use nu_plugin::{
    serve_plugin, EngineInterface, EvaluatedCall, MsgPackSerializer, Plugin, PluginCommand,
    SimplePluginCommand,
};
use nu_protocol::{record, Category, Example, LabeledError, Signature, SyntaxShape, Type, Value};

mod helpers;

#[cfg(test)]
mod tests;

/// Nushell plugin for provisioning authentication (JWT, MFA)
pub struct AuthPlugin;

impl Plugin for AuthPlugin {
    /// Returns the plugin version from Cargo.toml
    fn version(&self) -> String {
        env!("CARGO_PKG_VERSION").into()
    }

    /// Returns the list of commands provided by this plugin
    fn commands(&self) -> Vec<Box<dyn PluginCommand<Plugin = Self>>> {
        vec![
            Box::new(Login),
            Box::new(Logout),
            Box::new(Verify),
            Box::new(Sessions),
            Box::new(MfaEnroll),
            Box::new(MfaVerify),
        ]
    }
}

/// Login command - Authenticate with the provisioning platform
pub struct Login;

impl SimplePluginCommand for Login {
    type Plugin = AuthPlugin;

    fn name(&self) -> &str {
        "auth login"
    }

    fn signature(&self) -> Signature {
        Signature::build(PluginCommand::name(self))
            .input_output_type(Type::Nothing, Type::Record(vec![].into()))
            .required("username", SyntaxShape::String, "Username for login")
            .optional(
                "password",
                SyntaxShape::String,
                "Password (will prompt if omitted)",
            )
            .named(
                "url",
                SyntaxShape::String,
                "Control center URL (default: http://localhost:8081)",
                None,
            )
            .switch("save", "Save credentials to secure keyring", None)
            .category(Category::Custom("provisioning".into()))
    }

    fn description(&self) -> &str {
        "Login to provisioning platform with JWT authentication"
    }

    fn examples(&self) -> Vec<Example<'_>> {
        vec![
            Example {
                example: "auth login admin",
                description: "Login as admin (password prompt)",
                result: None,
            },
            Example {
                example: "auth login admin mypassword",
                description: "Login with password in command",
                result: None,
            },
            Example {
                example: "auth login admin --url http://control.example.com:8081",
                description: "Login to custom control center URL",
                result: None,
            },
            Example {
                example: "auth login admin --save",
                description: "Login and save credentials to keyring",
                result: None,
            },
        ]
    }

    fn run(
        &self,
        _plugin: &AuthPlugin,
        _engine: &EngineInterface,
        call: &EvaluatedCall,
        _input: &Value,
    ) -> Result<Value, LabeledError> {
        let username: String = call.req(0)?;
        let password_arg: Option<String> = call.opt(1)?;
        let url = call
            .get_flag::<String>("url")?
            .unwrap_or("http://localhost:8081".to_string());
        let save_token = call.has_flag("save")?;

        // Get password (from arg or prompt)
        let password = if let Some(pwd) = password_arg {
            pwd
        } else {
            helpers::prompt_password("Password: ")
                .map_err(|e| LabeledError::new(format!("Password input failed: {}", e)))?
        };

        // Send login request
        let token_response = helpers::send_login_request(&url, &username, &password)
            .map_err(|e| LabeledError::new(format!("Login failed: {}", e)))?;

        // Store tokens in keyring if requested
        if save_token {
            helpers::store_tokens_in_keyring(
                &username,
                &token_response.access_token,
                &token_response.refresh_token,
            )
            .map_err(|e| LabeledError::new(format!("Failed to save tokens: {}", e)))?;
        }

        // Return success response
        Ok(Value::record(
            record! {
                "success" => Value::bool(true, call.head),
                "user" => Value::record(record! {
                    "id" => Value::string(&token_response.user.id, call.head),
                    "username" => Value::string(&token_response.user.username, call.head),
                    "email" => Value::string(&token_response.user.email, call.head),
                    "roles" => Value::list(
                        token_response.user.roles.iter()
                            .map(|r| Value::string(r, call.head))
                            .collect(),
                        call.head
                    ),
                }, call.head),
                "expires_in" => Value::int(token_response.expires_in, call.head),
                "token_saved" => Value::bool(save_token, call.head),
            },
            call.head,
        ))
    }
}

/// Logout command - Remove authentication session
pub struct Logout;

impl SimplePluginCommand for Logout {
    type Plugin = AuthPlugin;

    fn name(&self) -> &str {
        "auth logout"
    }

    fn signature(&self) -> Signature {
        Signature::build(PluginCommand::name(self))
            .input_output_type(Type::Nothing, Type::Record(vec![].into()))
            .named(
                "user",
                SyntaxShape::String,
                "Username (defaults to current user)",
                Some('u'),
            )
            .named("url", SyntaxShape::String, "Control Center URL", None)
            .switch("all", "Logout from all active sessions", Some('a'))
            .category(Category::Custom("provisioning".into()))
    }

    fn description(&self) -> &str {
        "Logout from provisioning platform"
    }

    fn examples(&self) -> Vec<Example<'_>> {
        vec![
            Example {
                example: "auth logout",
                description: "Logout from current session",
                result: None,
            },
            Example {
                example: "auth logout --all",
                description: "Logout from all active sessions",
                result: None,
            },
        ]
    }

    fn run(
        &self,
        _plugin: &AuthPlugin,
        _engine: &EngineInterface,
        call: &EvaluatedCall,
        _input: &Value,
    ) -> Result<Value, LabeledError> {
        let username_arg: Option<String> = call.get_flag("user")?;
        let _all_sessions = call.has_flag("all")?;
        let url = call
            .get_flag::<String>("url")?
            .unwrap_or("http://localhost:8081".to_string());

        // Get username (from flag or current user)
        let username = if let Some(user) = username_arg {
            user
        } else {
            std::env::var("USER").unwrap_or("default".to_string())
        };

        // Get access token
        let access_token = helpers::get_access_token(&username)
            .map_err(|e| LabeledError::new(format!("No active session: {}", e)))?;

        // Send logout request
        helpers::send_logout_request(&url, &access_token)
            .map_err(|e| LabeledError::new(format!("Logout failed: {}", e)))?;

        // Remove tokens from keyring
        helpers::remove_tokens_from_keyring(&username)
            .map_err(|e| LabeledError::new(format!("Failed to remove tokens: {}", e)))?;

        Ok(Value::record(
            record! {
                "success" => Value::bool(true, call.head),
                "message" => Value::string("Logged out successfully", call.head),
                "user" => Value::string(&username, call.head),
            },
            call.head,
        ))
    }
}

/// Verify token command - Check authentication status
pub struct Verify;

impl SimplePluginCommand for Verify {
    type Plugin = AuthPlugin;

    fn name(&self) -> &str {
        "auth verify"
    }

    fn signature(&self) -> Signature {
        Signature::build(PluginCommand::name(self))
            .input_output_type(Type::Nothing, Type::Record(vec![].into()))
            .named(
                "token",
                SyntaxShape::String,
                "Token to verify (uses stored token if omitted)",
                None,
            )
            .category(Category::Custom("provisioning".into()))
    }

    fn description(&self) -> &str {
        "Verify current authentication token"
    }

    fn examples(&self) -> Vec<Example<'_>> {
        vec![
            Example {
                example: "auth verify",
                description: "Verify stored authentication token",
                result: None,
            },
            Example {
                example: "auth verify --token eyJhbGc...",
                description: "Verify specific token",
                result: None,
            },
        ]
    }

    fn run(
        &self,
        _plugin: &AuthPlugin,
        _engine: &EngineInterface,
        call: &EvaluatedCall,
        _input: &Value,
    ) -> Result<Value, LabeledError> {
        let _token: Option<String> = call.get_flag("token")?;

        // Placeholder - will be implemented by Agente 4
        Ok(Value::record(
            record! {
                "valid" => Value::bool(true, call.head),
                "message" => Value::string("Verify placeholder - to be implemented", call.head),
            },
            call.head,
        ))
    }
}

/// Sessions command - List active authentication sessions
pub struct Sessions;

impl SimplePluginCommand for Sessions {
    type Plugin = AuthPlugin;

    fn name(&self) -> &str {
        "auth sessions"
    }

    fn signature(&self) -> Signature {
        Signature::build(PluginCommand::name(self))
            .input_output_type(
                Type::Nothing,
                Type::List(Box::new(Type::Record(vec![].into()))),
            )
            .switch("active", "Show only active sessions", None)
            .category(Category::Custom("provisioning".into()))
    }

    fn description(&self) -> &str {
        "List active authentication sessions"
    }

    fn examples(&self) -> Vec<Example<'_>> {
        vec![
            Example {
                example: "auth sessions",
                description: "List all sessions",
                result: None,
            },
            Example {
                example: "auth sessions --active",
                description: "List only active sessions",
                result: None,
            },
        ]
    }

    fn run(
        &self,
        _plugin: &AuthPlugin,
        _engine: &EngineInterface,
        call: &EvaluatedCall,
        _input: &Value,
    ) -> Result<Value, LabeledError> {
        let _active: bool = call.has_flag("active")?;

        // Placeholder - will be implemented by Agente 5
        Ok(Value::list(vec![], call.head))
    }
}

/// MFA Enrollment command
pub struct MfaEnroll;

impl SimplePluginCommand for MfaEnroll {
    type Plugin = AuthPlugin;

    fn name(&self) -> &str {
        "auth mfa enroll"
    }

    fn signature(&self) -> Signature {
        Signature::build(PluginCommand::name(self))
            .input_output_type(Type::Nothing, Type::Record(vec![].into()))
            .required("type", SyntaxShape::String, "MFA type: totp or webauthn")
            .named("user", SyntaxShape::String, "Username", Some('u'))
            .named("url", SyntaxShape::String, "Control Center URL", None)
            .category(Category::Custom("provisioning".into()))
    }

    fn description(&self) -> &str {
        "Enroll in MFA (TOTP or WebAuthn)"
    }

    fn examples(&self) -> Vec<Example<'_>> {
        vec![
            Example {
                example: "auth mfa enroll totp",
                description: "Enroll TOTP (Google Authenticator, Authy)",
                result: None,
            },
            Example {
                example: "auth mfa enroll webauthn",
                description: "Enroll WebAuthn (YubiKey, Touch ID)",
                result: None,
            },
            Example {
                example: "auth mfa enroll totp --user alice",
                description: "Enroll TOTP for specific user",
                result: None,
            },
        ]
    }

    fn run(
        &self,
        _plugin: &AuthPlugin,
        _engine: &EngineInterface,
        call: &EvaluatedCall,
        _input: &Value,
    ) -> Result<Value, LabeledError> {
        let mfa_type: String = call.req(0)?;
        let username = call
            .get_flag::<String>("user")?
            .unwrap_or_else(|| std::env::var("USER").unwrap_or("default".to_string()));
        let url = call
            .get_flag::<String>("url")?
            .unwrap_or("http://localhost:3000".to_string());

        // Get access token
        let access_token = helpers::get_access_token(&username)
            .map_err(|e| LabeledError::new(format!("Not logged in: {}", e)))?;

        // Send enrollment request
        let response = helpers::send_mfa_enroll_request(&url, &access_token, &mfa_type)
            .map_err(|e| LabeledError::new(format!("MFA enrollment failed: {}", e)))?;

        // Display QR code if TOTP
        if mfa_type == "totp" {
            helpers::display_qr_code(&response.qr_code_uri)
                .map_err(|e| LabeledError::new(format!("QR display failed: {}", e)))?;
        }

        Ok(Value::record(
            record! {
                "success" => Value::bool(true, call.head),
                "mfa_type" => Value::string(&mfa_type, call.head),
                "secret" => Value::string(&response.secret, call.head),
                "backup_codes" => Value::list(
                    response.backup_codes.iter()
                        .map(|c| Value::string(c, call.head))
                        .collect(),
                    call.head
                ),
            },
            call.head,
        ))
    }
}

/// MFA Verify command
pub struct MfaVerify;

impl SimplePluginCommand for MfaVerify {
    type Plugin = AuthPlugin;

    fn name(&self) -> &str {
        "auth mfa verify"
    }

    fn signature(&self) -> Signature {
        Signature::build(PluginCommand::name(self))
            .input_output_type(Type::Nothing, Type::Record(vec![].into()))
            .named("code", SyntaxShape::String, "6-digit TOTP code", Some('c'))
            .named("user", SyntaxShape::String, "Username", Some('u'))
            .named("url", SyntaxShape::String, "Control Center URL", None)
            .category(Category::Custom("provisioning".into()))
    }

    fn description(&self) -> &str {
        "Verify MFA code"
    }

    fn examples(&self) -> Vec<Example<'_>> {
        vec![
            Example {
                example: "auth mfa verify --code 123456",
                description: "Verify TOTP code",
                result: None,
            },
            Example {
                example: "auth mfa verify --code 123456 --user alice",
                description: "Verify TOTP code for specific user",
                result: None,
            },
        ]
    }

    fn run(
        &self,
        _plugin: &AuthPlugin,
        _engine: &EngineInterface,
        call: &EvaluatedCall,
        _input: &Value,
    ) -> Result<Value, LabeledError> {
        let code = call
            .get_flag::<String>("code")?
            .ok_or_else(|| LabeledError::new("--code required"))?;
        let username = call
            .get_flag::<String>("user")?
            .unwrap_or_else(|| std::env::var("USER").unwrap_or("default".to_string()));
        let url = call
            .get_flag::<String>("url")?
            .unwrap_or("http://localhost:3000".to_string());

        // Get access token
        let access_token = helpers::get_access_token(&username)
            .map_err(|e| LabeledError::new(format!("Not logged in: {}", e)))?;

        // Verify code
        let valid = helpers::send_mfa_verify_request(&url, &access_token, &code)
            .map_err(|e| LabeledError::new(format!("MFA verification failed: {}", e)))?;

        Ok(Value::record(
            record! {
                "valid" => Value::bool(valid, call.head),
                "message" => Value::string(
                    if valid { "MFA verified" } else { "Invalid code" },
                    call.head
                ),
            },
            call.head,
        ))
    }
}

/// Entry point for the plugin binary
fn main() {
    serve_plugin(&AuthPlugin, MsgPackSerializer);
}