using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Primitives;
using Sarand.Net.Standard.Base.App;
using Sarand.Net.Standard.Base.Bus;
using Sarand.Net.Standard.Base.Core;
using Sarand.Net.Standard.Base.Helpers;
using Sarand.Net.Standard.Base.Utils;
using Saxonite.Net.Core.Web.Admin.App;
using Saxonite.Net.Core.Web.Admin.Models;
using Saxonite.Net.Core.Web.Base.App;
using Saxonite.Net.Core.Web.Base.Controllers;
using Saxonite.Net.Standard.Base.App;
using Saxonite.Net.Standard.Base.Bus;
using System;
using System.Collections.Generic;
using System.Collections.Specialized;
using System.Linq;
using System.Text.RegularExpressions;
using System.Threading.Tasks;
using System.Web;

namespace Saxonite.Net.Core.Web.Admin.Controllers
{
	//=======================================================================
	public partial class SecurityController : SaxController_Admin
	{
		//-------------------------------------------------------------------
		// Data members.

		//-------------------------------------------------------------------
		// Construction.
		public SecurityController(SaxLocaliser localiser, ILogger<HomeController> logger) :
			base(localiser, logger)
		{
		}

		//-------------------------------------------------------------------
		[HttpGet]
		public IActionResult Index()
		{
			return RedirectToAction("Signin", "Security");
		}

		//-------------------------------------------------------------------
		[HttpGet]
		public IActionResult Signin()
		{
			// Redirect home if signed-in.
			if (ValidUserSession)
				return RedirectToAction("", "");

			Model_Security model = new Model_Security(Localiser);
			return View(model);
		}

		//-------------------------------------------------------------------
		// Security - Change password
		/// <summary>
		/// Security - Change Password action.
		/// <para>- GET from request password email link.</para>
		/// <para>- POST with user signed-in. Browser cache prohibited.</para>
		/// </summary>
		[HttpGet, HttpPost]
		public IActionResult ChangePassword(Model_Security model)
		{
			String fn = GetType().Name + ".ChangePassword";
			bool validSessionRequired = true;

			if (Request.Method.EqualsCI(HttpMethods.Get))
			{
				// Check for encrypted parameters from 'Request Password' email link.
				// NB Only allowed as a 'GET' request.
				String encryptedParams = Request.Query[ParamName_RequestPasswordEncrypted];
				RequestPasswordParams requestPasswordParams = ExtractRequestPasswordLinkParams(encryptedParams);
				if (requestPasswordParams.IsValid())
				{
					String logSuffix = requestPasswordParams.GetValidParams().Concat("", " ", ".");
					using (SaxUserAccount userAccount = AccountMgr.GetUserAccountById(requestPasswordParams.UserAccountId))
					{
						if (userAccount.IsStatusActive)
						{
							if (AccountMgr.UserHasRole(userAccount.Id, Sax.UserRole.SystemAdmin))
							{
								if (requestPasswordParams.IsValid(userAccount))
								{
									model.rpe = encryptedParams;
									validSessionRequired = false;
								}
								else SaLogger.Warn(fn + " 'Request Password' parameters supplied but invalid. " + logSuffix);
							}
							else
							{
								// Account is active but not 'Admin'.
								// Redirect to Online application if URL is available and not already redirected ('rpe2' parameter).
								String redirectParamName = ParamName_RequestPasswordEncrypted + "2";
								SaLogger.Warn(fn + " 'Request Password' parameters supplied but account is not 'Admin'. " + logSuffix);
								if (!Request.Query.Keys.Contains(redirectParamName)  && !StringUtil.IsEmpty(AppConfig.URL.Online.Root))
								{
									UriBuilder uri = new UriBuilder(Regex.Replace(AppConfig.URL.Online.Root,"/$","") + "/Security/ChangePassword");
									uri.Query = ParamName_RequestPasswordEncrypted + "=" + Uri.EscapeDataString(encryptedParams) + "&" + redirectParamName;
									return Redirect(uri.Uri.OriginalString);
								}
							}
						}
						else SaLogger.Warn(fn + " 'Request Password' parameters supplied but account is not active. " + logSuffix);
					}
				}
			}

			// Must have a valid session to change password unless linked from Request Password above.
			if (validSessionRequired && !ValidUserSession)
				return RedirectToAction("", "");

			// Configure page.

			return View(model);
		}

		//-------------------------------------------------------------------
		// Security - Request Password
		//-------------------------------------------------------------------
		/// <summary>
		/// Sign-in Request Password action.
		/// <para>- User not signed-in.</para>
		/// <para>- GET only with browser cache allowed.</para>
		/// </summary>
		[HttpGet]
		public IActionResult RequestPassword()
		{
			Model_Security model = new Model_Security(Localiser);

			// Configure page.
			model.ProhibitCache = false;

			return View(model);
		}

		//-------------------------------------------------------------------
	}
	//=======================================================================
}