/**
 * Auth 状态机：Actors（异步服务）
 */
import { fromPromise } from "xstate";

import { AuthPlatform, type AuthProvider } from "@/lib/auth/auth_platform";
import type { LoginStatus } from "@/models/auth/login-status";
import { authRepository } from "@/data/repositories/auth_repository";
import type { IAuthRepository } from "@/data/repositories/interfaces";
import { AuthStorage } from "@/data/storage/auth/auth_storage";
import { UserStorage } from "@/data/storage/user/user_storage";
import { deviceIdentifier } from "@/utils/device_identifier";
import { fetchFacebookUserData } from "@/utils/facebook-graph";
import { Logger } from "@/utils/logger";
import { Result } from "@/utils/result";

import { readGuestId } from "./auth-helpers";

const log = new Logger("AuthActors");

// 仓库以接口类型注入：调用面只看接口，运行时仍是同一单例
const authRepo: IAuthRepository = authRepository;

export const emailLoginActor = fromPromise<LoginStatus, { email: string; password: string }>(
  async ({ input }) => {
    console.log("[auth-machine] emailLoginActor ENTRY", {
      emailLength: input.email.length,
      emailPreview: input.email.slice(0, 8),
      passwordLength: input.password.length,
    });
    const guestId = await readGuestId();
    console.log("[auth-machine] emailLoginActor calling authRepo.emailLogin", {
      hasGuestId: !!guestId,
    });
    const result = await authRepo.emailLogin({ ...input, guestId });
    console.log("[auth-machine] emailLoginActor authRepo.emailLogin DONE", {
      success: result.success,
      hasData: result.success ? !!result.data : null,
      errorName: result.success ? null : result.error?.name,
      errorMessage: result.success ? null : result.error?.message,
    });
    if (Result.isErr(result)) throw result.error;
    return "email" as LoginStatus;
  },
);

export const emailRegisterThenLoginActor = fromPromise<
  LoginStatus,
  { email: string; password: string; username: string; confirmPassword: string }
>(async ({ input }) => {
  console.log("[auth-machine] emailRegisterThenLoginActor ENTRY", {
    emailLength: input.email.length,
    usernameLength: input.username.length,
    passwordLength: input.password.length,
    confirmPasswordLength: input.confirmPassword.length,
  });
  const guestId = await readGuestId();

  console.log("[auth-machine] emailRegisterThenLoginActor calling authRepo.register");
  const registerResult = await authRepo.register({ ...input, guestId });
  console.log("[auth-machine] emailRegisterThenLoginActor authRepo.register DONE", {
    success: registerResult.success,
    errorName: registerResult.success ? null : registerResult.error?.name,
    errorMessage: registerResult.success ? null : registerResult.error?.message,
  });
  if (Result.isErr(registerResult)) throw registerResult.error;

  // 注册后自动登录（对齐 Dart 行为）
  console.log(
    "[auth-machine] emailRegisterThenLoginActor calling authRepo.emailLogin (post-register)",
  );
  const loginResult = await authRepo.emailLogin({
    email: input.email,
    password: input.password,
    guestId,
  });
  console.log(
    "[auth-machine] emailRegisterThenLoginActor authRepo.emailLogin DONE",
    {
      success: loginResult.success,
      errorName: loginResult.success ? null : loginResult.error?.name,
      errorMessage: loginResult.success ? null : loginResult.error?.message,
    },
  );
  if (Result.isErr(loginResult)) throw loginResult.error;
  return "email" as LoginStatus;
});

// OAuth 登录 actor：调 AuthPlatform 触发 OAuth 跳转。
// 成功路径下 NextAuth 会重定向离开本应用，actor 通常不会 resolve；
// onDone 仍保留以处理 SDK 同步返回（极少见）。
export const oauthSignInActor = fromPromise<void, AuthProvider>(async ({ input }) => {
  if (input === "google") {
    await AuthPlatform.googleSignIn();
  } else {
    await AuthPlatform.facebookSignIn();
  }
});

export const logoutActor = fromPromise<void>(async () => {
  const result = await authRepo.logout();
  if (Result.isErr(result)) throw result.error;
});

// ========== OAuth token → 后端业务 token sync actors ==========
// 由 <OAuthSessionSync /> 在 NextAuth 回调后派发（监听 useSession()）。
// 用 OAuth provider 的 idToken / accessToken 调后端换业务 token + user。
// 后端返回的 LoginResponse 已经被 authRepository._saveLoginData 持久化。

export const syncGoogleBackendActor = fromPromise<LoginStatus, { idToken: string }>(
  async ({ input }) => {
    const guestId = await readGuestId();
    const result = await authRepo.googleLogin({
      idToken: input.idToken,
      guestId,
    });
    if (Result.isErr(result)) throw result.error;
    return "google" as LoginStatus;
  },
);

export const syncFacebookBackendActor = fromPromise<
  LoginStatus,
  { accessToken: string }
>(async ({ input }) => {
  const guestId = await readGuestId();
  const result = await authRepo.facebookLogin({
    accessToken: input.accessToken,
    guestId,
  });
  if (Result.isErr(result)) throw result.error;

  // 业务 token 已到手 —— 顺带用同一个 accessToken 调 Facebook Graph `/me`
  // 拉用户资料（id / name / email / picture），把 pictureUrl + Facebook ID
  // 写本地。
  //
  // 为什么要这一步？后端 LoginResponse.user.avatarUrl 不一定总有（依赖
  // 后端在 OAuth 流程里有没有抓过）；前端用 accessToken 直接调 Graph
  // 拿到的 picture 是最新的，独立于后端缓存。
  //
  // 失败策略：best-effort。Graph 调用挂掉 / 用户没头像 / token 过期都不
  // 影响 Facebook 登录主流程 —— 业务 token 已经在 result 里。
  await persistFacebookProfile(input.accessToken);

  return "facebook" as LoginStatus;
});

/**
 * 用 accessToken 调 Facebook Graph `/me` 拉用户资料，写本地：
 *   - `id`            → `AuthStorage.setFacebookId()`（独立于后端 userId）
 *   - `pictureUrl`    → `UserStorage.setAvatarUrl()`（头像专用 slot，便于快速读取）
 *
 * 全部 best-effort：单条失败只 warn，不抛错。`pictureUrl == null` 也算成功
 * （用户没设头像），只是不写入。
 */
async function persistFacebookProfile(accessToken: string): Promise<void> {
  const fbR = await fetchFacebookUserData(accessToken);
  if (Result.isErr(fbR)) {
    log.warn(
      { err: fbR.error.message },
      "[auth-machine] syncFacebookBackendActor: fetchFacebookUserData failed (continuing anyway)",
    );
    return;
  }
  const fbUser = fbR.data;
  log.info(
    {
      hasId: !!fbUser.id,
      hasPicture: !!fbUser.pictureUrl,
    },
    "[auth-machine] syncFacebookBackendActor: Facebook profile fetched",
  );

  const authStorage = AuthStorage.getInstance();
  if (fbUser.id) {
    const r = await authStorage.setFacebookId(fbUser.id);
    if (!r.success) {
      log.warn(
        { err: r.error.message },
        "[auth-machine] syncFacebookBackendActor: setFacebookId failed",
      );
    }
  }

  if (fbUser.pictureUrl) {
    const r = await UserStorage.getInstance().setAvatarUrl(fbUser.pictureUrl);
    if (!r.success) {
      log.warn(
        { err: r.error.message },
        "[auth-machine] syncFacebookBackendActor: setAvatarUrl failed",
      );
    }
  }
}

// ========== 显式游客登录 actor（opt-in） ==========
// 由 splash UI 派发 `AuthGuestLoginSubmitted` 触发，不自动跑。
// 取代了之前 checkAuthStatusActor 的 auto-guest-login 行为 —— 避免每次
// 访 splash 都自动创建游客账号污染后端。
//
// 短路优化：本地已有 guestToken 时直接 return "guest"，跳过 deviceId
// 探测 + 后端 round-trip（splash 每打开一次就可能点一次 Skip，命中率高）。
// 已知 trade-off：若后端已吊销该 token，actor 仍返回 "guest" —— 任何后续
// 受保护 API 401 会由 HTTP 层清掉 token 回到 splash，无需在此处主动校验。

export const guestLoginActor = fromPromise<LoginStatus, void>(async () => {
  console.log("[auth-machine] guestLoginActor ENTRY");

  // 1. 先查本地 guestToken —— 已有就直接进 idle（带 pendingRedirect）
  const hasTokenR = await AuthStorage.getInstance().hasGuestToken();
  console.log("[auth-machine] guestLoginActor hasGuestToken", {
    success: hasTokenR.success,
    hasData: hasTokenR.success ? !!hasTokenR.data : null,
  });
  if (hasTokenR.success && hasTokenR.data) {
    console.log("[auth-machine] guestLoginActor SHORT-CIRCUIT (has local guestToken) → return guest");
    return "guest" as LoginStatus;
  }
  // Result.err(_) 时不抛 —— 落到 API 路径让真正的错误信号出现

  // 2. 没有（或读不出）才走完整流程：拿 deviceId → 调后端
  const deviceId = await deviceIdentifier.getDeviceId();
  console.log("[auth-machine] guestLoginActor deviceId", {
    length: deviceId.length,
    prefix: deviceId.slice(0, 8),
  });

  console.log("[auth-machine] guestLoginActor calling authRepository.guestLogin");
  const result = await authRepository.guestLogin(deviceId);
  console.log("[auth-machine] guestLoginActor authRepository.guestLogin DONE", {
    success: result.success,
    hasData: result.success ? !!result.data : null,
    errorName: result.success ? null : result.error?.name,
    errorMessage: result.success ? null : result.error?.message,
  });
  if (Result.isErr(result)) throw result.error;
  return "guest" as LoginStatus;
});

// ========== 启动 / 恢复时检查登录态 actor（只查不创） ==========
// 由 <AuthStatusChecker /> 在 mount 时派发（一次性）。
// 流程（纯只读）：
//   1. deviceIdentifier.getDeviceId()     —— 无则通过 fingerprintjs 生成 + 落盘
//      （给后续 OAuth/email 登录准备 deviceId，不在 splash 首次访问就 auto-create 游客）
//   2. AuthStorage.getLoginToken()         —— 有 → "email"
//   3. AuthStorage.getGuestToken()         —— 有 → "guest"
//   4. 都没有 → "notLoggedIn"（让用户显式选 OAuth / Email / Guest 入口）

export const checkAuthStatusActor = fromPromise<LoginStatus, void>(async () => {
  // 1. 拿 deviceId（不用于 auto-guest-login，仅供后续登录用）
  await deviceIdentifier.getDeviceId();
  const storage = AuthStorage.getInstance();

  // 2. 查 loginToken
  const loginTokenR = await storage.getLoginToken();
  if (loginTokenR.success && loginTokenR.data) {
    return "email" as LoginStatus;
  }

  // 3. 查 guestToken
  const guestTokenR = await storage.getGuestToken();
  if (guestTokenR.success && guestTokenR.data) {
    return "guest" as LoginStatus;
  }

  // 4. 都没有 → "notLoggedIn"（保持 splash 页面 + 登录入口）
  return "notLoggedIn" as LoginStatus;
});