package auth

import (
	"context"
	"fmt"
	"math/rand"
	"qnc-server/common/xerr"
	"qnc-server/pkg/captcha"
	"qnc-server/pkg/lzkit/crypto"
	"time"

	"github.com/pkg/errors"

	"qnc-server/app/main/api/internal/svc"
	"qnc-server/app/main/api/internal/types"

	openapi "github.com/alibabacloud-go/darabonba-openapi/v2/client"
	dysmsapi "github.com/alibabacloud-go/dysmsapi-20170525/v3/client"
	"github.com/alibabacloud-go/tea-utils/v2/service"
	"github.com/alibabacloud-go/tea/tea"
	"github.com/zeromicro/go-zero/core/logx"
)

type SendSmsLogic struct {
	logx.Logger
	ctx    context.Context
	svcCtx *svc.ServiceContext
}

func NewSendSmsLogic(ctx context.Context, svcCtx *svc.ServiceContext) *SendSmsLogic {
	return &SendSmsLogic{
		Logger: logx.WithContext(ctx),
		ctx:    ctx,
		svcCtx: svcCtx,
	}
}

func (l *SendSmsLogic) SendSms(req *types.SendSmsReq, clientIP string, userAgent string) error {
	secretKey := l.svcCtx.Config.Encrypt.SecretKey
	encryptedMobile, err := crypto.EncryptMobile(req.Mobile, secretKey)
    if err != nil {
        return errors.Wrapf(xerr.NewErrCode(xerr.SERVER_COMMON_ERROR), "短信发送, 加密手机号失败: %v", err)
    }

    // 1. 滑块验证码校验（可选，支持微信环境跳过验证）
    cfg := l.svcCtx.Config.Captcha
    captchaResult := captcha.VerifyOptionalWithUserAgent(captcha.Config{
        AccessKeyID:     cfg.AccessKeyID,
        AccessKeySecret: cfg.AccessKeySecret,
        EndpointURL:     cfg.EndpointURL,
        SceneID:         cfg.SceneID,
    }, req.CaptchaVerifyParam, userAgent)

    if captchaResult.VerifyErr != nil {
        return captchaResult.VerifyErr
    }

	// 2. 防刷策略
	if captchaResult.Skipped {
		// 没有滑块验证码，使用更严格的限流策略
		// 2.1 IP 限流：同一 IP 每小时最多发送 10 次
		ipLimitKey := fmt.Sprintf("ip_limit:%s", clientIP)
		ipCount, err := l.svcCtx.Redis.Incr(ipLimitKey)
		if err != nil {
			return errors.Wrapf(xerr.NewErrCode(xerr.SERVER_COMMON_ERROR), "短信发送, 读取IP限流缓存失败: %v", err)
		}
		if ipCount == 1 {
			// 第一次访问，设置 1 小时过期
			l.svcCtx.Redis.Expire(ipLimitKey, 3600)
		}
		if ipCount > 10 {
			return errors.Wrapf(xerr.NewErrMsg("请求过于频繁，请稍后再试"), "短信发送, IP限流: %s, count: %d", clientIP, ipCount)
		}

		// 2.2 手机号限流：同一手机号每小时最多发送 5 次（无滑块时更严格）
		hourLimitKey := fmt.Sprintf("hour_limit:%s:%s", req.ActionType, encryptedMobile)
		hourCount, err := l.svcCtx.Redis.Incr(hourLimitKey)
		if err != nil {
			return errors.Wrapf(xerr.NewErrCode(xerr.SERVER_COMMON_ERROR), "短信发送, 读取小时限流缓存失败: %v", err)
		}
		if hourCount == 1 {
			l.svcCtx.Redis.Expire(hourLimitKey, 3600)
		}
		if hourCount > 5 {
			return errors.Wrapf(xerr.NewErrMsg("该手机号请求过于频繁，请稍后再试"), "短信发送, 手机号小时限流: %s, count: %d", encryptedMobile, hourCount)
		}
	}

	// 3. 检查手机号是否在一分钟内已发送过验证码（通用）
	limitCodeKey := fmt.Sprintf("limit:%s:%s", req.ActionType, encryptedMobile)
	exists, err := l.svcCtx.Redis.Exists(limitCodeKey)
	if err != nil {
		return errors.Wrapf(xerr.NewErrCode(xerr.SERVER_COMMON_ERROR), "短信发送, 读取redis缓存失败: %s", encryptedMobile)
	}

	if exists {
		return errors.Wrapf(xerr.NewErrMsg("一分钟内不能重复发送验证码"), "短信发送, 手机号1分钟内重复请求发送验证码: %s", encryptedMobile)
	}

	code := fmt.Sprintf("%06d", rand.New(rand.NewSource(time.Now().UnixNano())).Intn(1000000))

	// 发送短信
	smsResp, err := l.sendSmsRequest(req.Mobile, code)
	if err != nil {
		return errors.Wrapf(xerr.NewErrCode(xerr.SERVER_COMMON_ERROR), "短信发送, 调用阿里客户端失败: %v", err)
	}
	if *smsResp.Body.Code != "OK" {
		return errors.Wrapf(xerr.NewErrCode(xerr.SERVER_COMMON_ERROR), "短信发送, 阿里客户端响应失败: %s", *smsResp.Body.Message)
	}
	codeKey := fmt.Sprintf("%s:%s", req.ActionType, encryptedMobile)
	// 将验证码保存到 Redis，设置过期时间
	err = l.svcCtx.Redis.Setex(codeKey, code, l.svcCtx.Config.VerifyCode.ValidTime) // 验证码有效期5分钟
	if err != nil {
		return errors.Wrapf(xerr.NewErrCode(xerr.SERVER_COMMON_ERROR), "短信发送, 验证码设置过期时间失败: %v", err)
	}
	// 在 Redis 中设置 1 分钟的标记，限制重复请求
	err = l.svcCtx.Redis.Setex(limitCodeKey, code, 60) // 标记 1 分钟内不能重复请求
	if err != nil {
		return errors.Wrapf(xerr.NewErrCode(xerr.SERVER_COMMON_ERROR), "短信发送, 验证码设置限制重复请求失败: %v", err)
	}
	return nil
}

// CreateClient 创建阿里云短信客户端
func (l *SendSmsLogic) CreateClient() (*dysmsapi.Client, error) {
	config := &openapi.Config{
		AccessKeyId:     &l.svcCtx.Config.VerifyCode.AccessKeyID,
		AccessKeySecret: &l.svcCtx.Config.VerifyCode.AccessKeySecret,
	}
	config.Endpoint = tea.String(l.svcCtx.Config.VerifyCode.EndpointURL)
	return dysmsapi.NewClient(config)
}

// sendSmsRequest 发送短信请求
func (l *SendSmsLogic) sendSmsRequest(mobile, code string) (*dysmsapi.SendSmsResponse, error) {
	// 初始化阿里云短信客户端
	cli, err := l.CreateClient()
	if err != nil {
		return nil, err
	}

	request := &dysmsapi.SendSmsRequest{
		SignName:      tea.String(l.svcCtx.Config.VerifyCode.SignName),
		TemplateCode:  tea.String(l.svcCtx.Config.VerifyCode.TemplateCode),
		PhoneNumbers:  tea.String(mobile),
		TemplateParam: tea.String(fmt.Sprintf("{\"code\":\"%s\"}", code)),
	}
	runtime := &service.RuntimeOptions{}
	return cli.SendSmsWithOptions(request, runtime)
}