// POST /api/v1/users/:id/messages
import { Request, Response, NextFunction } from 'express';
import { z } from 'zod';
import jwt from 'jsonwebtoken';
import { randomUUID } from 'crypto';

// ── Types ──────────────────────────────────────────────────────────────────
interface JwtPayload { sub: string; role: 'user' | 'admin'; }

interface ProblemDetail {
  type: string; title: string; status: number;
  detail: string; instance: string; requestId: string;
}

// ── Token Bucket ───────────────────────────────────────────────────────────
const buckets = new Map<string, { tokens: number; lastRefill: number }>();
const RATE = 10; const BURST = 20; const WINDOW_MS = 60_000;

function consume(userId: string): boolean {
  const now = Date.now();
  let b = buckets.get(userId) ?? { tokens: BURST, lastRefill: now };
  const elapsed = now - b.lastRefill;
  b.tokens = Math.min(BURST, b.tokens + (elapsed / WINDOW_MS) * RATE);
  b.lastRefill = now;
  if (b.tokens < 1) { buckets.set(userId, b); return false; }
  b.tokens -= 1;
  buckets.set(userId, b);
  return true;
}

// ── Validation ─────────────────────────────────────────────────────────────
const MessageSchema = z.object({
  content: z.string().min(1).max(2000),
  priority: z.enum(['low', 'medium', 'high']).default('medium'),
});

// ── Helpers ────────────────────────────────────────────────────────────────
const problem = (res: Response, status: number, title: string,
  detail: string, reqId: string): void => {
  const body: ProblemDetail = {
    type: `https://agentic-coding.ch/errors/${title.toLowerCase().replace(/ /g, '-')}`,
    title, status, detail,
    instance: res.req.originalUrl, requestId: reqId,
  };
  res.status(status).type('application/problem+json').json(body);
};

const log = (level: string, msg: string, meta: object) =>
  console.log(JSON.stringify({ ts: new Date().toISOString(), level, msg, ...meta }));

// ── Handler ────────────────────────────────────────────────────────────────
export async function postMessage(req: Request, res: Response, next: NextFunction) {
  const reqId = randomUUID();
  log('info', 'request', { reqId, method: req.method, path: req.path });

  // Auth
  const token = req.headers.authorization?.split(' ')[1];
  if (!token) return problem(res, 401, 'Unauthorized', 'Missing bearer token', reqId);

  let caller: JwtPayload;
  try { caller = jwt.verify(token, process.env.JWT_SECRET!) as JwtPayload; }
  catch { return problem(res, 401, 'Unauthorized', 'Invalid or expired token', reqId); }

  const { id } = req.params;
  if (caller.role !== 'admin' && caller.sub !== id)
    return problem(res, 403, 'Forbidden', 'You may only send messages as yourself', reqId);

  // Rate limit
  if (!consume(caller.sub))
    return problem(res, 429, 'Too Many Requests',
      'Rate limit exceeded. Retry after 60 seconds.', reqId);

  // Validate
  const parsed = MessageSchema.safeParse(req.body);
  if (!parsed.success)
    return problem(res, 422, 'Unprocessable Entity',
      parsed.error.issues.map(i => `${i.path.join('.')}: ${i.message}`).join('; '), reqId);

  const { content, priority } = parsed.data;

  // Business logic (placeholder)
  log('info', 'message_sent', { reqId, userId: id, priority, length: content.length });
  res.status(201).json({ id: randomUUID(), userId: id, content, priority,
    createdAt: new Date().toISOString() });
}

/**
 * POST /api/v1/users/:id/messages
 *
 * Sends a message on behalf of a user.
 * Auth:       JWT bearer – caller must be the target user OR an admin.
 * Rate limit: Token-bucket, 10 req/min sustained, burst up to 20.
 * Validation: Zod schema (content: 1-2000 chars, priority: low|medium|high).
 * Errors:     RFC 7807 Problem Details (application/problem+json).
 * Logging:    Structured JSON with request-id tracing.
 *
 * ⚠️  Production note: The in-memory token bucket does NOT work correctly
 *     across multiple Node.js processes or pods. Replace `TokenBucketStore`
 *     with a Redis-backed implementation before deploying to a cluster.
 */

import { Request, Response, NextFunction } from 'express';
import { z, ZodError } from 'zod';
import jwt, { JsonWebTokenError, TokenExpiredError } from 'jsonwebtoken';
import { randomUUID } from 'crypto';

// ─────────────────────────────────────────────────────────────────────────────
// Domain types
// ─────────────────────────────────────────────────────────────────────────────

type UserRole = 'user' | 'admin';

interface AuthenticatedCaller {
  sub: string;
  role: UserRole;
  iat: number;
  exp: number;
}

/** RFC 7807 Problem Details (https://www.rfc-editor.org/rfc/rfc7807) */
interface ProblemDetails {
  type: string;
  title: string;
  status: number;
  detail: string;
  instance: string;
  /** Non-standard extension: correlates logs with HTTP responses */
  requestId: string;
}

interface MessageResponse {
  id: string;
  userId: string;
  content: string;
  priority: 'low' | 'medium' | 'high';
  createdAt: string;
}

// ─────────────────────────────────────────────────────────────────────────────
// Token Bucket Rate Limiter
// ─────────────────────────────────────────────────────────────────────────────

interface BucketState {
  /** Current token count (fractional tokens are allowed during calculation) */
  tokens: number;
  lastRefillMs: number;
}

interface TokenBucketConfig {
  /** Sustained rate: tokens added per millisecond */
  ratePerMs: number;
  /** Maximum burst capacity */
  capacity: number;
}

/**
 * In-memory token bucket store.
 *
 * Algorithm: Continuous token refill (not fixed windows).
 * Each `consume()` call calculates tokens earned since the last call
 * and adds them to the bucket before attempting to consume one token.
 *
 * Time complexity: O(1) per consume call.
 * Space complexity: O(n) where n = number of unique user IDs seen.
 */
class TokenBucketStore {
  private readonly buckets = new Map<string, BucketState>();
  private readonly config: TokenBucketConfig;

  constructor(config: TokenBucketConfig) {
    this.config = config;
  }

  /**
   * Attempts to consume one token for the given key.
   * @returns `true` if the request is allowed, `false` if rate-limited.
   */
  consume(key: string): boolean {
    const now = Date.now();
    const state = this.buckets.get(key) ?? {
      tokens: this.config.capacity,
      lastRefillMs: now,
    };

    // Refill tokens based on elapsed time
    const elapsedMs = now - state.lastRefillMs;
    const newTokens = Math.min(
      this.config.capacity,
      state.tokens + elapsedMs * this.config.ratePerMs,
    );

    if (newTokens < 1) {
      // Update lastRefill even on rejection to avoid token accumulation
      this.buckets.set(key, { tokens: newTokens, lastRefillMs: now });
      return false;
    }

    this.buckets.set(key, { tokens: newTokens - 1, lastRefillMs: now });
    return true;
  }
}

// Singleton: 10 tokens/minute = 10/60000 tokens/ms, burst capacity 20
const rateLimiter = new TokenBucketStore({
  ratePerMs: 10 / 60_000,
  capacity: 20,
});

// ─────────────────────────────────────────────────────────────────────────────
// Input validation schema
// ─────────────────────────────────────────────────────────────────────────────

const MessageBodySchema = z.object({
  content: z
    .string({ required_error: 'content is required' })
    .min(1, 'content must not be empty')
    .max(2000, 'content must not exceed 2000 characters'),
  priority: z
    .enum(['low', 'medium', 'high'], {
      errorMap: () => ({ message: "priority must be 'low', 'medium', or 'high'" }),
    })
    .default('medium'),
});

type MessageBody = z.infer<typeof MessageBodySchema>;

// ─────────────────────────────────────────────────────────────────────────────
// Utilities
// ─────────────────────────────────────────────────────────────────────────────

const BASE_URL = process.env.API_BASE_URL ?? 'https://agentic-coding.ch';

function sendProblem(
  res: Response,
  status: number,
  title: string,
  detail: string,
  requestId: string,
): void {
  const body: ProblemDetails = {
    type: `${BASE_URL}/problems/${encodeURIComponent(title.toLowerCase().replace(/\s+/g, '-'))}`,
    title,
    status,
    detail,
    instance: res.req.originalUrl,
    requestId,
  };
  res
    .status(status)
    .setHeader('Content-Type', 'application/problem+json')
    .json(body);
}

function structuredLog(
  level: 'info' | 'warn' | 'error',
  message: string,
  context: Record<string, unknown>,
): void {
  // In production, replace with a proper logger (pino, winston, etc.)
  process.stdout.write(
    JSON.stringify({
      timestamp: new Date().toISOString(),
      level,
      message,
      ...context,
    }) + '\n',
  );
}

// ─────────────────────────────────────────────────────────────────────────────
// Route handler
// ─────────────────────────────────────────────────────────────────────────────

export async function postMessage(
  req: Request,
  res: Response,
  next: NextFunction,
): Promise<void> {
  const requestId = randomUUID();

  structuredLog('info', 'Incoming request', {
    requestId,
    method: req.method,
    path: req.path,
    params: req.params,
    ip: req.ip,
  });

  // ── 1. Authentication ────────────────────────────────────────────────────
  const authHeader = req.headers.authorization;
  if (!authHeader?.startsWith('Bearer ')) {
    sendProblem(res, 401, 'Unauthorized', 'Authorization header with Bearer token is required.', requestId);
    return;
  }

  const token = authHeader.slice(7);
  let caller: AuthenticatedCaller;

  try {
    caller = jwt.verify(token, process.env.JWT_SECRET!) as AuthenticatedCaller;
  } catch (err) {
    const detail =
      err instanceof TokenExpiredError
        ? 'The provided token has expired. Please re-authenticate.'
        : err instanceof JsonWebTokenError
          ? 'The provided token is invalid or malformed.'
          : 'Token verification failed.';

    structuredLog('warn', 'Authentication failed', { requestId, reason: detail });
    sendProblem(res, 401, 'Unauthorized', detail, requestId);
    return;
  }

  // ── 2. Authorization ─────────────────────────────────────────────────────
  const { id: targetUserId } = req.params;
  const isOwner = caller.sub === targetUserId;
  const isAdmin = caller.role === 'admin';

  if (!isOwner && !isAdmin) {
    structuredLog('warn', 'Authorization denied', {
      requestId, callerId: caller.sub, targetUserId,
    });
    sendProblem(
      res, 403, 'Forbidden',
      'You are not authorized to send messages on behalf of this user.',
      requestId,
    );
    return;
  }

  // ── 3. Rate limiting ─────────────────────────────────────────────────────
  if (!rateLimiter.consume(caller.sub)) {
    structuredLog('warn', 'Rate limit exceeded', { requestId, userId: caller.sub });
    res.setHeader('Retry-After', '60');
    sendProblem(
      res, 429, 'Too Many Requests',
      'You have exceeded the rate limit of 10 requests per minute. Please wait before retrying.',
      requestId,
    );
    return;
  }

  // ── 4. Input validation ──────────────────────────────────────────────────
  const parseResult = MessageBodySchema.safeParse(req.body);
  if (!parseResult.success) {
    const issues = parseResult.error.issues
      .map(issue => `${issue.path.join('.') || 'body'}: ${issue.message}`)
      .join('; ');

    structuredLog('info', 'Validation failed', { requestId, issues });
    sendProblem(res, 422, 'Unprocessable Entity', issues, requestId);
    return;
  }

  const { content, priority }: MessageBody = parseResult.data;

  // ── 5. Business logic ────────────────────────────────────────────────────
  // TODO: Persist the message to the database here.
  const messageId = randomUUID();

  structuredLog('info', 'Message created', {
    requestId,
    messageId,
    userId: targetUserId,
    priority,
    contentLength: content.length,
    sentByAdmin: isAdmin && !isOwner,
  });

  const response: MessageResponse = {
    id: messageId,
    userId: targetUserId,
    content,
    priority,
    createdAt: new Date().toISOString(),
  };

  res.status(201).json(response);
}

// Fehlerhafter Code (Fixed-Window statt Token-Bucket)
function consume(userId: string): boolean {
  const now = Date.now();
  const windowStart = Math.floor(now / 60_000) * 60_000;
  let b = buckets.get(userId) ?? { count: 0, windowStart };
  if (b.windowStart !== windowStart) { b = { count: 0, windowStart }; }
  if (b.count >= 10) return false;
  b.count++;
  buckets.set(userId, b);
  return true;
}