# Create new Stripe customer
stripe_customer_create() {
    local email="$1"
    local name="${2:-}"
    local project_name="${3:-}"

    if [[ -z "$email" ]]; then
        error "Email required"
        return 1
    fi

    local params=()
    params+=("email=${email}")

    if [[ -n "$name" ]]; then
        params+=("name=${name}")
    fi

    # Metadata for tracking
    params+=("metadata[source]=nself")
    params+=("metadata[created_at]=$(date -u +%Y-%m-%dT%H:%M:%SZ)")

    if [[ -n "$project_name" ]]; then
        params+=("metadata[project_name]=${project_name}")
    fi

    # Idempotency key based on email
    local idempotency_key
    idempotency_key=$(printf "%s_%s" "create_customer" "$email" | openssl dgst -sha256 | awk '{print $NF}')

    local response
    response=$(stripe_api_request POST "/customers" \
        "idempotency_key=${idempotency_key}" \
        "${params[@]}")

    if [[ -n "$response" ]]; then
        local customer_id
        customer_id=$(printf "%s" "$response" | grep -o '"id":"cus_[^"]*"' | cut -d'"' -f4)

        if [[ -n "$customer_id" ]]; then
            # Store in database
            billing_db_query "
                UPDATE billing_customers
                SET stripe_customer_id = '${customer_id}'
                WHERE email = '${email}';
            " >/dev/null

            success "Customer created: ${customer_id}"
            printf "%s" "$customer_id"
            return 0
        fi
    fi

    error "Failed to create customer"
    return 1
}

# Create new subscription
stripe_subscription_create() {
    local customer_id="$1"
    local price_id="$2"
    local trial_days="${3:-0}"

    if [[ -z "$customer_id" ]] || [[ -z "$price_id" ]]; then
        error "Customer ID and price ID required"
        return 1
    fi

    # Get Stripe customer ID
    local stripe_customer_id
    stripe_customer_id=$(billing_db_query "
        SELECT stripe_customer_id FROM billing_customers
        WHERE customer_id = '${customer_id}';
    " | tr -d ' ')

    info "Creating subscription for customer ${customer_id}"

    local params=()
    params+=("customer=${stripe_customer_id}")
    params+=("items[0][price]=${price_id}")

    if [[ $trial_days -gt 0 ]]; then
        params+=("trial_period_days=${trial_days}")
    fi

    # Expand response to include invoice details
    params+=("expand[]=latest_invoice")
    params+=("expand[]=latest_invoice.payment_intent")

    # Idempotency key
    local idempotency_key
    idempotency_key=$(printf "%s_%s_%s" "create_subscription" "$customer_id" "$price_id" | openssl dgst -sha256 | awk '{print $NF}')

    local response
    response=$(stripe_api_request POST "/subscriptions" \
        "idempotency_key=${idempotency_key}" \
        "${params[@]}")

    if [[ -n "$response" ]]; then
        local subscription_id status period_start period_end
        subscription_id=$(printf "%s" "$response" | grep -o '"id":"sub_[^"]*"' | head -1 | cut -d'"' -f4)
        status=$(printf "%s" "$response" | grep -o '"status":"[^"]*"' | head -1 | cut -d'"' -f4)
        period_start=$(printf "%s" "$response" | grep -o '"current_period_start":[0-9]*' | cut -d':' -f2)
        period_end=$(printf "%s" "$response" | grep -o '"current_period_end":[0-9]*' | cut -d':' -f2)

        # Store in database
        local plan_name
        plan_name=$(billing_db_query "
            SELECT plan_name FROM billing_plans
            WHERE stripe_price_id_monthly = '${price_id}' OR stripe_price_id_yearly = '${price_id}'
            LIMIT 1;
        " | tr -d ' ')

        billing_db_query "
            INSERT INTO billing_subscriptions
                (subscription_id, customer_id, plan_name, stripe_subscription_id, status,
                 current_period_start, current_period_end, created_at)
            VALUES
                ('${subscription_id}', '${customer_id}', '${plan_name}', '${subscription_id}',
                 '${status}', to_timestamp(${period_start}), to_timestamp(${period_end}), NOW())
            ON CONFLICT (stripe_subscription_id) DO UPDATE
            SET status = '${status}', updated_at = NOW();
        " >/dev/null

        success "Subscription created: ${subscription_id} (status: ${status})"
        printf "%s" "$subscription_id"
        return 0
    fi

    error "Failed to create subscription"
    return 1
}

# Generate idempotency key
stripe_generate_idempotency_key() {
    local operation="$1"
    local identifier="$2"
    local timestamp
    timestamp=$(date +%s)

    printf "%s_%s_%s" "$operation" "$identifier" "$timestamp" | openssl dgst -sha256 | awk '{print $NF}'
}

# Make Stripe API request with retry logic and idempotency
stripe_api_request() {
    local method="$1"
    local endpoint="$2"
    shift 2
    local params=("$@")

    local idempotency_key=""
    local max_retries=3
    local retry_count=0

    if [[ -z "$STRIPE_SECRET_KEY" ]]; then
        error "STRIPE_SECRET_KEY not configured"
        return 1
    fi

    # Parse idempotency key from params if provided
    local final_params=()
    for param in "${params[@]}"; do
        if [[ "$param" == idempotency_key=* ]]; then
            idempotency_key="${param#*=}"
        else
            final_params+=("$param")
        fi
    done

    # Create secure temp file
    local curl_config
    curl_config=$(mktemp) || return 1
    trap "rm -f '$curl_config'" RETURN
    chmod 600 "$curl_config"

    cat > "$curl_config" <<EOF
user = ":${STRIPE_SECRET_KEY}"
EOF
    chmod 400 "$curl_config"

    local url="${STRIPE_API_BASE}${endpoint}"

    # Retry loop
    while [[ $retry_count -lt $max_retries ]]; do
        local curl_opts=(-s -w "\n%{http_code}" --config "$curl_config" -X "$method")
        curl_opts+=(-H "Stripe-Version: ${STRIPE_API_VERSION}")

        # Add idempotency key for POST/DELETE
        if [[ ("$method" == "POST" || "$method" == "DELETE") ]] && [[ -n "$idempotency_key" ]]; then
            curl_opts+=(-H "Idempotency-Key: ${idempotency_key}")
        fi

        # Add parameters
        if [[ ${#final_params[@]} -gt 0 ]]; then
            for param in "${final_params[@]}"; do
                curl_opts+=(-d "$param")
            done
        fi

        # Make request
        local full_response
        full_response=$(curl "${curl_opts[@]}" "$url" 2>/dev/null)

        # Extract status code
        local http_code
        http_code=$(printf "%s" "$full_response" | tail -n1)
        local response
        response=$(printf "%s" "$full_response" | sed '$d')

        # Handle status codes
        case "$http_code" in
            200|201|204)
                # Check for error in body
                if printf "%s" "$response" | grep -q '"error"'; then
                    local error_msg
                    error_msg=$(printf "%s" "$response" | grep -o '"message":"[^"]*"' | cut -d'"' -f4)
                    error "Stripe API error: ${error_msg}"
                    return 1
                fi
                printf "%s" "$response"
                return 0
                ;;
            400|401|402|404)
                error "Stripe API error: HTTP ${http_code}"
                return 1
                ;;
            409)
                # Idempotent request already processed - this is OK
                warn "Idempotent request already processed"
                printf "%s" "$response"
                return 0
                ;;
            429|500|502|503|504)
                # Retry with exponential backoff
                local wait_time=$((2 ** retry_count))
                warn "Stripe API error ${http_code} - retrying in ${wait_time}s (attempt $((retry_count + 1))/${max_retries})"
                sleep "$wait_time"
                ((retry_count++))
                continue
                ;;
            *)
                error "Unexpected HTTP code: ${http_code}"
                return 1
                ;;
        esac
    done

    error "Stripe API request failed after ${max_retries} retries"
    return 1
}

# Verify webhook signature
stripe_webhook_verify_signature() {
    local payload="$1"
    local signature_header="$2"
    local webhook_secret="${3:-$STRIPE_WEBHOOK_SECRET}"

    if [[ -z "$webhook_secret" ]]; then
        error "STRIPE_WEBHOOK_SECRET not configured"
        return 1
    fi

    # Extract timestamp and signature
    local timestamp signature
    timestamp=$(printf "%s" "$signature_header" | grep -o 't=[0-9]*' | cut -d= -f2)
    signature=$(printf "%s" "$signature_header" | grep -o 'v1=[a-f0-9]*' | cut -d= -f2)

    if [[ -z "$timestamp" ]] || [[ -z "$signature" ]]; then
        error "Invalid signature header"
        return 1
    fi

    # Check timestamp tolerance (5 minutes)
    local current_time
    current_time=$(date +%s)
    local time_diff=$((current_time - timestamp))

    if [[ $time_diff -gt 300 ]] || [[ $time_diff -lt -300 ]]; then
        error "Webhook timestamp outside tolerance: ${time_diff}s"
        return 1
    fi

    # Compute expected signature
    local signed_payload="${timestamp}.${payload}"
    local expected_signature
    expected_signature=$(printf "%s" "$signed_payload" | openssl dgst -sha256 -hmac "$webhook_secret" | awk '{print $NF}')

    # Compare signatures
    if [[ "$signature" == "$expected_signature" ]]; then
        return 0
    else
        error "Webhook signature verification failed"
        return 1
    fi
}

# Handle webhook event
stripe_webhook_handle() {
    local event_json="$1"

    # Extract event type and ID
    local event_type event_id
    event_type=$(printf "%s" "$event_json" | grep -o '"type":"[^"]*"' | cut -d'"' -f4)
    event_id=$(printf "%s" "$event_json" | grep -o '"id":"evt_[^"]*"' | cut -d'"' -f4)

    info "Processing webhook: ${event_type} (${event_id})"

    # Check if already processed (idempotency)
    local existing
    existing=$(billing_db_query "
        SELECT event_id FROM billing_events
        WHERE stripe_event_id = '${event_id}';
    " | tr -d ' ')

    if [[ -n "$existing" ]]; then
        warn "Event already processed: ${event_id}"
        return 0
    fi

    # Log event
    billing_db_query "
        INSERT INTO billing_events (stripe_event_id, event_type, payload, processed)
        VALUES ('${event_id}', '${event_type}', '${event_json}', false);
    " >/dev/null

    # Handle specific events
    case "$event_type" in
        customer.subscription.created|customer.subscription.updated)
            stripe_webhook_handle_subscription_change "$event_json"
            ;;
        customer.subscription.deleted)
            stripe_webhook_handle_subscription_deleted "$event_json"
            ;;
        invoice.paid)
            stripe_webhook_handle_invoice_paid "$event_json"
            ;;
        invoice.payment_failed)
            stripe_webhook_handle_invoice_payment_failed "$event_json"
            ;;
        *)
            warn "Unhandled event type: ${event_type}"
            ;;
    esac

    # Mark as processed
    billing_db_query "
        UPDATE billing_events
        SET processed = true, processed_at = NOW()
        WHERE stripe_event_id = '${event_id}';
    " >/dev/null

    success "Event processed: ${event_id}"
}

# Webhook event handlers
stripe_webhook_handle_subscription_change() {
    local event_json="$1"
    local sub_id status
    sub_id=$(printf "%s" "$event_json" | grep -o '"id":"sub_[^"]*"' | head -1 | cut -d'"' -f4)
    status=$(printf "%s" "$event_json" | grep -o '"status":"[^"]*"' | head -1 | cut -d'"' -f4)

    billing_db_query "
        UPDATE billing_subscriptions
        SET status = '${status}', updated_at = NOW()
        WHERE stripe_subscription_id = '${sub_id}';
    " >/dev/null
}

stripe_webhook_handle_subscription_deleted() {
    local event_json="$1"
    local sub_id
    sub_id=$(printf "%s" "$event_json" | grep -o '"id":"sub_[^"]*"' | head -1 | cut -d'"' -f4)

    billing_db_query "
        UPDATE billing_subscriptions
        SET status = 'canceled', canceled_at = NOW(), updated_at = NOW()
        WHERE stripe_subscription_id = '${sub_id}';
    " >/dev/null
}

stripe_webhook_handle_invoice_paid() {
    local event_json="$1"
    local invoice_id
    invoice_id=$(printf "%s" "$event_json" | grep -o '"id":"in_[^"]*"' | head -1 | cut -d'"' -f4)

    billing_db_query "
        UPDATE billing_invoices
        SET status = 'paid', paid_at = NOW()
        WHERE stripe_invoice_id = '${invoice_id}';
    " >/dev/null
}

stripe_webhook_handle_invoice_payment_failed() {
    local event_json="$1"
    local invoice_id
    invoice_id=$(printf "%s" "$event_json" | grep -o '"id":"in_[^"]*"' | head -1 | cut -d'"' -f4)

    billing_db_query "
        UPDATE billing_invoices
        SET status = 'payment_failed'
        WHERE stripe_invoice_id = '${invoice_id}';
    " >/dev/null
}

# Create draft invoice
stripe_invoice_create() {
    local customer_id="$1"
    local description="${2:-Monthly subscription invoice}"

    if [[ -z "$customer_id" ]]; then
        error "Customer ID required"
        return 1
    fi

    local stripe_customer_id
    stripe_customer_id=$(billing_db_query "
        SELECT stripe_customer_id FROM billing_customers
        WHERE customer_id = '${customer_id}';
    " | tr -d ' ')

    info "Creating invoice for ${customer_id}"

    local params=()
    params+=("customer=${stripe_customer_id}")
    params+=("description=${description}")
    params+=("auto_advance=true")

    local response
    response=$(stripe_api_request POST "/invoices" "${params[@]}")

    if [[ -n "$response" ]]; then
        local invoice_id
        invoice_id=$(printf "%s" "$response" | grep -o '"id":"in_[^"]*"' | cut -d'"' -f4)

        success "Invoice created: ${invoice_id}"
        printf "%s" "$invoice_id"
        return 0
    fi

    error "Failed to create invoice"
    return 1
}

# Finalize invoice (make immutable and ready for payment)
stripe_invoice_finalize() {
    local invoice_id="$1"

    if [[ -z "$invoice_id" ]]; then
        error "Invoice ID required"
        return 1
    fi

    info "Finalizing invoice: ${invoice_id}"

    local response
    response=$(stripe_api_request POST "/invoices/${invoice_id}/finalize")

    if [[ -n "$response" ]]; then
        local status
        status=$(printf "%s" "$response" | grep -o '"status":"[^"]*"' | cut -d'"' -f4)

        success "Invoice finalized (status: ${status})"
        return 0
    fi

    error "Failed to finalize invoice"
    return 1
}

export -f stripe_generate_idempotency_key
export -f stripe_customer_create
export -f stripe_subscription_create
export -f stripe_invoice_create
export -f stripe_invoice_finalize
export -f stripe_webhook_verify_signature
export -f stripe_webhook_handle
export -f stripe_webhook_handle_subscription_change
export -f stripe_webhook_handle_subscription_deleted
export -f stripe_webhook_handle_invoice_paid
export -f stripe_webhook_handle_invoice_payment_failed