using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Identity;
using Microsoft.Extensions.DependencyInjection;
using Hua.Todo.Application.CloudSync.Auth;
using Hua.Todo.Application.CloudSync.Services;
using Hua.Todo.Core.Entities;

namespace Hua.Todo.Application.CloudSync;

/// <summary>
/// 云同步服务端能力的依赖注入扩展。
/// </summary>
public static class CloudSyncServiceCollectionExtensions
{
    /// <summary>
    /// 注册云同步相关的认证、授权与业务服务。
    /// </summary>
    /// <param name="services">服务集合。</param>
    /// <returns>服务集合。</returns>
    public static IServiceCollection AddCloudSyncServer(this IServiceCollection services)
    {
        services.AddHttpContextAccessor();

        services.AddSingleton<IRolePermissionMapper, DefaultRolePermissionMapper>();
        services.AddScoped<IPasswordHasher<UserEntity>, PasswordHasher<UserEntity>>();

        services.AddScoped<CloudAuthService>();
        services.AddScoped<CloudAdminService>();
        services.AddScoped<CloudTaskSyncService>();
        services.AddScoped<SecurityPolicyService>();

        // 注册探测服务专用的 HttpClient（仅限服务端，MAUI 端不注册 AddCloudSyncServer）
        // 关闭 SSL 证书校验：探测目标可能是自签证书或内网服务器
        services.AddHttpClient("ProbeClient", client =>
        {
            client.DefaultRequestHeaders.UserAgent.ParseAdd("HuaTodo-Probe/1.0");
        })
        .ConfigurePrimaryHttpMessageHandler(() => new HttpClientHandler
        {
            ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator
        });
        services.AddScoped<CloudProbeService>();

        services.AddAuthentication(SessionAuthenticationDefaults.Scheme)
            .AddScheme<AuthenticationSchemeOptions, SessionAuthenticationHandler>(SessionAuthenticationDefaults.Scheme, _ => { });

        services.AddAuthorization(options =>
        {
            options.AddPolicy("tasks:read", p => p.RequireClaim(CloudClaims.Permission, CloudPermissions.TasksRead));
            options.AddPolicy("tasks:write", p => p.RequireClaim(CloudClaims.Permission, CloudPermissions.TasksWrite));
            options.AddPolicy("sync:write", p => p.RequireClaim(CloudClaims.Permission, CloudPermissions.SyncWrite));
            options.AddPolicy("policy:read", p => p.RequireClaim(CloudClaims.Permission, CloudPermissions.PolicyRead));
            options.AddPolicy("policy:write", p => p.RequireClaim(CloudClaims.Permission, CloudPermissions.PolicyWrite));
            options.AddPolicy("users:manage", p => p.RequireClaim(CloudClaims.Permission, CloudPermissions.UsersManage));
        });

        return services;
    }

    /// <summary>
    /// 注册云同步反向代理所需的服务（轻量级，供嵌入式 MAUI/Avalonia WebServer 使用）。
    /// 仅注册 URL 管理服务与转发专用 HttpClient，不包含认证/授权/业务服务。
    /// </summary>
    /// <param name="services">服务集合。</param>
    /// <returns>服务集合。</returns>
    public static IServiceCollection AddCloudSyncProxy(this IServiceCollection services)
    {
        services.AddSingleton<CloudSyncProxySettings>();

        // 代理专用的 HttpClient：不跟随重定向，允许转发到自签/内网服务器
        services.AddHttpClient("CloudSyncProxy", client =>
        {
            client.DefaultRequestHeaders.UserAgent.ParseAdd("HuaTodo-Proxy/1.0");
        })
        .ConfigurePrimaryHttpMessageHandler(() => new HttpClientHandler
        {
            AllowAutoRedirect = false,
            ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator
        });

        return services;
    }
}