gochat/internal/handler/widget/widget_handler.go

package widget

import (
	"net/http"
	"strconv"
	"strings"

	"github.com/gin-gonic/gin"

	"github.com/gochat/gochat/internal/model"
	"github.com/gochat/gochat/internal/service"
)

// WidgetHandler handles the public-facing widget API endpoints.
// These endpoints are accessed by the embedded JS widget on customer websites
// and do not require agent JWT authentication — they use a widget_token instead.
// Reference: Chatwoot app/controllers/api/v1/widget_messages_controller.rb
type WidgetHandler struct {
	widgetService *service.WidgetService
}

// NewHandler creates a new WidgetHandler with the WidgetService dependency.
func NewHandler(widgetService *service.WidgetService) *WidgetHandler {
	return &WidgetHandler{
		widgetService: widgetService,
	}
}

// Init handles widget initialization — authenticates/creates a contact
// and returns a widget_token (pubsub_token) for subsequent requests.
// POST /widget/init
// Reference: Chatwoot widget SDK init — website_token identifies the inbox,
// contact attributes are optional (anonymous visitor if not provided).
func (h *WidgetHandler) Init(c *gin.Context) {
	var req service.WidgetInitRequest
	if err := c.ShouldBindJSON(&req); err != nil && c.Request.ContentLength != 0 {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request body", "details": err.Error()})
		return
	}
	if req.WebsiteToken == "" {
		req.WebsiteToken = c.Query("website_token")
	}

	// HMAC verification: if the client provides an identifier + identifier_hash,
	// verify the hash against the inbox's hmac_token. This mirrors Chatwoot's
	// WebWidget HMAC verification (identifier_hash is SHA-256 HMAC of the identifier
	// using the hmac_token from channel_config).
	// When HMAC is verified, the contact is treated as authenticated (not anonymous).
	identifierHash := c.GetHeader("X-Identifier-Hash")
	if identifierHash == "" {
		identifierHash = c.Query("identifier_hash")
	}
	if req.Identifier != "" && identifierHash != "" {
		// Resolve the inbox to get its hmac_token for verification
		inbox, err := h.widgetService.GetInboxByWebsiteToken(c.Request.Context(), req.WebsiteToken)
		if err != nil {
			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid website_token for HMAC verification"})
			return
		}
		widgetConfig, err := service.ParseWebWidgetConfig(inbox.ChannelConfig)
		if err != nil {
			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid widget config"})
			return
		}
		if service.VerifyHMAC(widgetConfig.HMACToken, req.Identifier, identifierHash) {
			req.HMACVerified = true
		}
	}

	resp, err := h.widgetService.Init(c.Request.Context(), req)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	c.JSON(http.StatusOK, resp)
}

// Config implements Chatwoot's POST /api/v1/widget/config endpoint.
func (h *WidgetHandler) Config(c *gin.Context) {
	var req service.WidgetInitRequest
	if err := c.ShouldBindJSON(&req); err != nil && c.Request.ContentLength != 0 {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request body", "details": err.Error()})
		return
	}
	if req.WebsiteToken == "" {
		req.WebsiteToken = c.Query("website_token")
	}

	resp, err := h.widgetService.Init(c.Request.Context(), req)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	contact := gin.H{
		"id":           resp.ContactID,
		"pubsub_token": resp.WidgetToken,
	}
	if resp.Contact != nil {
		contact["email"] = resp.Contact.Email
		contact["identifier"] = resp.Contact.Identifier
		contact["name"] = resp.Contact.Name
		contact["phone_number"] = resp.Contact.PhoneNumber
	}

	c.JSON(http.StatusOK, gin.H{
		"website_channel_config": gin.H{
			"auth_token":      resp.WidgetToken,
			"website_token":   resp.WidgetConfig.WebsiteToken,
			"widget_color":    resp.WidgetConfig.WidgetColor,
			"welcome_title":   resp.WidgetConfig.WelcomeTitle,
			"welcome_tagline": resp.WidgetConfig.WelcomeTagline,
			"website_name":    resp.InboxName,
		},
		"contact":       contact,
		"global_config": gin.H{},
	})
}

// SendMessage sends a message from the widget contact to the conversation.
// POST /widget/messages
// Reference: Chatwoot widget SDK — send message endpoint
func (h *WidgetHandler) SendMessage(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}

	req, err := bindWidgetSendMessageRequest(c)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request body", "details": err.Error()})
		return
	}

	req.WidgetToken = widgetToken
	resp, err := h.widgetService.SendMessage(c.Request.Context(), req)
	if err != nil {
		status := http.StatusBadRequest
		if err.Error() == "invalid widget_token" || err.Error() == "widget_token required" {
			status = http.StatusUnauthorized
		}
		c.JSON(status, gin.H{"error": err.Error()})
		return
	}

	if c.FullPath() == "/widget/messages" {
		c.JSON(http.StatusOK, resp)
		return
	}
	c.JSON(http.StatusOK, widgetMessagePayload(resp.Message, resp.ConversationID))
}

func (h *WidgetHandler) UpdateMessage(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}
	messageID, err := strconv.ParseUint(c.Param("message_id"), 10, 32)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid message id"})
		return
	}
	var req struct {
		Contact struct {
			Email string `json:"email"`
			Name  string `json:"name"`
		} `json:"contact"`
		Message struct {
			SubmittedValues []map[string]any `json:"submitted_values"`
		} `json:"message"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request body", "details": err.Error()})
		return
	}
	contact, _, err := h.widgetService.UpdateMessage(c.Request.Context(), service.WidgetMessageUpdate{
		MessageID:       uint(messageID),
		WidgetToken:     widgetToken,
		ContactEmail:    req.Contact.Email,
		ContactName:     req.Contact.Name,
		SubmittedValues: req.Message.SubmittedValues,
	})
	if err != nil {
		c.JSON(widgetErrorStatus(err), gin.H{"error": err.Error()})
		return
	}
	c.JSON(http.StatusOK, gin.H{"contact": widgetContactFullPayload(contact)})
}

// GetLatestMessages implements Chatwoot's GET /api/v1/widget/messages endpoint.
func (h *WidgetHandler) GetLatestMessages(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}

	offset, _ := strconv.Atoi(c.DefaultQuery("offset", "0"))
	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "25"))
	if limit <= 0 || limit > 100 {
		limit = 25
	}

	messages, total, conversation, err := h.widgetService.GetLatestConversationMessages(c.Request.Context(), widgetToken, offset, limit)
	if err != nil {
		status := http.StatusBadRequest
		if err.Error() == "invalid widget_token" {
			status = http.StatusUnauthorized
		}
		c.JSON(status, gin.H{"error": err.Error()})
		return
	}

	payload := make([]gin.H, 0, len(messages))
	for _, msg := range messages {
		payload = append(payload, widgetMessagePayload(msg, msg.ConversationID))
	}
	meta := gin.H{"total": total, "offset": offset, "limit": limit}
	if conversation != nil && conversation.ContactLastSeenAt != nil {
		meta["contact_last_seen_at"] = *conversation.ContactLastSeenAt
	}
	c.JSON(http.StatusOK, gin.H{"payload": payload, "meta": meta})
}

// GetConversations returns the conversation list for a widget contact.
// GET /widget/conversations
// Reference: Chatwoot widget SDK — fetch conversation list
func (h *WidgetHandler) GetConversations(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}

	conversations, err := h.widgetService.GetConversations(c.Request.Context(), widgetToken)
	if err != nil {
		status := http.StatusBadRequest
		if err.Error() == "invalid widget_token" {
			status = http.StatusUnauthorized
		}
		c.JSON(status, gin.H{"error": err.Error()})
		return
	}

	if c.FullPath() == "/api/v1/widget/conversations" {
		if len(conversations) == 0 {
			c.JSON(http.StatusOK, gin.H{})
			return
		}
		conversation := conversations[0]
		c.JSON(http.StatusOK, widgetConversationPayload(conversation))
		return
	}

	c.JSON(http.StatusOK, gin.H{"conversations": conversations})
}

// CreateConversation implements Chatwoot's POST /api/v1/widget/conversations endpoint.
func (h *WidgetHandler) CreateConversation(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}

	req, err := bindWidgetSendMessageRequest(c)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request body", "details": err.Error()})
		return
	}
	req.WidgetToken = widgetToken
	req.ConversationID = nil

	resp, err := h.widgetService.SendMessage(c.Request.Context(), req)
	if err != nil {
		status := http.StatusBadRequest
		if err.Error() == "invalid widget_token" || err.Error() == "widget_token required" {
			status = http.StatusUnauthorized
		}
		c.JSON(status, gin.H{"error": err.Error()})
		return
	}

	conversation, err := h.widgetService.GetConversation(c.Request.Context(), widgetToken, resp.ConversationID)
	if err != nil {
		c.JSON(http.StatusOK, gin.H{"id": resp.ConversationID, "messages": []gin.H{widgetMessagePayload(resp.Message, resp.ConversationID)}})
		return
	}
	payload := widgetConversationPayload(*conversation)
	payload["messages"] = []gin.H{widgetMessagePayload(resp.Message, resp.ConversationID)}
	c.JSON(http.StatusOK, payload)
}

// GetMessages retrieves messages for a specific conversation.
// GET /widget/conversations/:id/messages
// Reference: Chatwoot widget SDK — fetch messages for a conversation
func (h *WidgetHandler) GetMessages(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}

	conversationIDStr := c.Param("id")
	conversationID, err := strconv.ParseUint(conversationIDStr, 10, 32)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid conversation id"})
		return
	}

	offset, _ := strconv.Atoi(c.DefaultQuery("offset", "0"))
	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "25"))
	if limit <= 0 || limit > 100 {
		limit = 25
	}

	messages, total, err := h.widgetService.GetMessages(
		c.Request.Context(), widgetToken, uint(conversationID), offset, limit)
	if err != nil {
		status := http.StatusBadRequest
		if err.Error() == "invalid widget_token" {
			status = http.StatusUnauthorized
		}
		c.JSON(status, gin.H{"error": err.Error()})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"messages": messages,
		"meta": gin.H{
			"total":  total,
			"offset": offset,
			"limit":  limit,
		},
	})
}

// GetCableToken returns the pubsub_token for WebSocket/ActionCable connection.
// GET /widget/cable_token
// Reference: Chatwoot widget SDK — fetch token for ActionCable subscription
func (h *WidgetHandler) GetCableToken(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}

	resp, err := h.widgetService.GetCableToken(c.Request.Context(), widgetToken)
	if err != nil {
		status := http.StatusBadRequest
		if err.Error() == "invalid widget_token" {
			status = http.StatusUnauthorized
		}
		c.JSON(status, gin.H{"error": err.Error()})
		return
	}

	c.JSON(http.StatusOK, resp)
}

// UpdateContact updates the contact's profile from the widget.
// PATCH /widget/contact
// Reference: Chatwoot widget SDK — update contact name/email
func (h *WidgetHandler) UpdateContact(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}

	var req struct {
		Name                 string         `json:"name,omitempty"`
		Email                string         `json:"email,omitempty"`
		PhoneNumber          string         `json:"phone_number,omitempty"`
		Identifier           string         `json:"identifier,omitempty"`
		AvatarURL            string         `json:"avatar_url,omitempty"`
		CustomAttributes     map[string]any `json:"custom_attributes,omitempty"`
		AdditionalAttributes map[string]any `json:"additional_attributes,omitempty"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request body", "details": err.Error()})
		return
	}

	contact, err := h.widgetService.UpdateContactProfile(c.Request.Context(), widgetToken, service.WidgetContactUpdate{
		Name:                 req.Name,
		Email:                req.Email,
		PhoneNumber:          req.PhoneNumber,
		Identifier:           req.Identifier,
		AvatarURL:            req.AvatarURL,
		CustomAttributes:     req.CustomAttributes,
		AdditionalAttributes: req.AdditionalAttributes,
	})
	if err != nil {
		status := http.StatusBadRequest
		if err.Error() == "invalid widget_token" {
			status = http.StatusUnauthorized
		}
		c.JSON(status, gin.H{"error": err.Error()})
		return
	}

	c.JSON(http.StatusOK, widgetContactPayload(contact))
}

// GetContact implements Chatwoot's GET /api/v1/widget/contact endpoint.
func (h *WidgetHandler) GetContact(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}

	contact, err := h.widgetService.GetContact(c.Request.Context(), widgetToken)
	if err != nil {
		status := http.StatusBadRequest
		if err.Error() == "invalid widget_token" {
			status = http.StatusUnauthorized
		}
		c.JSON(status, gin.H{"error": err.Error()})
		return
	}
	c.JSON(http.StatusOK, widgetContactPayload(contact))
}

func (h *WidgetHandler) DestroyContactCustomAttributes(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}

	var req struct {
		CustomAttributes []string `json:"custom_attributes"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request body", "details": err.Error()})
		return
	}
	contact, err := h.widgetService.DeleteContactCustomAttributes(c.Request.Context(), widgetToken, req.CustomAttributes)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}
	c.JSON(http.StatusOK, contact)
}

func (h *WidgetHandler) SetUser(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}
	var req struct {
		Identifier           string         `json:"identifier"`
		IdentifierHash       string         `json:"identifier_hash"`
		Email                string         `json:"email"`
		Name                 string         `json:"name"`
		AvatarURL            string         `json:"avatar_url"`
		PhoneNumber          string         `json:"phone_number"`
		CustomAttributes     map[string]any `json:"custom_attributes"`
		AdditionalAttributes map[string]any `json:"additional_attributes"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request body", "details": err.Error()})
		return
	}
	identifierHash := req.IdentifierHash
	if identifierHash == "" {
		identifierHash = c.Query("identifier_hash")
	}
	resp, err := h.widgetService.SetUser(c.Request.Context(), service.WidgetSetUserRequest{
		WebsiteToken:         c.Query("website_token"),
		WidgetToken:          widgetToken,
		Identifier:           req.Identifier,
		IdentifierHash:       identifierHash,
		Email:                req.Email,
		Name:                 req.Name,
		AvatarURL:            req.AvatarURL,
		PhoneNumber:          req.PhoneNumber,
		CustomAttributes:     req.CustomAttributes,
		AdditionalAttributes: req.AdditionalAttributes,
	})
	if err != nil {
		c.JSON(widgetErrorStatus(err), gin.H{"error": err.Error()})
		return
	}
	payload := widgetContactPayload(resp.Contact)
	if resp.WidgetAuthToken != "" {
		payload["widget_auth_token"] = resp.WidgetAuthToken
	}
	c.JSON(http.StatusOK, payload)
}

// ToggleTyping signals that the contact is typing or stopped typing.
// POST /widget/conversations/:id/toggle_typing
// Reference: Chatwoot widget SDK — typing indicator
func (h *WidgetHandler) ToggleTyping(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}

	var conversationID uint64
	var err error
	conversationIDStr := c.Param("id")
	if conversationIDStr != "" {
		conversationID, err = strconv.ParseUint(conversationIDStr, 10, 32)
		if err != nil {
			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid conversation id"})
			return
		}
	} else {
		conversation, convErr := h.widgetService.GetLatestConversation(c.Request.Context(), widgetToken)
		if convErr != nil {
			c.JSON(http.StatusNotFound, gin.H{"error": convErr.Error()})
			return
		}
		conversationID = uint64(conversation.ID)
	}

	var req struct {
		Typing       bool   `json:"typing"`
		TypingStatus string `json:"typing_status"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		// Default to typing=true if no body provided
		req.Typing = true
	}
	if req.TypingStatus == "on" {
		req.Typing = true
	} else if req.TypingStatus == "off" {
		req.Typing = false
	}

	err = h.widgetService.ToggleTyping(c.Request.Context(), widgetToken, uint(conversationID), req.Typing)
	if err != nil {
		status := http.StatusBadRequest
		if err.Error() == "invalid widget_token" {
			status = http.StatusUnauthorized
		}
		c.JSON(status, gin.H{"error": err.Error()})
		return
	}

	c.JSON(http.StatusOK, gin.H{"status": "ok"})
}

func (h *WidgetHandler) UpdateLastSeen(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}
	conversation, err := h.widgetService.UpdateLastSeen(c.Request.Context(), widgetToken)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}
	c.JSON(http.StatusOK, gin.H{"contact_last_seen_at": conversation.ContactLastSeenAt})
}

func (h *WidgetHandler) ToggleStatus(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}
	conversation, err := h.widgetService.ResolveLatestConversation(c.Request.Context(), widgetToken)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}
	c.JSON(http.StatusOK, widgetConversationPayload(*conversation))
}

func (h *WidgetHandler) SetConversationCustomAttributes(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}
	var req struct {
		CustomAttributes map[string]any `json:"custom_attributes"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request body", "details": err.Error()})
		return
	}
	conversation, err := h.widgetService.SetLatestConversationCustomAttributes(c.Request.Context(), widgetToken, req.CustomAttributes)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}
	c.JSON(http.StatusOK, conversation)
}

func (h *WidgetHandler) DestroyConversationCustomAttributes(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}
	var req struct {
		CustomAttribute []string `json:"custom_attribute"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request body", "details": err.Error()})
		return
	}
	conversation, err := h.widgetService.DeleteLatestConversationCustomAttributes(c.Request.Context(), widgetToken, req.CustomAttribute)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}
	c.JSON(http.StatusOK, conversation)
}

func (h *WidgetHandler) ListInboxMembers(c *gin.Context) {
	websiteToken := c.Query("website_token")
	if websiteToken == "" {
		c.JSON(http.StatusBadRequest, gin.H{"error": "website_token is required"})
		return
	}
	members, err := h.widgetService.GetInboxMembersByWebsiteToken(c.Request.Context(), websiteToken)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}
	c.JSON(http.StatusOK, gin.H{"payload": members})
}

func (h *WidgetHandler) ListCampaigns(c *gin.Context) {
	websiteToken := c.Query("website_token")
	if websiteToken == "" {
		c.JSON(http.StatusBadRequest, gin.H{"error": "website_token is required"})
		return
	}
	campaigns, err := h.widgetService.GetCampaignsByWebsiteToken(c.Request.Context(), websiteToken)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}
	c.JSON(http.StatusOK, campaigns)
}

func (h *WidgetHandler) CreateEvent(c *gin.Context) {
	websiteToken := c.Query("website_token")
	var req struct {
		Name      string         `json:"name"`
		EventInfo map[string]any `json:"event_info"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request body", "details": err.Error()})
		return
	}
	if err := h.widgetService.TrackEvent(c.Request.Context(), websiteToken, widgetTokenFromRequest(c), req.Name, req.EventInfo); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}
	c.Status(http.StatusNoContent)
}

func (h *WidgetHandler) AddLabel(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}
	var req struct {
		Label string `json:"label"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request body", "details": err.Error()})
		return
	}
	if err := h.widgetService.AddLabelToLatestConversation(c.Request.Context(), widgetToken, req.Label); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}
	c.Status(http.StatusNoContent)
}

func (h *WidgetHandler) RemoveLabel(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}
	if err := h.widgetService.RemoveLabelFromLatestConversation(c.Request.Context(), widgetToken, c.Param("label_id")); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}
	c.Status(http.StatusNoContent)
}

func (h *WidgetHandler) SendTranscript(c *gin.Context) {
	widgetToken := widgetTokenFromRequest(c)
	if widgetToken == "" {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "widget_token required"})
		return
	}
	if err := h.widgetService.SendTranscript(c.Request.Context(), widgetToken); err != nil {
		status := widgetErrorStatus(err)
		if strings.Contains(err.Error(), "conversation not found") {
			status = http.StatusTooManyRequests
		}
		c.JSON(status, gin.H{"error": err.Error()})
		return
	}
	c.Status(http.StatusOK)
}

func (h *WidgetHandler) AddDyteParticipantToMeeting(c *gin.Context) {
	var req struct {
		MessageID uint `json:"message_id"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request body", "details": err.Error()})
		return
	}
	resp, err := h.widgetService.AddDyteParticipant(c.Request.Context(), c.Query("website_token"), req.MessageID)
	if err != nil {
		status := http.StatusUnprocessableEntity
		if strings.Contains(err.Error(), "website_token") {
			status = http.StatusBadRequest
		}
		c.JSON(status, gin.H{"error": err.Error()})
		return
	}
	c.JSON(http.StatusOK, resp)
}

// SubmitOfflineMessage handles a visitor submitting a message when agents are offline.
// POST /widget/offline_message
// Reference: Chatwoot widget SDK — when business_hours are disabled and no agents online,
// visitors can still leave their info + message which creates a pending conversation.
func (h *WidgetHandler) SubmitOfflineMessage(c *gin.Context) {
	websiteToken := c.Query("website_token")
	if websiteToken == "" {
		c.JSON(http.StatusBadRequest, gin.H{"error": "website_token is required"})
		return
	}

	// Resolve inbox from website_token
	inbox, err := h.widgetService.GetInboxByWebsiteToken(c.Request.Context(), websiteToken)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{"error": "invalid website_token"})
		return
	}

	var submission model.WidgetOfflineMessageSubmission
	if err := c.ShouldBindJSON(&submission); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request body", "details": err.Error()})
		return
	}

	referer := c.Request.Referer()
	browserInfo := c.GetHeader("User-Agent")

	msg, err := h.widgetService.SubmitOfflineMessage(
		c.Request.Context(),
		inbox.ID,
		inbox.AccountID,
		&submission,
		referer,
		browserInfo,
	)
	if err != nil {
		c.JSON(http.StatusUnprocessableEntity, gin.H{"error": err.Error()})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"offline_message": msg,
		"message":         "Your message has been recorded. An agent will respond when available.",
	})
}

func widgetTokenFromRequest(c *gin.Context) string {
	if token := c.GetHeader("X-Widget-Token"); token != "" {
		return token
	}
	if token := c.GetHeader("X-Auth-Token"); token != "" {
		return token
	}
	return c.Query("widget_token")
}

func bindWidgetSendMessageRequest(c *gin.Context) (service.WidgetSendMessageRequest, error) {
	var body struct {
		Content        string `json:"content"`
		ContentType    string `json:"content_type"`
		ConversationID *uint  `json:"conversation_id"`
		Message        struct {
			Content string `json:"content"`
		} `json:"message"`
	}
	if err := c.ShouldBindJSON(&body); err != nil {
		return service.WidgetSendMessageRequest{}, err
	}
	content := body.Content
	if content == "" {
		content = body.Message.Content
	}
	return service.WidgetSendMessageRequest{
		Content:        content,
		ContentType:    body.ContentType,
		ConversationID: body.ConversationID,
	}, nil
}

func widgetMessagePayload(message model.Message, conversationID uint) gin.H {
	return gin.H{
		"id":                 message.ID,
		"content":            message.Content,
		"inbox_id":           message.InboxID,
		"conversation_id":    conversationID,
		"message_type":       message.MessageType,
		"content_type":       message.ContentType,
		"content_attributes": message.ContentAttributes,
		"created_at":         message.CreatedAt.Unix(),
		"private":            message.Private,
		"source_id":          message.SourceID,
	}
}

func widgetConversationPayload(conversation model.Conversation) gin.H {
	return gin.H{
		"id":                   conversation.ID,
		"uuid":                 conversation.UUID,
		"inbox_id":             conversation.InboxID,
		"contact_last_seen_at": conversation.ContactLastSeenAt,
		"status":               conversation.Status,
		"custom_attributes":    conversation.CustomAttributes,
	}
}

func widgetContactPayload(contact *model.Contact) gin.H {
	return gin.H{
		"id":               contact.ID,
		"identifier":       contact.Identifier,
		"has_email":        contact.Email != "",
		"has_name":         contact.Name != "",
		"has_phone_number": contact.PhoneNumber != "",
	}
}

func widgetContactFullPayload(contact *model.Contact) gin.H {
	return gin.H{
		"id":                    contact.ID,
		"name":                  contact.Name,
		"email":                 contact.Email,
		"phone_number":          contact.PhoneNumber,
		"avatar_url":            contact.AvatarURL,
		"identifier":            contact.Identifier,
		"custom_attributes":     contact.CustomAttributes,
		"additional_attributes": contact.AdditionalAttributes,
	}
}

func widgetErrorStatus(err error) int {
	msg := err.Error()
	if strings.Contains(msg, "invalid widget_token") || strings.Contains(msg, "HMAC failed") {
		return http.StatusUnauthorized
	}
	if strings.Contains(msg, "not found") {
		return http.StatusNotFound
	}
	return http.StatusBadRequest
}