using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;
using Sarand.BusinessMgr.Net.Core.Web.App;
using Sarand.BusinessMgr.Net.Core.Web.Helpers;
using Sarand.BusinessMgr.Net.Core.Web.Portal.Models;
using Sarand.BusinessMgr.Net.Standard.Base.App;
using Sarand.BusinessMgr.Net.Standard.Base.Bus;
using Sarand.BusinessMgr.Net.Standard.Base.Mgr;
using Sarand.Net.Standard.Base.App;
using Sarand.Net.Standard.Base.Bus;
using Sarand.Net.Standard.Base.Security;
using Sarand.Net.Standard.Base.Utils;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Threading.Tasks;

namespace Sarand.BusinessMgr.Net.Core.Web.Portal.Controllers
{
	//=======================================================================
	// Online Security Controller.
	//=======================================================================
	public partial class SecurityController : SbmController_Portal
	{
		//-------------------------------------------------------------------
		// Data members.

		//-------------------------------------------------------------------
		// Construction.
		public SecurityController(SbmLocaliser localiser, ILogger<HomeController> logger) :
			base(localiser, logger)
		{
		}

		//-------------------------------------------------------------------
		[HttpGet]
		public IActionResult Index()
		{
			return RedirectToAction("Signin", "Security");
		}

		//-------------------------------------------------------------------
		[HttpGet]
		public IActionResult Signin()
		{
			// Redirect home if signed-in.
			if (ValidUserSession)
				return RedirectToAction("", "");

			Model_Security model = new Model_Security(Localiser);
			return View(model);
		}

		//-------------------------------------------------------------------
		// Security - Change password
		/// <summary>
		/// Security - Change Password action.
		/// <para>- GET from request password email link.</para>
		/// <para>- POST with user signed-in. Browser cache prohibited.</para>
		/// </summary>
		[HttpGet, HttpPost]
		public IActionResult ChangePassword(Model_Security model)
		{
			bool validSessionRequired = true;

			if (Request.Method.EqualsCI(HttpMethods.Get))
			{
				// Check for encrypted parameters from 'Request Password' email link.
				// NB Only allowed as a 'GET' request.
				String encryptedParams = Request.Query[ParamName_RequestPasswordEncrypted];
				RequestPasswordParams requestPasswordParams = ExtractRequestPasswordLinkParams(encryptedParams);
				if (requestPasswordParams.IsValid())
				{
					String logPrefix = $"{SysUtil.Fn} 'Request Password' parameters supplied but ";
					String logSuffix = requestPasswordParams.GetValidParams().Concat("", " ", ".");
					// User may be defined on any one of the BusinessMgr databases - need to find out which.
					// Identify session contexts with a BusMgr database that hosts the specified email address.
					List<ushort> sessionContextIdxs = SbmSessionContextHelper_Web.GetSessionContextIdxsForContextUserEmail(requestPasswordParams.DbIdentifier, requestPasswordParams.EmailAddress);
					foreach (ushort sessionContextIdx in sessionContextIdxs)
					{
						// Consoles and Managers must be associated with the specific context.
						SbmSessionContext sessionContext = SbmSessionContextHelper_Web.GetSessionContext(sessionContextIdx);
						SbmUserContext_Web userContext = new SbmUserContext_Web(sessionContext);
						using (SaSecurityConsole securityConsoleForUser = App.CreateSecurityConsole(userContext))
						using (SbmAccountMgr accountMgrForUser = App.System.CreateAccountMgr(userContext))
						{
							using (SaSecurityItem securityItemUser = securityConsoleForUser.GetUserByEmail(requestPasswordParams.EmailAddress))
							using (SbmAffiliate affiliateUser = accountMgrForUser.GetAffiliateById(requestPasswordParams.AffiliateId))
							{
								if (securityItemUser != null && affiliateUser != null)
								{
									if (securityItemUser.Id.Equals(requestPasswordParams.SecurityItemId) && affiliateUser.UserId.Equals(securityItemUser.Id))
									{
										if (affiliateUser.IsStatusCurrent)
										{
											if (requestPasswordParams.IsValid(securityItemUser, affiliateUser))
											{
												model.rpe = encryptedParams;
												validSessionRequired = false;
												break;
											}
											else SaLogger.Warn(logPrefix + "Security Item and Affiliate are incompatible with parameters. " + logSuffix);
										}
										else SaLogger.Warn(logPrefix + "Affiliate is not active. " + logSuffix);
									}
									else SaLogger.Warn(logPrefix + "Security Item and Affiliate are inconsistent. " + logSuffix);
								}
								else SaLogger.Warn(logPrefix + "Security Item or Affiliate not found. " + logSuffix);
							}
						}
					}
				}
			}

			// Must have a valid session to change password unless linked from Request Password above.
			if (validSessionRequired && !ValidUserSession)
				return RedirectToAction("", "");

			// Configure page.
			model.PageCaption = Localiser["security.caption.change.password"];

			return View(model);
		}

		//-------------------------------------------------------------------
		// Security - Request Password
		//-------------------------------------------------------------------
		/// <summary>
		/// Sign-in Request Password action.
		/// <para>- User not signed-in.</para>
		/// <para>- GET only with browser cache allowed.</para>
		/// </summary>
		[HttpGet]
		public IActionResult RequestPassword()
		{
			Model_Security model = new Model_Security(Localiser);

			// Configure page.
			model.PageCaption = Localiser["security.caption.request.password"];
			model.ProhibitCache = false;

			return View(model);
		}

		//-------------------------------------------------------------------
	}
	//=======================================================================
}