<?php
/**
 * AKSRT OAuth Third-party Login (v5 - 基于 yurunsoft/yurun-oauth-login)
 *
 * 使用 yurunsoft/yurun-oauth-login 统一处理各平台的授权流程：
 * - GitHub:  Yurun\OAuthLogin\Github\OAuth2
 * - Gitee:   Yurun\OAuthLogin\Gitee\OAuth2
 * - QQ:      Yurun\OAuthLogin\QQ\OAuth2
 * - Google:  手动实现标准 OAuth2 流程
 *
 * 支持平台：GitHub、Gitee、QQ、Google
 *
 * @package AKSRT
 */

defined('ABSPATH') || exit;

class AKSRT_OAuth {
    use AKSRT_OAuth_Part_1;
    use AKSRT_OAuth_Part_2;


    private static $instance = null;

    private function __construct() {}

    public static function get_instance(): self {
        if (null === self::$instance) self::$instance = new self();
        return self::$instance;
    }

    public function init(): void {
        add_action('init', [$this, 'add_rewrite_rules']);
        add_action('template_redirect', [$this, 'handle_callback']);
        add_action('show_user_profile', [$this, 'profile_bindings'], 10, 1);
        add_action('wp_ajax_aksrt_oauth_unbind', [$this, 'ajax_unbind']);
    }

    public function add_rewrite_rules(): void {
        add_rewrite_rule('^oauth/callback/?$', 'index.php?aksrt_oauth=callback', 'top');
        add_filter('query_vars', function($vars) {
            $vars[] = 'aksrt_oauth';
            return $vars;
        });
    }

    /**
     * 生成OAuth授权URL
     */
    public function get_auth_url(string $provider, string $action = 'login'): string {
        if (class_exists('AKSRT_Settings') && AKSRT_Settings::oauth_proxy_mode() === 'client') {
            if (class_exists('AKSRT_OAuth_Proxy_Client')) {
                return AKSRT_OAuth_Proxy_Client::get_instance()->get_proxy_auth_url($provider, $action);
            }
            return '';
        }

        $config = $this->get_provider_config($provider);
        if (!$config) return '';

        $uid = get_current_user_id();
        $nonce = wp_create_nonce('aksrt_oauth_' . $provider . '_' . $uid);
        $state = ($action === 'bind' && $uid)
            ? 'bind_' . $provider . '_' . $nonce
            : $provider . '_' . $nonce;

        $redirect_uri = !empty($config['redirect_uri']) ? $config['redirect_uri'] : home_url('/oauth/callback/');

        try {
            switch ($provider) {
                case 'github':
                    $oauth = new \Yurun\OAuthLogin\Github\OAuth2(
                        $config['client_id'],
                        $config['client_secret'],
                        $redirect_uri
                    );
                    return $oauth->getAuthUrl($redirect_uri, $state);

                case 'gitee':
                    $oauth = new \Yurun\OAuthLogin\Gitee\OAuth2(
                        $config['client_id'],
                        $config['client_secret'],
                        $redirect_uri
                    );
                    return $oauth->getAuthUrl($redirect_uri, $state);

                case 'qq':
                    $oauth = new \Yurun\OAuthLogin\QQ\OAuth2(
                        $config['client_id'],
                        $config['client_secret'],
                        $redirect_uri
                    );
                    return $oauth->getAuthUrl($redirect_uri, $state);

                case 'weibo':
                    $oauth = new \Yurun\OAuthLogin\Weibo\OAuth2(
                        $config['client_id'],
                        $config['client_secret'],
                        $redirect_uri
                    );
                    return $oauth->getAuthUrl($redirect_uri, $state);

                case 'weixin':
                    $oauth = new \Yurun\OAuthLogin\Weixin\OAuth2(
                        $config['client_id'],
                        $config['client_secret'],
                        $redirect_uri
                    );
                    return $oauth->getAuthUrl($redirect_uri, $state);

                case 'baidu':
                    $oauth = new \Yurun\OAuthLogin\Baidu\OAuth2(
                        $config['client_id'],
                        $config['client_secret'],
                        $redirect_uri
                    );
                    return $oauth->getAuthUrl($redirect_uri, $state);

                case 'alipay':
                    $oauth = new \Yurun\OAuthLogin\Alipay\OAuth2(
                        $config['client_id'],
                        $config['client_secret'],
                        $redirect_uri
                    );
                    return $oauth->getAuthUrl($redirect_uri, $state);

                case 'google':
                    return $this->get_google_auth_url($config, $redirect_uri, $state);

                case 'weixingzh':
                    return $this->get_weixingzh_auth_url($config, $redirect_uri, $state);

                default:
                    return '';
            }
        } catch (\Exception $e) {
            return '';
        }
    }

    /**
     * 处理OAuth回调 — 路由分发
     */
    public function handle_callback(): void {
        $provider = $this->resolve_callback_provider();
        if ($provider === '' || !in_array($provider, $this->get_enabled_providers())) return;

        $error = $_GET['error'] ?? '';
        if ($error) {
            wp_die(__('登录失败：', 'aksrt') . esc_html($error));
        }

        $code  = $_GET['code'] ?? '';
        $state = $_GET['state'] ?? '';
        if (empty($code)) {
            wp_die(__('OAuth回调缺少授权码', 'aksrt'));
        }

        $is_bind = strpos($state, 'bind_') === 0;
        $rest    = $is_bind ? substr($state, 5) : $state;
        $sep     = strpos($rest, '_');

        if ($sep === false || $sep >= strlen($rest) - 1) {
            wp_die(__('无效的OAuth状态参数', 'aksrt'));
        }

        $parsed_provider = sanitize_key(substr($rest, 0, $sep));
        if (!in_array($parsed_provider, $this->get_enabled_providers())) {
            wp_die(__('未知的OAuth提供商', 'aksrt'));
        }

        $nonce_state = substr($rest, $sep + 1);

        if ($is_bind) {
            $this->handle_bind_callback($parsed_provider, $code, $nonce_state);
        } else {
            $this->handle_login_callback($parsed_provider, $code, $nonce_state);
        }
    }

    private function handle_login_callback(string $provider, string $code, string $nonce): void {
        try {
            if (!wp_verify_nonce($nonce, "aksrt_oauth_{$provider}_0")) {
                throw new \Exception(__('安全验证失败，请重试', 'aksrt'));
            }

            $user_data = $this->get_user_data($provider, $code);

            if (!$user_data || empty($user_data['provider_id'])) {
                throw new \Exception(__('无法获取用户信息', 'aksrt'));
            }

            $user = $this->find_or_create_user($provider, $user_data);

            if (is_wp_error($user) && $user->get_error_code() === 'oauth_no_match') {
                $error_data = $user->get_error_data();
                $obk = 'aksrt_ob_' . wp_generate_password(24, false);
                set_transient($obk, [
                    'provider'    => $error_data['provider'],
                    'provider_id' => $error_data['user_data']['provider_id'] ?? '',
                    'user_data'   => $error_data['user_data'],
                ], 15 * MINUTE_IN_SECONDS);

                $bind_url = aksrt_get_bind_url();
                wp_safe_redirect(add_query_arg('obk', $obk, $bind_url));
                exit;
            }

            if (is_wp_error($user)) {
                throw new \Exception($user->get_error_message());
            }

            wp_set_auth_cookie($user->ID, true);
            $redirect_url = home_url('/');
            if (function_exists('aksrt_get_user_center_url')) {
                $redirect_url = aksrt_get_user_center_url();
            }
            wp_safe_redirect(add_query_arg(['oauth_action' => 'login', 'oauth_bound' => $provider], $redirect_url));
            exit;

        } catch (\Exception $e) {
            wp_die(__('登录失败：', 'aksrt') . '<br>' . esc_html($e->getMessage()));
        }
    }

    private function handle_bind_callback(string $provider, string $code, string $nonce): void {
        $current_uid = get_current_user_id();
        if (!$current_uid) {
            wp_safe_redirect(aksrt_get_login_url());
            exit;
        }

        try {
            $expected = wp_create_nonce("aksrt_oauth_{$provider}_{$current_uid}");
            if (!hash_equals($expected, $nonce)) {
                throw new \Exception(__('安全验证失败，请重试', 'aksrt'));
            }

            $existing_binding = get_user_meta($current_uid, "aksrt_{$provider}_id", true);
            if (!empty($existing_binding)) {
                wp_safe_redirect(add_query_arg(['tab' => 'settings', 'oauth_action' => 'bind', 'oauth_bound' => $provider], $this->get_profile_url()));
                exit;
            }

            $user_data = $this->get_user_data($provider, $code);

            if (!$user_data || empty($user_data['provider_id'])) {
                throw new \Exception(__('无法获取用户信息', 'aksrt'));
            }

            $existing = $this->find_user_by_provider($provider, $user_data['provider_id'] ?? '');
            if ($existing && $existing->ID !== $current_uid) {
                throw new \Exception(__('该第三方账号已被其他用户绑定', 'aksrt'));
            }

            $this->bind_provider_to_user($current_uid, $provider, $user_data);

            wp_safe_redirect(add_query_arg(['tab' => 'settings', 'oauth_action' => 'bind', 'oauth_bound' => $provider], $this->get_profile_url()));
            exit;

        } catch (\Exception $e) {
            wp_die(__('绑定失败：', 'aksrt') . '<br>' . esc_html($e->getMessage()));
        }
    }

    /**
     * 通过授权码获取用户数据（统一输出格式）
     */
    private function get_user_data(string $provider, string $code): array {
        $config = $this->get_provider_config($provider);
        $redirect_uri = !empty($config['redirect_uri']) ? $config['redirect_uri'] : home_url('/oauth/callback/');

        switch ($provider) {
            case 'github':
                return $this->get_github_user_data($config, $code, $redirect_uri);
            case 'gitee':
                return $this->get_gitee_user_data($config, $code, $redirect_uri);
            case 'qq':
                return $this->get_qq_user_data($config, $code, $redirect_uri);
            case 'weibo':
                return $this->get_weibo_user_data($config, $code, $redirect_uri);
            case 'weixin':
                return $this->get_weixin_user_data($config, $code, $redirect_uri);
            case 'baidu':
                return $this->get_baidu_user_data($config, $code, $redirect_uri);
            case 'alipay':
                return $this->get_alipay_user_data($config, $code, $redirect_uri);
            case 'google':
                return $this->get_google_user_data($config, $code, $redirect_uri);
            case 'weixingzh':
                return $this->get_weixingzh_user_data($config, $code, $redirect_uri);
            default:
                throw new \Exception(__('不支持的OAuth平台：', 'aksrt') . $provider);
        }
    }

    private function get_github_user_data(array $config, string $code, string $redirect_uri): array {
        $oauth = new \Yurun\OAuthLogin\Github\OAuth2(
            $config['client_id'],
            $config['client_secret'],
            $redirect_uri
        );

        $oauth->getAccessToken($_GET['state'] ?? '', $code, $_GET['state'] ?? null);
        $userInfo = $oauth->getUserInfo();

        // 获取邮箱
        $email = $userInfo['email'] ?? '';
        if (empty($email)) {
            $emails_json = $oauth->http->header('Authorization', ' token ' . $oauth->accessToken)
                ->get('https://api.github.com/user/emails')
                ->body();
            $emails = json_decode($emails_json, true) ?: [];
            foreach ($emails as $em) {
                if (!empty($em['primary']) && !empty($em['email'])) {
                    $email = $em['email'];
                    break;
                }
            }
        }

        return [
            'provider'    => 'github',
            'provider_id' => (string) ($userInfo['id'] ?? ''),
            'username'    => $userInfo['login'] ?? '',
            'name'        => $userInfo['name'] ?? '',
            'email'       => $email,
            'avatar_url'  => $userInfo['avatar_url'] ?? '',
            'url'         => $userInfo['html_url'] ?? '',
            'bio'         => $userInfo['bio'] ?? '',
        ];
    }

    private function get_gitee_user_data(array $config, string $code, string $redirect_uri): array {
        $oauth = new \Yurun\OAuthLogin\Gitee\OAuth2(
            $config['client_id'],
            $config['client_secret'],
            $redirect_uri
        );

        $oauth->getAccessToken($_GET['state'] ?? '', $code, $_GET['state'] ?? null);
        $userInfo = $oauth->getUserInfo();

        return [
            'provider'    => 'gitee',
            'provider_id' => (string) ($userInfo['id'] ?? ''),
            'username'    => $userInfo['login'] ?? '',
            'name'        => $userInfo['name'] ?? '',
            'email'       => $userInfo['email'] ?? '',
            'avatar_url'  => $userInfo['avatar_url'] ?? '',
            'url'         => $userInfo['html_url'] ?? '',
            'bio'         => $userInfo['bio'] ?? '',
        ];
    }

    private function get_qq_user_data(array $config, string $code, string $redirect_uri): array {
        $oauth = new \Yurun\OAuthLogin\QQ\OAuth2(
            $config['client_id'],
            $config['client_secret'],
            $redirect_uri
        );

        $oauth->getAccessToken($_GET['state'] ?? '', $code, $_GET['state'] ?? null);
        $openid = $oauth->getOpenID();
        $userInfo = $oauth->getUserInfo();

        return [
            'provider'    => 'qq',
            'provider_id' => $openid,
            'username'    => $userInfo['nickname'] ?? '',
            'name'        => $userInfo['nickname'] ?? '',
            'email'       => '',
            'avatar_url'  => $userInfo['figureurl_qq_2'] ?? $userInfo['figureurl_2'] ?? $userInfo['figureurl'] ?? '',
            'gender'      => $userInfo['gender'] ?? '',
        ];
    }

    private function get_weibo_user_data(array $config, string $code, string $redirect_uri): array {
        $oauth = new \Yurun\OAuthLogin\Weibo\OAuth2(
            $config['client_id'],
            $config['client_secret'],
            $redirect_uri
        );

        $oauth->getAccessToken($_GET['state'] ?? '', $code, $_GET['state'] ?? null);
        $userInfo = $oauth->getUserInfo();

        return [
            'provider'    => 'weibo',
            'provider_id' => (string) ($userInfo['id'] ?? ''),
            'username'    => $userInfo['screen_name'] ?? '',
            'name'        => $userInfo['name'] ?? '',
            'email'       => '',
            'avatar_url'  => $userInfo['avatar_large'] ?? $userInfo['profile_image_url'] ?? '',
            'gender'      => ($userInfo['gender'] ?? '') === 'm' ? 'male' : (($userInfo['gender'] ?? '') === 'f' ? 'female' : ''),
        ];
    }

    private function get_weixin_user_data(array $config, string $code, string $redirect_uri): array {
        $oauth = new \Yurun\OAuthLogin\Weixin\OAuth2(
            $config['client_id'],
            $config['client_secret'],
            $redirect_uri
        );

        $oauth->getAccessToken($_GET['state'] ?? '', $code, $_GET['state'] ?? null);
        $userInfo = $oauth->getUserInfo();

        return [
            'provider'    => 'weixin',
            'provider_id' => (string) ($userInfo['openid'] ?? ''),
            'username'    => $userInfo['nickname'] ?? '',
            'name'        => $userInfo['nickname'] ?? '',
            'email'       => '',
            'avatar_url'  => $userInfo['headimgurl'] ?? '',
            'gender'      => ($userInfo['sex'] ?? 0) == 1 ? 'male' : (($userInfo['sex'] ?? 0) == 2 ? 'female' : ''),
        ];
    }

}

return AKSRT_OAuth::get_instance();