package api

import (
	"encoding/json"
	"net/http"

	"golang.org/x/crypto/bcrypt"

	"git.fabledsword.com/bvandeusen/minstrel/internal/audit"
	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
)

type changePasswordReq struct {
	CurrentPassword string `json:"current_password"`
	NewPassword     string `json:"new_password"`
}

// handleChangePassword implements PUT /api/me/password. Self-service:
// the caller proves they know their current password before they can
// set a new one. Distinct from the admin-driven reset path.
func (h *handlers) handleChangePassword(w http.ResponseWriter, r *http.Request) {
	user, ok := auth.UserFromContext(r.Context())
	if !ok {
		writeErr(w, http.StatusUnauthorized, "auth_required", "")
		return
	}
	var req changePasswordReq
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeErr(w, http.StatusBadRequest, "invalid_body", "")
		return
	}
	if len(req.NewPassword) < minPasswordLength {
		writeErr(w, http.StatusBadRequest, "password_too_short", "password must be at least 8 chars")
		return
	}

	q := dbq.New(h.pool)
	current, err := q.GetUserByID(r.Context(), user.ID)
	if err != nil {
		h.logger.Error("change password: lookup failed", "err", err)
		writeErr(w, http.StatusInternalServerError, "server_error", "")
		return
	}
	if err := bcrypt.CompareHashAndPassword([]byte(current.PasswordHash), []byte(req.CurrentPassword)); err != nil {
		writeErr(w, http.StatusUnauthorized, "wrong_password", "")
		return
	}

	hash, err := bcrypt.GenerateFromPassword([]byte(req.NewPassword), bcrypt.DefaultCost)
	if err != nil {
		h.logger.Error("change password: hash failed", "err", err)
		writeErr(w, http.StatusInternalServerError, "server_error", "")
		return
	}
	if err := q.ChangeUserPassword(r.Context(), dbq.ChangeUserPasswordParams{
		ID:           user.ID,
		PasswordHash: string(hash),
	}); err != nil {
		h.logger.Error("change password: update failed", "err", err)
		writeErr(w, http.StatusInternalServerError, "server_error", "")
		return
	}

	if err := audit.Write(r.Context(), h.pool, user.ID, user.ID, audit.ActionPasswordChangeSelf, nil); err != nil {
		h.logger.Warn("change password: audit failed", "err", err)
	}

	w.WriteHeader(http.StatusNoContent)
}