<?php
defined('ABSPATH') || exit;

trait AKSRT_OAuth_Part_1 {

    private function get_baidu_user_data(array $config, string $code, string $redirect_uri): array {
        $oauth = new \Yurun\OAuthLogin\Baidu\OAuth2(
            $config['client_id'],
            $config['client_secret'],
            $redirect_uri
        );

        $oauth->getAccessToken($_GET['state'] ?? '', $code, $_GET['state'] ?? null);
        $userInfo = $oauth->getUserInfo();

        return [
            'provider'    => 'baidu',
            'provider_id' => (string) ($userInfo['userid'] ?? ''),
            'username'    => $userInfo['username'] ?? '',
            'name'        => $userInfo['realname'] ?? $userInfo['username'] ?? '',
            'email'       => $userInfo['email'] ?? '',
            'avatar_url'  => $userInfo['portrait'] ? ('https://himg.bdimg.com/sys/portrait/item/' . $userInfo['portrait'] . '.jpg') : '',
        ];
    }

    private function get_alipay_user_data(array $config, string $code, string $redirect_uri): array {
        $oauth = new \Yurun\OAuthLogin\Alipay\OAuth2(
            $config['client_id'],
            $config['client_secret'],
            $redirect_uri
        );

        $oauth->getAccessToken($_GET['state'] ?? '', $code, $_GET['state'] ?? null);
        $userInfo = $oauth->getUserInfo();

        return [
            'provider'    => 'alipay',
            'provider_id' => (string) ($userInfo['user_id'] ?? ''),
            'username'    => $userInfo['user_name'] ?? '',
            'name'        => $userInfo['user_name'] ?? '',
            'email'       => $userInfo['email'] ?? '',
            'avatar_url'  => $userInfo['avatar'] ?? '',
            'gender'      => ($userInfo['gender'] ?? '') === 'm' ? 'male' : (($userInfo['gender'] ?? '') === 'f' ? 'female' : ''),
        ];
    }

    private function get_google_auth_url(array $config, string $redirect_uri, string $state): string {
        $params = http_build_query([
            'client_id'     => $config['client_id'],
            'redirect_uri'  => $redirect_uri,
            'response_type' => 'code',
            'scope'         => 'openid email profile',
            'state'         => $state,
            'access_type'   => 'offline',
        ]);
        return 'https://accounts.google.com/o/oauth2/v2/auth?' . $params;
    }

    private function get_google_user_data(array $config, string $code, string $redirect_uri): array {
        // 换取 token
        $response = wp_remote_post('https://oauth2.googleapis.com/token', [
            'body' => [
                'code'          => $code,
                'client_id'     => $config['client_id'],
                'client_secret' => $config['client_secret'],
                'redirect_uri'  => $redirect_uri,
                'grant_type'    => 'authorization_code',
            ],
        ]);

        if (is_wp_error($response)) {
            throw new \Exception($response->get_error_message());
        }

        $token_data = json_decode(wp_remote_retrieve_body($response), true);
        if (empty($token_data['access_token'])) {
            throw new \Exception(__('Google token 获取失败', 'aksrt'));
        }

        // 获取用户信息
        $user_response = wp_remote_get('https://www.googleapis.com/oauth2/v2/userinfo', [
            'headers' => ['Authorization' => 'Bearer ' . $token_data['access_token']],
        ]);

        if (is_wp_error($user_response)) {
            throw new \Exception($user_response->get_error_message());
        }

        $user_info = json_decode(wp_remote_retrieve_body($user_response), true);

        return [
            'provider'       => 'google',
            'provider_id'    => (string) ($user_info['id'] ?? ''),
            'username'       => $user_info['email'] ?? '',
            'name'           => $user_info['name'] ?? '',
            'email'          => $user_info['email'] ?? '',
            'email_verified' => !empty($user_info['verified_email']),
            'avatar_url'     => $user_info['picture'] ?? '',
            'locale'         => $user_info['locale'] ?? '',
        ];
    }

    /**
     * 微信公众号 OAuth2 授权 URL
     *
     * 使用 snsapi_userinfo scope 获取用户信息（需已认证服务号或订阅号+验证）。
     */
    private function get_weixingzh_auth_url(array $config, string $redirect_uri, string $state): string {
        $params = http_build_query([
            'appid'         => $config['client_id'],
            'redirect_uri'  => $redirect_uri,
            'response_type' => 'code',
            'scope'         => 'snsapi_userinfo',
            'state'         => $state,
        ]);
        return 'https://open.weixin.qq.com/connect/oauth2/authorize?' . $params . '#wechat_redirect';
    }

    /**
     * 微信公众号 OAuth2 获取用户信息
     *
     * 1. code → access_token + openid
     * 2. access_token + openid → userinfo
     */
    private function get_weixingzh_user_data(array $config, string $code, string $redirect_uri): array {
        // 1. 换取 access_token
        $token_url = add_query_arg([
            'appid'      => $config['client_id'],
            'secret'     => $config['client_secret'],
            'code'       => $code,
            'grant_type' => 'authorization_code',
        ], 'https://api.weixin.qq.com/sns/oauth2/access_token');

        $response = wp_remote_get($token_url);
        if (is_wp_error($response)) {
            throw new \Exception($response->get_error_message());
        }

        $token_data = json_decode(wp_remote_retrieve_body($response), true);
        if (empty($token_data['access_token']) || empty($token_data['openid'])) {
            $errmsg = $token_data['errmsg'] ?? __('微信公众号 token 获取失败', 'aksrt');
            throw new \Exception($errmsg);
        }

        // 2. 获取用户信息
        $user_url = add_query_arg([
            'access_token' => $token_data['access_token'],
            'openid'       => $token_data['openid'],
            'lang'         => 'zh_CN',
        ], 'https://api.weixin.qq.com/sns/userinfo');

        $user_response = wp_remote_get($user_url);
        if (is_wp_error($user_response)) {
            throw new \Exception($user_response->get_error_message());
        }

        $user_info = json_decode(wp_remote_retrieve_body($user_response), true);

        return [
            'provider'       => 'weixingzh',
            'provider_id'    => (string) ($user_info['openid'] ?? $token_data['openid']),
            'username'       => $user_info['nickname'] ?? '',
            'name'           => $user_info['nickname'] ?? '',
            'email'          => '',
            'email_verified' => false,
            'avatar_url'     => $user_info['headimgurl'] ?? '',
            'locale'         => 'zh_CN',
            'unionid'        => $user_info['unionid'] ?? '',
        ];
    }

    private function resolve_callback_provider(): string {
        $state = $_GET['state'] ?? '';
        if ($state === '') return '';

        $rest = (strpos($state, 'bind_') === 0) ? substr($state, 5) : $state;
        $sep  = strpos($rest, '_');
        if ($sep !== false && $sep < strlen($rest) - 1) {
            return sanitize_key(substr($rest, 0, $sep));
        }
        return '';
    }

    private function get_enabled_providers(): array {
        if (class_exists('AKSRT_Settings') && AKSRT_Settings::oauth_proxy_mode() === 'client') {
            return AKSRT_Settings::oauth_proxy_client_providers();
        }

        $providers = get_option('aksrt_oauth', []);
        $enabled   = [];
        foreach (['github', 'gitee', 'qq', 'google', 'weibo', 'weixin', 'baidu', 'alipay', 'weixingzh'] as $key) {
            if (!empty($providers[$key]['enabled']) && !empty($providers[$key]['client_id'])) {
                $enabled[] = $key;
                continue;
            }
            // BC: also check aksrt_settings flat keys
            if (class_exists('AKSRT_Settings')) {
                $s = AKSRT_Settings::get_all();
                $switch_key = 'oauth_' . $key . '_s';
                if (!empty($s[$switch_key])) {
                    $id_key  = $key . '_appid';
                    $sec_key = $key . '_appsecret';
                    if ($key === 'weixingzh') {
                        $sec_key = 'weixingzh_appsecret';
                    } elseif ($key === 'github' || $key === 'gitee' || $key === 'qq') {
                        $sec_key = $key . '_appkey';
                    }
                    if (!empty($s[$id_key]) && !empty($s[$sec_key])) {
                        $enabled[] = $key;
                    }
                }
            }
        }
        return array_unique($enabled);
    }

    /**
     * 获取 OAuth 提供商数据（供模板使用）
     * 返回 [{name, label, icon, url}, ...]
     */
    public function get_auth_providers_data(): array {
        $platform_names = [
            'github'    => 'GitHub',
            'gitee'     => 'Gitee',
            'qq'        => 'QQ',
            'google'    => 'Google',
            'weibo'     => 'Weibo',
            'weixin'    => 'WeChat',
            'baidu'     => 'Baidu',
            'alipay'    => 'Alipay',
            'weixingzh' => '微信公众号',
        ];

        $result = [];
        foreach ($this->get_enabled_providers() as $key) {
            $url = $this->get_auth_url($key);
            if (empty($url)) continue;

            $result[] = [
                'name'  => $key,
                'label' => $platform_names[$key] ?? ucfirst($key),
                'icon'  => aksrt_inline_svg($key),
                'url'   => esc_url($url),
            ];
        }
        return $result;
    }

    private function get_provider_config(string $provider): ?array {
        $providers = get_option('aksrt_oauth', []);
        $config = $providers[$provider] ?? null;
        if (!empty($config['client_id']) && !empty($config['client_secret'])) {
            return $config;
        }

        // BC: fallback to aksrt_settings flat keys
        if (class_exists('AKSRT_Settings')) {
            $s = AKSRT_Settings::get_all();
            $id_key  = $provider . '_appid';
            $sec_key = $provider . '_appsecret';
            if ($provider === 'github' || $provider === 'gitee' || $provider === 'qq') {
                $sec_key = $provider . '_appkey';
            } elseif ($provider === 'google') {
                $id_key  = 'google_client_id';
                $sec_key = 'google_client_secret';
            }
            $client_id     = (string) ($s[$id_key] ?? '');
            $client_secret = (string) ($s[$sec_key] ?? '');
            if ($client_id !== '' && $client_secret !== '') {
                return [
                    'client_id'     => $client_id,
                    'client_secret' => $client_secret,
                    'redirect_uri'  => home_url('/oauth/callback/'),
                ];
            }
        }

        return null;
    }

    private function find_or_create_user($provider, $user_data) {
        $email = $user_data['email'] ?? '';

        if (!empty($user_data['provider_id'])) {
            $by_provider = $this->find_user_by_provider($provider, (string) $user_data['provider_id']);
            if ($by_provider instanceof WP_User) {
                $bindings = get_user_meta($by_provider->ID, 'aksrt_oauth_bindings', true) ?: [];
                if (!is_array($bindings)) $bindings = [];
                if (!in_array($provider, $bindings, true)) {
                    $bindings[] = $provider;
                    update_user_meta($by_provider->ID, 'aksrt_oauth_bindings', $bindings);
                }
                if (!empty($user_data['avatar_url'])) {
                    update_user_meta($by_provider->ID, 'aksrt_oauth_avatar', esc_url_raw($user_data['avatar_url']));
                }
                return $by_provider;
            }
        }

        if (!empty($email)) {
            $existing = get_user_by('email', $email);
            if ($existing && !$existing instanceof WP_Error) {
                $bindings = get_user_meta($existing->ID, 'aksrt_oauth_bindings', true) ?: [];
                if (!is_array($bindings)) $bindings = [];
                if (!in_array($provider, $bindings, true)) {
                    $bindings[] = $provider;
                    update_user_meta($existing->ID, 'aksrt_oauth_bindings', $bindings);
                }
                if (!empty($user_data['provider_id'])) {
                    update_user_meta($existing->ID, "aksrt_{$provider}_id", (string) $user_data['provider_id']);
                }
                if (!empty($user_data['avatar_url'])) {
                    update_user_meta($existing->ID, 'aksrt_oauth_avatar', esc_url_raw($user_data['avatar_url']));
                }
                return $existing;
            }
        }

        return new WP_Error(
            'oauth_no_match',
            __('需要绑定已有账号', 'aksrt'),
            [
                'provider'   => $provider,
                'user_data'  => $user_data,
            ]
        );
    }

    // ============================================
    // 前端UI方法
    // ============================================

    public function login_button(): void {
        echo $this->render_social_buttons(__('使用以下方式快速登录', 'aksrt'));
    }

    public function register_button(): void {
        echo $this->render_social_buttons(__('使用以下方式快速注册', 'aksrt'));
    }

    public function render_social_buttons(string $title = ''): string {
        $providers = get_option('aksrt_oauth', []);
        $enabled_providers = [];
        foreach ($providers as $key => $cfg) {
            if (!empty($cfg['enabled']) && !empty($cfg['client_id']) && in_array($key, ['github', 'gitee', 'qq', 'google', 'weibo', 'weixin', 'baidu', 'alipay'], true)) {
                $enabled_providers[$key] = $cfg;
            }
        }

        if (empty($enabled_providers)) return '';

        $icons = [
            'github' => aksrt_inline_svg('github'),
            'gitee'  => aksrt_inline_svg('gitee'),
            'qq'     => aksrt_inline_svg('qq'),
            'google' => aksrt_inline_svg('google'),
            'weibo'  => aksrt_inline_svg('weibo'),
            'weixin' => aksrt_inline_svg('wechat'),
            'baidu'  => '<span class="oauth-btn__fallback">B</span>',
            'alipay' => '<span class="oauth-btn__fallback">A</span>',
        ];

        ob_start();
        ?>
<div class="social-login-divider">
	<span><?php echo esc_html($title) ?: esc_html__('or', 'aksrt'); ?></span>
</div>
<div class="oauth-row">
	<?php foreach ($enabled_providers as $key => $cfg):
	    $url = $this->get_auth_url($key);
	    if (empty($url)) continue;
	?>
	<a href="<?php echo esc_url($url); ?>"
	   class="oauth-btn"
	   aria-label="<?php echo esc_attr(ucfirst($key)); ?>"
	   title="<?php echo esc_attr(ucfirst($key)); ?>">
		<?php echo $icons[$key] ?? ''; ?>
	</a>
	<?php endforeach; ?>
</div>
        <?php
        return ob_get_clean();
    }

    public function get_login_buttons(): string {
        return $this->render_social_buttons();
    }

    public function login_message(string $message): string {
        return $message . self::get_instance()->render_social_buttons();
    }

    public function register_message(string $message): string {
        return $message . self::get_instance()->render_social_buttons(__('或使用社交账号快速注册', 'aksrt'));
    }
}