<?php

namespace FootyRoom\Services\Auth;

use RuntimeException;
use Illuminate\Contracts\Events\Dispatcher;
use Illuminate\Contracts\Auth\UserProvider;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Illuminate\Contracts\Auth\Guard as GuardContract;
use Illuminate\Contracts\Cookie\QueueingFactory as CookieJar;
use Illuminate\Contracts\Auth\Authenticatable as AuthenticatableContract;
use Illuminate\Contracts\Session\Session;

class Guard implements GuardContract
{
    /**
     * The currently authenticated user.
     *
     * @var \Illuminate\Contracts\Auth\Authenticatable
     */
    protected $user;

    /**
     * The user we last attempted to retrieve.
     *
     * @var \Illuminate\Contracts\Auth\Authenticatable
     */
    protected $lastAttempted;

    /**
     * Indicates if the user was authenticated via a recaller cookie.
     *
     * @var bool
     */
    protected $viaRemember = false;

    /**
     * The user provider implementation.
     *
     * @var \Illuminate\Contracts\Auth\UserProvider
     */
    protected $provider;

    /**
     * The session used by the guard.
     *
     * @var \Illuminate\Contracts\Session\Session
     */
    protected $session;

    /**
     * The Illuminate cookie creator service.
     *
     * @var \Illuminate\Contracts\Cookie\QueueingFactory
     */
    protected $cookie;

    /**
     * The request instance.
     *
     * @var \Symfony\Component\HttpFoundation\Request
     */
    protected $request;

    /**
     * The event dispatcher instance.
     *
     * @var \Illuminate\Contracts\Events\Dispatcher
     */
    protected $events;

    /**
     * Indicates if the logout method has been called.
     *
     * @var bool
     */
    protected $loggedOut = false;

    /**
     * Indicates if attempt was prevented due to many failed continuous attempts.
     *
     * @var bool
     */
    protected $attemptPrevented = false;

    /**
     * Indicates if a forced attempt has been made.
     *
     * @var bool
     */
    protected $forcedAttempt = false;

    /**
     * Indicates if user credentials are valid.
     *
     * @var bool
     */
    protected $validCredentials = false;

    /**
     * Indicates if user retrieval has already been attempted.
     *
     * @var bool
     */
    protected $retrievalAttempted = false;

    /**
     * Create a new authentication guard.
     *
     * @param  \Illuminate\Contracts\Auth\UserProvider  $provider
     * @param  \Illuminate\Contracts\Session\Session  $session
     * @param  \Symfony\Component\HttpFoundation\Request  $request
     * @return void
     */
    public function __construct(
        UserProvider $provider,
        Session $session,
        Request $request = null
    ) {
        $this->session = $session;
        $this->request = $request;
        $this->provider = $provider;
    }

    /**
     * Determine if the current user is authenticated.
     *
     * @return bool
     */
    public function check()
    {
        return !is_null($this->user());
    }

    /**
     * Determine if the current user is a guest.
     *
     * @return bool
     */
    public function guest()
    {
        return !$this->check();
    }

    /**
     * Get the currently authenticated user.
     *
     * @return \Illuminate\Contracts\Auth\Authenticatable|null
     */
    public function user()
    {
        if ($this->loggedOut) {
            return;
        }

        // If we have already retrieved the user for the current request we can just
        // return it back immediately. We do not want to pull the user data every
        // request into the method because that would tremendously slow an app.
        if (!is_null($this->user) || $this->retrievalAttempted) {
            return $this->user;
        }

        // First we will try to load the user using the identifier in the session if
        // one exists. Otherwise we will check for a "remember me" cookie in this
        // request, and if one exists, attempt to retrieve the user using that.
        if ($this->session->has($this->getSessionName())) {
            $this->user = $this->provider->retrieveBySession($this->getSessionName());
        }
        // If the user is null, but we decrypt a "remember" cookie we can attempt to
        // pull the user data on that cookie. Once we have a user we can return it to the caller.
        if (is_null($this->user) && $this->hasRememberCookie()) {
            $this->loginUserFromCookie($this->getRememberCookie());
        }

        return $this->user;
    }

    /**
     * Get the ID for the currently authenticated user.
     *
     * @return int|null
     */
    public function id()
    {
        if ($this->loggedOut) {
            return;
        }

        if ($user = $this->user()) {
            return $user->getAuthIdentifier();
        }
    }

    /**
     * Determines whether "remember" cookie exists in request.
     *
     * @return bool
     */
    protected function hasRememberCookie()
    {
        if ($this->request) {
            return $this->request->cookies->has($this->getRememberCookieName());
        }

        return false;
    }

    /**
     * Returns "remember" cookie value.
     *
     * @return string
     */
    protected function getRememberCookie()
    {
        if ($this->request) {
            return $this->request->cookies->get($this->getRememberCookieName());
        }

        return null;
    }

    /**
     * Logs in user whose credentials are in the "remember" cookie.
     *
     * @return void
     */
    protected function loginUserFromCookie($cookie)
    {
        if ($this->validRememberCookie($cookie)) {
            list($id, $passwordHash) = explode('|', $cookie, 2);

            $this->attempt(['user_id' => $id, 'passwordHash' => $passwordHash], false, true);

            if ($this->user !== null) {
                $this->viaRemember = true;
            }
        }

        if ($this->user === null) {
            $this->clearRememberCookie();
        }
    }

    /**
     * Determine if the remember cookie is in a valid format.
     *
     * @param  string $cookie
     *
     * @return bool
     */
    protected function validRememberCookie($cookie): bool
    {
        if (!is_string($cookie) || !str_contains($cookie, '|')) {
            return false;
        }

        $segments = explode('|', $cookie);

        return count($segments) == 2 && trim($segments[0]) !== '' && trim($segments[1]) !== '';
    }

    /**
     * Log a user into the application without sessions or cookies.
     *
     * @param  array  $credentials
     * @return bool
     */
    public function once(array $credentials = [])
    {
        if ($this->validate($credentials)) {
            $this->setUser($this->lastAttempted);

            return true;
        }

        return false;
    }

    /**
     * Validate a user's credentials.
     *
     * @param  array  $credentials
     * @return bool
     */
    public function validate(array $credentials = [])
    {
        return $this->attempt($credentials, false, false);
    }

    /**
     * Attempt to authenticate using HTTP Basic Auth.
     *
     * @param  string  $field
     * @return \Symfony\Component\HttpFoundation\Response|null
     */
    public function basic($field = 'email')
    {
        if ($this->check()) {
            return;
        }

        // If a username is set on the HTTP basic request, we will return out without
        // interrupting the request lifecycle. Otherwise, we'll need to generate a
        // request indicating that the given credentials were invalid for login.
        if ($this->attemptBasic($this->getRequest(), $field)) {
            return;
        }

        return $this->getBasicResponse();
    }

    /**
     * Perform a stateless HTTP Basic login attempt.
     *
     * @param  string  $field
     * @return \Symfony\Component\HttpFoundation\Response|null
     */
    public function onceBasic($field = 'email')
    {
        if (!$this->once($this->getBasicCredentials($this->getRequest(), $field))) {
            return $this->getBasicResponse();
        }
    }

    /**
     * Attempt to authenticate using basic authentication.
     *
     * @param  \Symfony\Component\HttpFoundation\Request  $request
     * @param  string  $field
     * @return bool
     */
    protected function attemptBasic(Request $request, $field)
    {
        if (!$request->getUser()) {
            return false;
        }

        return $this->attempt($this->getBasicCredentials($request, $field));
    }

    /**
     * Get the credential array for a HTTP Basic request.
     *
     * @param  \Symfony\Component\HttpFoundation\Request  $request
     * @param  string  $field
     * @return array
     */
    protected function getBasicCredentials(Request $request, $field)
    {
        return [$field => $request->getUser(), 'password' => $request->getPassword()];
    }

    /**
     * Get the response for basic authentication.
     *
     * @return \Symfony\Component\HttpFoundation\Response
     */
    protected function getBasicResponse()
    {
        $headers = ['WWW-Authenticate' => 'Basic'];

        return new Response('Invalid credentials.', 401, $headers);
    }

    /**
     * Attempt to authenticate a user using the given credentials.
     *
     * @param  array  $credentials
     * @param  bool   $remember
     * @param  bool   $login
     * @return bool
     */
    public function attempt(array $credentials = [], $remember = false, $login = true)
    {
        $this->fireAttemptEvent($credentials, $remember, $login);

        $this->lastAttempted = $user = $this->provider->retrieveByCredentials($credentials);

        if ($user === null) {
            return false;
        }

        if ($this->preventAttempt($user)) {
            return false;
        }

        if (!$this->provider->validateCredentials($user, $credentials)) {
            $this->provider->recordFailedAttempt($user, $this->request->getClientIp());

            return false;
        }

        $this->validCredentials = true;

        if (!$this->provider->accountOpen($user)) {
            return false;
        }

        if ($login) {
            $this->login($user, $remember);
        }

        $this->provider->clearFailedAttempts($user);

        return true;
    }

    public function forceAttempt(array $credentials = [], $remember = false, $login = true)
    {
        $this->forcedAttempt = true;

        $this->attempt($credentials, $remember, $login);
    }

    /**
     * Decides whether to prevent user's attempts to login.
     * Returns true if user has too many consequent failed attempts.
     *
     * @param  \Illuminate\Contracts\Auth\Authenticatable $user
     *
     * @return bool
     */
    protected function preventAttempt($user)
    {
        $failedAttempts = $this->provider->failedAttempts($user);

        if (!$this->forcedAttempt && $failedAttempts >= 3) {
            $this->attemptPrevented = true;

            return true;
        }

        return false;
    }

    /**
     * Fire the attempt event with the arguments.
     *
     * @param  array  $credentials
     * @param  bool  $remember
     * @param  bool  $login
     * @return void
     */
    protected function fireAttemptEvent(array $credentials, $remember, $login)
    {
        if ($this->events) {
            $payload = [$credentials, $remember, $login];

            $this->events->dispatch('auth.attempt', $payload);
        }
    }

    /**
     * Register an authentication attempt event listener.
     *
     * @param  mixed  $callback
     * @return void
     */
    public function attempting($callback)
    {
        if ($this->events) {
            $this->events->listen('auth.attempt', $callback);
        }
    }

    /**
     * Log a user into the application.
     *
     * @param  \Illuminate\Contracts\Auth\Authenticatable  $user
     * @param  bool  $remember
     * @return void
     */
    public function login(AuthenticatableContract $user, $remember = false)
    {
        $this->updateSession($user);

        // If the user should be permanently "remembered" by the application we will
        // queue a permanent cookie that contains the encrypted copy of the user
        // identifier. We will then decrypt this later to retrieve the users.
        $this->queueRememberCookie($user);

        // If we have an event dispatcher instance set we will fire an event so that
        // any listeners will hook into the authentication events and run actions
        // based on the login and logout events fired from the guard instances.
        $this->fireLoginEvent($user, $this->request);

        $this->setUser($user);
    }

    /**
     * Fire the login event if the dispatcher is set.
     *
     * @param  \Illuminate\Contracts\Auth\Authenticatable  $user
     * @param  bool  $remember
     * @return void
     */
    protected function fireLoginEvent($user, $request)
    {
        if (isset($this->events)) {
            $this->events->dispatch('auth.login', [$user, $request]);
        }
    }

    /**
     * Log a user without firing events.
     *
     * @param \Illuminate\Contracts\Auth\Authenticatable  $user
     */
    public function loginQuiet(AuthenticatableContract $user)
    {
        $this->updateSession($user);

        $this->queueRememberCookie($user);

        $this->setUser($user);
    }

    /**
     * Update the session with the given user.
     *
     * @param  string  $id
     * @return void
     */
    protected function updateSession($user)
    {
        $this->session->put($this->getSessionName(), $this->provider->toArray($user));

        $this->session->migrate();
    }

    /**
     * Log the given user ID into the application.
     *
     * @param  mixed  $id
     * @param  bool   $remember
     * @return \Illuminate\Contracts\Auth\Authenticatable
     */
    public function loginUsingId($id, $remember = false)
    {
        $this->login($user = $this->provider->retrieveById($id), $remember);

        $this->updateSession($user);

        return $user;
    }

    /**
     * Log the given user ID into the application without sessions or cookies.
     *
     * @param  mixed  $id
     * @return bool
     */
    public function onceUsingId($id)
    {
        if (!is_null($user = $this->provider->retrieveById($id))) {
            $this->setUser($user);

            return true;
        }

        return false;
    }

    /**
     * Queue the recaller cookie into the cookie jar.
     *
     * @param  \Illuminate\Contracts\Auth\Authenticatable  $user
     *
     * @return void
     */
    protected function queueRememberCookie(AuthenticatableContract $user)
    {
        $value = $this->provider->getId($user).'|'.$this->provider->getPasswordHash($user);

        $this->getCookieJar()->queue(
            $this->getCookieJar()->forever(
                $this->getRememberCookieName(),
                $value
            )
        );
    }

    /**
     * Log the user out of the application.
     *
     * @return void
     */
    public function logout()
    {
        $user = $this->user();

        $this->clearUserDataFromStorage();

        // If we have an event dispatcher instance, we can fire off the logout event
        // so any further processing can be done. This allows the developer to be
        // listening for anytime a user signs out of this application manually.
        if (isset($this->events)) {
            $this->events->dispatch('auth.logout', [$user]);
        }

        // Once we have fired the logout event we will clear the users out of memory
        // so they are no longer available as the user is no longer considered as
        // being signed into this application and should not be available here.
        $this->user = null;

        $this->loggedOut = true;
    }

    /**
     * Remove the user data from the session and cookies.
     *
     * @return void
     */
    protected function clearUserDataFromStorage()
    {
        $this->session->remove($this->getSessionName());

        $this->clearRememberCookie();
    }

    /**
     * Removes "remember" cookies.
     *
     * @return void
     */
    protected function clearRememberCookie()
    {
        $this->getCookieJar()->queue(
            $this->getCookieJar()->forget($this->getRememberCookieName())
        );
    }

    /**
     * Get the cookie creator instance used by the guard.
     *
     * @throws \RuntimeException
     * @return \Illuminate\Contracts\Cookie\QueueingFactory
     */
    public function getCookieJar()
    {
        if (!isset($this->cookie)) {
            throw new RuntimeException('Cookie jar has not been set.');
        }

        return $this->cookie;
    }

    /**
     * Set the cookie creator instance used by the guard.
     *
     * @param  \Illuminate\Contracts\Cookie\QueueingFactory  $cookie
     * @return void
     */
    public function setCookieJar(CookieJar $cookie)
    {
        $this->cookie = $cookie;
    }

    /**
     * Get the event dispatcher instance.
     *
     * @return \Illuminate\Contracts\Events\Dispatcher
     */
    public function getDispatcher()
    {
        return $this->events;
    }

    /**
     * Set the event dispatcher instance.
     *
     * @param  \Illuminate\Contracts\Events\Dispatcher  $events
     * @return void
     */
    public function setDispatcher(Dispatcher $events)
    {
        $this->events = $events;
    }

    /**
     * Get the session store used by the guard.
     *
     * @return \Illuminate\Session\Store
     */
    public function getSession()
    {
        return $this->session;
    }

    /**
     * Get the user provider used by the guard.
     *
     * @return \Illuminate\Contracts\Auth\UserProvider
     */
    public function getProvider()
    {
        return $this->provider;
    }

    /**
     * Set the user provider used by the guard.
     *
     * @param  \Illuminate\Contracts\Auth\UserProvider  $provider
     * @return void
     */
    public function setProvider(UserProvider $provider)
    {
        $this->provider = $provider;
    }

    /**
     * Return the currently cached user.
     *
     * @return \Illuminate\Contracts\Auth\Authenticatable|null
     */
    public function getUser()
    {
        return $this->user;
    }

    /**
     * Set the current user.
     *
     * @param  \Illuminate\Contracts\Auth\Authenticatable  $user
     * @return void
     */
    public function setUser(AuthenticatableContract $user)
    {
        $this->user = $user;

        $this->loggedOut = false;
    }

    /**
     * Get the current request instance.
     *
     * @return \Symfony\Component\HttpFoundation\Request
     */
    public function getRequest()
    {
        return $this->request ?: Request::createFromGlobals();
    }

    /**
     * Set the current request instance.
     *
     * @param  \Symfony\Component\HttpFoundation\Request  $request
     * @return $this
     */
    public function setRequest(Request $request)
    {
        $this->request = $request;

        return $this;
    }

    /**
     * Get the last user we attempted to authenticate.
     *
     * @return \Illuminate\Contracts\Auth\Authenticatable
     */
    public function getLastAttempted()
    {
        return $this->lastAttempted;
    }

    /**
     * Indicates if attempt was prevented due to many failed continuous attempts.
     *
     * @return bool
     */
    public function attemptPrevented()
    {
        return $this->attemptPrevented;
    }

    /**
     * Get name of auth session value.
     *
     * @return string
     */
    public function getSessionName()
    {
        return 'USER';
    }

    /**
     * Get the name of the "remember" cookie.
     *
     * @return string
     */
    public function getRememberCookieName()
    {
        return 'fr_user';
    }

    /**
     * Determine if the user was authenticated via "remember me" cookie.
     *
     * @return bool
     */
    public function viaRemember()
    {
        return $this->viaRemember;
    }

    /**
     * Indicates if user credentials are valid.
     *
     * @return bool
     */
    public function validCredentials()
    {
        return $this->validCredentials;
    }
}