package web

import (
	"net/http"
	"strconv"

	"uPortal/internal/auth"
)

// HandleUsers lists every user in the system. Requires a super user.
func (s *WebService) HandleUsers(w http.ResponseWriter, r *http.Request) {
	data, ok := s.basicViewData(w, r, "Users")
	if !ok {
		http.Redirect(w, r, "/signin", http.StatusSeeOther)
		return
	}

	users, err := s.users.GetUsers(r.Context(), 1000, 0)
	if err != nil {
		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
		return
	}
	data.Users = users

	s.render(w, r, "user/view.html", data)
}

// HandleUserResetPassword lets a super admin reset another user's password.
func (s *WebService) HandleUserResetPassword(w http.ResponseWriter, r *http.Request) {
	if err := auth.ValidateCsrf(r, CsrfCookieName, CsrfFieldName); err != nil {
		http.Redirect(w, r, "/users", http.StatusSeeOther)
		return
	}

	if err := r.ParseForm(); err != nil {
		http.Redirect(w, r, "/users", http.StatusSeeOther)
		return
	}

	userIdStr := r.FormValue("user_id")
	newPassword := r.FormValue("new_password")

	userId, err := strconv.ParseInt(userIdStr, 10, 64)
	if err != nil {
		http.Redirect(w, r, "/users", http.StatusSeeOther)
		return
	}

	if len(newPassword) < 6 {
		http.Redirect(w, r, "/users", http.StatusSeeOther)
		return
	}

	user, err := s.users.GetUserById(r.Context(), userId)
	if err != nil {
		http.Redirect(w, r, "/users", http.StatusSeeOther)
		return
	}

	hashedPassword, err := auth.HashPassword(newPassword)
	if err != nil {
		http.Redirect(w, r, "/users", http.StatusSeeOther)
		return
	}

	user.Password = hashedPassword
	s.users.UpdateUser(r.Context(), user)

	http.Redirect(w, r, "/users", http.StatusSeeOther)
}

// HandleUserEndSessions ends all sessions for a given user. Requires a super user.
func (s *WebService) HandleUserEndSessions(w http.ResponseWriter, r *http.Request) {
	if err := auth.ValidateCsrf(r, CsrfCookieName, CsrfFieldName); err != nil {
		http.Redirect(w, r, "/users", http.StatusSeeOther)
		return
	}

	if err := r.ParseForm(); err != nil {
		http.Redirect(w, r, "/users", http.StatusSeeOther)
		return
	}

	userIdStr := r.FormValue("user_id")
	userId, err := strconv.ParseInt(userIdStr, 10, 64)
	if err != nil {
		http.Redirect(w, r, "/users", http.StatusSeeOther)
		return
	}

	s.auths.DeleteSessionsByUserId(r.Context(), userId)
	http.Redirect(w, r, "/users", http.StatusSeeOther)
}