package usecase

import (
	"context"
	"crypto/rand"
	"encoding/hex"
	"errors"
	"fmt"
	"math/big"
	"strings"
	"time"

	"apps/backend/internal/module/member/domain"
	tokenDomain "apps/backend/internal/module/token/domain"
)

// AccountService implements domain.AccountUseCase (stand-alone full member surface).
// AuthService is an alias so existing callers keep working.
type AccountService struct {
	Repo       domain.Repository
	Issuer     tokenDomain.Issuer
	BcryptCost int
	// OAuth optional config (empty = dev mock path)
	GoogleClientID   string
	LineClientID     string
	LineClientSecret string
	LineRedirectURI  string
}

// AuthService kept as type alias for svc/logic compatibility.
type AuthService = AccountService

func NewAuthService(repo domain.Repository, issuer tokenDomain.Issuer, bcryptCost int) *AccountService {
	return NewAccountService(repo, issuer, bcryptCost)
}

func NewAccountService(repo domain.Repository, issuer tokenDomain.Issuer, bcryptCost int) *AccountService {
	if bcryptCost <= 0 {
		bcryptCost = 10
	}
	return &AccountService{Repo: repo, Issuer: issuer, BcryptCost: bcryptCost}
}

// ---------- create / login ----------

func (s *AccountService) CreateUserAccount(ctx context.Context, req domain.CreateLoginUserRequest) (*domain.Member, *tokenDomain.TokenPair, error) {
	platform := strings.ToLower(strings.TrimSpace(req.Platform))
	if platform == "" {
		platform = domain.PlatformPassword
	}
	loginID := strings.TrimSpace(req.LoginID)
	if loginID == "" {
		return nil, nil, domain.ErrBadPassword
	}
	if platform == domain.PlatformPassword {
		loginID = strings.ToLower(loginID)
	}

	// already bound?
	if _, err := s.Repo.FindIdentity(ctx, loginID, platform); err == nil {
		return nil, nil, domain.ErrIdentityTaken
	}

	uid, err := s.Repo.NextUID(ctx)
	if err != nil {
		return nil, nil, err
	}
	now := domain.NowNano()
	display := strings.TrimSpace(req.DisplayName)
	email := strings.ToLower(strings.TrimSpace(req.Email))
	phone := strings.TrimSpace(req.Phone)
	if platform == domain.PlatformPassword {
		if req.AccountType == domain.AccountTypePhone || looksLikePhone(loginID) {
			if phone == "" {
				phone = loginID
			}
			req.AccountType = domain.AccountTypePhone
		} else {
			if email == "" {
				email = loginID
			}
			req.AccountType = domain.AccountTypeEmail
		}
	}
	if display == "" {
		if email != "" {
			display = strings.Split(email, "@")[0]
		} else {
			display = loginID
		}
	}

	var passHash string
	if platform == domain.PlatformPassword {
		if req.Password == "" {
			return nil, nil, domain.ErrWeakPassword
		}
		passHash, err = HashPassword(req.Password, s.BcryptCost)
		if err != nil {
			return nil, nil, err
		}
	}

	status := domain.StatusActive
	if platform == domain.PlatformPassword {
		status = domain.StatusUnverified
	}

	m := &domain.Member{
		UID: uid, TenantID: "default", Email: email, Phone: phone,
		DisplayName: display, Roles: []string{domain.RoleMember}, Status: status,
		EmailVerified: false, InviteCode: NewInviteCode(), PasswordHash: passHash,
		Timezone: "Asia/Taipei", PreferredLanguage: "zh-TW", Currency: "TWD",
		CreatedAt: now, UpdatedAt: now,
	}
	if err := s.Repo.CreateMember(ctx, m); err != nil {
		return nil, nil, err
	}

	accType := req.AccountType
	if accType == "" {
		if platform == domain.PlatformPassword {
			if phone != "" && email == "" {
				accType = domain.AccountTypePhone
			} else {
				accType = domain.AccountTypeEmail
			}
		} else {
			accType = domain.AccountTypePlatform
		}
	}
	ident := &domain.Identity{
		UID: uid, LoginID: loginID, Platform: platform,
		AccountType: accType, PasswordHash: passHash, CreatedAt: now, UpdatedAt: now,
	}
	if err := s.Repo.CreateIdentity(ctx, ident); err != nil {
		return nil, nil, err
	}

	pair, err := s.issueSession(m)
	if err != nil {
		return m, nil, err
	}
	return m, pair, nil
}

func (s *AccountService) LoginPassword(ctx context.Context, loginID, password, platform string) (*domain.Member, *tokenDomain.TokenPair, error) {
	if platform == "" {
		platform = domain.PlatformPassword
	}
	loginID = strings.TrimSpace(loginID)
	if platform == domain.PlatformPassword {
		loginID = strings.ToLower(loginID)
	}

	// Prefer identity; fallback member email for seed admin without identity row
	ident, err := s.Repo.FindIdentity(ctx, loginID, platform)
	var m *domain.Member
	switch {
	case err == nil:
		hash := ident.PasswordHash
		if hash == "" || !CheckPasswordHash(password, hash) {
			// also try member primary password
			m, err = s.Repo.FindByUID(ctx, ident.UID)
			if err != nil {
				return nil, nil, err
			}
			if m.PasswordHash == "" || !CheckPasswordHash(password, m.PasswordHash) {
				return nil, nil, domain.ErrBadPassword
			}
		} else {
			m, err = s.Repo.FindByUID(ctx, ident.UID)
			if err != nil {
				return nil, nil, err
			}
		}
	case errors.Is(err, domain.ErrIdentityNotFound):
		// legacy: email login without identity
		m, err = s.Repo.FindByEmail(ctx, loginID)
		if errors.Is(err, domain.ErrNotFound) {
			return nil, nil, domain.ErrBadPassword
		}
		if err != nil {
			return nil, nil, err // DB/auth errors must not look like bad password
		}
		if m.PasswordHash == "" || !CheckPasswordHash(password, m.PasswordHash) {
			return nil, nil, domain.ErrBadPassword
		}
		// auto-heal identity for seed users
		_ = s.Repo.CreateIdentity(ctx, &domain.Identity{
			UID: m.UID, LoginID: m.Email, Platform: domain.PlatformPassword,
			AccountType: domain.AccountTypeEmail, PasswordHash: m.PasswordHash,
			CreatedAt: domain.NowNano(), UpdatedAt: domain.NowNano(),
		})
	default:
		// infrastructure failure (e.g. Mongo auth)
		return nil, nil, err
	}
	if m.IsSuspended() {
		return nil, nil, domain.ErrSuspended
	}
	pair, err := s.issueSession(m)
	if err != nil {
		return nil, nil, err
	}
	return m, pair, nil
}

// Login — Harbor Desk email login shorthand
func (s *AccountService) Login(ctx context.Context, email, password string) (*domain.Member, *tokenDomain.TokenPair, error) {
	return s.LoginPassword(ctx, email, password, domain.PlatformPassword)
}

func (s *AccountService) LoginOAuth(ctx context.Context, platform, subject, email, displayName string) (*domain.Member, *tokenDomain.TokenPair, error) {
	platform = strings.ToLower(strings.TrimSpace(platform))
	subject = strings.TrimSpace(subject)
	if platform == "" || subject == "" {
		return nil, nil, domain.ErrOAuthFailed
	}
	email = strings.ToLower(strings.TrimSpace(email))

	if ident, err := s.Repo.FindIdentity(ctx, subject, platform); err == nil {
		m, err := s.Repo.FindByUID(ctx, ident.UID)
		if err != nil {
			return nil, nil, err
		}
		if m.IsSuspended() {
			return nil, nil, domain.ErrSuspended
		}
		pair, err := s.issueSession(m)
		return m, pair, err
	}

	// new member via oauth
	req := domain.CreateLoginUserRequest{
		LoginID: subject, Platform: platform, AccountType: domain.AccountTypePlatform,
		DisplayName: displayName, Email: email,
	}
	m, pair, err := s.CreateUserAccount(ctx, req)
	if err != nil {
		return nil, nil, err
	}
	// oauth accounts treated as verified email when provider gives email
	if email != "" {
		now := domain.NowNano()
		m.EmailVerified = true
		m.EmailVerifiedAt = &now
		m.Status = domain.StatusActive
		m.UpdatedAt = now
		_ = s.Repo.UpdateMember(ctx, m)
	}
	return m, pair, nil
}

// ---------- query ----------

func (s *AccountService) GetUIDByAccount(ctx context.Context, account, platform string) (int64, error) {
	ident, err := s.Repo.FindIdentity(ctx, account, platform)
	if err != nil {
		return 0, err
	}
	return ident.UID, nil
}

func (s *AccountService) GetUserAccountInfo(ctx context.Context, account, platform string) (*domain.Identity, error) {
	return s.Repo.FindIdentity(ctx, account, platform)
}

func (s *AccountService) GetUserInfo(ctx context.Context, uid int64) (*domain.Member, error) {
	return s.Repo.FindByUID(ctx, uid)
}

func (s *AccountService) ListMember(ctx context.Context, page, pageSize int, query, status string) ([]*domain.Member, int64, error) {
	return s.Repo.ListPage(ctx, page, pageSize, query, status)
}

func (s *AccountService) ListIdentities(ctx context.Context, uid int64) ([]*domain.Identity, error) {
	return s.Repo.ListIdentitiesByUID(ctx, uid)
}

func (s *AccountService) FindLoginIDsByUID(ctx context.Context, uid int64) ([]*domain.Identity, error) {
	return s.Repo.ListIdentitiesByUID(ctx, uid)
}

// ---------- update ----------

func (s *AccountService) UpdateUserToken(ctx context.Context, loginID, platform, newPassword string) error {
	hash, err := HashPassword(newPassword, s.BcryptCost)
	if err != nil {
		return err
	}
	if err := s.Repo.UpdateIdentityPassword(ctx, loginID, platform, hash); err != nil {
		return err
	}
	// sync primary password on member if platform password identity
	ident, err := s.Repo.FindIdentity(ctx, loginID, platform)
	if err != nil {
		return err
	}
	m, err := s.Repo.FindByUID(ctx, ident.UID)
	if err != nil {
		return err
	}
	m.PasswordHash = hash
	m.UpdatedAt = domain.NowNano()
	if err := s.Repo.UpdateMember(ctx, m); err != nil {
		return err
	}
	return s.Repo.RevokeAllRefreshByUID(ctx, ident.UID)
}

func (s *AccountService) UpdateUserInfo(ctx context.Context, uid int64, patch *domain.UpdateUserInfoPatch) (*domain.Member, error) {
	m, err := s.Repo.FindByUID(ctx, uid)
	if err != nil {
		return nil, err
	}
	if patch == nil {
		return m, nil
	}
	if patch.DisplayName != nil {
		m.DisplayName = *patch.DisplayName
	}
	if patch.Nickname != nil {
		m.Nickname = *patch.Nickname
	}
	if patch.FullName != nil {
		m.FullName = *patch.FullName
	}
	if patch.AvatarURL != nil {
		m.AvatarURL = *patch.AvatarURL
	}
	if patch.Bio != nil {
		m.Bio = *patch.Bio
	}
	if patch.Timezone != nil {
		m.Timezone = *patch.Timezone
	}
	if patch.NotifyEmail != nil {
		m.NotifyEmail = *patch.NotifyEmail
	}
	if patch.GenderCode != nil {
		m.GenderCode = *patch.GenderCode
	}
	if patch.Birthdate != nil {
		m.Birthdate = *patch.Birthdate
	}
	if patch.National != nil {
		m.National = *patch.National
	}
	if patch.Address != nil {
		m.Address = *patch.Address
	}
	if patch.PostCode != nil {
		m.PostCode = *patch.PostCode
	}
	if patch.PreferredLanguage != nil {
		m.PreferredLanguage = *patch.PreferredLanguage
	}
	if patch.Currency != nil {
		m.Currency = *patch.Currency
	}
	if patch.Email != nil {
		newEmail := strings.ToLower(strings.TrimSpace(*patch.Email))
		if newEmail != "" && newEmail != m.Email {
			m.Email = newEmail
			m.EmailVerified = false
			m.EmailVerifiedAt = nil
		}
	}
	if patch.Phone != nil {
		m.Phone = strings.TrimSpace(*patch.Phone)
		m.PhoneVerified = false
		m.PhoneVerifiedAt = nil
	}
	passwordChanged := patch.NewPassword != nil && *patch.NewPassword != ""
	if passwordChanged {
		if patch.CurrentPassword == nil || !CheckPasswordHash(*patch.CurrentPassword, m.PasswordHash) {
			return nil, domain.ErrBadPassword
		}
		hash, err := HashPassword(*patch.NewPassword, s.BcryptCost)
		if err != nil {
			return nil, err
		}
		m.PasswordHash = hash
		// update platform identity password if exists
		if m.Email != "" {
			_ = s.Repo.UpdateIdentityPassword(ctx, m.Email, domain.PlatformPassword, hash)
		}
	}
	m.UpdatedAt = domain.NowNano()
	if err := s.Repo.UpdateMember(ctx, m); err != nil {
		return nil, err
	}
	if passwordChanged {
		if err := s.Repo.RevokeAllRefreshByUID(ctx, uid); err != nil {
			return nil, err
		}
	}
	return m, nil
}

func (s *AccountService) UpdateStatus(ctx context.Context, uid int64, status string) (*domain.Member, error) {
	m, err := s.Repo.FindByUID(ctx, uid)
	if err != nil {
		return nil, err
	}
	m.Status = status
	m.UpdatedAt = domain.NowNano()
	if err := s.Repo.UpdateMember(ctx, m); err != nil {
		return nil, err
	}
	return m, nil
}

// ---------- session ----------

func (s *AccountService) Refresh(ctx context.Context, refreshToken string) (*tokenDomain.TokenPair, error) {
	claims, err := s.Issuer.ParseRefresh(refreshToken)
	if err != nil {
		return nil, err
	}
	uid, ok := s.Repo.ConsumeRefresh(claims.JTI)
	if !ok || uid != claims.UID {
		return nil, tokenDomain.ErrInvalidToken
	}
	m, err := s.Repo.FindByUID(ctx, uid)
	if err != nil {
		return nil, err
	}
	if m.IsSuspended() {
		return nil, domain.ErrSuspended
	}
	return s.issueSession(m)
}

func (s *AccountService) Logout(refreshToken string) {
	if refreshToken == "" {
		return
	}
	if claims, err := s.Issuer.ParseRefresh(refreshToken); err == nil {
		s.Repo.RevokeRefresh(claims.JTI)
	}
}

func (s *AccountService) LogoutAll(ctx context.Context, uid int64) error {
	return s.Repo.RevokeAllRefreshByUID(ctx, uid)
}

// ---------- binding ----------

func (s *AccountService) BindAccount(ctx context.Context, uid int64, loginID, platform, accountType, password string) (*domain.Identity, error) {
	if _, err := s.Repo.FindByUID(ctx, uid); err != nil {
		return nil, err
	}
	platform = strings.ToLower(strings.TrimSpace(platform))
	if platform == "" {
		platform = domain.PlatformPassword
	}
	loginID = strings.TrimSpace(loginID)
	if platform == domain.PlatformPassword {
		loginID = strings.ToLower(loginID)
	}
	if _, err := s.Repo.FindIdentity(ctx, loginID, platform); err == nil {
		return nil, domain.ErrIdentityTaken
	}
	var hash string
	if platform == domain.PlatformPassword && password != "" {
		var err error
		hash, err = HashPassword(password, s.BcryptCost)
		if err != nil {
			return nil, err
		}
	}
	if accountType == "" {
		if platform == domain.PlatformPassword {
			accountType = domain.AccountTypeEmail
		} else {
			accountType = domain.AccountTypePlatform
		}
	}
	now := domain.NowNano()
	ident := &domain.Identity{
		UID: uid, LoginID: loginID, Platform: platform,
		AccountType: accountType, PasswordHash: hash, CreatedAt: now, UpdatedAt: now,
	}
	if err := s.Repo.CreateIdentity(ctx, ident); err != nil {
		return nil, err
	}
	return ident, nil
}

func (s *AccountService) UnbindAccount(ctx context.Context, uid int64, loginID, platform string) error {
	ident, err := s.Repo.FindIdentity(ctx, loginID, platform)
	if err != nil {
		return err
	}
	if ident.UID != uid {
		return domain.ErrIdentityNotFound
	}
	// refuse unbind last identity
	list, err := s.Repo.ListIdentitiesByUID(ctx, uid)
	if err != nil {
		return err
	}
	if len(list) <= 1 {
		return domain.ErrAlreadyBound // reuse: cannot unbind last
	}
	return s.Repo.DeleteIdentity(ctx, loginID, platform)
}

func (s *AccountService) BindVerifyEmail(ctx context.Context, uid int64, email string) error {
	email = strings.ToLower(strings.TrimSpace(email))
	m, err := s.Repo.FindByUID(ctx, uid)
	if err != nil {
		return err
	}
	now := domain.NowNano()
	m.Email = email
	m.EmailVerified = true
	m.EmailVerifiedAt = &now
	if m.Status == domain.StatusUnverified {
		m.Status = domain.StatusActive
	}
	m.UpdatedAt = now
	if err := s.Repo.UpdateMember(ctx, m); err != nil {
		return err
	}
	// ensure identity
	if _, err := s.Repo.FindIdentity(ctx, email, domain.PlatformPassword); err != nil {
		_ = s.Repo.CreateIdentity(ctx, &domain.Identity{
			UID: uid, LoginID: email, Platform: domain.PlatformPassword,
			AccountType: domain.AccountTypeEmail, PasswordHash: m.PasswordHash,
			CreatedAt: now, UpdatedAt: now,
		})
	}
	return nil
}

func (s *AccountService) BindVerifyPhone(ctx context.Context, uid int64, phone string) error {
	phone = strings.TrimSpace(phone)
	m, err := s.Repo.FindByUID(ctx, uid)
	if err != nil {
		return err
	}
	now := domain.NowNano()
	m.Phone = phone
	m.PhoneVerified = true
	m.PhoneVerifiedAt = &now
	m.UpdatedAt = now
	return s.Repo.UpdateMember(ctx, m)
}

// ---------- codes ----------

func (s *AccountService) GenerateCode(ctx context.Context, loginID, codeType string) (string, error) {
	code := randomDigits(6)
	if !s.Repo.SetCode(codeType, strings.ToLower(loginID), code, 10*time.Minute) {
		return "", domain.ErrCodeRateLimited
	}
	return code, nil
}

func (s *AccountService) VerifyCode(ctx context.Context, loginID, codeType, code string, consume bool) error {
	key := strings.ToLower(loginID)
	ok := false
	if consume {
		ok = s.Repo.CheckCode(codeType, key, code)
	} else {
		ok = s.Repo.PeekCode(codeType, key, code)
	}
	if !ok {
		return domain.ErrInvalidCode
	}
	return nil
}

func (s *AccountService) VerifyPlatformAuthResult(ctx context.Context, loginID, platform, password string) (bool, error) {
	ident, err := s.Repo.FindIdentity(ctx, loginID, platform)
	if err != nil {
		return false, err
	}
	if ident.PasswordHash == "" {
		return false, nil
	}
	return CheckPasswordHash(password, ident.PasswordHash), nil
}

// ---------- OAuth providers ----------

func (s *AccountService) VerifyGoogleIDToken(ctx context.Context, idToken string) (subject, email, name string, err error) {
	if strings.TrimSpace(s.GoogleClientID) == "" {
		return "", "", "", domain.ErrOAuthFailed
	}
	info, e := googleIDTokenInfo(ctx, idToken, s.GoogleClientID)
	if e != nil {
		return "", "", "", domain.ErrOAuthFailed
	}
	return info.Subject, info.Email, info.Name, nil
}

func (s *AccountService) LineCodeToProfile(ctx context.Context, code, redirectURI string) (subject, displayName, email string, err error) {
	if s.LineClientID == "" || s.LineClientSecret == "" {
		return "", "", "", domain.ErrOAuthFailed
	}
	if redirectURI == "" {
		redirectURI = s.LineRedirectURI
	}
	tok, e := lineExchangeCode(ctx, code, redirectURI, s.LineClientID, s.LineClientSecret)
	if e != nil {
		return "", "", "", domain.ErrOAuthFailed
	}
	prof, e := lineProfile(ctx, tok)
	if e != nil {
		return "", "", "", domain.ErrOAuthFailed
	}
	return prof.UserID, prof.DisplayName, "", nil
}

// ---------- Harbor Desk convenience ----------

func (s *AccountService) RegisterEmail(ctx context.Context, email, password, displayName string) (*domain.Member, *tokenDomain.TokenPair, error) {
	return s.CreateUserAccount(ctx, domain.CreateLoginUserRequest{
		LoginID: email, Platform: domain.PlatformPassword, AccountType: domain.AccountTypeEmail,
		Password: password, DisplayName: displayName, Email: email,
	})
}

// Register — alias for logic layer
func (s *AccountService) Register(ctx context.Context, email, password, displayName string) (*domain.Member, *tokenDomain.TokenPair, error) {
	return s.RegisterEmail(ctx, email, password, displayName)
}

func (s *AccountService) Me(ctx context.Context, uid int64) (*domain.Member, error) {
	m, err := s.Repo.FindByUID(ctx, uid)
	if err != nil {
		return nil, err
	}
	if m.IsSuspended() {
		return nil, domain.ErrSuspended
	}
	return m, nil
}

func (s *AccountService) RequestPasswordReset(ctx context.Context, email string) (string, error) {
	email = strings.ToLower(strings.TrimSpace(email))
	if email == "" || !strings.Contains(email, "@") {
		return "", domain.ErrEmailNotRegistered
	}
	code := randomDigits(6)
	// try identity or member — unknown email must error (product: 無此信箱不寄)
	if _, err := s.Repo.FindByEmail(ctx, email); err == nil {
		if !s.Repo.SetCode(domain.CodeTypeForgetPassword, email, code, 30*time.Minute) {
			return "", domain.ErrCodeRateLimited
		}
		return code, nil
	}
	if _, err := s.Repo.FindIdentity(ctx, email, domain.PlatformPassword); err == nil {
		if !s.Repo.SetCode(domain.CodeTypeForgetPassword, email, code, 30*time.Minute) {
			return "", domain.ErrCodeRateLimited
		}
		return code, nil
	}
	return "", domain.ErrEmailNotRegistered
}

func (s *AccountService) ResetPassword(ctx context.Context, email, code, newPassword string) error {
	email = strings.ToLower(strings.TrimSpace(email))
	code = strings.TrimSpace(code)
	// 1) 先驗密碼政策（失敗不消費驗證碼）
	if err := ValidatePasswordPolicy(newPassword); err != nil {
		return err
	}
	// 2) Peek：輸錯／未過期都不刪（與信箱驗證同一套）
	match := s.Repo.PeekCode(domain.CodeTypeForgetPassword, email, code) ||
		s.Repo.PeekCode("reset", email, code)
	if !match {
		return domain.ErrInvalidCode
	}
	// 3) 業務先寫入；成功才消費碼
	if err := s.UpdateUserToken(ctx, email, domain.PlatformPassword, newPassword); err != nil {
		if !errors.Is(err, domain.ErrIdentityNotFound) {
			return err
		}
		// seed / legacy member without identity row
		hash, herr := HashPassword(newPassword, s.BcryptCost)
		if herr != nil {
			return herr
		}
		m, err := s.Repo.FindByEmail(ctx, email)
		if err != nil {
			return domain.ErrNotFound
		}
		m.PasswordHash = hash
		m.UpdatedAt = domain.NowNano()
		if err := s.Repo.UpdateMember(ctx, m); err != nil {
			return err
		}
		_ = s.Repo.CreateIdentity(ctx, &domain.Identity{
			UID: m.UID, LoginID: email, Platform: domain.PlatformPassword,
			AccountType: domain.AccountTypeEmail, PasswordHash: hash,
			CreatedAt: domain.NowNano(), UpdatedAt: domain.NowNano(),
		})
		if err := s.Repo.RevokeAllRefreshByUID(ctx, m.UID); err != nil {
			return err
		}
	}
	// 4) 成功才刪碼（兩種 kind 都清）
	_ = s.Repo.CheckCode(domain.CodeTypeForgetPassword, email, code)
	_ = s.Repo.CheckCode("reset", email, code)
	return nil
}

func (s *AccountService) SendEmailCode(ctx context.Context, uid int64) (string, error) {
	m, err := s.Repo.FindByUID(ctx, uid)
	if err != nil {
		return "", err
	}
	code := randomDigits(6)
	key := m.Email
	if key == "" {
		key = fmt.Sprintf("%d", uid)
	}
	if !s.Repo.SetCode(domain.CodeTypeEmail, strings.ToLower(key), code, 30*time.Minute) {
		return "", domain.ErrCodeRateLimited
	}
	// also store by uid for VerifyEmailCode
	if key != fmt.Sprintf("%d", uid) {
		_ = s.Repo.SetCode(domain.CodeTypeEmail, fmt.Sprintf("%d", uid), code, 30*time.Minute)
	}
	return code, nil
}

func (s *AccountService) VerifyEmailCode(ctx context.Context, uid int64, code string) (*domain.Member, error) {
	m, err := s.Repo.FindByUID(ctx, uid)
	if err != nil {
		return nil, err
	}
	uidKey := fmt.Sprintf("%d", uid)
	emailKey := ""
	if m.Email != "" {
		emailKey = strings.ToLower(m.Email)
	}
	code = strings.TrimSpace(code)
	// 與重設密碼同一套：Peek（輸錯不刪）→ 業務成功 → CheckCode 消費
	match := s.Repo.PeekCode(domain.CodeTypeEmail, uidKey, code)
	if !match && emailKey != "" {
		match = s.Repo.PeekCode(domain.CodeTypeEmail, emailKey, code)
	}
	if !match {
		return nil, domain.ErrInvalidCode
	}
	now := domain.NowNano()
	m.EmailVerified = true
	m.EmailVerifiedAt = &now
	if m.Status == domain.StatusUnverified {
		m.Status = domain.StatusActive
	}
	m.UpdatedAt = now
	if err := s.Repo.UpdateMember(ctx, m); err != nil {
		// 業務失敗：碼仍有效，可重試
		return nil, err
	}
	// 成功才消費兩把 key
	_ = s.Repo.CheckCode(domain.CodeTypeEmail, uidKey, code)
	if emailKey != "" {
		_ = s.Repo.CheckCode(domain.CodeTypeEmail, emailKey, code)
	}
	return m, nil
}

// VerifyEmail — alias
func (s *AccountService) VerifyEmail(ctx context.Context, uid int64, code string) (*domain.Member, error) {
	return s.VerifyEmailCode(ctx, uid, code)
}

// ---------- helpers ----------

func (s *AccountService) issueSession(m *domain.Member) (*tokenDomain.TokenPair, error) {
	pair, jti, exp, err := s.Issuer.Issue(m.UID, m.Roles)
	if err != nil {
		return nil, err
	}
	s.Repo.SaveRefresh(jti, m.UID, exp)
	return pair, nil
}

func NewInviteCode() string {
	var b [4]byte
	_, _ = rand.Read(b[:])
	return strings.ToUpper(hex.EncodeToString(b[:]))
}

func randomDigits(n int) string {
	var b strings.Builder
	for i := 0; i < n; i++ {
		v, _ := rand.Int(rand.Reader, big.NewInt(10))
		b.WriteByte(byte('0' + v.Int64()))
	}
	return b.String()
}

func looksLikePhone(s string) bool {
	if len(s) < 8 {
		return false
	}
	for _, c := range s {
		if c >= '0' && c <= '9' || c == '+' {
			continue
		}
		return false
	}
	return true
}