"use client";

import { useState } from "react";
import { useRouter } from "next/navigation";
import Link from "next/link";
import { startAuthentication } from "@simplewebauthn/browser";
import { formatMessage } from "@/lib/i18n/shared";
import { useDict } from "@/components/i18n/LocaleProvider";
import LanguageSwitcher from "@/components/i18n/LanguageSwitcher";
import type { Dict } from "@/lib/i18n/shared";

function authErrorMessage(dict: Dict, code: string): string {
  if (code === "invalid_credentials") return dict.login.errorInvalidCredentials;
  if (code === "password_disabled") return dict.login.errorPasswordDisabled;
  if (code === "oidc_invalid_state") return dict.login.errorOidcInvalidState;
  if (code === "oidc_unknown_user") return dict.login.errorOidcUnknownUser;
  if (code === "oidc_failed") return dict.login.errorOidcFailed;
  if (/cancelled|aborted|NotAllowedError/i.test(code))
    return dict.login.errorPasskeyCancelled;
  return formatMessage(dict.login.errorGeneric, { message: code });
}

function redirectPath(role: string): string {
  return role === "admin" ? "/admin" : "/intern";
}

export default function LoginForm({
  oidcEnabled,
  initialError,
}: {
  oidcEnabled: boolean;
  initialError: string | null;
}) {
  const router = useRouter();
  const dict = useDict();
  const [email, setEmail] = useState("");
  const [password, setPassword] = useState("");
  const [error, setError] = useState<string | null>(() =>
    initialError ? authErrorMessage(dict, initialError) : null
  );
  const [busy, setBusy] = useState(false);

  async function signInWithPassword(e: React.FormEvent) {
    e.preventDefault();
    setError(null);
    setBusy(true);
    const res = await fetch("/api/auth/login", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ email, password }),
    });
    const data = await res.json().catch(() => ({}));
    if (!res.ok) {
      setError(authErrorMessage(dict, data.error ?? "unknown"));
      setBusy(false);
      return;
    }
    router.replace(redirectPath(data.role));
    router.refresh();
  }

  async function signInWithPasskey() {
    setError(null);
    setBusy(true);
    try {
      const optionsRes = await fetch("/api/auth/passkeys/login-options", { method: "POST" });
      const options = await optionsRes.json();
      const response = await startAuthentication({ optionsJSON: options });

      const verifyRes = await fetch("/api/auth/passkeys/login-verify", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ response }),
      });
      const data = await verifyRes.json().catch(() => ({}));
      if (!verifyRes.ok) {
        setError(authErrorMessage(dict, data.error ?? "unknown"));
        setBusy(false);
        return;
      }
      router.replace(redirectPath(data.role));
      router.refresh();
    } catch (err) {
      setError(authErrorMessage(dict, err instanceof Error ? err.message : String(err)));
      setBusy(false);
    }
  }

  return (
    <div className="flex-1 flex items-center justify-center p-4">
      <div className="card w-full max-w-sm">
        <div className="flex justify-between items-center mb-4">
          <h1 className="text-xl font-bold text-[var(--c-primary)]">
            {dict.login.title}
          </h1>
          <LanguageSwitcher variant="light" />
        </div>
        <form onSubmit={signInWithPassword} className="space-y-3">
          <div>
            <label className="label" htmlFor="email">
              {dict.common.email}
            </label>
            <input
              id="email"
              type="email"
              className="input"
              value={email}
              onChange={(e) => setEmail(e.target.value)}
              autoComplete="username webauthn"
              required
            />
          </div>
          <div>
            <label className="label" htmlFor="password">
              {dict.common.password}
            </label>
            <input
              id="password"
              type="password"
              className="input"
              value={password}
              onChange={(e) => setPassword(e.target.value)}
              autoComplete="current-password"
              required
            />
          </div>
          {error && <p className="text-sm text-[var(--c-del)]">{error}</p>}
          <button type="submit" className="btn btn-primary w-full" disabled={busy}>
            {dict.login.submit}
          </button>
        </form>

        <div className="my-4 flex items-center gap-3 text-xs text-gray-400">
          <span className="h-px flex-1 bg-gray-200" />
          {dict.login.or}
          <span className="h-px flex-1 bg-gray-200" />
        </div>

        <button
          type="button"
          onClick={signInWithPasskey}
          className="btn btn-neutral w-full"
          disabled={busy}
        >
          {dict.login.passkeyButton}
        </button>

        {oidcEnabled && (
          <a href="/api/auth/oidc/login" className="btn btn-neutral w-full mt-2">
            {dict.login.ssoButton}
          </a>
        )}

        <p className="mt-4 text-center text-sm">
          <Link href="/" className="text-gray-500 hover:text-[var(--c-primary)]">
            {dict.login.backToMenu}
          </Link>
        </p>
      </div>
    </div>
  );
}