package entity

import (
	"fmt"
	"time"

	"github.com/jinzhu/gorm"
	"github.com/photoprism/photoprism/internal/acl"
	"github.com/photoprism/photoprism/pkg/rnd"
)

type People []Person

// Person represents a real person that can also be a user if a password is set.
type Person struct {
	ID            int        `gorm:"primary_key" json:"ID" yaml:"-"`
	PersonUID     string     `gorm:"type:varbinary(42);unique_index;" json:"UID" yaml:"UID"`
	UserName      string     `gorm:"type:varchar(32);" json:"UserName" yaml:"UserName,omitempty"`
	FirstName     string     `gorm:"type:varchar(32);" json:"FirstName" yaml:"FirstName,omitempty"`
	LastName      string     `gorm:"type:varchar(32);" json:"LastName" yaml:"LastName,omitempty"`
	DisplayName   string     `gorm:"type:varchar(64);" json:"DisplayName" yaml:"DisplayName,omitempty"`
	UserEmail     string     `gorm:"type:varchar(255);" json:"Email" yaml:"Email,omitempty"`
	UserInfo      string     `gorm:"type:text;" json:"Info" yaml:"Info,omitempty"`
	UserPath      string     `json:"UserPath" yaml:"UserPath,omitempty"`
	UserActive    bool       `json:"Active" yaml:"Active,omitempty"`
	UserConfirmed bool       `json:"Confirmed" yaml:"Confirmed,omitempty"`
	RoleAdmin     bool       `json:"Admin" yaml:"Admin,omitempty"`
	RoleGuest     bool       `json:"Guest" yaml:"Guest,omitempty"`
	RoleChild     bool       `json:"Child" yaml:"Child,omitempty"`
	RoleFamily    bool       `json:"Family" yaml:"Family,omitempty"`
	RoleFriend    bool       `json:"Friend" yaml:"Friend,omitempty"`
	IsArtist      bool       `json:"Artist" yaml:"Artist,omitempty"`
	IsSubject     bool       `json:"Subject" yaml:"Subject,omitempty"`
	CanEdit       bool       `json:"CanEdit" yaml:"CanEdit,omitempty"`
	CanComment    bool       `json:"CanComment" yaml:"CanComment,omitempty"`
	CanUpload     bool       `json:"CanUpload" yaml:"CanUpload,omitempty"`
	CanDownload   bool       `json:"CanDownload" yaml:"CanDownload,omitempty"`
	WebDAV        bool       `gorm:"column:webdav" json:"WebDAV" yaml:"WebDAV,omitempty"`
	ApiToken      string     `json:"ApiToken" yaml:"ApiToken,omitempty"`
	LoginAttempts int        `json:"-" yaml:"-,omitempty"`
	LoginAt       *time.Time `json:"-" yaml:"-"`
	CreatedAt     time.Time  `json:"CreatedAt" yaml:"-"`
	UpdatedAt     time.Time  `json:"UpdatedAt" yaml:"-"`
	DeletedAt     *time.Time `sql:"index" json:"DeletedAt,omitempty" yaml:"-"`
}

// Default admin user.
var Admin = Person{
	ID:            1,
	UserName:      "admin",
	DisplayName:   "Admin",
	RoleAdmin:     true,
	UserActive:    true,
	UserConfirmed: true,
}

// Anonymous, public user without own account.
var UnknownPerson = Person{
	ID:            -1,
	PersonUID:     "u000000000000001",
	UserName:      "",
	DisplayName:   "Anonymous",
	RoleAdmin:     false,
	RoleGuest:     false,
	UserActive:    false,
	UserConfirmed: false,
}

// Guest user without own account for link sharing.
var Guest = Person{
	ID:            -2,
	PersonUID:     "u000000000000002",
	UserName:      "",
	DisplayName:   "Guest",
	RoleAdmin:     false,
	RoleGuest:     true,
	UserActive:    false,
	UserConfirmed: false,
}

// CreateDefaultUsers initializes the database with default user accounts.
func CreateDefaultUsers() {
	if user := FirstOrCreatePerson(&Admin); user != nil {
		Admin = *user
		Admin.InitPassword("photoprism")
	}

	if user := FirstOrCreatePerson(&UnknownPerson); user != nil {
		UnknownPerson = *user
	}

	if user := FirstOrCreatePerson(&Guest); user != nil {
		Guest = *user
	}
}

// Create inserts a new row to the database.
func (m *Person) Create() error {
	return Db().Create(m).Error
}

// BeforeCreate creates a random UID if needed before inserting a new row to the database.
func (m *Person) BeforeCreate(scope *gorm.Scope) error {
	if rnd.IsUID(m.PersonUID, 'u') {
		return nil
	}

	return scope.SetColumn("PersonUID", rnd.PPID('u'))
}

// FirstOrCreatePerson returns an existing row, inserts a new row or nil in case of errors.
func FirstOrCreatePerson(m *Person) *Person {
	result := Person{}

	if err := Db().Where("id = ? OR person_uid = ?", m.ID, m.PersonUID).First(&result).Error; err == nil {
		return &result
	} else if err := m.Create(); err != nil {
		log.Errorf("person: %s", err)
		return nil
	}

	return m
}

// FindPersonByUserName returns an existing user or nil if not found.
func FindPersonByUserName(userName string) *Person {
	if userName == "" {
		return nil
	}

	result := Person{}

	if err := Db().Where("user_name = ?", userName).First(&result).Error; err == nil {
		return &result
	} else {
		log.Errorf("user: %s", err)
		return nil
	}
}

// FindPersonByUID returns an existing user or nil if not found.
func FindPersonByUID(uid string) *Person {
	if uid == "" {
		return nil
	}

	result := Person{}

	if err := Db().Where("person_uid = ?", uid).First(&result).Error; err == nil {
		return &result
	} else {
		log.Errorf("user: %s", err)
		return nil
	}
}

// String returns an identifier that can be used in logs.
func (m *Person) String() string {
	if m.UserName != "" {
		return m.UserName
	}

	if m.DisplayName != "" {
		return m.DisplayName
	}

	return m.PersonUID
}

// User returns true if the person has a user name.
func (m *Person) Registered() bool {
	return m.UserName != "" && rnd.IsPPID(m.PersonUID, 'u')
}

// Admin returns true if the person is an admin with user name.
func (m *Person) Admin() bool {
	return m.Registered() && m.RoleAdmin
}

// Anonymous returns true if the person is unknown.
func (m *Person) Anonymous() bool {
	return !rnd.IsPPID(m.PersonUID, 'u') || m.ID == UnknownPerson.ID || m.PersonUID == UnknownPerson.PersonUID
}

// Guest returns true if the person is a guest.
func (m *Person) Guest() bool {
	return m.RoleGuest
}

// SetPassword sets a new password stored as hash.
func (m *Person) SetPassword(password string) error {
	if !m.Registered() {
		return fmt.Errorf("auth: only registered users can change their password")
	}

	pw := NewPassword(m.PersonUID, password)

	return pw.Save()
}

// InitPassword sets the initial user password stored as hash.
func (m *Person) InitPassword(password string) {
	if !m.Registered() {
		log.Warn("auth: only registered users can change their password")
		return
	}

	existing := FindPassword(m.PersonUID)

	if existing != nil {
		return
	}

	pw := NewPassword(m.PersonUID, password)

	if err := pw.Save(); err != nil {
		log.Error(err)
	}
}

// InvalidPassword returns true if the given password does not match the hash.
func (m *Person) InvalidPassword(password string) bool {
	if !m.Registered() {
		log.Warn("auth: only registered users can change their password")
		return true
	}

	pw := FindPassword(m.PersonUID)

	if pw == nil {
		return true
	}

	return pw.InvalidPassword(password)
}

// Role returns the user role for ACL permission checks.
func (m *Person) Role() acl.Role {
	if m.RoleAdmin {
		return acl.RoleAdmin
	}

	if m.RoleChild {
		return acl.RoleChild
	}

	if m.RoleFamily {
		return acl.RoleFamily
	}

	if m.RoleFriend {
		return acl.RoleFriend
	}

	if m.RoleGuest {
		return acl.RoleGuest
	}

	return acl.RoleDefault
}