use std::collections::hash_map::DefaultHasher;
use std::hash::{Hash, Hasher};
use std::sync::LazyLock;
use std::time::Instant;

use cot::db::Database;
use cot::request::extractors::UrlQuery;
use cot::session::Session;
use openidconnect::core::{CoreClient, CoreProviderMetadata};
use openidconnect::{
    AuthorizationCode, ClientId, ClientSecret, CsrfToken, EndpointMaybeSet, EndpointNotSet,
    EndpointSet, IssuerUrl, Nonce, PkceCodeChallenge, PkceCodeVerifier, RedirectUrl, Scope,
};

use cot::request::RequestHead;
use cot::request::extractors::FromRequestHead;

use crate::auth;
use crate::config::AppConfig;
use crate::i18n::I18n;
use crate::user::{OidcLink, User};

// ---------------------------------------------------------------------------
// Request origin extractor (scheme + host from headers)
// ---------------------------------------------------------------------------

/// Extracts the origin (e.g. "http://127.0.0.1:3001") from the request so we
/// can build the correct OIDC redirect URI.
pub struct RequestOrigin(pub String);

impl FromRequestHead for RequestOrigin {
    async fn from_request_head(head: &RequestHead) -> cot::Result<Self> {
        let scheme = head
            .headers
            .get("x-forwarded-proto")
            .and_then(|v| v.to_str().ok())
            .unwrap_or("http");

        let host = head
            .headers
            .get(cot::http::header::HOST)
            .and_then(|v| v.to_str().ok())
            .unwrap_or("localhost");

        Ok(RequestOrigin(format!("{scheme}://{host}")))
    }
}

// ---------------------------------------------------------------------------
// Session keys for OIDC flow state
// ---------------------------------------------------------------------------

const SESSION_CSRF_STATE: &str = "oidc_csrf_state";
const SESSION_NONCE: &str = "oidc_nonce";
const SESSION_PKCE_VERIFIER: &str = "oidc_pkce_verifier";
const SESSION_REDIRECT_URI: &str = "oidc_redirect_uri";

const SESSION_MOBILE_CSRF_STATE: &str = "mobile_oidc_csrf_state";
const SESSION_MOBILE_NONCE: &str = "mobile_oidc_nonce";
const SESSION_MOBILE_PKCE_VERIFIER: &str = "mobile_oidc_pkce_verifier";
const SESSION_MOBILE_PROVIDER_REDIRECT_URI: &str = "mobile_oidc_provider_redirect_uri";
const SESSION_MOBILE_APP_REDIRECT_URI: &str = "mobile_oidc_app_redirect_uri";
const DEFAULT_MOBILE_REDIRECT_URI: &str = "furumi://auth/callback";

// ---------------------------------------------------------------------------
// Provider cache
// ---------------------------------------------------------------------------

/// Concrete client type returned by `from_provider_metadata` + `set_redirect_uri`.
/// The provider metadata discovery sets auth URL to EndpointSet, and token/userinfo
/// endpoints to EndpointMaybeSet. The remaining endpoints stay EndpointNotSet.
type ConfiguredClient = CoreClient<
    EndpointSet,
    EndpointNotSet,
    EndpointNotSet,
    EndpointNotSet,
    EndpointMaybeSet,
    EndpointMaybeSet,
>;

struct CachedProvider {
    client: ConfiguredClient,
    fetched_at: Instant,
    config_hash: u64,
}

static PROVIDER_CACHE: LazyLock<tokio::sync::RwLock<Option<CachedProvider>>> =
    LazyLock::new(|| tokio::sync::RwLock::new(None));

/// TTL for cached provider metadata (1 hour).
const PROVIDER_TTL_SECS: u64 = 3600;

/// Compute a hash of the OIDC configuration values so we can detect changes.
fn config_hash(issuer: &str, client_id: &str, client_secret: &str) -> u64 {
    let mut hasher = DefaultHasher::new();
    issuer.hash(&mut hasher);
    client_id.hash(&mut hasher);
    client_secret.hash(&mut hasher);
    hasher.finish()
}

fn oidc_http_client() -> reqwest::Client {
    reqwest::ClientBuilder::new()
        .redirect(reqwest::redirect::Policy::none())
        .build()
        .expect("valid reqwest client")
}

/// Get or refresh the cached OIDC provider. Returns a cloned `ConfiguredClient`.
async fn get_or_refresh_provider(
    config: &AppConfig,
    http: &reqwest::Client,
) -> Result<ConfiguredClient, String> {
    let hash = config_hash(
        &config.oidc_issuer,
        &config.oidc_client_id,
        &config.oidc_client_secret,
    );

    // Fast path: check if we have a valid cached provider.
    {
        let cache = PROVIDER_CACHE.read().await;
        if let Some(ref cached) = *cache {
            if cached.config_hash == hash
                && cached.fetched_at.elapsed().as_secs() < PROVIDER_TTL_SECS
            {
                return Ok(cached.client.clone());
            }
        }
    }

    // Slow path: discover provider metadata + JWKS.
    // Strip /.well-known/openid-configuration suffix if the user pasted the
    // full discovery URL, so discover_async doesn't double-append it.
    let issuer = config
        .oidc_issuer
        .trim_end_matches('/')
        .strip_suffix("/.well-known/openid-configuration")
        .unwrap_or(config.oidc_issuer.trim_end_matches('/'))
        .to_owned();

    let issuer_url = IssuerUrl::new(issuer).map_err(|e| format!("invalid issuer URL: {e}"))?;

    let metadata = CoreProviderMetadata::discover_async(issuer_url, http)
        .await
        .map_err(|e| format!("OIDC discovery failed: {e}"))?;

    let client = CoreClient::from_provider_metadata(
        metadata,
        ClientId::new(config.oidc_client_id.clone()),
        Some(ClientSecret::new(config.oidc_client_secret.clone())),
    );

    let mut cache = PROVIDER_CACHE.write().await;
    *cache = Some(CachedProvider {
        client: client.clone(),
        fetched_at: Instant::now(),
        config_hash: hash,
    });

    Ok(client)
}

// ---------------------------------------------------------------------------
// GET /auth/oidc/start
// ---------------------------------------------------------------------------

pub async fn oidc_start_handler(
    origin: RequestOrigin,
    i18n: I18n,
    db: Database,
    session: Session,
) -> cot::Result<cot::response::Response> {
    let (config, _) = AppConfig::load_with_db(&db).await;

    // Validate SSO is enabled and configured.
    if !config.auth_sso_enabled
        || config.oidc_issuer.is_empty()
        || config.oidc_client_id.is_empty()
        || config.oidc_client_secret.is_empty()
    {
        tracing::warn!("OIDC start requested but SSO is not configured");
        crate::metrics::record_auth_attempt("oidc", "failure", "not_configured");
        return redirect_login_with_error(i18n.t.login_sso_disabled);
    }

    let http = oidc_http_client();
    let client = match get_or_refresh_provider(&config, &http).await {
        Ok(c) => c,
        Err(e) => {
            tracing::error!("OIDC provider error: {e}");
            crate::metrics::record_auth_attempt("oidc", "failure", "provider_error");
            return redirect_login_with_error(i18n.t.login_oidc_error);
        }
    };

    // Build redirect URI from the actual request origin.
    let redirect_uri_str = format!("{}/auth/oidc/callback", origin.0);
    let redirect_url = RedirectUrl::new(redirect_uri_str.clone())
        .map_err(|e| cot::Error::internal(format!("bad redirect URI: {e}")))?;
    let client = client.set_redirect_uri(redirect_url);
    tracing::info!(
        redirect_uri = %redirect_uri_str,
        oidc_issuer = %config.oidc_issuer,
        "OIDC start: building authorization request",
    );

    // Build PKCE challenge.
    let (pkce_challenge, pkce_verifier) = PkceCodeChallenge::new_random_sha256();

    // Build authorization URL.
    // The openid scope is added automatically by the crate; only add email + profile.
    let (auth_url, csrf_state, nonce) = client
        .authorize_url(
            openidconnect::AuthenticationFlow::<openidconnect::core::CoreResponseType>::AuthorizationCode,
            CsrfToken::new_random,
            Nonce::new_random,
        )
        .add_scope(Scope::new("email".to_string()))
        .add_scope(Scope::new("profile".to_string()))
        .set_pkce_challenge(pkce_challenge)
        .url();
    tracing::info!(auth_url = %auth_url, "OIDC start: redirecting to provider");

    // Store OIDC flow state in the session.
    session
        .insert(SESSION_CSRF_STATE, csrf_state.secret().clone())
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    session
        .insert(SESSION_NONCE, nonce.secret().clone())
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    session
        .insert(SESSION_PKCE_VERIFIER, pkce_verifier.secret().clone())
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    session
        .insert(SESSION_REDIRECT_URI, redirect_uri_str)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;

    Ok(auth::redirect(auth_url.as_str()))
}

// ---------------------------------------------------------------------------
// GET /auth/oidc/callback
// ---------------------------------------------------------------------------

use serde::Deserialize;

#[derive(Deserialize)]
pub struct OidcCallbackQuery {
    code: String,
    state: String,
}

#[derive(Deserialize)]
pub struct MobileOidcStartQuery {
    redirect_uri: Option<String>,
}

#[derive(Deserialize)]
pub struct MobileOidcCallbackQuery {
    code: Option<String>,
    state: Option<String>,
    error: Option<String>,
}

pub async fn oidc_callback_handler(
    i18n: I18n,
    db: Database,
    session: Session,
    UrlQuery(query): UrlQuery<OidcCallbackQuery>,
) -> cot::Result<cot::response::Response> {
    let (config, _) = AppConfig::load_with_db(&db).await;

    // Retrieve OIDC flow state from the session.
    let saved_csrf: Option<String> = session
        .get(SESSION_CSRF_STATE)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    let saved_nonce: Option<String> = session
        .get(SESSION_NONCE)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    let saved_pkce: Option<String> = session
        .get(SESSION_PKCE_VERIFIER)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    let saved_redirect_uri: Option<String> = session
        .get(SESSION_REDIRECT_URI)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;

    // Validate CSRF state.
    let Some(saved_csrf) = saved_csrf else {
        tracing::warn!("OIDC callback: no CSRF state in session");
        crate::metrics::record_auth_attempt("oidc", "failure", "missing_state");
        return redirect_login_with_error(i18n.t.login_oidc_error);
    };
    if query.state != saved_csrf {
        tracing::warn!("OIDC callback: CSRF state mismatch");
        crate::metrics::record_auth_attempt("oidc", "failure", "csrf");
        return redirect_login_with_error(i18n.t.login_oidc_error);
    }

    let Some(nonce_str) = saved_nonce else {
        tracing::warn!("OIDC callback: no nonce in session");
        crate::metrics::record_auth_attempt("oidc", "failure", "missing_nonce");
        return redirect_login_with_error(i18n.t.login_oidc_error);
    };
    let Some(pkce_str) = saved_pkce else {
        tracing::warn!("OIDC callback: no PKCE verifier in session");
        crate::metrics::record_auth_attempt("oidc", "failure", "missing_pkce");
        return redirect_login_with_error(i18n.t.login_oidc_error);
    };

    let nonce = Nonce::new(nonce_str);
    let pkce_verifier = PkceCodeVerifier::new(pkce_str);

    let http = oidc_http_client();
    let client = match get_or_refresh_provider(&config, &http).await {
        Ok(c) => c,
        Err(e) => {
            tracing::error!("OIDC provider error during callback: {e}");
            crate::metrics::record_auth_attempt("oidc", "failure", "provider_error");
            return redirect_login_with_error(i18n.t.login_oidc_error);
        }
    };

    // Restore the redirect URI that was used in the authorization request.
    let client = if let Some(ref uri) = saved_redirect_uri {
        let redirect_url = RedirectUrl::new(uri.clone())
            .map_err(|e| cot::Error::internal(format!("bad redirect URI from session: {e}")))?;
        client.set_redirect_uri(redirect_url)
    } else {
        client
    };

    // Exchange code for tokens.
    let token_request = match client.exchange_code(AuthorizationCode::new(query.code.clone())) {
        Ok(req) => req,
        Err(e) => {
            tracing::error!("OIDC token endpoint not configured: {e}");
            crate::metrics::record_auth_attempt("oidc", "failure", "token_config");
            return redirect_login_with_error(i18n.t.login_oidc_error);
        }
    };
    let token_response = token_request
        .set_pkce_verifier(pkce_verifier)
        .request_async(&http)
        .await;

    let token_response = match token_response {
        Ok(t) => t,
        Err(e) => {
            tracing::error!("OIDC token exchange failed: {e}");
            crate::metrics::record_auth_attempt("oidc", "failure", "token_exchange");
            return redirect_login_with_error(i18n.t.login_oidc_error);
        }
    };

    // Verify and extract ID token claims.
    use openidconnect::TokenResponse;
    let id_token = match token_response.id_token() {
        Some(t) => t,
        None => {
            tracing::error!("OIDC response missing ID token");
            crate::metrics::record_auth_attempt("oidc", "failure", "missing_id_token");
            return redirect_login_with_error(i18n.t.login_oidc_error);
        }
    };

    let claims = match id_token.claims(&client.id_token_verifier(), &nonce) {
        Ok(c) => c,
        Err(e) => {
            tracing::error!("OIDC ID token verification failed: {e}");
            crate::metrics::record_auth_attempt("oidc", "failure", "id_token_verify");
            return redirect_login_with_error(i18n.t.login_oidc_error);
        }
    };

    let sub = claims.subject().to_string();
    let issuer = claims.issuer().to_string();
    let email = claims.email().map(|e| e.to_string());
    let name = claims
        .name()
        .and_then(|n| n.get(None))
        .map(|n| n.to_string());

    // Extract groups from the raw JWT payload (second dot-separated segment).
    // The token is already signature-verified above, so we only need to decode
    // the payload to read the non-standard `groups` claim.
    let groups: Vec<String> = (|| {
        use base64::Engine;
        let raw = id_token.to_string();
        let payload_b64 = raw.split('.').nth(1)?;
        // JWT payloads use URL-safe base64; try without padding first, then
        // fall back to the padded variant (some providers add trailing '=').
        let payload_bytes = base64::engine::general_purpose::URL_SAFE_NO_PAD
            .decode(payload_b64)
            .or_else(|_| base64::engine::general_purpose::URL_SAFE.decode(payload_b64))
            .ok()?;
        let value: serde_json::Value = serde_json::from_slice(&payload_bytes).ok()?;
        let arr = value.get("groups")?.as_array()?;
        Some(
            arr.iter()
                .filter_map(|v| v.as_str().map(String::from))
                .collect(),
        )
    })()
    .unwrap_or_default();

    tracing::info!(
        "OIDC login: sub={sub}, groups={groups:?}, admin_groups={:?}, user_groups={:?}",
        config.oidc_admin_groups,
        config.oidc_user_groups,
    );

    if !is_allowed_by_groups(&groups, &config.oidc_user_groups, &config.oidc_admin_groups) {
        tracing::warn!(
            "OIDC login denied by group allowlist: sub={sub}, groups={groups:?}, user_groups={:?}, admin_groups={:?}",
            config.oidc_user_groups,
            config.oidc_admin_groups,
        );
        crate::metrics::record_auth_attempt("oidc", "failure", "not_in_group");
        return redirect_login_with_error(i18n.t.login_access_denied);
    }

    // User provisioning logic.
    let user = match provision_user(
        &db,
        &issuer,
        &sub,
        email.as_deref(),
        name.as_deref(),
        &groups,
        &config.oidc_admin_groups,
    )
    .await
    {
        Ok(u) => u,
        Err(e) => {
            tracing::error!("OIDC user provisioning failed: {e}");
            crate::metrics::record_auth_attempt("oidc", "failure", "provisioning");
            return redirect_login_with_error(i18n.t.login_oidc_error);
        }
    };

    let redirect_to = auth::get_post_login_redirect(&session)
        .await?
        .unwrap_or_else(|| "/".to_string());

    // Log the user in.
    auth::login(&session, user.id_val()).await?;
    auth::clear_post_login_redirect(&session).await?;
    crate::metrics::record_auth_attempt("oidc", "success", "ok");
    crate::metrics::record_session_created("oidc");

    // Clear OIDC session keys.
    let _: Option<String> = session
        .remove(SESSION_CSRF_STATE)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    let _: Option<String> = session
        .remove(SESSION_NONCE)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    let _: Option<String> = session
        .remove(SESSION_PKCE_VERIFIER)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    let _: Option<String> = session
        .remove(SESSION_REDIRECT_URI)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;

    Ok(auth::redirect(&redirect_to))
}

// ---------------------------------------------------------------------------
// Mobile OIDC flow
// ---------------------------------------------------------------------------

pub async fn oidc_mobile_start_handler(
    origin: RequestOrigin,
    db: Database,
    session: Session,
    UrlQuery(query): UrlQuery<MobileOidcStartQuery>,
) -> cot::Result<cot::response::Response> {
    let Some(app_redirect_uri) = safe_mobile_redirect_uri(query.redirect_uri.as_deref()) else {
        crate::metrics::record_auth_attempt("mobile_oidc", "failure", "bad_redirect_uri");
        return Ok(text_response(
            cot::http::StatusCode::BAD_REQUEST,
            "invalid mobile redirect_uri",
        ));
    };

    let (config, _) = AppConfig::load_with_db(&db).await;

    if !config.auth_sso_enabled
        || config.oidc_issuer.is_empty()
        || config.oidc_client_id.is_empty()
        || config.oidc_client_secret.is_empty()
    {
        tracing::warn!("Mobile OIDC start requested but SSO is not configured");
        crate::metrics::record_auth_attempt("mobile_oidc", "failure", "not_configured");
        return Ok(mobile_redirect_error(
            &app_redirect_uri,
            "sso_not_configured",
        ));
    }

    let http = oidc_http_client();
    let client = match get_or_refresh_provider(&config, &http).await {
        Ok(c) => c,
        Err(e) => {
            tracing::error!("Mobile OIDC provider error: {e}");
            crate::metrics::record_auth_attempt("mobile_oidc", "failure", "provider_error");
            return Ok(mobile_redirect_error(&app_redirect_uri, "provider_error"));
        }
    };

    let provider_redirect_uri = format!("{}/auth/mobile/oidc/callback", origin.0);
    let redirect_url = RedirectUrl::new(provider_redirect_uri.clone())
        .map_err(|e| cot::Error::internal(format!("bad mobile redirect URI: {e}")))?;
    let client = client.set_redirect_uri(redirect_url);

    let (pkce_challenge, pkce_verifier) = PkceCodeChallenge::new_random_sha256();
    let (auth_url, csrf_state, nonce) = client
        .authorize_url(
            openidconnect::AuthenticationFlow::<openidconnect::core::CoreResponseType>::AuthorizationCode,
            CsrfToken::new_random,
            Nonce::new_random,
        )
        .add_scope(Scope::new("email".to_string()))
        .add_scope(Scope::new("profile".to_string()))
        .set_pkce_challenge(pkce_challenge)
        .url();

    session
        .insert(SESSION_MOBILE_CSRF_STATE, csrf_state.secret().clone())
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    session
        .insert(SESSION_MOBILE_NONCE, nonce.secret().clone())
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    session
        .insert(SESSION_MOBILE_PKCE_VERIFIER, pkce_verifier.secret().clone())
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    session
        .insert(
            SESSION_MOBILE_PROVIDER_REDIRECT_URI,
            provider_redirect_uri.clone(),
        )
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    session
        .insert(SESSION_MOBILE_APP_REDIRECT_URI, app_redirect_uri)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;

    tracing::info!(
        auth_url = %auth_url,
        provider_redirect_uri = %provider_redirect_uri,
        "Mobile OIDC start: redirecting to provider",
    );

    Ok(auth::redirect(auth_url.as_str()))
}

pub async fn oidc_mobile_callback_handler(
    db: Database,
    session: Session,
    UrlQuery(query): UrlQuery<MobileOidcCallbackQuery>,
) -> cot::Result<cot::response::Response> {
    let app_redirect_uri = mobile_app_redirect_uri_from_session(&session).await?;

    if query.error.is_some() {
        tracing::warn!("Mobile OIDC callback returned provider error");
        crate::metrics::record_auth_attempt("mobile_oidc", "failure", "provider_denied");
        clear_mobile_oidc_session(&session).await?;
        return Ok(mobile_redirect_error(&app_redirect_uri, "provider_denied"));
    }

    let Some(code) = query.code else {
        crate::metrics::record_auth_attempt("mobile_oidc", "failure", "missing_code");
        clear_mobile_oidc_session(&session).await?;
        return Ok(mobile_redirect_error(&app_redirect_uri, "missing_code"));
    };
    let Some(state) = query.state else {
        crate::metrics::record_auth_attempt("mobile_oidc", "failure", "missing_state");
        clear_mobile_oidc_session(&session).await?;
        return Ok(mobile_redirect_error(&app_redirect_uri, "missing_state"));
    };

    let saved_csrf: Option<String> = session
        .get(SESSION_MOBILE_CSRF_STATE)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    let saved_nonce: Option<String> = session
        .get(SESSION_MOBILE_NONCE)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    let saved_pkce: Option<String> = session
        .get(SESSION_MOBILE_PKCE_VERIFIER)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    let provider_redirect_uri: Option<String> = session
        .get(SESSION_MOBILE_PROVIDER_REDIRECT_URI)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;

    let Some(saved_csrf) = saved_csrf else {
        tracing::warn!("Mobile OIDC callback: no CSRF state in session");
        crate::metrics::record_auth_attempt("mobile_oidc", "failure", "missing_state");
        clear_mobile_oidc_session(&session).await?;
        return Ok(mobile_redirect_error(&app_redirect_uri, "missing_state"));
    };
    if state != saved_csrf {
        tracing::warn!("Mobile OIDC callback: CSRF state mismatch");
        crate::metrics::record_auth_attempt("mobile_oidc", "failure", "csrf");
        clear_mobile_oidc_session(&session).await?;
        return Ok(mobile_redirect_error(&app_redirect_uri, "csrf"));
    }

    let Some(nonce_str) = saved_nonce else {
        crate::metrics::record_auth_attempt("mobile_oidc", "failure", "missing_nonce");
        clear_mobile_oidc_session(&session).await?;
        return Ok(mobile_redirect_error(&app_redirect_uri, "missing_nonce"));
    };
    let Some(pkce_str) = saved_pkce else {
        crate::metrics::record_auth_attempt("mobile_oidc", "failure", "missing_pkce");
        clear_mobile_oidc_session(&session).await?;
        return Ok(mobile_redirect_error(&app_redirect_uri, "missing_pkce"));
    };
    let Some(provider_redirect_uri) = provider_redirect_uri else {
        crate::metrics::record_auth_attempt("mobile_oidc", "failure", "missing_redirect_uri");
        clear_mobile_oidc_session(&session).await?;
        return Ok(mobile_redirect_error(
            &app_redirect_uri,
            "missing_redirect_uri",
        ));
    };

    let (config, _) = AppConfig::load_with_db(&db).await;
    if !config.auth_sso_enabled
        || config.oidc_issuer.is_empty()
        || config.oidc_client_id.is_empty()
        || config.oidc_client_secret.is_empty()
    {
        crate::metrics::record_auth_attempt("mobile_oidc", "failure", "not_configured");
        clear_mobile_oidc_session(&session).await?;
        return Ok(mobile_redirect_error(
            &app_redirect_uri,
            "sso_not_configured",
        ));
    }

    let http = oidc_http_client();
    let client = match get_or_refresh_provider(&config, &http).await {
        Ok(c) => c,
        Err(e) => {
            tracing::error!("Mobile OIDC provider error during callback: {e}");
            crate::metrics::record_auth_attempt("mobile_oidc", "failure", "provider_error");
            clear_mobile_oidc_session(&session).await?;
            return Ok(mobile_redirect_error(&app_redirect_uri, "provider_error"));
        }
    };
    let redirect_url = RedirectUrl::new(provider_redirect_uri)
        .map_err(|e| cot::Error::internal(format!("bad mobile redirect URI from session: {e}")))?;
    let client = client.set_redirect_uri(redirect_url);

    let token_request = match client.exchange_code(AuthorizationCode::new(code)) {
        Ok(req) => req,
        Err(e) => {
            tracing::error!("Mobile OIDC token endpoint not configured: {e}");
            crate::metrics::record_auth_attempt("mobile_oidc", "failure", "token_config");
            clear_mobile_oidc_session(&session).await?;
            return Ok(mobile_redirect_error(&app_redirect_uri, "oidc_error"));
        }
    };
    let token_response = token_request
        .set_pkce_verifier(PkceCodeVerifier::new(pkce_str))
        .request_async(&http)
        .await;
    let token_response = match token_response {
        Ok(t) => t,
        Err(e) => {
            tracing::error!("Mobile OIDC token exchange failed: {e}");
            crate::metrics::record_auth_attempt("mobile_oidc", "failure", "token_exchange");
            clear_mobile_oidc_session(&session).await?;
            return Ok(mobile_redirect_error(&app_redirect_uri, "oidc_error"));
        }
    };

    use openidconnect::TokenResponse;
    let id_token = match token_response.id_token() {
        Some(t) => t,
        None => {
            tracing::error!("Mobile OIDC response missing ID token");
            crate::metrics::record_auth_attempt("mobile_oidc", "failure", "missing_id_token");
            clear_mobile_oidc_session(&session).await?;
            return Ok(mobile_redirect_error(&app_redirect_uri, "oidc_error"));
        }
    };

    let nonce = Nonce::new(nonce_str);
    let claims = match id_token.claims(&client.id_token_verifier(), &nonce) {
        Ok(c) => c,
        Err(e) => {
            tracing::error!("Mobile OIDC ID token verification failed: {e}");
            crate::metrics::record_auth_attempt("mobile_oidc", "failure", "id_token_verify");
            clear_mobile_oidc_session(&session).await?;
            return Ok(mobile_redirect_error(&app_redirect_uri, "oidc_error"));
        }
    };

    let sub = claims.subject().to_string();
    let issuer = claims.issuer().to_string();
    let email = claims.email().map(|e| e.to_string());
    let name = claims
        .name()
        .and_then(|n| n.get(None))
        .map(|n| n.to_string());
    let groups = extract_groups_from_jwt(&id_token.to_string());

    if !is_allowed_by_groups(&groups, &config.oidc_user_groups, &config.oidc_admin_groups) {
        tracing::warn!(
            "Mobile OIDC login denied by group allowlist: sub={sub}, groups={groups:?}, user_groups={:?}, admin_groups={:?}",
            config.oidc_user_groups,
            config.oidc_admin_groups,
        );
        crate::metrics::record_auth_attempt("mobile_oidc", "failure", "not_in_group");
        clear_mobile_oidc_session(&session).await?;
        return Ok(mobile_redirect_error(&app_redirect_uri, "access_denied"));
    }

    let user = match provision_user(
        &db,
        &issuer,
        &sub,
        email.as_deref(),
        name.as_deref(),
        &groups,
        &config.oidc_admin_groups,
    )
    .await
    {
        Ok(u) => u,
        Err(e) => {
            tracing::error!("Mobile OIDC user provisioning failed: {e}");
            crate::metrics::record_auth_attempt("mobile_oidc", "failure", "provisioning");
            clear_mobile_oidc_session(&session).await?;
            return Ok(mobile_redirect_error(&app_redirect_uri, "oidc_error"));
        }
    };

    let exchange_code = auth::create_mobile_exchange_code(&db, user.id_val())
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    clear_mobile_oidc_session(&session).await?;

    crate::metrics::record_auth_attempt("mobile_oidc", "success", "ok");
    crate::metrics::record_session_created("mobile_oidc");
    Ok(mobile_redirect_success(&app_redirect_uri, &exchange_code))
}

// ---------------------------------------------------------------------------
// User provisioning
// ---------------------------------------------------------------------------

/// Resolve the role based on OIDC group membership.
/// If `admin_groups` is non-empty and any user group matches, return "admin";
/// otherwise return "user".
fn resolve_role(groups: &[String], admin_groups: &str) -> &'static str {
    if admin_groups.is_empty() {
        return auth::Role::User.code();
    }
    let admin_set: std::collections::HashSet<&str> = admin_groups
        .split(',')
        .map(|s| s.trim())
        .filter(|s| !s.is_empty())
        .collect();
    if admin_set.is_empty() {
        return auth::Role::User.code();
    }
    for g in groups {
        if admin_set.contains(g.as_str()) {
            return auth::Role::Admin.code();
        }
    }
    auth::Role::User.code()
}

fn parse_group_set(groups: &str) -> std::collections::HashSet<&str> {
    groups
        .split(',')
        .map(str::trim)
        .filter(|s| !s.is_empty())
        .collect()
}

fn has_any_group(groups: &[String], allowed: &std::collections::HashSet<&str>) -> bool {
    groups.iter().any(|g| allowed.contains(g.as_str()))
}

fn is_allowed_by_groups(groups: &[String], user_groups: &str, admin_groups: &str) -> bool {
    let user_set = parse_group_set(user_groups);
    if user_set.is_empty() {
        return true;
    }
    let admin_set = parse_group_set(admin_groups);
    has_any_group(groups, &user_set) || has_any_group(groups, &admin_set)
}

async fn provision_user(
    db: &Database,
    issuer: &str,
    sub: &str,
    email: Option<&str>,
    name: Option<&str>,
    groups: &[String],
    admin_groups: &str,
) -> Result<User, String> {
    let role = resolve_role(groups, admin_groups);

    // 1. Check for existing OIDC link.
    if let Some(mut link) = OidcLink::find_by_issuer_sub(db, issuer, sub)
        .await
        .map_err(|e| format!("DB error finding OIDC link: {e}"))?
    {
        // Fetch the linked user.
        match User::get_by_id(db, link.user_id()).await {
            Ok(Some(mut user)) => {
                // Update cached claims.
                link.update_claims(db, email, name)
                    .await
                    .map_err(|e| format!("DB error updating OIDC link: {e}"))?;

                // Always update role on login.
                user.update_role(db, role)
                    .await
                    .map_err(|e| format!("DB error updating user role: {e}"))?;

                return Ok(user);
            }
            Ok(None) => {
                // User was deleted but the OIDC link is stale — remove it
                // and fall through to re-create the user below.
                tracing::warn!(
                    "OIDC link points to deleted user {}; removing stale link",
                    link.user_id(),
                );
                link.delete(db)
                    .await
                    .map_err(|e| format!("DB error deleting stale OIDC link: {e}"))?;
            }
            Err(e) => return Err(format!("DB error fetching user: {e}")),
        }
    }

    // 2. No existing link — try to find a user by email.
    if let Some(email_str) = email {
        if let Some(mut user) = User::get_by_email(db, email_str)
            .await
            .map_err(|e| format!("DB error finding user by email: {e}"))?
        {
            // Create OIDC link for existing user.
            OidcLink::create_link(db, user.id_val(), issuer, sub, email, name)
                .await
                .map_err(|e| format!("DB error creating OIDC link: {e}"))?;

            user.update_role(db, role)
                .await
                .map_err(|e| format!("DB error updating user role: {e}"))?;

            return Ok(user);
        }
    }

    // 3. Create a brand-new user + OIDC link.
    // Generate a unique username from the sub or email.
    let username = if let Some(email_str) = email {
        email_str.split('@').next().unwrap_or(sub).to_owned()
    } else {
        sub.to_owned()
    };

    // Ensure username uniqueness by appending a suffix if needed.
    let mut candidate = username.clone();
    let mut suffix = 0u32;
    loop {
        match User::get_by_username(db, &candidate).await {
            Ok(None) => break,
            Ok(Some(_)) => {
                suffix += 1;
                candidate = format!("{username}_{suffix}");
            }
            Err(e) => return Err(format!("DB error checking username: {e}")),
        }
    }

    let user = User::create_oidc(db, &candidate, email, name, role)
        .await
        .map_err(|e| format!("DB error creating user: {e}"))?;

    OidcLink::create_link(db, user.id_val(), issuer, sub, email, name)
        .await
        .map_err(|e| format!("DB error creating OIDC link: {e}"))?;

    Ok(user)
}

// ---------------------------------------------------------------------------
// Helpers
// ---------------------------------------------------------------------------

fn redirect_login_with_error(message: &str) -> cot::Result<cot::response::Response> {
    let encoded = urlencoded(message);
    Ok(auth::redirect(&format!("/login?error={encoded}")))
}

fn text_response(status: cot::http::StatusCode, message: &str) -> cot::response::Response {
    cot::http::Response::builder()
        .status(status)
        .body(cot::Body::fixed(message.to_owned()))
        .expect("valid response")
}

async fn mobile_app_redirect_uri_from_session(session: &Session) -> cot::Result<String> {
    let saved: Option<String> = session
        .get(SESSION_MOBILE_APP_REDIRECT_URI)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    Ok(safe_mobile_redirect_uri(saved.as_deref())
        .unwrap_or_else(|| DEFAULT_MOBILE_REDIRECT_URI.to_owned()))
}

async fn clear_mobile_oidc_session(session: &Session) -> cot::Result<()> {
    let _: Option<String> = session
        .remove(SESSION_MOBILE_CSRF_STATE)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    let _: Option<String> = session
        .remove(SESSION_MOBILE_NONCE)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    let _: Option<String> = session
        .remove(SESSION_MOBILE_PKCE_VERIFIER)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    let _: Option<String> = session
        .remove(SESSION_MOBILE_PROVIDER_REDIRECT_URI)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    let _: Option<String> = session
        .remove(SESSION_MOBILE_APP_REDIRECT_URI)
        .await
        .map_err(|e| cot::Error::internal(e.to_string()))?;
    Ok(())
}

fn safe_mobile_redirect_uri(raw: Option<&str>) -> Option<String> {
    let value = raw
        .map(str::trim)
        .filter(|value| !value.is_empty())
        .unwrap_or(DEFAULT_MOBILE_REDIRECT_URI);
    if value.len() > 2048 || value.bytes().any(|b| matches!(b, b'\r' | b'\n')) {
        return None;
    }

    let lower = value.to_ascii_lowercase();
    if lower.starts_with("furumi://") || lower.starts_with("furumusic://") {
        return Some(value.to_owned());
    }
    if is_loopback_http_redirect(&lower) {
        return Some(value.to_owned());
    }
    None
}

/// RFC 8252 §7.3: native apps without a custom URL scheme (the CLI client)
/// receive the callback on a loopback listener with an ephemeral port.
fn is_loopback_http_redirect(lower: &str) -> bool {
    let Some(rest) = lower.strip_prefix("http://") else {
        return false;
    };
    let host_port = rest.split(['/', '?', '#']).next().unwrap_or("");
    let Some((host, port)) = host_port.rsplit_once(':') else {
        return false;
    };
    matches!(host, "127.0.0.1" | "localhost" | "[::1]")
        && !port.is_empty()
        && port.len() <= 5
        && port.bytes().all(|b| b.is_ascii_digit())
}

fn mobile_redirect_success(app_redirect_uri: &str, code: &str) -> cot::response::Response {
    let deep_link = append_query_param(app_redirect_uri, "code", code);
    if is_loopback_http_redirect(&app_redirect_uri.to_ascii_lowercase()) {
        return auth::redirect(&deep_link);
    }
    mobile_deep_link_page(
        "success",
        "Sign-in complete",
        "Furumi should open automatically. If it doesn't, use the button or copy the code below.",
        None,
        Some(code),
        &deep_link,
    )
}

fn mobile_redirect_error(app_redirect_uri: &str, error: &str) -> cot::response::Response {
    let deep_link = append_query_param(app_redirect_uri, "error", error);
    if is_loopback_http_redirect(&app_redirect_uri.to_ascii_lowercase()) {
        return auth::redirect(&deep_link);
    }
    mobile_deep_link_page(
        "error",
        "Sign-in failed",
        "Furumi should open automatically and show the sign-in error.",
        Some(error),
        None,
        &deep_link,
    )
}

fn mobile_deep_link_page(
    state: &str,
    title: &str,
    message: &str,
    detail: Option<&str>,
    code: Option<&str>,
    deep_link: &str,
) -> cot::response::Response {
    let state_class = html_escape(state);
    let title_html = html_escape(title);
    let message_html = html_escape(message);
    let detail_html = detail
        .map(|value| format!(r#"<p class="detail">Reason: {}</p>"#, html_escape(value)))
        .unwrap_or_default();
    let code_html = code
        .map(|value| {
            format!(
                r#"<p class="hint">Signing in from a terminal? Paste this code there:</p>
    <input class="code" readonly value="{}" onclick="this.select()">"#,
                html_escape(value)
            )
        })
        .unwrap_or_default();
    let deep_link_html = html_escape(deep_link);
    let deep_link_js =
        serde_json::to_string(deep_link).expect("serializing URL string cannot fail");

    let html = format!(
        r#"<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>{title_html}</title>
  <style>
    :root {{
      color-scheme: light dark;
      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
      background: #101114;
      color: #f5f2ea;
    }}
    body {{
      min-height: 100vh;
      margin: 0;
      display: grid;
      place-items: center;
      padding: 24px;
      box-sizing: border-box;
    }}
    main {{
      width: min(420px, 100%);
      text-align: center;
    }}
    .mark {{
      width: 54px;
      height: 54px;
      margin: 0 auto 18px;
      border-radius: 999px;
      display: grid;
      place-items: center;
      font-size: 18px;
      font-weight: 700;
      background: #2f7d52;
      color: white;
    }}
    .mark.error {{
      background: #9d3d42;
    }}
    h1 {{
      margin: 0 0 10px;
      font-size: 26px;
      line-height: 1.15;
      letter-spacing: 0;
    }}
    p {{
      margin: 0;
      color: #c9c2b7;
      font-size: 15px;
      line-height: 1.55;
    }}
    .detail {{
      margin-top: 12px;
      color: #f1b3b7;
      overflow-wrap: anywhere;
    }}
    a {{
      display: inline-flex;
      align-items: center;
      justify-content: center;
      min-height: 44px;
      margin-top: 24px;
      padding: 0 18px;
      border-radius: 8px;
      background: #e8d8a8;
      color: #17150f;
      font-weight: 700;
      text-decoration: none;
    }}
    .hint {{
      margin-top: 14px;
      font-size: 13px;
      color: #89847c;
    }}
    .code {{
      width: 100%;
      margin-top: 8px;
      padding: 10px 12px;
      box-sizing: border-box;
      border: 1px solid #3a3c42;
      border-radius: 8px;
      background: #1a1c20;
      color: #e8d8a8;
      font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
      font-size: 13px;
      text-align: center;
    }}
  </style>
</head>
<body>
  <main>
    <div class="mark {state_class}" aria-hidden="true">{mark}</div>
    <h1>{title_html}</h1>
    <p>{message_html}</p>
    {detail_html}
    <a href="{deep_link_html}">Open Furumi</a>
    <p class="hint">If nothing happens, use the button above.</p>
    {code_html}
  </main>
  <script>
    const deepLink = {deep_link_js};
    window.setTimeout(() => {{
      window.location.href = deepLink;
    }}, 100);
  </script>
</body>
</html>"#,
        mark = if state == "error" { "!" } else { "OK" }
    );

    cot::http::Response::builder()
        .status(cot::http::StatusCode::OK)
        .header(cot::http::header::CONTENT_TYPE, "text/html; charset=utf-8")
        .header(cot::http::header::CACHE_CONTROL, "no-store")
        .body(cot::Body::fixed(html))
        .expect("valid response")
}

fn append_query_param(uri: &str, key: &str, value: &str) -> String {
    let (base, fragment) = uri.split_once('#').unwrap_or((uri, ""));
    let separator = if base.contains('?') { '&' } else { '?' };
    let mut out = format!("{base}{separator}{key}={}", urlencoded(value));
    if !fragment.is_empty() {
        out.push('#');
        out.push_str(fragment);
    }
    out
}

fn html_escape(value: &str) -> String {
    let mut out = String::with_capacity(value.len());
    for ch in value.chars() {
        match ch {
            '&' => out.push_str("&amp;"),
            '<' => out.push_str("&lt;"),
            '>' => out.push_str("&gt;"),
            '"' => out.push_str("&quot;"),
            '\'' => out.push_str("&#39;"),
            _ => out.push(ch),
        }
    }
    out
}

fn extract_groups_from_jwt(token: &str) -> Vec<String> {
    use base64::Engine;

    let Some(payload_b64) = token.split('.').nth(1) else {
        return Vec::new();
    };
    let Ok(payload_bytes) = base64::engine::general_purpose::URL_SAFE_NO_PAD
        .decode(payload_b64)
        .or_else(|_| base64::engine::general_purpose::URL_SAFE.decode(payload_b64))
    else {
        return Vec::new();
    };
    let Ok(value) = serde_json::from_slice::<serde_json::Value>(&payload_bytes) else {
        return Vec::new();
    };
    let Some(arr) = value.get("groups").and_then(|value| value.as_array()) else {
        return Vec::new();
    };
    arr.iter()
        .filter_map(|value| value.as_str().map(String::from))
        .collect()
}

/// Minimal percent-encoding for query parameter values.
fn urlencoded(s: &str) -> String {
    let mut out = String::with_capacity(s.len() * 2);
    for b in s.bytes() {
        match b {
            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
                out.push(b as char);
            }
            _ => {
                out.push('%');
                out.push_str(&format!("{b:02X}"));
            }
        }
    }
    out
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn mobile_oidc_append_query_param_preserves_fragment() {
        assert_eq!(
            append_query_param("furumi://auth/callback#done", "code", "a b"),
            "furumi://auth/callback?code=a%20b#done"
        );
        assert_eq!(
            append_query_param("furumi://auth/callback?desktop=1", "error", "oidc_error"),
            "furumi://auth/callback?desktop=1&error=oidc_error"
        );
    }

    #[test]
    fn mobile_oidc_html_escape_escapes_page_values() {
        assert_eq!(
            html_escape(r#"<tag attr="x&y">'text'</tag>"#),
            "&lt;tag attr=&quot;x&amp;y&quot;&gt;&#39;text&#39;&lt;/tag&gt;"
        );
    }

    #[test]
    fn mobile_oidc_redirect_uri_allows_only_furumi_schemes() {
        assert_eq!(
            safe_mobile_redirect_uri(Some("furumi://auth/callback")).as_deref(),
            Some("furumi://auth/callback")
        );
        assert_eq!(
            safe_mobile_redirect_uri(Some("furumusic://auth/callback")).as_deref(),
            Some("furumusic://auth/callback")
        );
        assert!(safe_mobile_redirect_uri(Some("https://example.com/callback")).is_none());
    }

    #[test]
    fn mobile_oidc_redirect_uri_allows_loopback_http() {
        assert_eq!(
            safe_mobile_redirect_uri(Some("http://127.0.0.1:8753/callback")).as_deref(),
            Some("http://127.0.0.1:8753/callback")
        );
        assert_eq!(
            safe_mobile_redirect_uri(Some("http://localhost:1234/callback")).as_deref(),
            Some("http://localhost:1234/callback")
        );
        assert_eq!(
            safe_mobile_redirect_uri(Some("http://[::1]:1234/callback")).as_deref(),
            Some("http://[::1]:1234/callback")
        );
        // Non-loopback hosts, missing ports and https stay rejected.
        assert!(safe_mobile_redirect_uri(Some("http://127.0.0.1/callback")).is_none());
        assert!(safe_mobile_redirect_uri(Some("http://evil.com:80/callback")).is_none());
        assert!(safe_mobile_redirect_uri(Some("https://127.0.0.1:80/callback")).is_none());
        assert!(safe_mobile_redirect_uri(Some("http://127.0.0.1:notaport/x")).is_none());
    }
}