"use client";

import type { ManagedUser, Role } from "@domainops/shared-types";
import { App, Button, Form, Input, Modal, Popconfirm, Select, Space, Typography } from "antd";
import { useEffect, useState } from "react";
import { resetUser2fa, resetUserPassword, updateUser } from "@/lib/api/users";
import { ApiError } from "@/lib/api/client";
import { reportFormErrors } from "@/lib/utils/formErrors";
import { useAuth } from "@/lib/auth/AuthProvider";
import { titleCase } from "@/lib/utils/text";

interface EditUserFormValues {
  name: string;
  username: string;
  email: string;
  role_id?: number;
  password?: string;
}

/**
 * Name + role reassignment, plus quick access to the same reset-password
 * and reset-2FA actions available from the Users table row - super-admin
 * only (matches the backend). Feature/action permissions per role are
 * managed elsewhere via ManageRolesModal, not here.
 */
export function EditUserModal({
  open,
  user,
  roles,
  onClose,
  onSaved,
}: {
  open: boolean;
  user: ManagedUser | null;
  roles: Role[];
  onClose: () => void;
  onSaved: (user: ManagedUser) => void;
}) {
  const { message, modal } = App.useApp();
  const { user: currentUser } = useAuth();
  const canEditIdentity = !!currentUser?.is_admin;
  const isProtectedTarget = !!user?.role?.is_protected;
  const [form] = Form.useForm<EditUserFormValues>();
  const [isSubmitting, setIsSubmitting] = useState(false);
  const [isResettingPassword, setIsResettingPassword] = useState(false);
  const [isResetting2fa, setIsResetting2fa] = useState(false);

  useEffect(() => {
    if (open && user) form.setFieldsValue({ name: user.name, username: user.username, email: user.email, role_id: user.role_id ?? undefined });
  }, [open, user, form]);

  async function handleSubmit(values: EditUserFormValues) {
    if (!user) return;
    setIsSubmitting(true);
    try {
      const updated = await updateUser(user.id, {
        name: values.name,
        ...(canEditIdentity ? { username: values.username, email: values.email } : {}),
        ...(isProtectedTarget ? {} : { role_id: values.role_id, password: values.password || undefined }),
      });
      message.success(`${updated.name} updated.`);
      form.setFieldValue("password", undefined);
      onSaved(updated);
    } catch (err) {
      message.error(reportFormErrors(form, err, "Couldn't update that user."));
    } finally {
      setIsSubmitting(false);
    }
  }

  async function handleResetPassword() {
    if (!user) return;
    setIsResettingPassword(true);
    try {
      const { password } = await resetUserPassword(user.id);
      modal.success({
        title: `${user.name}'s password was reset`,
        content: (
          <div className="flex flex-col gap-2">
            <Typography.Text>Share this with them now - it won&apos;t be shown again:</Typography.Text>
            <Typography.Text code copyable className="text-base">
              {password}
            </Typography.Text>
          </div>
        ),
      });
    } catch (err) {
      message.error(err instanceof ApiError ? err.message : "Couldn't reset that password.");
    } finally {
      setIsResettingPassword(false);
    }
  }

  async function handleReset2fa() {
    if (!user) return;
    setIsResetting2fa(true);
    try {
      await resetUser2fa(user.id);
      message.success(`Two-factor authentication reset for ${user.name}.`);
    } catch (err) {
      message.error(err instanceof ApiError ? err.message : "Couldn't reset two-factor authentication.");
    } finally {
      setIsResetting2fa(false);
    }
  }

  return (
    <Modal
      title={user ? `Edit User - ${user.name}` : "Edit User"}
      open={open}
      onCancel={onClose}
      onOk={() => form.submit()}
      confirmLoading={isSubmitting}
      okText="Save"
      destroyOnHidden
      className="dms_edit_user_modal"
    >
      <Form<EditUserFormValues> form={form} layout="vertical" onFinish={handleSubmit} className="dms_edit_user_form">
        <Form.Item
          name="name"
          label="Name"
          rules={[{ required: true, message: "Enter a name" }]}
          className="dms_edit_user_name_field"
        >
          <Input autoFocus />
        </Form.Item>
        {canEditIdentity && (
          <>
            <Form.Item
              name="username"
              label="Username"
              extra={user?.is_fixed ? "A fixed account - its username cannot be changed." : "Locked for everyone but a Super Admin. Must be unique."}
              rules={[{ required: true, message: "Enter a username" }]}
              className="dms_edit_user_username_field"
            >
              <Input disabled={!!user?.is_fixed} className="dms_edit_user_username_input" />
            </Form.Item>
            <Form.Item
              name="email"
              label="Email"
              extra="Locked for everyone but a Super Admin. Must be unique."
              rules={[{ required: true, type: "email", message: "Enter a valid email" }]}
              className="dms_edit_user_email_field"
            >
              <Input className="dms_edit_user_email_input" />
            </Form.Item>
          </>
        )}
        {!isProtectedTarget && (
          <>
        <Form.Item
          name="role_id"
          label="Role"
          rules={[{ required: true, message: "Pick a role" }]}
          className="dms_edit_user_role_field"
        >
          <Select disabled={!!user?.is_fixed} options={roles.map((r) => ({ value: r.id, label: titleCase(r.label) }))} />
        </Form.Item>
        <Form.Item
          name="password"
          label="Set Password"
          extra="Leave blank to keep the current password. Sets it directly - the user isn't shown a generated one."
          rules={[{ min: 8, message: "At least 8 characters" }]}
          className="dms_edit_user_password_field"
        >
          <Input.Password placeholder="New password" autoComplete="new-password" />
        </Form.Item>
          </>
        )}
      </Form>

      <Space>
        <Popconfirm title="Reset this user's password?" onConfirm={handleResetPassword}>
          <Button loading={isResettingPassword} className="dms_edit_user_reset_password_btn">
            Reset Password
          </Button>
        </Popconfirm>
        <Popconfirm title="Reset this user's two-factor authentication?" onConfirm={handleReset2fa}>
          <Button loading={isResetting2fa} className="dms_edit_user_reset_2fa_btn">
            Reset 2FA
          </Button>
        </Popconfirm>
      </Space>
    </Modal>
  );
}