// Copyright 2026 Alibaba Group
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package app

import (
	"bytes"
	"context"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"io"
	"os"
	"path/filepath"
	"runtime"
	"strings"
	"time"

	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/helpers"
	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/keychain"
	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
	"github.com/spf13/cobra"
)

type authLoginConfig struct {
	Token  string
	Force  bool
	Device bool
}

func buildAuthCommand() *cobra.Command {
	cmd := &cobra.Command{
		Use:               "auth",
		Short:             "认证管理",
		Long:              "管理钉钉 CLI 的认证凭证。支持 OAuth 扫码登录和 Device Flow。",
		Args:              cobra.NoArgs,
		TraverseChildren:  true,
		DisableAutoGenTag: true,
		RunE: func(cmd *cobra.Command, args []string) error {
			return cmd.Help()
		},
	}

	if !edition.Get().HideAuthLogin {
		cmd.AddCommand(newAuthLoginCommand())
	}
	cmd.AddCommand(
		newAuthLogoutCommand(),
		newAuthStatusCommand(),
		newAuthExportCommand(),
		newAuthImportCommand(),
		newAuthExchangeCommand(),
		newAuthResetCommand(),
	)
	return cmd
}

func newAuthLoginCommand() *cobra.Command {
	cmd := &cobra.Command{
		Use:   "login",
		Short: "登录钉钉（自动刷新 token，必要时扫码）",
		Long: `登录钉钉并获取认证凭证。

支持的登录方式:
  - OAuth Loopback 流 (默认): 本机自动起 127.0.0.1 监听接收回调，浏览器授权后自动完成
  - OAuth 设备流 (--device): 显示 user_code + 短 URL，适合 SSH 远程 / 容器 / 无头环境
  - 直接提供 Token (--token): 跳过授权，使用已有 token

不支持的登录方式:
  - 邮箱/密码登录
  - 手机号/验证码登录
  - 应用凭证 (AppKey/AppSecret) 直接登录

注意: SSH 远程或无头环境（无本地浏览器可访问远端的 127.0.0.1）请使用 --device，
      否则 OAuth 回调会跳到本机不可达的 127.0.0.1 链接，授权完成后无法回写 token。

示例:
  dws auth login              # 本机扫码登录 (loopback 流)
  dws auth login --device     # SSH 远程 / 无头环境登录 (设备流)
  dws auth login --force      # 强制重新登录 (忽略缓存 token)
  dws auth login --token xxx  # 使用指定 token`,
		DisableAutoGenTag: true,
		RunE: func(cmd *cobra.Command, args []string) error {
			cfg, err := resolveAuthLoginConfig(cmd)
			if err != nil {
				return err
			}
			configDir := defaultConfigDir()
			var tokenData *authpkg.TokenData

			switch {
			case strings.TrimSpace(cfg.Token) != "":
				tokenData = &authpkg.TokenData{
					AccessToken: cfg.Token,
					ExpiresAt:   time.Now().Add(config.ManualTokenExpiry),
				}
				if err := authpkg.SaveTokenData(configDir, tokenData); err != nil {
					return apperrors.NewInternal(fmt.Sprintf("failed to persist auth token: %v", err))
				}
			case cfg.Device:
				loginCtx, cancel := context.WithTimeout(cmd.Context(), config.DeviceFlowTimeout)
				defer cancel()

				provider := authpkg.NewDeviceFlowProvider(configDir, nil)
				provider.Output = cmd.ErrOrStderr()
				provider.NoBrowser, _ = cmd.Flags().GetBool("no-browser")
				tokenData, err = provider.Login(loginCtx)
				if err != nil {
					return apperrors.NewAuth(fmt.Sprintf("device authorization failed: %v", err))
				}
			default:
				loginCtx, cancel := context.WithTimeout(cmd.Context(), config.OAuthFlowTimeout)
				defer cancel()

				provider := authpkg.NewOAuthProvider(configDir, nil)
				provider.Output = cmd.ErrOrStderr()
				provider.NoBrowser, _ = cmd.Flags().GetBool("no-browser")
				configureOAuthProviderCompatibility(provider, configDir)
				tokenData, err = provider.Login(loginCtx, cfg.Force)
				if err != nil {
					return apperrors.NewAuth(fmt.Sprintf("dingtalk login failed: %v", err))
				}
			}

			ResetRuntimeTokenCache()
			clearCompatCache()

			w := cmd.OutOrStdout()

			// Check if JSON output is requested
			format, _ := cmd.Root().PersistentFlags().GetString("format")
			if strings.EqualFold(strings.TrimSpace(format), "json") {
				return writeAuthLoginJSON(w, tokenData, cfg.Force)
			}

			// Default table output
			fmt.Fprintln(w)
			if !cfg.Device && tokenData != nil && tokenData.IsAccessTokenValid() && !cfg.Force {
				fmt.Fprintf(w, "[OK] Token 有效，无需重新登录\n")
			} else {
				fmt.Fprintf(w, "[OK] 登录成功！\n")
			}
			if tokenData != nil {
				if tokenData.CorpName != "" {
					fmt.Fprintf(w, "%-16s%s\n", "企业:", tokenData.CorpName)
				}
				if tokenData.CorpID != "" {
					fmt.Fprintf(w, "%-16s%s\n", "企业 ID:", tokenData.CorpID)
				}
				if tokenData.UserName != "" {
					fmt.Fprintf(w, "%-16s%s\n", "用户:", tokenData.UserName)
				}
				if expiry := authLoginDisplayExpiry(tokenData); expiry != "" {
					fmt.Fprintf(w, "%-16s%s\n", "有效期:", expiry)
				}
			}
			fmt.Fprintf(w, "Token 将自动刷新，无需重复登录\n")
			return nil
		},
	}
	cmd.Flags().String("token", "", "Access token")
	cmd.Flags().Bool("device", false, "Use device authorization flow")
	cmd.Flags().Bool("force", false, "Force interactive login (ignore cached token)")
	// Hidden compatibility flags
	cmd.Flags().String("redirect-url", "", "Loopback redirect URL")
	cmd.Flags().String("scopes", "", "Space-separated DingTalk OAuth scopes")
	cmd.Flags().String("authorize-url", "", "Override DingTalk authorization URL")
	cmd.Flags().String("token-url", "", "Override DingTalk token exchange URL")
	cmd.Flags().String("refresh-url", "", "Override DingTalk refresh token URL")
	cmd.Flags().Int("login-timeout", 0, "Login timeout seconds")
	cmd.Flags().Bool("no-browser", false, "Suppress browser launch")
	_ = cmd.Flags().MarkHidden("redirect-url")
	_ = cmd.Flags().MarkHidden("scopes")
	_ = cmd.Flags().MarkHidden("authorize-url")
	_ = cmd.Flags().MarkHidden("token-url")
	_ = cmd.Flags().MarkHidden("refresh-url")
	_ = cmd.Flags().MarkHidden("login-timeout")
	return cmd
}

func newAuthLogoutCommand() *cobra.Command {
	return &cobra.Command{
		Use:               "logout",
		Short:             "清除认证信息",
		DisableAutoGenTag: true,
		RunE: func(cmd *cobra.Command, args []string) error {
			configDir := defaultConfigDir()
			revokeCtx, cancel := context.WithTimeout(cmd.Context(), 15*time.Second)
			defer cancel()
			_ = authpkg.RevokeTokenRemote(revokeCtx)

			// Load token data to get associated clientId before deletion
			var storedClientID string
			if tokenData, err := authpkg.LoadTokenData(configDir); err == nil && tokenData != nil {
				storedClientID = tokenData.ClientID
			}

			if err := authpkg.DeleteTokenData(configDir); err != nil {
				return apperrors.NewInternal(fmt.Sprintf("failed to clear token data: %v", err))
			}
			// Clean up associated client secret and app token from keychain
			if storedClientID != "" {
				_ = authpkg.DeleteClientSecret(storedClientID)
				_ = authpkg.DeleteAppTokenData(storedClientID)
			}
			// Also try cleaning app token using appKey from app config
			if appKey, _ := authpkg.ResolveAppCredentials(configDir); appKey != "" && appKey != storedClientID {
				_ = authpkg.DeleteAppTokenData(appKey)
			}
			// Clean up app credentials (app.json + keychain secret)
			_ = authpkg.DeleteAppConfig(configDir)
			_ = os.Remove(filepath.Join(configDir, "mcp_url"))
			_ = os.Remove(filepath.Join(configDir, "token"))
			_ = os.Remove(filepath.Join(configDir, "token.json"))
			ResetRuntimeTokenCache()
			clearCompatCache()
			w := cmd.OutOrStdout()
			fmt.Fprintln(w, "[OK] 已清除所有认证信息")
			if !edition.Get().IsEmbedded {
				fmt.Fprintln(w, "请运行 dws auth login 重新登录")
			}
			return nil
		},
	}
}

func newAuthStatusCommand() *cobra.Command {
	return &cobra.Command{
		Use:               "status",
		Short:             "查看认证状态",
		DisableAutoGenTag: true,
		RunE: func(cmd *cobra.Command, args []string) error {
			configDir := defaultConfigDir()

			authenticated := false
			refreshed := false
			var tokenData *authpkg.TokenData
			provider := authpkg.NewOAuthProvider(configDir, nil)
			configureOAuthProviderCompatibility(provider, configDir)
			if data, err := provider.Status(); err == nil {
				tokenData = data
				if !data.IsAccessTokenValid() && data.IsRefreshTokenValid() {
					refreshCtx, cancel := context.WithTimeout(cmd.Context(), 15*time.Second)
					_, refreshErr := provider.GetAccessToken(refreshCtx)
					cancel()
					if refreshErr == nil {
						if updatedData, statusErr := provider.Status(); statusErr == nil {
							tokenData = updatedData
							refreshed = true
						}
					} else if edition.Get().AutoPurgeToken {
						_ = authpkg.DeleteTokenData(configDir)
					}
				}
				if authStatusAuthenticated(tokenData) {
					authenticated = true
				}
			}

			// Check if JSON output is requested
			format, _ := cmd.Root().PersistentFlags().GetString("format")
			if strings.EqualFold(strings.TrimSpace(format), "json") {
				return writeAuthStatusJSON(cmd.OutOrStdout(), authenticated, refreshed, tokenData)
			}

			// Default table output
			w := cmd.OutOrStdout()
			if authenticated {
				if refreshed {
					fmt.Fprintf(w, "%-16s%s\n", "状态:", "已登录 ✅")
					fmt.Fprintln(w, "Token 已自动刷新")
				} else {
					fmt.Fprintf(w, "%-16s%s\n", "状态:", "已登录 ✅")
				}
				if tokenData != nil {
					if tokenData.IsRefreshTokenValid() {
						fmt.Fprintf(w, "%-16s%s\n", "Refresh Token:", "有效 ✅")
					} else {
						fmt.Fprintf(w, "%-16s%s\n", "Refresh Token:", "缺失或已过期 ⚠️")
					}
				}
				if updatedAt := authStatusUpdatedAt(tokenData); updatedAt != "" {
					fmt.Fprintf(w, "%-16s%s\n", "有效期:", updatedAt)
				}
			} else {
				fmt.Fprintf(w, "%-16s%s\n", "状态:", "未登录")
				if !edition.Get().IsEmbedded {
					fmt.Fprintln(w, "运行 dws auth login 进行登录")
				}
			}
			return nil
		},
	}
}

func newAuthExportCommand() *cobra.Command {
	cmd := &cobra.Command{
		Use:   "export",
		Short: "导出可迁移认证包",
		Long: `导出包含 refresh token 与解密材料的认证包，便于在另一台 Linux 沙箱中导入。

包内包含 ~/.local/share/dws-cli 加密 keychain 与 ~/.dws 必要配置，不含 token 明文。

示例:
  dws auth export -o dws-auth.tar.gz
  dws auth export --base64 > dws-auth.b64`,
		DisableAutoGenTag: true,
		RunE: func(cmd *cobra.Command, args []string) error {
			output, err := cmd.Flags().GetString("output")
			if err != nil {
				return apperrors.NewInternal("failed to read --output")
			}
			asBase64, err := cmd.Flags().GetBool("base64")
			if err != nil {
				return apperrors.NewInternal("failed to read --base64")
			}
			output = strings.TrimSpace(output)
			if !asBase64 && output == "" {
				return apperrors.NewValidation("--output is required unless --base64 is used")
			}
			if !authpkg.PortableExportSupported() {
				return apperrors.NewValidation(fmt.Sprintf(
					"macOS 默认将 DEK 存在系统 Keychain，导出的包无法在其它机器解密；请设置 %s=1 后重新登录再导出",
					keychain.DisableKeychainEnv,
				))
			}
			if !authpkg.PortableAuthSourceReady() {
				return apperrors.NewValidation("尚未登录，请先运行 dws auth login")
			}

			var bundle bytes.Buffer
			if err := authpkg.ExportPortableAuthBundle(defaultConfigDir(), &bundle); err != nil {
				return apperrors.NewInternal(fmt.Sprintf("failed to export auth bundle: %v", err))
			}

			if asBase64 {
				payload := []byte(base64.StdEncoding.EncodeToString(bundle.Bytes()) + "\n")
				if output == "" {
					_, err := cmd.OutOrStdout().Write(payload)
					return err
				}
				if err := helpers.AtomicWrite(output, payload, config.FilePerm); err != nil {
					return apperrors.NewInternal(fmt.Sprintf("failed to write auth bundle: %v", err))
				}
				fmt.Fprintf(cmd.OutOrStdout(), "[OK] 已导出认证包: %s\n", output)
				fmt.Fprintf(cmd.ErrOrStderr(), "认证包含敏感凭据，用完请删除: rm -P %s\n", output)
				return nil
			}

			if err := helpers.AtomicWrite(output, bundle.Bytes(), config.FilePerm); err != nil {
				return apperrors.NewInternal(fmt.Sprintf("failed to write auth bundle: %v", err))
			}
			fmt.Fprintf(cmd.OutOrStdout(), "[OK] 已导出认证包: %s\n", output)
			fmt.Fprintf(cmd.ErrOrStderr(), "认证包含敏感凭据，用完请删除: rm -P %s\n", output)
			return nil
		},
	}
	cmd.Flags().StringP("output", "o", "", "认证包输出路径")
	cmd.Flags().Bool("base64", false, "将认证包编码为 base64，便于复制粘贴")
	return cmd
}

func newAuthImportCommand() *cobra.Command {
	cmd := &cobra.Command{
		Use:   "import",
		Short: "导入可迁移认证包",
		Long: `从 dws auth export 生成的 tar.gz 或 base64 文件恢复认证。

导入后请运行 dws auth status 确认 refresh token 仍有效。

示例:
  dws auth import -i dws-auth.tar.gz
  dws auth import -i dws-auth.b64 --base64`,
		DisableAutoGenTag: true,
		RunE: func(cmd *cobra.Command, args []string) error {
			input, err := cmd.Flags().GetString("input")
			if err != nil {
				return apperrors.NewInternal("failed to read --input")
			}
			input = strings.TrimSpace(input)
			if input == "" {
				return apperrors.NewValidation("--input is required")
			}
			asBase64, err := cmd.Flags().GetBool("base64")
			if err != nil {
				return apperrors.NewInternal("failed to read --base64")
			}
			force, err := cmd.Flags().GetBool("force")
			if err != nil {
				return apperrors.NewInternal("failed to read --force")
			}

			configDir := defaultConfigDir()
			if !force && authpkg.PortableAuthTargetPopulated(configDir) {
				return apperrors.NewValidation("检测到已有登录态，请使用 --force 确认覆盖")
			}

			payload, err := os.ReadFile(input)
			if err != nil {
				return apperrors.NewInternal(fmt.Sprintf("failed to read auth bundle: %v", err))
			}
			if asBase64 {
				payload, err = base64.StdEncoding.DecodeString(strings.TrimSpace(string(payload)))
				if err != nil {
					return apperrors.NewValidation(fmt.Sprintf("invalid base64 auth bundle: %v", err))
				}
			}
			report, err := authpkg.ImportPortableAuthBundle(configDir, bytes.NewReader(payload))
			if err != nil {
				return apperrors.NewInternal(fmt.Sprintf("failed to import auth bundle: %v", err))
			}
			if report.OSMismatch {
				fmt.Fprintf(cmd.ErrOrStderr(), "警告: 认证包来自 %s，当前系统为 %s，请确认解密材料兼容\n", report.BundleOS, runtime.GOOS)
			}
			ResetRuntimeTokenCache()
			clearCompatCache()
			fmt.Fprintln(cmd.OutOrStdout(), "[OK] 已导入认证包")
			fmt.Fprintln(cmd.OutOrStdout(), "请运行 dws auth status 验证登录状态")
			return nil
		},
	}
	cmd.Flags().StringP("input", "i", "", "认证包输入路径")
	cmd.Flags().Bool("base64", false, "输入为 base64 编码的认证包")
	cmd.Flags().Bool("force", false, "覆盖已有登录态")
	return cmd
}

func newAuthExchangeCommand() *cobra.Command {
	cmd := &cobra.Command{
		Use:               "exchange",
		Short:             "Exchange an authorization code for credentials",
		Hidden:            true,
		DisableAutoGenTag: true,
		RunE: func(cmd *cobra.Command, args []string) error {
			code, err := cmd.Flags().GetString("code")
			if err != nil {
				return apperrors.NewInternal("failed to read --code")
			}
			code = strings.TrimSpace(code)
			if code == "" {
				return apperrors.NewValidation("--code is required")
			}
			uid, err := cmd.Flags().GetString("uid")
			if err != nil {
				return apperrors.NewInternal("failed to read --uid")
			}

			configDir := defaultConfigDir()
			provider := authpkg.NewOAuthProvider(configDir, nil)
			configureOAuthProviderCompatibility(provider, configDir)
			exchangeCtx, cancel := context.WithTimeout(cmd.Context(), time.Minute)
			defer cancel()
			tokenData, err := provider.ExchangeAuthCode(exchangeCtx, code, strings.TrimSpace(uid))
			if err != nil {
				return apperrors.NewAuth(fmt.Sprintf("failed to exchange authorization code: %v", err))
			}
			ResetRuntimeTokenCache()
			clearCompatCache()

			w := cmd.OutOrStdout()
			fmt.Fprintln(w, "[OK] 授权码兑换成功！")
			if strings.TrimSpace(uid) != "" {
				fmt.Fprintf(w, "%-16s%s\n", "用户:", strings.TrimSpace(uid))
			}
			if strings.TrimSpace(tokenData.CorpID) != "" {
				fmt.Fprintf(w, "%-16s%s\n", "企业 ID:", tokenData.CorpID)
			}
			if !tokenData.ExpiresAt.IsZero() {
				fmt.Fprintf(w, "%-16s%s\n", "有效期:", authLoginFormatExpiry(tokenData.ExpiresAt))
			}
			return nil
		},
	}
	cmd.Flags().String("code", "", "Authorization code")
	cmd.Flags().String("uid", "", "Optional user identifier for compatibility")
	cmd.Flags().String("client-id", "", "Compatibility flag")
	cmd.Flags().String("authorize-url", "", "Compatibility flag")
	cmd.Flags().String("token-url", "", "Compatibility flag")
	cmd.Flags().String("refresh-url", "", "Compatibility flag")
	cmd.Flags().String("redirect-url", "", "Compatibility flag")
	cmd.Flags().String("scopes", "", "Compatibility flag")
	return cmd
}

func newAuthResetCommand() *cobra.Command {
	return &cobra.Command{
		Use:               "reset",
		Short:             "重置认证信息（清除本地 Token，触发重新授权）",
		DisableAutoGenTag: true,
		RunE: func(cmd *cobra.Command, args []string) error {
			configDir := defaultConfigDir()
			if err := authpkg.DeleteTokenData(configDir); err != nil {
				return apperrors.NewInternal(fmt.Sprintf("failed to reset token data: %v", err))
			}
			_ = os.Remove(filepath.Join(configDir, "mcp_url"))
			_ = os.Remove(filepath.Join(configDir, "token"))
			ResetRuntimeTokenCache()
			clearCompatCache()
			w := cmd.OutOrStdout()
			fmt.Fprintln(w, "[OK] 认证信息已重置")
			if !edition.Get().IsEmbedded {
				fmt.Fprintln(w, "请运行 dws auth login 重新登录")
			}
			return nil
		},
	}
}

func timeOrEmpty(t time.Time) string {
	if t.IsZero() {
		return ""
	}
	return t.UTC().Format(time.RFC3339)
}

func authLoginFormatExpiry(t time.Time) string {
	remaining := time.Until(t)
	if remaining <= 0 {
		return "已过期"
	}
	if remaining > 24*time.Hour {
		return fmt.Sprintf("%.0f 天后", remaining.Hours()/24)
	}
	return fmt.Sprintf("%.0f 小时后", remaining.Hours())
}

// authLoginDisplayExpiry 返回用于显示的有效期（优先显示 refresh token 有效期）
func authLoginDisplayExpiry(data *authpkg.TokenData) string {
	if data == nil {
		return ""
	}
	// 优先使用 refresh token 有效期（更长，对用户更有意义）
	if data.IsRefreshTokenValid() {
		return authLoginFormatExpiry(data.RefreshExpAt)
	}
	// 回退到 access token 有效期
	if !data.ExpiresAt.IsZero() {
		return authLoginFormatExpiry(data.ExpiresAt)
	}
	return ""
}

func clearCompatCache() {
	store := cacheStoreFromEnv()
	if store != nil {
		_ = os.RemoveAll(store.Root)
	}
}

func resolveAuthLoginConfig(cmd *cobra.Command) (authLoginConfig, error) {
	token, err := cmd.Flags().GetString("token")
	if err != nil {
		return authLoginConfig{}, apperrors.NewInternal("failed to read --token")
	}
	device, err := cmd.Flags().GetBool("device")
	if err != nil {
		return authLoginConfig{}, apperrors.NewInternal("failed to read --device")
	}
	force, err := cmd.Flags().GetBool("force")
	if err != nil {
		return authLoginConfig{}, apperrors.NewInternal("failed to read --force")
	}
	return authLoginConfig{
		Token:  strings.TrimSpace(token),
		Force:  force,
		Device: device,
	}, nil
}

func authStatusAuthenticated(data *authpkg.TokenData) bool {
	if data == nil {
		return false
	}
	return data.IsAccessTokenValid() || data.IsRefreshTokenValid()
}

func authStatusUpdatedAt(data *authpkg.TokenData) string {
	if data == nil {
		return ""
	}
	if data.IsAccessTokenValid() {
		return timeOrEmpty(data.ExpiresAt)
	}
	if data.IsRefreshTokenValid() {
		return timeOrEmpty(data.RefreshExpAt)
	}
	return ""
}

// authStatusResponse is the JSON response for auth status command.
type authStatusResponse struct {
	Success           bool   `json:"success"`
	Authenticated     bool   `json:"authenticated"`
	Message           string `json:"message,omitempty"`
	Refreshed         bool   `json:"refreshed,omitempty"`
	TokenValid        bool   `json:"token_valid,omitempty"`
	RefreshTokenValid bool   `json:"refresh_token_valid,omitempty"`
	ExpiresAt         string `json:"expires_at,omitempty"`
	RefreshExpiresAt  string `json:"refresh_expires_at,omitempty"`
	CorpID            string `json:"corp_id,omitempty"`
	CorpName          string `json:"corp_name,omitempty"`
	UserID            string `json:"user_id,omitempty"`
	UserName          string `json:"user_name,omitempty"`
}

func writeAuthStatusJSON(w io.Writer, authenticated, refreshed bool, data *authpkg.TokenData) error {
	resp := authStatusResponse{
		Success:       true,
		Authenticated: authenticated,
	}

	if !authenticated {
		resp.Message = "未登录"
	} else if data != nil {
		resp.Refreshed = refreshed
		resp.TokenValid = data.IsAccessTokenValid()
		resp.RefreshTokenValid = data.IsRefreshTokenValid()
		if !data.ExpiresAt.IsZero() {
			resp.ExpiresAt = data.ExpiresAt.Format(time.RFC3339Nano)
		}
		if !data.RefreshExpAt.IsZero() {
			resp.RefreshExpiresAt = data.RefreshExpAt.Format(time.RFC3339Nano)
		}
		resp.CorpID = data.CorpID
		resp.CorpName = data.CorpName
		resp.UserID = data.UserID
		resp.UserName = data.UserName
	}

	enc := json.NewEncoder(w)
	enc.SetIndent("", "  ")
	return enc.Encode(resp)
}

// authLoginResponse is the JSON response for auth login command.
type authLoginResponse struct {
	Success           bool   `json:"success"`
	Message           string `json:"message"`
	TokenValid        bool   `json:"token_valid,omitempty"`
	RefreshTokenValid bool   `json:"refresh_token_valid,omitempty"`
	ExpiresAt         string `json:"expires_at,omitempty"`
	RefreshExpiresAt  string `json:"refresh_expires_at,omitempty"`
	CorpID            string `json:"corp_id,omitempty"`
	CorpName          string `json:"corp_name,omitempty"`
	UserID            string `json:"user_id,omitempty"`
	UserName          string `json:"user_name,omitempty"`
}

func writeAuthLoginJSON(w io.Writer, data *authpkg.TokenData, forced bool) error {
	resp := authLoginResponse{
		Success: true,
		Message: "登录成功",
	}

	if data != nil {
		if data.IsAccessTokenValid() && !forced {
			resp.Message = "Token 有效，无需重新登录"
		}
		resp.TokenValid = data.IsAccessTokenValid()
		resp.RefreshTokenValid = data.IsRefreshTokenValid()
		if !data.ExpiresAt.IsZero() {
			resp.ExpiresAt = data.ExpiresAt.Format(time.RFC3339Nano)
		}
		if !data.RefreshExpAt.IsZero() {
			resp.RefreshExpiresAt = data.RefreshExpAt.Format(time.RFC3339Nano)
		}
		resp.CorpID = data.CorpID
		resp.CorpName = data.CorpName
		resp.UserID = data.UserID
		resp.UserName = data.UserName
	}

	enc := json.NewEncoder(w)
	enc.SetIndent("", "  ")
	return enc.Encode(resp)
}