import type { Context, Hono } from "hono";
import { html } from "../pages/html.ts";
import { plural } from "../pages/layout.ts";
import { isDomain, saveConfig } from "../server/config.ts";
import { keepState } from "../server/db.ts";
import { endOtherSessions, liveSessions } from "../server/login.ts";
import { isSecret, newSecret, otpauthUri, stepFor } from "../server/totp.ts";
import { type AdminContext, adminPage, formField, notice, textFields } from "./console.ts";

export const MIN_PASSWORD = 12;

/**
 * The Account section (June, 2026-09-30): the admin password, the sessions signed in, and the
 * domain, each written to kepr.toml by Kepr and applied without a restart.
 */
export function registerAccount(app: Hono, ctx: AdminContext): void {
	app.get("/admin/account", (c) => c.html(accountPage(c, ctx, "")));

	app.post("/admin/account", async (c) => {
		const fields = await textFields(c);
		const refuse = (error: string) => c.html(accountPage(c, ctx, error), 400);
		const save = async (change: Partial<typeof ctx.config>) => {
			await saveConfig(ctx.configPath, { ...ctx.config, ...change });
			Object.assign(ctx.config, change);
		};
		if (fields.action === "password") {
			const password = fields.password ?? "";
			const current = fields.current_password ?? "";
			if (!(await Bun.password.verify(current, ctx.config.adminPasswordHash))) {
				return refuse("The current password is not right.");
			}
			if (password.length < MIN_PASSWORD) {
				return refuse(`The new password needs at least ${MIN_PASSWORD} characters.`);
			}
			if (password !== fields.confirm) return refuse("The two new passwords differ.");
			await save({ adminPasswordHash: await Bun.password.hash(password, "argon2id") });
			// Whoever knew the old password is signed out with it.
			endOtherSessions(ctx, c);
		} else if (fields.action === "totp-start") {
			return c.html(accountPage(c, ctx, "", newSecret()));
		} else if (fields.action === "totp-confirm") {
			const secret = fields.secret ?? "";
			const step = isSecret(secret)
				? stepFor(secret, (fields.code ?? "").trim(), Math.floor(Date.now() / 1000))
				: null;
			if (step === null) {
				return c.html(accountPage(c, ctx, "That code did not match. Set it up again.", ""), 400);
			}
			// The code that set it up is spent, so the same one cannot also sign in (§24).
			keepState(ctx.kepr, "totp_step", String(step));
			await save({ totpSecret: secret });
		} else if (fields.action === "totp-off") {
			const current = fields.current_password ?? "";
			if (!(await Bun.password.verify(current, ctx.config.adminPasswordHash))) {
				return refuse("The current password is not right.");
			}
			keepState(ctx.kepr, "totp_step", null);
			await save({ totpSecret: undefined });
		} else if (fields.action === "sessions") {
			endOtherSessions(ctx, c);
		} else if (fields.action === "domain") {
			const domain = (fields.domain ?? "").trim().toLowerCase();
			if (!isDomain(domain)) {
				return refuse(
					"The domain is a bare hostname, such as code.example.com, with an optional :port.",
				);
			}
			await save({ domain });
		} else {
			return refuse("Unknown action.");
		}
		return c.redirect("/admin/account?saved=1", 303);
	});
}

function accountPage(c: Context, ctx: AdminContext, error: string, offered = ""): string {
	const password = (name: string, label: string, autocomplete: string) =>
		html`<label class="issues-label" for="account-${name}">${label}</label>
<input class="issues-input" id="account-${name}" name="${name}" type="password"
autocomplete="${autocomplete}" required>`;
	// Setting up keeps the offered secret in the form: the code that confirms it proves whoever
	// typed it holds it, so a tampered field can only fail.
	const twoStep =
		offered !== ""
			? html`<p>Add this key to an authenticator app by hand, or paste the address under it, then
type the code the app shows. The key is shown this once; from then on sign-in asks for the password
and a code.</p>
<p class="issue-meta mono">key: ${offered}</p>
<p class="issue-meta mono">${otpauthUri(offered, ctx.domain)}</p>
<form class="issues-form" method="post" action="/admin/account">
${formField(c)}<input type="hidden" name="action" value="totp-confirm">
<input type="hidden" name="secret" value="${offered}">
<label class="issues-label" for="account-code">code from the app</label>
<input class="issues-input mono" id="account-code" name="code" inputmode="numeric"
autocomplete="one-time-code" required autofocus>
<button class="issues-submit" type="submit">turn two-step sign-in on</button>
</form>`
			: ctx.config.totpSecret === undefined
				? html`<p>Off. Sign-in asks for the password alone.</p>
<form method="post" action="/admin/account">
${formField(c)}<input type="hidden" name="action" value="totp-start">
<button class="issues-submit" type="submit">set up two-step sign-in</button>
</form>`
				: html`<p>On. Sign-in asks for the password and the code from your authenticator app.</p>
<form class="issues-form" method="post" action="/admin/account">
${formField(c)}<input type="hidden" name="action" value="totp-off">
${password("current_password", "password, to turn it off", "current-password")}
<p class="issue-meta mono">The password is also the way back in when the phone is lost.</p>
<button class="issues-submit" type="submit">turn it off</button>
</form>`;
	const body = html`${notice(error)}
<section class="repo-section"><h2 class="section-label mono">password</h2>
<form class="issues-form" method="post" action="/admin/account">
${formField(c)}<input type="hidden" name="action" value="password">
${password("current_password", "current password", "current-password")}
${password("password", `new password (at least ${MIN_PASSWORD} characters)`, "new-password")}
${password("confirm", "new password again", "new-password")}
<p class="issue-meta mono">Changing it signs out every other session.</p>
<button class="issues-submit" type="submit">change password</button>
</form></section>
<section class="repo-section"><h2 class="section-label mono">two-step sign-in</h2>
${twoStep}</section>
<section class="repo-section"><h2 class="section-label mono">sessions</h2>
<p>${plural(liveSessions(ctx), "session")} signed in, this one included. A session lasts 30 days.</p>
<form method="post" action="/admin/account">
${formField(c)}<input type="hidden" name="action" value="sessions">
<button class="issues-submit" type="submit">sign out everywhere else</button>
</form></section>
<section class="repo-section"><h2 class="section-label mono">domain</h2>
<form class="issues-form" method="post" action="/admin/account">
${formField(c)}<input type="hidden" name="action" value="domain">
<label class="issues-label" for="account-domain">domain</label>
<input class="issues-input mono" id="account-domain" name="domain" value="${ctx.domain}"
autocomplete="off" spellcheck="false" required>
<p class="issue-meta mono">Where Kepr is reached: pages, feeds and install.sh use it, and the console
accepts forms only from it. Point the new name at this server first, then save and sign in there.</p>
<button class="issues-submit" type="submit">save domain</button>
</form></section>`;
	return adminPage(c, ctx, "account", body);
}