package jwt

import (
	"context"
	"fmt"
	"reflect"
	"slices"
	"strconv"
	"time"

	jwterrs "github.com/lestrrat-go/jwx/v3/jwt/internal/errors"
)

type Clock interface {
	Now() time.Time
}
type ClockFunc func() time.Time

func (f ClockFunc) Now() time.Time {
	return f()
}

func isSupportedTimeClaim(c string) error {
	switch c {
	case ExpirationKey, IssuedAtKey, NotBeforeKey:
		return nil
	}
	return jwterrs.ValidateErrorf(`unsupported time claim %s in jwt.WithMaxDelta/jwt.WithMinDelta`, strconv.Quote(c))
}

func timeClaim(t Token, clock Clock, c string) time.Time {
	// We don't check if the claims already exist. It should have been done
	// by piggybacking on `required` check.
	switch c {
	case ExpirationKey:
		tv, _ := t.Expiration()
		return tv
	case IssuedAtKey:
		tv, _ := t.IssuedAt()
		return tv
	case NotBeforeKey:
		tv, _ := t.NotBefore()
		return tv
	case "":
		return clock.Now()
	}
	return time.Time{} // should *NEVER* reach here, but...
}

// Validate makes sure that the essential claims stand.
//
// See the various `WithXXX` functions for optional parameters
// that can control the behavior of this method.
func Validate(t Token, options ...ValidateOption) error {
	if t == nil {
		return jwterrs.ValidateErrorf(`jwt.Validate: token is nil`)
	}

	ctx := context.Background()
	trunc := getDefaultTruncation()

	var clock Clock = ClockFunc(time.Now)
	var skew time.Duration
	var baseValidators = []Validator{
		IsIssuedAtValid(),
		IsExpirationValid(),
		IsNbfValid(),
	}
	var extraValidators []Validator
	var resetValidators bool
	for _, o := range options {
		switch o.Ident() {
		case identClock{}:
			if err := o.Value(&clock); err != nil {
				return fmt.Errorf(`jwt.Validate: value for WithClock() option must be jwt.Clock: %w`, err)
			}
		case identAcceptableSkew{}:
			if err := o.Value(&skew); err != nil {
				return fmt.Errorf(`jwt.Validate: value for WithAcceptableSkew() option must be time.Duration: %w`, err)
			}
			if skew < 0 {
				return fmt.Errorf(`jwt.Validate: WithAcceptableSkew() must not be negative`)
			}
		case identTruncation{}:
			if err := o.Value(&trunc); err != nil {
				return fmt.Errorf(`jwt.Validate: value for WithTruncation() option must be time.Duration: %w`, err)
			}
		case identContext{}:
			if err := o.Value(&ctx); err != nil {
				return fmt.Errorf(`jwt.Validate: value for WithContext() option must be context.Context: %w`, err)
			}
		case identResetValidators{}:
			if err := o.Value(&resetValidators); err != nil {
				return fmt.Errorf(`jwt.Validate: value for WithResetValidators() option must be bool: %w`, err)
			}
		case identValidator{}:
			var v Validator
			if err := o.Value(&v); err != nil {
				return fmt.Errorf(`jwt.Validate: value for WithValidator() option must be jwt.Validator: %w`, err)
			}
			switch v := v.(type) {
			case *isInTimeRange:
				if v.c1 != "" {
					if err := isSupportedTimeClaim(v.c1); err != nil {
						return err
					}
					extraValidators = append(extraValidators, IsRequired(v.c1))
				}
				if v.c2 != "" {
					if err := isSupportedTimeClaim(v.c2); err != nil {
						return err
					}
					extraValidators = append(extraValidators, IsRequired(v.c2))
				}
			}
			extraValidators = append(extraValidators, v)
		}
	}

	ctx = SetValidationCtxSkew(ctx, skew)
	ctx = SetValidationCtxClock(ctx, clock)
	ctx = SetValidationCtxTruncation(ctx, trunc)

	var validators []Validator
	if !resetValidators {
		validators = append(baseValidators, extraValidators...)
	} else {
		if len(extraValidators) == 0 {
			return jwterrs.ValidateErrorf(`no validators specified: jwt.WithResetValidators(true) and no jwt.WithValidator() specified`)
		}
		validators = extraValidators
	}

	for _, v := range validators {
		if err := v.Validate(ctx, t); err != nil {
			return jwterrs.ValidateErrorf(`validation failed: %w`, err)
		}
	}

	return nil
}

type isInTimeRange struct {
	c1   string
	c2   string
	dur  time.Duration
	less bool // if true, d =< c1 - c2. otherwise d >= c1 - c2
}

// MaxDeltaIs implements the logic behind `WithMaxDelta()` option
func MaxDeltaIs(c1, c2 string, dur time.Duration) Validator {
	return &isInTimeRange{
		c1:   c1,
		c2:   c2,
		dur:  dur,
		less: true,
	}
}

// MinDeltaIs implements the logic behind `WithMinDelta()` option
func MinDeltaIs(c1, c2 string, dur time.Duration) Validator {
	return &isInTimeRange{
		c1:   c1,
		c2:   c2,
		dur:  dur,
		less: false,
	}
}

func (iitr *isInTimeRange) Validate(ctx context.Context, t Token) error {
	clock := ValidationCtxClock(ctx) // MUST be populated
	skew := ValidationCtxSkew(ctx)   // MUST be populated
	t1 := timeClaim(t, clock, iitr.c1)
	t2 := timeClaim(t, clock, iitr.c2)
	// Defensive: reject zero-value claims before computing delta. The
	// auto-IsRequired piggyback in WithValidator type-switches on the
	// concrete *isInTimeRange — wrapping this validator (e.g., in
	// ValidatorFunc) skips that piggyback, and a missing time claim
	// would silently produce a hugely-negative delta that trivially
	// satisfies the upper-bound check. Reject the missing claim
	// regardless of how the validator was wrapped.
	if t1.IsZero() {
		return jwterrs.MissingRequiredClaimErrorf(iitr.c1)
	}
	if t2.IsZero() {
		return jwterrs.MissingRequiredClaimErrorf(iitr.c2)
	}
	if iitr.less { // t1 - t2 <= iitr.dur
		// t1 - t2 < iitr.dur + skew
		if t1.Sub(t2) > iitr.dur+skew {
			return fmt.Errorf(`iitr between %s and %s exceeds %s (skew %s)`, iitr.c1, iitr.c2, iitr.dur, skew)
		}
	} else {
		if t1.Sub(t2) < iitr.dur-skew {
			return fmt.Errorf(`iitr between %s and %s is less than %s (skew %s)`, iitr.c1, iitr.c2, iitr.dur, skew)
		}
	}
	return nil
}

// Validator describes interface to validate a Token.
type Validator interface {
	// Validate should return an error if a required conditions is not met.
	Validate(context.Context, Token) error
}

// ValidatorFunc is a type of Validator that does not have any
// state, that is implemented as a function
type ValidatorFunc func(context.Context, Token) error

func (vf ValidatorFunc) Validate(ctx context.Context, tok Token) error {
	return vf(ctx, tok)
}

type identValidationCtxClock struct{}
type identValidationCtxSkew struct{}
type identValidationCtxTruncation struct{}

func SetValidationCtxClock(ctx context.Context, cl Clock) context.Context {
	return context.WithValue(ctx, identValidationCtxClock{}, cl)
}

func SetValidationCtxTruncation(ctx context.Context, dur time.Duration) context.Context {
	return context.WithValue(ctx, identValidationCtxTruncation{}, dur)
}

func SetValidationCtxSkew(ctx context.Context, dur time.Duration) context.Context {
	return context.WithValue(ctx, identValidationCtxSkew{}, dur)
}

// ValidationCtxClock returns the Clock object associated with
// the current validation context. When called from within a Validator
// invoked by [Validate], the value is always populated. If the context
// was not initialized by [Validate] (for example, a custom validator
// was invoked with a bare context), a default clock backed by
// [time.Now] is returned instead of panicking.
func ValidationCtxClock(ctx context.Context) Clock {
	if cl, ok := ctx.Value(identValidationCtxClock{}).(Clock); ok {
		return cl
	}
	return ClockFunc(time.Now)
}

// ValidationCtxSkew returns the clock skew associated with the current
// validation context. If the context was not initialized by [Validate],
// zero is returned instead of panicking.
func ValidationCtxSkew(ctx context.Context) time.Duration {
	if dur, ok := ctx.Value(identValidationCtxSkew{}).(time.Duration); ok {
		return dur
	}
	return 0
}

// ValidationCtxTruncation returns the truncation granularity associated
// with the current validation context. If the context was not initialized
// by [Validate], zero is returned instead of panicking.
func ValidationCtxTruncation(ctx context.Context) time.Duration {
	if dur, ok := ctx.Value(identValidationCtxTruncation{}).(time.Duration); ok {
		return dur
	}
	return 0
}

// IsExpirationValid is one of the default validators that will be executed.
// It does not need to be specified by users, but it exists as an
// exported field so that you can check what it does.
//
// The supplied context.Context object must have the "clock" and "skew"
// populated with appropriate values using SetValidationCtxClock() and
// SetValidationCtxSkew()
func IsExpirationValid() Validator {
	return ValidatorFunc(isExpirationValid)
}

func isExpirationValid(ctx context.Context, t Token) error {
	tv, ok := t.Expiration()
	if !ok {
		return nil
	}

	clock := ValidationCtxClock(ctx)      // MUST be populated
	skew := ValidationCtxSkew(ctx)        // MUST be populated
	trunc := ValidationCtxTruncation(ctx) // MUST be populated

	now := clock.Now().Truncate(trunc)
	ttv := tv.Truncate(trunc)

	// expiration date must be after NOW
	if !now.Before(ttv.Add(skew)) {
		return TokenExpiredError()
	}
	return nil
}

// IsIssuedAtValid is one of the default validators that will be executed.
// It does not need to be specified by users, but it exists as an
// exported field so that you can check what it does.
//
// The supplied context.Context object must have the "clock" and "skew"
// populated with appropriate values using SetValidationCtxClock() and
// SetValidationCtxSkew()
func IsIssuedAtValid() Validator {
	return ValidatorFunc(isIssuedAtValid)
}

func isIssuedAtValid(ctx context.Context, t Token) error {
	tv, ok := t.IssuedAt()
	if !ok {
		return nil
	}

	clock := ValidationCtxClock(ctx)      // MUST be populated
	skew := ValidationCtxSkew(ctx)        // MUST be populated
	trunc := ValidationCtxTruncation(ctx) // MUST be populated

	now := clock.Now().Truncate(trunc)
	ttv := tv.Truncate(trunc)

	if now.Before(ttv.Add(-1 * skew)) {
		return InvalidIssuedAtError()
	}
	return nil
}

// IsNbfValid is one of the default validators that will be executed.
// It does not need to be specified by users, but it exists as an
// exported field so that you can check what it does.
//
// The supplied context.Context object must have the "clock" and "skew"
// populated with appropriate values using SetValidationCtxClock() and
// SetValidationCtxSkew()
func IsNbfValid() Validator {
	return ValidatorFunc(isNbfValid)
}

func isNbfValid(ctx context.Context, t Token) error {
	tv, ok := t.NotBefore()
	if !ok {
		return nil
	}

	clock := ValidationCtxClock(ctx)      // MUST be populated
	skew := ValidationCtxSkew(ctx)        // MUST be populated
	trunc := ValidationCtxTruncation(ctx) // MUST be populated

	// Truncation always happens even for trunc = 0 because
	// we also use this to strip monotonic clocks
	now := clock.Now().Truncate(trunc)
	ttv := tv.Truncate(trunc)

	// "now" cannot be before t - skew, so we check for now > t - skew
	ttv = ttv.Add(-1 * skew)
	if now.Before(ttv) {
		return TokenNotYetValidError()
	}
	return nil
}

type claimContainsString struct {
	name    string
	value   string
	makeErr func(string, ...any) error
}

// ClaimContainsString can be used to check if the claim called `name`, which is
// expected to be a list of strings, contains `value`. Currently, because of the
// implementation, this will probably only work for `aud` fields.
func ClaimContainsString(name, value string) Validator {
	return claimContainsString{
		name:    name,
		value:   value,
		makeErr: fmt.Errorf,
	}
}

func (ccs claimContainsString) Validate(_ context.Context, t Token) error {
	var list []string
	if err := t.Get(ccs.name, &list); err != nil {
		return ccs.makeErr(`claim %q does not exist or is not a []string: %w`, ccs.name, err)
	}

	if !slices.Contains(list, ccs.value) {
		return ccs.makeErr(`%q not satisfied`, ccs.name)
	}
	return nil
}

// audienceClaimContainsString can be used to check if the audience claim, which is
// expected to be a list of strings, contains `value`.
func audienceClaimContainsString(value string) Validator {
	return claimContainsString{
		name:    AudienceKey,
		value:   value,
		makeErr: jwterrs.AudienceErrorf,
	}
}

type claimValueIs struct {
	name    string
	value   any
	makeErr func(string, ...any) error
}

// ClaimValueIs creates a Validator that checks if the value of claim `name`
// matches `value`. The comparison is done with reflect.DeepEqual, so
// slice-, map-, and struct-valued claims are supported in addition to
// scalars. Function-valued claims follow reflect.DeepEqual semantics
// (equal only when both sides are nil). If you need finer-grained
// matching than DeepEqual provides, use a custom Validator.
func ClaimValueIs(name string, value any) Validator {
	return &claimValueIs{
		name:    name,
		value:   value,
		makeErr: fmt.Errorf,
	}
}

func (cv *claimValueIs) Validate(_ context.Context, t Token) error {
	var v any
	if err := t.Get(cv.name, &v); err != nil {
		return cv.makeErr(`claim %[1]q does not exist or is not a []string: %[2]w`, cv.name, err)
	}
	if !reflect.DeepEqual(v, cv.value) {
		return cv.makeErr(`claim %[1]q does not have the expected value`, cv.name)
	}
	return nil
}

// issuerClaimValueIs creates a Validator that checks if the issuer claim
// matches `value`.
func issuerClaimValueIs(value string) Validator {
	return &claimValueIs{
		name:    IssuerKey,
		value:   value,
		makeErr: jwterrs.IssuerErrorf,
	}
}

// IsRequired creates a Validator that checks if the required claim `name`
// exists in the token
func IsRequired(name string) Validator {
	return isRequired(name)
}

type isRequired string

func (ir isRequired) Validate(_ context.Context, t Token) error {
	name := string(ir)
	if !t.Has(name) {
		return jwterrs.MissingRequiredClaimErrorf(name)
	}
	return nil
}