using System.Security.Cryptography;
using System.Text;
using HoneyBox.Core.Interfaces;
using HoneyBox.Model.Data;
using HoneyBox.Model.Entities;
using HoneyBox.Model.Models.Auth;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Logging;

namespace HoneyBox.Core.Services;

/// <summary>
/// 认证服务实现
/// </summary>
public class AuthService : IAuthService
{
    private readonly HoneyBoxDbContext _dbContext;
    private readonly IUserService _userService;
    private readonly IJwtService _jwtService;
    private readonly IWechatService _wechatService;
    private readonly IIpLocationService _ipLocationService;
    private readonly IRedisService _redisService;
    private readonly JwtSettings _jwtSettings;
    private readonly ILogger<AuthService> _logger;

    // Redis key prefixes
    private const string LoginDebounceKeyPrefix = "login:debounce:";
    private const string SmsCodeKeyPrefix = "sms:code:";
    private const int DebounceSeconds = 3;

    // Refresh Token 配置
    private const int RefreshTokenLength = 64;

    public AuthService(
        HoneyBoxDbContext dbContext,
        IUserService userService,
        IJwtService jwtService,
        IWechatService wechatService,
        IIpLocationService ipLocationService,
        IRedisService redisService,
        JwtSettings jwtSettings,
        ILogger<AuthService> logger)
    {
        _dbContext = dbContext ?? throw new ArgumentNullException(nameof(dbContext));
        _userService = userService ?? throw new ArgumentNullException(nameof(userService));
        _jwtService = jwtService ?? throw new ArgumentNullException(nameof(jwtService));
        _wechatService = wechatService ?? throw new ArgumentNullException(nameof(wechatService));
        _ipLocationService = ipLocationService ?? throw new ArgumentNullException(nameof(ipLocationService));
        _redisService = redisService ?? throw new ArgumentNullException(nameof(redisService));
        _jwtSettings = jwtSettings ?? throw new ArgumentNullException(nameof(jwtSettings));
        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
    }


    /// <summary>
    /// 微信小程序登录
    /// Requirements: 1.1-1.8
    /// </summary>
    public async Task<LoginResult> WechatMiniProgramLoginAsync(string code, int? pid, string? clickId)
    {
        _logger.LogInformation("[AuthService] 微信登录开始，code={Code}, pid={Pid}, clickId={ClickId}", code, pid, clickId);
        
        if (string.IsNullOrWhiteSpace(code))
        {
            _logger.LogWarning("[AuthService] 微信登录失败：code为空");
            return new LoginResult
            {
                Success = false,
                ErrorMessage = "授权code不能为空"
            };
        }

        try
        {
            // 1.6 防抖机制 - 3秒内不允许重复登录
            var debounceKey = $"{LoginDebounceKeyPrefix}wechat:{code}";
            _logger.LogInformation("[AuthService] 检查防抖锁: {Key}", debounceKey);
            var lockAcquired = await _redisService.TryAcquireLockAsync(debounceKey, "1", TimeSpan.FromSeconds(DebounceSeconds));
            if (!lockAcquired)
            {
                _logger.LogWarning("[AuthService] 防抖触发，拒绝重复登录请求: {Code}", code);
                return new LoginResult
                {
                    Success = false,
                    ErrorMessage = "请勿频繁登录"
                };
            }
            _logger.LogInformation("[AuthService] 防抖锁获取成功");

            // 1.1 调用微信API获取openid和unionid
            _logger.LogInformation("[AuthService] 开始调用微信API获取openid...");
            var wechatResult = await _wechatService.GetOpenIdAsync(code);
            _logger.LogInformation("[AuthService] 微信API调用完成，Success={Success}, OpenId={OpenId}, UnionId={UnionId}, Error={Error}", 
                wechatResult.Success, 
                wechatResult.OpenId ?? "null", 
                wechatResult.UnionId ?? "null",
                wechatResult.ErrorMessage ?? "null");
            
            if (!wechatResult.Success)
            {
                _logger.LogWarning("[AuthService] 微信API调用失败: {Error}", wechatResult.ErrorMessage);
                return new LoginResult
                {
                    Success = false,
                    ErrorMessage = wechatResult.ErrorMessage ?? "登录失败，请稍后重试"
                };
            }

            var openId = wechatResult.OpenId!;
            var unionId = wechatResult.UnionId;

            // 1.2 查找用户 - 优先通过unionid查找，其次通过openid查找
            User? user = null;
            if (!string.IsNullOrWhiteSpace(unionId))
            {
                _logger.LogInformation("[AuthService] 尝试通过unionid查找用户: {UnionId}", unionId);
                user = await _userService.GetUserByUnionIdAsync(unionId);
                _logger.LogInformation("[AuthService] unionid查找结果: {Found}", user != null ? $"找到用户ID={user.Id}" : "未找到");
            }
            if (user == null)
            {
                _logger.LogInformation("[AuthService] 尝试通过openid查找用户: {OpenId}", openId);
                user = await _userService.GetUserByOpenIdAsync(openId);
                _logger.LogInformation("[AuthService] openid查找结果: {Found}", user != null ? $"找到用户ID={user.Id}" : "未找到");
            }

            if (user == null)
            {
                // 1.3 用户不存在，创建新用户
                _logger.LogInformation("[AuthService] 用户不存在，开始创建新用户...");
                var createDto = new CreateUserDto
                {
                    OpenId = openId,
                    UnionId = unionId,
                    Nickname = $"用户{Random.Shared.Next(100000, 999999)}",
                    Headimg = GenerateDefaultAvatar(openId),
                    Pid = pid ?? 0,
                    ClickId = ParseClickId(clickId)
                };

                user = await _userService.CreateUserAsync(createDto);
                _logger.LogInformation("[AuthService] 新用户创建成功: UserId={UserId}, OpenId={OpenId}", user.Id, openId);
            }
            else
            {
                // 1.4 用户存在，更新unionid（如果之前为空）
                if (string.IsNullOrWhiteSpace(user.UnionId) && !string.IsNullOrWhiteSpace(unionId))
                {
                    _logger.LogInformation("[AuthService] 更新用户unionid: UserId={UserId}", user.Id);
                    await _userService.UpdateUserAsync(user.Id, new UpdateUserDto { UnionId = unionId });
                    _logger.LogInformation("[AuthService] unionid更新成功");
                }
            }

            // 1.5 生成双 Token（Access Token + Refresh Token）
            _logger.LogInformation("[AuthService] 开始生成双 Token: UserId={UserId}", user.Id);
            var loginResponse = await GenerateLoginResponseAsync(user, null);
            _logger.LogInformation("[AuthService] 双 Token 生成成功，AccessToken长度={Length}", loginResponse.AccessToken?.Length ?? 0);

            // 3.6 同时在数据库UserAccount表中存储account_token用于兼容旧系统
            _logger.LogInformation("[AuthService] 更新UserAccount表...");
            await CreateOrUpdateAccountTokenAsync(user.Id, loginResponse.AccessToken);
            _logger.LogInformation("[AuthService] UserAccount更新成功");

            _logger.LogInformation("[AuthService] 微信登录成功: UserId={UserId}", user.Id);

            return new LoginResult
            {
                Success = true,
                Token = loginResponse.AccessToken, // 兼容旧版
                UserId = user.Id,
                LoginResponse = loginResponse
            };
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "[AuthService] 微信登录异常: code={Code}, Message={Message}, StackTrace={StackTrace}", 
                code, ex.Message, ex.StackTrace);
            return new LoginResult
            {
                Success = false,
                ErrorMessage = "网络故障，请稍后再试"
            };
        }
    }


    /// <summary>
    /// 手机号验证码登录
    /// Requirements: 2.1-2.7
    /// </summary>
    public async Task<LoginResult> MobileLoginAsync(string mobile, string code, int? pid, string? clickId)
    {
        if (string.IsNullOrWhiteSpace(mobile))
        {
            return new LoginResult
            {
                Success = false,
                ErrorMessage = "手机号不能为空"
            };
        }

        if (string.IsNullOrWhiteSpace(code))
        {
            return new LoginResult
            {
                Success = false,
                ErrorMessage = "验证码不能为空"
            };
        }

        try
        {
            // 2.6 防抖机制 - 3秒内不允许重复登录
            var debounceKey = $"{LoginDebounceKeyPrefix}mobile:{mobile}";
            var lockAcquired = await _redisService.TryAcquireLockAsync(debounceKey, "1", TimeSpan.FromSeconds(DebounceSeconds));
            if (!lockAcquired)
            {
                _logger.LogWarning("Login debounce triggered for mobile: {Mobile}", MaskMobile(mobile));
                return new LoginResult
                {
                    Success = false,
                    ErrorMessage = "请勿频繁登录"
                };
            }

            // 2.1 从Redis获取并验证验证码
            var smsCodeKey = $"{SmsCodeKeyPrefix}{mobile}";
            var storedCode = await _redisService.GetStringAsync(smsCodeKey);

            if (string.IsNullOrWhiteSpace(storedCode) || storedCode != code)
            {
                _logger.LogWarning("SMS code verification failed for mobile: {Mobile}", MaskMobile(mobile));
                return new LoginResult
                {
                    Success = false,
                    ErrorMessage = "验证码错误"
                };
            }

            // 2.2 验证码验证通过后，删除Redis中的验证码
            await _redisService.DeleteAsync(smsCodeKey);

            // 查找用户
            var user = await _userService.GetUserByMobileAsync(mobile);

            if (user == null)
            {
                // 2.3 用户不存在，创建新用户
                var createDto = new CreateUserDto
                {
                    Mobile = mobile,
                    Nickname = $"用户{Random.Shared.Next(100000, 999999)}",
                    Headimg = GenerateDefaultAvatar(mobile),
                    Pid = pid ?? 0,
                    ClickId = ParseClickId(clickId)
                };

                user = await _userService.CreateUserAsync(createDto);
                _logger.LogInformation("New user created via mobile login: UserId={UserId}, Mobile={Mobile}", user.Id, MaskMobile(mobile));
            }

            // 2.4 生成双 Token（Access Token + Refresh Token）
            var loginResponse = await GenerateLoginResponseAsync(user, null);

            // 3.6 同时在数据库UserAccount表中存储account_token用于兼容旧系统
            await CreateOrUpdateAccountTokenAsync(user.Id, loginResponse.AccessToken);

            _logger.LogInformation("Mobile login successful: UserId={UserId}", user.Id);

            return new LoginResult
            {
                Success = true,
                Token = loginResponse.AccessToken, // 兼容旧版
                UserId = user.Id,
                LoginResponse = loginResponse
            };
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Mobile login failed for mobile: {Mobile}", MaskMobile(mobile));
            return new LoginResult
            {
                Success = false,
                ErrorMessage = "网络故障，请稍后再试"
            };
        }
    }


    /// <summary>
    /// 验证码绑定手机号
    /// Requirements: 5.1-5.5
    /// </summary>
    public async Task<BindMobileResponse> BindMobileAsync(int userId, string mobile, string code)
    {
        if (string.IsNullOrWhiteSpace(mobile))
        {
            throw new ArgumentException("手机号不能为空", nameof(mobile));
        }

        if (string.IsNullOrWhiteSpace(code))
        {
            throw new ArgumentException("验证码不能为空", nameof(code));
        }

        // 5.1 验证短信验证码
        var smsCodeKey = $"{SmsCodeKeyPrefix}{mobile}";
        var storedCode = await _redisService.GetStringAsync(smsCodeKey);

        if (string.IsNullOrWhiteSpace(storedCode) || storedCode != code)
        {
            _logger.LogWarning("SMS code verification failed for bind mobile: UserId={UserId}, Mobile={Mobile}", userId, MaskMobile(mobile));
            throw new InvalidOperationException("验证码错误");
        }

        // 验证码验证通过后删除
        await _redisService.DeleteAsync(smsCodeKey);

        // 获取当前用户
        var currentUser = await _userService.GetUserByIdAsync(userId);
        if (currentUser == null)
        {
            throw new InvalidOperationException("用户不存在");
        }

        // 检查手机号是否已被其他用户绑定
        var existingUser = await _userService.GetUserByMobileAsync(mobile);

        if (existingUser != null && existingUser.Id != userId)
        {
            // 5.2 手机号已被其他用户绑定，需要合并账户
            return await MergeAccountsAsync(currentUser, existingUser);
        }

        // 5.4 手机号未被绑定，直接更新当前用户的手机号
        await _userService.UpdateUserAsync(userId, new UpdateUserDto { Mobile = mobile });
        _logger.LogInformation("Mobile bound successfully: UserId={UserId}, Mobile={Mobile}", userId, MaskMobile(mobile));

        return new BindMobileResponse { Token = null };
    }

    /// <summary>
    /// 微信授权绑定手机号
    /// Requirements: 5.1-5.5
    /// </summary>
    public async Task<BindMobileResponse> WechatBindMobileAsync(int userId, string wechatCode)
    {
        if (string.IsNullOrWhiteSpace(wechatCode))
        {
            throw new ArgumentException("微信授权code不能为空", nameof(wechatCode));
        }

        // 调用微信API获取手机号
        var mobileResult = await _wechatService.GetMobileAsync(wechatCode);
        if (!mobileResult.Success || string.IsNullOrWhiteSpace(mobileResult.Mobile))
        {
            _logger.LogWarning("WeChat get mobile failed: UserId={UserId}, Error={Error}", userId, mobileResult.ErrorMessage);
            throw new InvalidOperationException(mobileResult.ErrorMessage ?? "获取手机号失败");
        }

        var mobile = mobileResult.Mobile;

        // 获取当前用户
        var currentUser = await _userService.GetUserByIdAsync(userId);
        if (currentUser == null)
        {
            throw new InvalidOperationException("用户不存在");
        }

        // 检查手机号是否已被其他用户绑定
        var existingUser = await _userService.GetUserByMobileAsync(mobile);

        if (existingUser != null && existingUser.Id != userId)
        {
            // 5.2 手机号已被其他用户绑定，需要合并账户
            return await MergeAccountsAsync(currentUser, existingUser);
        }

        // 5.4 手机号未被绑定，直接更新当前用户的手机号
        await _userService.UpdateUserAsync(userId, new UpdateUserDto { Mobile = mobile });
        _logger.LogInformation("Mobile bound via WeChat successfully: UserId={UserId}, Mobile={Mobile}", userId, MaskMobile(mobile));

        return new BindMobileResponse { Token = null };
    }


    /// <summary>
    /// 记录登录信息
    /// Requirements: 6.1, 6.3, 6.4
    /// </summary>
    public async Task<RecordLoginResponse> RecordLoginAsync(int userId, string? device, string? deviceInfo)
    {
        var user = await _userService.GetUserByIdAsync(userId);
        if (user == null)
        {
            throw new InvalidOperationException("用户不存在");
        }

        try
        {
            // 获取客户端IP（这里使用空字符串作为占位符，实际IP应从Controller传入）
            var clientIp = deviceInfo ?? string.Empty;

            // 6.2 解析IP地址获取地理位置
            IpLocationResult? locationResult = null;
            if (!string.IsNullOrWhiteSpace(clientIp))
            {
                locationResult = await _ipLocationService.GetLocationAsync(clientIp);
            }

            var now = DateTime.UtcNow;
            var today = DateOnly.FromDateTime(now);

            // 6.1 记录登录日志
            var loginLog = new UserLoginLog
            {
                UserId = userId,
                LoginDate = today,
                LoginTime = now,
                LastLoginTime = now,
                Device = device,
                Ip = clientIp,
                Location = locationResult?.Success == true 
                    ? $"{locationResult.Province}{locationResult.City}" 
                    : null,
                Year = now.Year,
                Month = now.Month,
                Week = GetWeekOfYear(now)
            };

            await _dbContext.UserLoginLogs.AddAsync(loginLog);

            // 6.3 更新UserAccount表中的最后登录时间和IP信息
            var userAccount = await _dbContext.UserAccounts.FirstOrDefaultAsync(ua => ua.UserId == userId);
            if (userAccount != null)
            {
                userAccount.LastLoginTime = now;
                userAccount.LastLoginIp = clientIp;
                if (locationResult?.Success == true)
                {
                    userAccount.IpProvince = locationResult.Province;
                    userAccount.IpCity = locationResult.City;
                    userAccount.IpAdcode = locationResult.Adcode;
                }
                _dbContext.UserAccounts.Update(userAccount);
            }

            // 更新用户最后登录时间
            user.LastLoginTime = now;
            _dbContext.Users.Update(user);

            await _dbContext.SaveChangesAsync();

            _logger.LogInformation("Login recorded: UserId={UserId}, Device={Device}, IP={IP}", userId, device, clientIp);

            // 6.4 返回用户的uid、昵称和头像
            return new RecordLoginResponse
            {
                Uid = user.Uid,
                Nickname = user.Nickname,
                Headimg = user.HeadImg
            };
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Failed to record login: UserId={UserId}", userId);
            throw;
        }
    }

    /// <summary>
    /// H5绑定手机号（无需验证码）
    /// Requirements: 13.1
    /// </summary>
    public async Task<BindMobileResponse> BindMobileH5Async(int userId, string mobile)
    {
        if (string.IsNullOrWhiteSpace(mobile))
        {
            throw new ArgumentException("手机号不能为空", nameof(mobile));
        }

        // 获取当前用户
        var currentUser = await _userService.GetUserByIdAsync(userId);
        if (currentUser == null)
        {
            throw new InvalidOperationException("用户不存在");
        }

        // 检查手机号是否已被其他用户绑定
        var existingUser = await _userService.GetUserByMobileAsync(mobile);

        if (existingUser != null && existingUser.Id != userId)
        {
            // 手机号已被其他用户绑定，需要合并账户
            return await MergeAccountsAsync(currentUser, existingUser);
        }

        // 手机号未被绑定，直接更新当前用户的手机号
        await _userService.UpdateUserAsync(userId, new UpdateUserDto { Mobile = mobile });
        _logger.LogInformation("H5 Mobile bound successfully: UserId={UserId}, Mobile={Mobile}", userId, MaskMobile(mobile));

        return new BindMobileResponse { Token = null };
    }

    /// <summary>
    /// 账号注销
    /// Requirements: 7.1-7.3
    /// </summary>
    public async Task LogOffAsync(int userId, int type)
    {
        var user = await _userService.GetUserByIdAsync(userId);
        if (user == null)
        {
            throw new InvalidOperationException("用户不存在");
        }

        try
        {
            // 7.1 记录注销请求日志
            var action = type == 0 ? "注销账号" : "取消注销";
            _logger.LogInformation("User log off request: UserId={UserId}, Type={Type}, Action={Action}", userId, type, action);

            // 这里可以添加更多的注销逻辑，比如：
            // - 将用户状态设置为已注销
            // - 清理用户相关的缓存
            // - 发送通知等

            if (type == 0)
            {
                // 注销账号 - 可以设置用户状态为禁用
                user.Status = 0;
                _dbContext.Users.Update(user);
                await _dbContext.SaveChangesAsync();
                _logger.LogInformation("User account deactivated: UserId={UserId}", userId);
            }
            else if (type == 1)
            {
                // 取消注销 - 恢复用户状态
                user.Status = 1;
                _dbContext.Users.Update(user);
                await _dbContext.SaveChangesAsync();
                _logger.LogInformation("User account reactivated: UserId={UserId}", userId);
            }

            // 7.2 返回注销成功的消息（通过不抛出异常来表示成功）
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Failed to process log off: UserId={UserId}, Type={Type}", userId, type);
            throw;
        }
    }


    #region Refresh Token Methods

    /// <summary>
    /// 生成 Refresh Token 并存储到数据库
    /// Requirements: 1.4, 1.5, 4.1
    /// </summary>
    /// <param name="userId">用户ID</param>
    /// <param name="ipAddress">客户端 IP 地址</param>
    /// <returns>生成的 Refresh Token 明文</returns>
    private async Task<string> GenerateRefreshTokenAsync(int userId, string? ipAddress)
    {
        // 生成随机 Refresh Token
        var refreshToken = GenerateSecureRandomString(RefreshTokenLength);
        
        // 计算 SHA256 哈希值用于存储
        var tokenHash = ComputeSha256Hash(refreshToken);
        
        // 计算过期时间（7天）
        var expiresAt = DateTime.Now.AddDays(_jwtSettings.RefreshTokenExpirationDays);
        
        // 创建数据库记录
        var userRefreshToken = new UserRefreshToken
        {
            UserId = userId,
            TokenHash = tokenHash,
            ExpiresAt = expiresAt,
            CreatedAt = DateTime.Now,
            CreatedByIp = ipAddress
        };
        
        await _dbContext.UserRefreshTokens.AddAsync(userRefreshToken);
        await _dbContext.SaveChangesAsync();
        
        _logger.LogInformation("Generated refresh token for user {UserId}, expires at {ExpiresAt}", userId, expiresAt);
        
        return refreshToken;
    }

    /// <summary>
    /// 生成登录响应（包含双 Token）
    /// Requirements: 1.1, 1.2, 1.3, 1.4, 1.5
    /// </summary>
    /// <param name="user">用户实体</param>
    /// <param name="ipAddress">客户端 IP 地址</param>
    /// <returns>登录响应</returns>
    private async Task<LoginResponse> GenerateLoginResponseAsync(User user, string? ipAddress)
    {
        // 生成 Access Token (JWT)
        var accessToken = _jwtService.GenerateToken(user);
        
        // 生成 Refresh Token 并存储
        var refreshToken = await GenerateRefreshTokenAsync(user.Id, ipAddress);
        
        // 计算 Access Token 过期时间（秒）
        var expiresIn = _jwtSettings.ExpirationMinutes * 60;
        
        return new LoginResponse
        {
            AccessToken = accessToken,
            RefreshToken = refreshToken,
            ExpiresIn = expiresIn,
            UserId = user.Id
        };
    }

    /// <summary>
    /// 刷新 Token
    /// Requirements: 2.1-2.6
    /// </summary>
    public async Task<RefreshTokenResult> RefreshTokenAsync(string refreshToken, string? ipAddress)
    {
        if (string.IsNullOrWhiteSpace(refreshToken))
        {
            _logger.LogWarning("Refresh token is empty");
            return RefreshTokenResult.Fail("刷新令牌不能为空");
        }

        try
        {
            // 计算 Token 哈希值
            var tokenHash = ComputeSha256Hash(refreshToken);
            
            // 查找 Token 记录
            var storedToken = await _dbContext.UserRefreshTokens
                .Include(t => t.User)
                .FirstOrDefaultAsync(t => t.TokenHash == tokenHash);
            
            if (storedToken == null)
            {
                _logger.LogWarning("Refresh token not found: {TokenHash}", tokenHash.Substring(0, 8) + "...");
                return RefreshTokenResult.Fail("无效的刷新令牌");
            }
            
            // 检查是否已过期
            if (storedToken.IsExpired)
            {
                _logger.LogWarning("Refresh token expired for user {UserId}", storedToken.UserId);
                return RefreshTokenResult.Fail("刷新令牌已过期");
            }
            
            // 检查是否已撤销
            if (storedToken.IsRevoked)
            {
                _logger.LogWarning("Refresh token revoked for user {UserId}", storedToken.UserId);
                return RefreshTokenResult.Fail("刷新令牌已失效");
            }
            
            // 检查用户是否存在且有效
            var user = storedToken.User;
            if (user == null)
            {
                _logger.LogWarning("User not found for refresh token");
                return RefreshTokenResult.Fail("用户不存在");
            }
            
            if (user.Status == 0)
            {
                _logger.LogWarning("User {UserId} is disabled", user.Id);
                return RefreshTokenResult.Fail("账号已被禁用");
            }
            
            // Token 轮换：生成新的 Refresh Token
            var newRefreshToken = GenerateSecureRandomString(RefreshTokenLength);
            var newTokenHash = ComputeSha256Hash(newRefreshToken);
            
            // 撤销旧 Token 并记录关联关系
            storedToken.RevokedAt = DateTime.Now;
            storedToken.RevokedByIp = ipAddress;
            storedToken.ReplacedByToken = newTokenHash;
            
            // 创建新的 Token 记录
            var newUserRefreshToken = new UserRefreshToken
            {
                UserId = user.Id,
                TokenHash = newTokenHash,
                ExpiresAt = DateTime.Now.AddDays(_jwtSettings.RefreshTokenExpirationDays),
                CreatedAt = DateTime.Now,
                CreatedByIp = ipAddress
            };
            
            await _dbContext.UserRefreshTokens.AddAsync(newUserRefreshToken);
            await _dbContext.SaveChangesAsync();
            
            // 生成新的 Access Token
            var accessToken = _jwtService.GenerateToken(user);
            var expiresIn = _jwtSettings.ExpirationMinutes * 60;
            
            // 更新 UserAccount 表中的 token（兼容旧系统）
            await CreateOrUpdateAccountTokenAsync(user.Id, accessToken);
            
            _logger.LogInformation("Token refreshed successfully for user {UserId}", user.Id);
            
            return RefreshTokenResult.Ok(new LoginResponse
            {
                AccessToken = accessToken,
                RefreshToken = newRefreshToken,
                ExpiresIn = expiresIn,
                UserId = user.Id
            });
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error refreshing token");
            return RefreshTokenResult.Fail("刷新令牌失败，请稍后重试");
        }
    }

    /// <summary>
    /// 撤销 Token
    /// Requirements: 4.4
    /// </summary>
    public async Task RevokeTokenAsync(string refreshToken, string? ipAddress)
    {
        if (string.IsNullOrWhiteSpace(refreshToken))
        {
            _logger.LogWarning("Cannot revoke empty refresh token");
            return;
        }

        try
        {
            // 计算 Token 哈希值
            var tokenHash = ComputeSha256Hash(refreshToken);
            
            // 查找 Token 记录
            var storedToken = await _dbContext.UserRefreshTokens
                .FirstOrDefaultAsync(t => t.TokenHash == tokenHash);
            
            if (storedToken == null)
            {
                _logger.LogWarning("Refresh token not found for revocation");
                return;
            }
            
            // 如果已经撤销，直接返回
            if (storedToken.IsRevoked)
            {
                _logger.LogInformation("Refresh token already revoked");
                return;
            }
            
            // 撤销 Token
            storedToken.RevokedAt = DateTime.Now;
            storedToken.RevokedByIp = ipAddress;
            
            await _dbContext.SaveChangesAsync();
            
            _logger.LogInformation("Refresh token revoked for user {UserId}", storedToken.UserId);
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error revoking refresh token");
            throw;
        }
    }

    /// <summary>
    /// 撤销用户的所有 Token
    /// Requirements: 4.4
    /// </summary>
    public async Task RevokeAllUserTokensAsync(int userId, string? ipAddress)
    {
        try
        {
            // 查找用户所有有效的 Token
            var activeTokens = await _dbContext.UserRefreshTokens
                .Where(t => t.UserId == userId && t.RevokedAt == null)
                .ToListAsync();
            
            if (!activeTokens.Any())
            {
                _logger.LogInformation("No active tokens found for user {UserId}", userId);
                return;
            }
            
            var now = DateTime.Now;
            foreach (var token in activeTokens)
            {
                token.RevokedAt = now;
                token.RevokedByIp = ipAddress;
            }
            
            await _dbContext.SaveChangesAsync();
            
            _logger.LogInformation("Revoked {Count} tokens for user {UserId}", activeTokens.Count, userId);
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error revoking all tokens for user {UserId}", userId);
            throw;
        }
    }

    #endregion

    #region Private Helper Methods

    /// <summary>
    /// 合并账户 - 将当前用户的openid迁移到手机号用户
    /// </summary>
    private async Task<BindMobileResponse> MergeAccountsAsync(User currentUser, User mobileUser)
    {
        using var transaction = await _dbContext.Database.BeginTransactionAsync();
        try
        {
            _logger.LogInformation("Merging accounts: CurrentUserId={CurrentUserId}, MobileUserId={MobileUserId}", 
                currentUser.Id, mobileUser.Id);

            // 5.2 将当前用户的openid迁移到手机号用户
            if (!string.IsNullOrWhiteSpace(currentUser.OpenId))
            {
                mobileUser.OpenId = currentUser.OpenId;
            }
            if (!string.IsNullOrWhiteSpace(currentUser.UnionId))
            {
                mobileUser.UnionId = currentUser.UnionId;
            }
            mobileUser.UpdatedAt = DateTime.UtcNow;
            _dbContext.Users.Update(mobileUser);

            // 删除当前用户的账户记录
            var currentUserAccount = await _dbContext.UserAccounts.FirstOrDefaultAsync(ua => ua.UserId == currentUser.Id);
            if (currentUserAccount != null)
            {
                _dbContext.UserAccounts.Remove(currentUserAccount);
            }

            // 删除当前用户
            _dbContext.Users.Remove(currentUser);

            await _dbContext.SaveChangesAsync();
            await transaction.CommitAsync();

            // 5.3 生成新的token
            var newToken = _jwtService.GenerateToken(mobileUser);
            await CreateOrUpdateAccountTokenAsync(mobileUser.Id, newToken);

            _logger.LogInformation("Accounts merged successfully: NewUserId={NewUserId}", mobileUser.Id);

            return new BindMobileResponse { Token = newToken };
        }
        catch (Exception ex)
        {
            await transaction.RollbackAsync();
            _logger.LogError(ex, "Failed to merge accounts: CurrentUserId={CurrentUserId}, MobileUserId={MobileUserId}", 
                currentUser.Id, mobileUser.Id);
            throw;
        }
    }

    /// <summary>
    /// 创建或更新账户Token（用于兼容旧系统）
    /// </summary>
    private async Task CreateOrUpdateAccountTokenAsync(int userId, string jwtToken)
    {
        var tokenNum = GenerateRandomString(10);
        var time = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
        var accountToken = ComputeMd5($"{userId}{tokenNum}{time}");

        var userAccount = await _dbContext.UserAccounts.FirstOrDefaultAsync(ua => ua.UserId == userId);
        
        if (userAccount == null)
        {
            userAccount = new UserAccount
            {
                UserId = userId,
                AccountToken = accountToken,
                TokenNum = tokenNum,
                TokenTime = DateTime.UtcNow,
                LastLoginTime = DateTime.UtcNow,
                LastLoginIp = string.Empty
            };
            await _dbContext.UserAccounts.AddAsync(userAccount);
        }
        else
        {
            userAccount.AccountToken = accountToken;
            userAccount.TokenNum = tokenNum;
            userAccount.TokenTime = DateTime.UtcNow;
            userAccount.LastLoginTime = DateTime.UtcNow;
            _dbContext.UserAccounts.Update(userAccount);
        }

        await _dbContext.SaveChangesAsync();
    }

    /// <summary>
    /// 生成默认头像URL
    /// </summary>
    private static string GenerateDefaultAvatar(string seed)
    {
        // 使用种子生成一个简单的默认头像URL
        // 实际项目中可以使用Identicon库或其他头像生成服务
        var hash = ComputeMd5(seed);
        return $"https://api.dicebear.com/7.x/identicon/svg?seed={hash}";
    }

    /// <summary>
    /// 计算MD5哈希
    /// </summary>
    private static string ComputeMd5(string input)
    {
        var inputBytes = Encoding.UTF8.GetBytes(input);
        var hashBytes = MD5.HashData(inputBytes);
        return Convert.ToHexString(hashBytes).ToLowerInvariant();
    }

    /// <summary>
    /// 生成随机字符串
    /// </summary>
    private static string GenerateRandomString(int length)
    {
        const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
        var result = new char[length];
        for (int i = 0; i < length; i++)
        {
            result[i] = chars[Random.Shared.Next(chars.Length)];
        }
        return new string(result);
    }

    /// <summary>
    /// 解析ClickId
    /// </summary>
    private static int? ParseClickId(string? clickId)
    {
        if (string.IsNullOrWhiteSpace(clickId))
            return null;
        
        return int.TryParse(clickId, out var result) ? result : null;
    }

    /// <summary>
    /// 脱敏手机号
    /// </summary>
    private static string MaskMobile(string mobile)
    {
        if (string.IsNullOrWhiteSpace(mobile) || mobile.Length < 7)
            return "***";
        
        return $"{mobile.Substring(0, 3)}****{mobile.Substring(mobile.Length - 4)}";
    }

    /// <summary>
    /// 获取年份中的周数
    /// </summary>
    private static int GetWeekOfYear(DateTime date)
    {
        var cal = System.Globalization.CultureInfo.CurrentCulture.Calendar;
        return cal.GetWeekOfYear(date, System.Globalization.CalendarWeekRule.FirstDay, DayOfWeek.Monday);
    }

    /// <summary>
    /// 计算 SHA256 哈希值
    /// Requirements: 4.1
    /// </summary>
    private static string ComputeSha256Hash(string input)
    {
        var inputBytes = Encoding.UTF8.GetBytes(input);
        var hashBytes = SHA256.HashData(inputBytes);
        return Convert.ToHexString(hashBytes).ToLowerInvariant();
    }

    /// <summary>
    /// 生成安全的随机字符串（用于 Refresh Token）
    /// </summary>
    private static string GenerateSecureRandomString(int length)
    {
        var randomBytes = new byte[length];
        using var rng = RandomNumberGenerator.Create();
        rng.GetBytes(randomBytes);
        return Convert.ToBase64String(randomBytes)
            .Replace("+", "-")
            .Replace("/", "_")
            .Replace("=", "")
            .Substring(0, length);
    }

    #endregion
}