS, 60)
            .await
    }
    pub async fn create_browser_session(
        &self,
        generation: i64,
        previous: Option<&str>,
        session_seconds: i64,
    ) -> Result<Option<SessionToken>> {
        ensure!(
            (7 * 24 * 60 * 60..=30 * 24 * 60 * 60).contains(&session_seconds),
            "browser session lifetime must be 7..30 days"
        );
        self.create_session_with_lifetime(generation, "browser", previous, session_seconds, 60)
            .await
    }
    pub async fn create_live_log_session(&self, generation: i64) -> Result<Option<SessionToken>> {
        self.create_session_with_lifetime(generation, "cli", None, SESSION_SECONDS, 8 * 60 * 60)
            .await
    }
    async fn create_session_with_lifetime(
        &self,
        generation: i64,
        kind: &str,
        previous: Option<&str>,
        browser_lifetime: i64,
        cli_lifetime: i64,
    ) -> Result<Option<SessionToken>> {
        let time = now();
        let secret = random_secret();
        let hash = secret_hash(&secret);
        let csrf = random_secret();
        let lifetime = if kind == "cli" {
            cli_lifetime
        } else {
            browser_lifetime
        };
        let mut tx = self.pool.begin().await?;
        let valid = sqlx::query(
            "UPDATE administrator SET generation = generation WHERE id = 1 AND generation = ?",
        )
        .bind(generation)
        .execute(&mut *tx)
        .await?;
        if valid.rows_affected() == 0 {
            return Ok(None);
        }
        let username: String =
            sqlx::query_scalar("SELECT username FROM administrator WHERE id = 1")
                .fetch_one(&mut *tx)
                .await?;
        sqlx::query("DELETE FROM admin_sessions WHERE expires_at <= ? OR (kind = 'browser' AND created_at + ? <= ?)")
            .bind(time)
            .bind(browser_lifetime)
            .bind(time)
            .execute(&mut *tx)
            .await?;
        if let Some(previous) = previous {
            sqlx::query("DELETE FROM admin_sessions WHERE token_hash = ?")
                .bind(secret_hash(previous))
                .execute(&mut *tx)
                .await?;
        }
        // Independent caps avoid a local CLI burst evicting all browser sessions.
        let cap = if kind == "cli" { 8_i64 } else { 16_i64 };
        sqlx::query("DELETE FROM admin_sessions WHERE token_hash IN (SELECT token_hash FROM admin_sessions WHERE kind = ? ORDER BY created_at DESC, rowid DESC LIMIT -1 OFFSET ?)")
            .bind(kind).bind(cap - 1).execute(&mut *tx).await?;
        sqlx::query("INSERT INTO admin_sessions(token_hash, csrf_token, generation, created_at, last_seen, expires_at, kind) VALUES(?, ?, ?, ?, ?, ?, ?)")
            .bind(&hash).bind(&csrf).bind(generation).bind(time).bind(time).bind(time + lifetime)
            .bind(kind).execute(&mut *tx).await?;
        audit_tx(&mut tx, &username, "session.create", kind).await?;
        tx.commit().await?;
        Ok(Some(SessionToken {
            secret,
            session: Session {
                token_hash: hash,
                csrf,
                username,
                expires_at: time + lifetime,
                generation,
            },
        }))
    }
    pub async fn session_at(&self, secret: &str, time: i64) -> Result<Option<Session>> {
        self.session_at_with_browser_lifetime(secret, time, SESSION_SECONDS)
            .await
    }
    pub async fn session_at_with_browser_lifetime(
        &self,
        secret: &str,
        time: i64,
        browser_lifetime: i64,
    ) -> Result<Option<Session>> {
        ensure!(
            (7 * 24 * 60 * 60..=30 * 24 * 60 * 60).contains(&browser_lifetime),
            "browser session lifetime must be 7..30 days"
        );
        let hash = secret_hash(secret);
        // A browser session is bounded by the currently configured lifetime. If the
        // setting was increased while an older still-valid session exists, extend its
        // absolute expiry from its original creation time without turning it into a
        // sliding/immortal session. CLI capabilities keep the fixed expiry chosen
        // when they are created (60 seconds for one-shot admin commands, longer
        // for the bounded local live-log viewer).
        let row = sqlx::query("UPDATE admin_sessions SET last_seen = ?, expires_at = CASE WHEN kind = 'browser' THEN created_at + ? ELSE expires_at END WHERE token_hash = ? AND expires_at > ? AND (kind <> 'browser' OR created_at + ? > ?) AND generation = (SELECT generation FROM administrator WHERE id = 1) RETURNING csrf_token, expires_at, generation, (SELECT username FROM administrator WHERE id = 1) AS username")
            .bind(time)
            .bind(browser_lifetime)
            .bind(&hash)
            .bind(time)
            .bind(browser_lifetime)
            .bind(time)
            .fetch_optional(&self.pool).await?;
        row.map(|row| {
            Ok(Session {
                token_hash: hash,
                csrf: row.try_get("csrf_token")?,
                username: row.try_get("username")?,
                expires_at: row.try_get("expires_at")?,
                generation: row.try_get("generation")?,
            })
        })
        .transpose()
    }

    pub async fn admin_preferences(&self, username: &str) -> Result<Option<String>> {
        sqlx::query_scalar(
            "SELECT preferences.document FROM admin_preferences AS preferences JOIN administrator AS admin ON admin.id = preferences.administrator_id WHERE admin.id = 1 AND admin.username = ?",
        )
        .bind(username)
        .fetch_optional(&self.pool)
        .await
        .map_err(Into::into)
    }
    pub async fn save_admin_preferences(&self, username: &str, document: &str) -> Result<bool> {
        ensure!(
            (2..=4096).contains(&document.len()),
            "administrator preferences document is too large"
        );
        let result = sqlx::query(
            "INSERT INTO admin_preferences(administrator_id, document) SELECT id, ? FROM administrator WHERE id = 1 AND username = ? ON CONFLICT(administrator_id) DO UPDATE SET document = excluded.document",
        )
        .bind(document)
        .bind(username)
        .execute(&self.pool)
        .await?;
        Ok(result.rows_affected() == 1)
    }
    pub async fn end_session(&self, session: &Session) -> Result<()> {
        let mut tx = self.pool.begin().await?;
        sqlx::query("DELETE FROM admin_sessions WHERE token_hash = ?")
            .bind(&session.token_hash)
            .execute(&mut *tx)
            .await?;
        audit_tx(
            &mut tx,
            &session.username,
            "session.logout",
            "current session",
        )
        .await?;
        tx.commit().await?;
        Ok(())
    }
    /// expected_generation protects browser password changes against simultaneous resets.
    /// CLI passes the generation it read, so even two offline recoveries cannot silently win.
    pub async fn reset_admin_password(
        &self,
        hash: &str,
        expected_generation: i64,
        source: &str,
    ) -> Result<bool> {
        let mut tx = self.pool.begin().await?;
        let result = sqlx::query("UPDATE administrator SET password_hash = ?, generation = generation + 1 WHERE id = 1 AND generation = ? AND generation < 9223372036854775807")
            .bind(hash).bind(expected_generation).execute(&mut *tx).await?;
        if result.rows_affected() == 0 {
            return Ok(false);
        }
        let username: String =
            sqlx::query_scalar("SELECT username FROM administrator WHERE id = 1")
                .fetch_one(&mut *tx)
                .await?;
        sqlx::query("DELETE FROM admin_sessions")
            .execute(&mut *tx)
            .await?;
        sqlx::query("UPDATE auth_throttle SET window_start = 0, attempts = 0 WHERE id = 1")
            .execute(&mut *tx)
            .await?;
        audit_tx(&mut tx, &username, "admin.password_reset", source).await?;
        tx.commit().await?;
        Ok(true)
    }
    pub async fn revoke_all_sessions(&self, actor: &str) -> Result<()> {
        let mut tx = self.pool.begin().await?;
        sqlx::query("UPDATE administrator SET generation = generation + 1 WHERE id = 1 AND generation < 9223372036854775807")
            .execute(&mut *tx).await?;
        sqlx::query("DELETE FROM admin_sessions")
            .execute(&mut *tx)
            .await?;
        audit_tx(&mut tx, actor, "session.revoke_all", "all sessions").await?;
        tx.commit().await?;
        Ok(())
    }
}