use std::future::Future;
use std::time::Duration;

use base64::Engine;
use base64::prelude::BASE64_URL_SAFE_NO_PAD;
use chrono::{DateTime, Utc};
use reqwest::Client;
use serde::Deserialize;
use serde::de::Error as DeError;
use serde_json::json;
use sha2::{Digest, Sha256};
use tokio::io::{AsyncReadExt, AsyncWriteExt};
use tokio::net::TcpListener;
use url::Url;
use uuid::Uuid;

use super::data::{AccountKind, BrowserLogin, DeviceCodeLogin, MinecraftAccount};
use super::error::{MinecraftAuthError, MinecraftAuthStep, friendly_xbox_error};
use oneclient_common::constants::{MICROSOFT_CLIENT_ID, MINECRAFT_SCOPES};

const DEVICE_CODE_URL: &str = "https://login.microsoftonline.com/consumers/oauth2/v2.0/devicecode";

const AUTHORIZE_URL: &str = "https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize";

const TOKEN_URL: &str = "https://login.microsoftonline.com/consumers/oauth2/v2.0/token";

const AUTH_STEPS: u64 = 5;

#[tracing::instrument(level = "debug", skip_all)]
pub async fn begin_device_login(client: &Client) -> Result<DeviceCodeLogin, MinecraftAuthError> {
    request_device_code(client).await
}

#[tracing::instrument(level = "debug", skip_all)]
pub async fn finish_dual_login(
    client: &Client,
    pending: PendingBrowserLogin,
    device: &DeviceCodeLogin,
    on_progress: impl Fn(&str, u64, u64),
) -> Result<MinecraftAccount, MinecraftAuthError> {
    tracing::info!("waiting for Microsoft sign-in (browser or device code)");
    on_progress("Waiting for sign-in", 0, AUTH_STEPS);

    let deadline = Duration::from_secs(device.expires_in);
    let msa = tokio::time::timeout(deadline, race_msa_token(client, &pending, device))
        .await
        .map_err(|_| MinecraftAuthError::DeviceAuthorizationExpired)??;

    account_from_msa_token(client, msa, on_progress).await
}

#[tracing::instrument(level = "debug", skip_all)]
async fn race_msa_token(
    client: &Client,
    pending: &PendingBrowserLogin,
    device: &DeviceCodeLogin,
) -> Result<MsaToken, MinecraftAuthError> {
    let browser = browser_msa_token(client, pending);
    let device = poll_device_token(client, device);
    tokio::pin!(browser, device);

    let mut browser_done = false;
    let mut device_done = false;
    let mut last_err: Option<MinecraftAuthError> = None;

    loop {
        tokio::select! {
            res = &mut browser, if !browser_done => match res {
                Ok(token) => return Ok(token),
                Err(err) => {
                    browser_done = true;
                    if device_done {
                        return Err(err);
                    }
                    last_err = Some(err);
                }
            },
            res = &mut device, if !device_done => match res {
                Ok(token) => return Ok(token),
                Err(err) => {
                    device_done = true;
                    if browser_done {
                        return Err(err);
                    }
                    last_err = Some(err);
                }
            },
            else => return Err(last_err.unwrap_or(MinecraftAuthError::DeviceAuthorizationExpired)),
        }
    }
}

pub struct PendingBrowserLogin {
    listener: TcpListener,
    pkce_verifier: String,
    redirect_uri: String,
    csrf_state: String,
}

#[tracing::instrument(level = "debug", skip_all)]
pub async fn begin_browser_login() -> Result<(BrowserLogin, PendingBrowserLogin), MinecraftAuthError>
{
    let listener = TcpListener::bind("127.0.0.1:0")
        .await
        .map_err(|err| MinecraftAuthError::LoopbackBind(err.to_string()))?;
    let port = listener
        .local_addr()
        .map_err(|err| MinecraftAuthError::LoopbackBind(err.to_string()))?
        .port();
    let redirect_uri = format!("http://127.0.0.1:{port}");

    let pkce_verifier = random_token();
    let code_challenge = pkce_challenge(&pkce_verifier);
    let csrf_state = random_token();

    let mut url = Url::parse(AUTHORIZE_URL).expect("authorize url is valid");
    url.query_pairs_mut()
        .append_pair("client_id", MICROSOFT_CLIENT_ID)
        .append_pair("response_type", "code")
        .append_pair("redirect_uri", &redirect_uri)
        .append_pair("response_mode", "query")
        .append_pair("scope", MINECRAFT_SCOPES)
        .append_pair("state", &csrf_state)
        .append_pair("code_challenge", &code_challenge)
        .append_pair("code_challenge_method", "S256")
        .append_pair("prompt", "select_account");

    let login = BrowserLogin {
        auth_url: url.to_string(),
        state: csrf_state.clone(),
        redirect_uri: redirect_uri.clone(),
    };
    let pending = PendingBrowserLogin {
        listener,
        pkce_verifier,
        redirect_uri,
        csrf_state,
    };

    Ok((login, pending))
}

#[tracing::instrument(level = "debug", skip_all)]
async fn browser_msa_token(
    client: &Client,
    pending: &PendingBrowserLogin,
) -> Result<MsaToken, MinecraftAuthError> {
    let code = wait_for_redirect(pending).await?;
    exchange_auth_code(client, &code, pending).await
}

#[tracing::instrument(level = "debug", skip_all)]
async fn wait_for_redirect(pending: &PendingBrowserLogin) -> Result<String, MinecraftAuthError> {
    loop {
        let (mut stream, _) = pending
            .listener
            .accept()
            .await
            .map_err(|err| MinecraftAuthError::LoopbackBind(err.to_string()))?;

        let mut buf = [0u8; 2048];
        let read = stream.read(&mut buf).await.unwrap_or(0);
        let request = String::from_utf8_lossy(&buf[..read]);
        let Some(target) = request.split_whitespace().nth(1) else {
            respond(&mut stream, RedirectPage::Waiting).await;
            continue;
        };

        if !target.contains('?') {
            respond(&mut stream, RedirectPage::Waiting).await;
            continue;
        }

        let full = format!("http://127.0.0.1{target}");
        let parsed = Url::parse(&full).ok();
        let mut code = None;
        let mut state = None;
        let mut error = None;
        if let Some(parsed) = &parsed {
            for (key, value) in parsed.query_pairs() {
                match key.as_ref() {
                    "code" => code = Some(value.into_owned()),
                    "state" => state = Some(value.into_owned()),
                    "error" => error = Some(value.into_owned()),
                    "error_description" => error = Some(value.into_owned()),
                    _ => {}
                }
            }
        }

        if let Some(error) = error {
            tracing::warn!(%error, "browser authorization failed");
            respond(&mut stream, RedirectPage::Failed).await;
            return Err(MinecraftAuthError::BrowserAuthorizationFailed { error });
        }

        if state.as_deref() != Some(pending.csrf_state.as_str()) {
            respond(&mut stream, RedirectPage::Failed).await;
            continue;
        }

        if let Some(code) = code {
            respond(&mut stream, RedirectPage::Success).await;
            return Ok(code);
        }

        respond(&mut stream, RedirectPage::Waiting).await;
    }
}

#[derive(Clone, Copy)]
enum RedirectPage {
    Waiting,
    Success,
    Failed,
}

async fn respond(stream: &mut tokio::net::TcpStream, page: RedirectPage) {
    let body = redirect_page_html(page);
    let response = format!(
        "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
        body.len(),
        body
    );
    let _ = stream.write_all(response.as_bytes()).await;
    let _ = stream.flush().await;
}

fn redirect_page_html(page: RedirectPage) -> String {
    let (accent, glyph, heading, detail) = match page {
        RedirectPage::Waiting => (
            "#2567d8",
            r#"<div class="ring"></div>"#,
            "Signing you in",
            "Finish signing in with Microsoft in this window.",
        ),
        RedirectPage::Success => (
            "#45de2b",
            r#"<svg viewBox="0 0 24 24" class="glyph"><path d="M20 6 9 17l-5-5"/></svg>"#,
            "You're signed in!",
            "You can close this tab and return to OneClient.",
        ),
        RedirectPage::Failed => (
            "#ff0000",
            r#"<svg viewBox="0 0 24 24" class="glyph"><path d="M18 6 6 18M6 6l12 12"/></svg>"#,
            "Sign-in failed",
            "Something went wrong. Close this tab and try again from OneClient.",
        ),
    };

    format!(
        r##"<!doctype html><html lang="en"><head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>OneClient</title>
<style>
*{{box-sizing:border-box;margin:0;padding:0}}
:root{{--accent:{accent}}}
html,body{{height:100%}}
body{{
  font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;
  color:#111827;
  background:#ffffff;
  display:flex;align-items:center;justify-content:center;min-height:100vh;padding:24px;
}}
.card{{
  position:relative;width:100%;max-width:420px;text-align:center;
  padding:44px 36px 40px;border-radius:20px;
  background:#ffffff;
  border:1px solid #e5e7eb;
  box-shadow:0 10px 30px rgba(17,24,39,.10);
  animation:rise .5s cubic-bezier(.2,.8,.2,1) both;
}}
.badge{{width:76px;height:76px;margin:0 auto 26px;border-radius:50%;
  display:flex;align-items:center;justify-content:center;
  background:color-mix(in srgb, var(--accent) 12%, transparent);
  border:1px solid color-mix(in srgb, var(--accent) 40%, transparent)}}
.glyph{{width:34px;height:34px;fill:none;stroke:var(--accent);stroke-width:2.4;
  stroke-linecap:round;stroke-linejoin:round;animation:pop .4s .15s cubic-bezier(.2,1.4,.3,1) both}}
.ring{{width:34px;height:34px;border-radius:50%;
  border:3px solid rgba(37,103,216,.22);border-top-color:#2567d8;animation:spin .8s linear infinite}}
h1{{font-size:21px;font-weight:600;color:#111827;margin-bottom:10px}}
p{{font-size:14px;line-height:1.55;color:#6b7280}}
@keyframes spin{{to{{transform:rotate(360deg)}}}}
@keyframes rise{{from{{opacity:0;transform:translateY(10px)}}to{{opacity:1;transform:none}}}}
@keyframes pop{{from{{opacity:0;transform:scale(.6)}}to{{opacity:1;transform:none}}}}
</style></head>
<body>
  <main class="card">
    <div class="badge">{glyph}</div>
    <h1>{heading}</h1>
    <p>{detail}</p>
  </main>
</body></html>"##
    )
}

#[tracing::instrument(level = "debug", skip_all)]
async fn exchange_auth_code(
    client: &Client,
    code: &str,
    pending: &PendingBrowserLogin,
) -> Result<MsaToken, MinecraftAuthError> {
    let body = [
        ("client_id", MICROSOFT_CLIENT_ID),
        ("grant_type", "authorization_code"),
        ("code", code),
        ("redirect_uri", pending.redirect_uri.as_str()),
        ("code_verifier", pending.pkce_verifier.as_str()),
        ("scope", MINECRAFT_SCOPES),
    ];

    let res = auth_retry(|| {
        client
            .post(TOKEN_URL)
            .header("Accept", "application/json")
            .form(&body)
            .send()
    })
    .await
    .map_err(|source| MinecraftAuthError::RequestError {
        step: MinecraftAuthStep::AuthCodeExchange,
        source,
    })?;

    parse_json_response(res, MinecraftAuthStep::AuthCodeExchange)
        .await
        .map(MsaToken::from_response)
}

fn random_token() -> String {
    let mut bytes = [0u8; 32];
    bytes[..16].copy_from_slice(Uuid::new_v4().as_bytes());
    bytes[16..].copy_from_slice(Uuid::new_v4().as_bytes());
    BASE64_URL_SAFE_NO_PAD.encode(bytes)
}

fn pkce_challenge(verifier: &str) -> String {
    let digest = Sha256::digest(verifier.as_bytes());
    BASE64_URL_SAFE_NO_PAD.encode(digest)
}

#[tracing::instrument(level = "debug", skip_all, fields(username = %creds.username))]
pub async fn refresh_microsoft_account(
    client: &Client,
    creds: &MinecraftAccount,
) -> Result<MinecraftAccount, MinecraftAuthError> {
    tracing::debug!("refreshing Microsoft account token");
    let msa = refresh_msa_token(client, &creds.refresh_token).await?;
    let mut account = account_from_msa_token(client, msa, |_, _, _| {}).await?;
    account.id = creds.id;
    Ok(account)
}

#[tracing::instrument(level = "debug", skip_all)]
async fn request_device_code(client: &Client) -> Result<DeviceCodeLogin, MinecraftAuthError> {
    let body = [
        ("client_id", MICROSOFT_CLIENT_ID),
        ("scope", MINECRAFT_SCOPES),
    ];

    let res = auth_retry(|| {
        client
            .post(DEVICE_CODE_URL)
            .header("Accept", "application/json")
            .form(&body)
            .send()
    })
    .await
    .map_err(|source| MinecraftAuthError::RequestError {
        step: MinecraftAuthStep::DeviceCodeRequest,
        source,
    })?;

    parse_json_response(res, MinecraftAuthStep::DeviceCodeRequest).await
}

#[tracing::instrument(level = "debug", skip_all)]
async fn poll_device_token(
    client: &Client,
    flow: &DeviceCodeLogin,
) -> Result<MsaToken, MinecraftAuthError> {
    let deadline = Utc::now() + chrono::TimeDelta::seconds(flow.expires_in as i64);
    let mut interval_secs = flow.interval.max(5);

    loop {
        if Utc::now() >= deadline {
            return Err(MinecraftAuthError::DeviceAuthorizationExpired);
        }

        let body = [
            ("grant_type", "urn:ietf:params:oauth:grant-type:device_code"),
            ("client_id", MICROSOFT_CLIENT_ID),
            ("device_code", flow.device_code.as_str()),
        ];

        let res = auth_retry(|| {
            client
                .post(TOKEN_URL)
                .header("Accept", "application/json")
                .form(&body)
                .send()
        })
        .await
        .map_err(|source| MinecraftAuthError::RequestError {
            step: MinecraftAuthStep::DeviceCodePoll,
            source,
        })?;

        let status = res.status();
        let text = res
            .text()
            .await
            .map_err(|source| MinecraftAuthError::RequestError {
                step: MinecraftAuthStep::DeviceCodePoll,
                source,
            })?;

        if status.is_success() {
            let raw: MsaTokenResponse = serde_json::from_str(&text).map_err(|source| {
                MinecraftAuthError::DeserializeError {
                    step: MinecraftAuthStep::DeviceCodePoll,
                    raw: text,
                    source,
                    status_code: status,
                }
            })?;
            return Ok(MsaToken::from_response(raw));
        }

        if let Ok(err) = serde_json::from_str::<OAuthErrorResponse>(&text) {
            match err.error.as_str() {
                "authorization_pending" => {
                    tokio::time::sleep(Duration::from_secs(interval_secs)).await;
                    continue;
                }
                "slow_down" => {
                    interval_secs = interval_secs.saturating_add(5);
                    tokio::time::sleep(Duration::from_secs(interval_secs)).await;
                    continue;
                }
                "expired_token" => return Err(MinecraftAuthError::DeviceAuthorizationExpired),
                other => {
                    return Err(MinecraftAuthError::DeviceAuthorizationFailed {
                        error: err.error_description.unwrap_or_else(|| other.to_string()),
                    });
                }
            }
        }

        return Err(MinecraftAuthError::DeserializeError {
            step: MinecraftAuthStep::DeviceCodePoll,
            raw: text,
            source: DeError::custom("unexpected device code poll response"),
            status_code: status,
        });
    }
}

#[tracing::instrument(level = "debug", skip_all)]
async fn refresh_msa_token(
    client: &Client,
    refresh_token: &str,
) -> Result<MsaToken, MinecraftAuthError> {
    let body = [
        ("client_id", MICROSOFT_CLIENT_ID),
        ("refresh_token", refresh_token),
        ("grant_type", "refresh_token"),
        ("scope", MINECRAFT_SCOPES),
    ];

    let res = auth_retry(|| {
        client
            .post(TOKEN_URL)
            .header("Accept", "application/json")
            .form(&body)
            .send()
    })
    .await
    .map_err(|source| MinecraftAuthError::RequestError {
        step: MinecraftAuthStep::RefreshToken,
        source,
    })?;

    parse_json_response(res, MinecraftAuthStep::RefreshToken)
        .await
        .map(MsaToken::from_response)
}

struct MsaToken {
    access_token: String,
    refresh_token: String,
    expires_in: u64,
    obtained_at: DateTime<Utc>,
}

impl MsaToken {
    fn from_response(raw: MsaTokenResponse) -> Self {
        Self {
            access_token: raw.access_token,
            refresh_token: raw.refresh_token,
            expires_in: raw.expires_in,
            obtained_at: Utc::now(),
        }
    }
}

#[tracing::instrument(level = "debug", skip_all)]
async fn account_from_msa_token(
    client: &Client,
    msa: MsaToken,
    on_progress: impl Fn(&str, u64, u64),
) -> Result<MinecraftAccount, MinecraftAuthError> {
    let rps_ticket = format!("d={}", msa.access_token);
    on_progress("Authenticating with Xbox Live", 1, AUTH_STEPS);
    let xbl = xbl_authenticate(client, &rps_ticket).await?;
    on_progress("Authorizing access (XSTS)", 2, AUTH_STEPS);
    let xsts = xsts_authorize(client, &xbl.token).await?;

    let xsts_token = xsts.token.ok_or(MinecraftAuthError::HashError)?;

    let uhs: &str = xsts
        .display_claims
        .as_ref()
        .and_then(|c| c.xui.first())
        .map(|x| x.uhs.as_str())
        .ok_or(MinecraftAuthError::HashError)?;

    on_progress("Requesting Minecraft token", 3, AUTH_STEPS);
    let minecraft_token = minecraft_login(client, uhs, &xsts_token).await?;
    on_progress("Verifying game ownership", 4, AUTH_STEPS);
    minecraft_entitlements(client, &minecraft_token.access_token).await?;
    let profile = minecraft_profile(client, &minecraft_token.access_token).await?;
    on_progress("Loading profile", AUTH_STEPS, AUTH_STEPS);

    Ok(MinecraftAccount {
        id: profile.id.unwrap_or_default(),
        username: profile.name,
        access_token: minecraft_token.access_token,
        refresh_token: msa.refresh_token,
        #[allow(clippy::cast_possible_wrap)]
        expires: msa.obtained_at + chrono::TimeDelta::seconds(msa.expires_in as i64),
        kind: AccountKind::Microsoft,
    })
}

#[tracing::instrument(level = "debug", skip_all)]
async fn xbl_authenticate(
    client: &Client,
    rps_ticket: &str,
) -> Result<XblUserToken, MinecraftAuthError> {
    let res = auth_retry(|| {
        client
            .post("https://user.auth.xboxlive.com/user/authenticate")
            .header("Accept", "application/json")
            .header("x-xbl-contract-version", "1")
            .json(&json!({
                "Properties": {
                    "AuthMethod": "RPS",
                    "SiteName": "user.auth.xboxlive.com",
                    "RpsTicket": rps_ticket
                },
                "RelyingParty": "http://auth.xboxlive.com",
                "TokenType": "JWT"
            }))
            .send()
    })
    .await
    .map_err(|source| MinecraftAuthError::RequestError {
        step: MinecraftAuthStep::XblAuthenticate,
        source,
    })?;

    let token: XboxTokenResponse =
        parse_json_response(res, MinecraftAuthStep::XblAuthenticate).await?;
    check_xbox_error(MinecraftAuthStep::XblAuthenticate, &token)?;

    Ok(XblUserToken {
        token: token.token.ok_or(MinecraftAuthError::DeserializeError {
            step: MinecraftAuthStep::XblAuthenticate,
            raw: String::new(),
            source: DeError::custom("missing Token"),
            status_code: reqwest::StatusCode::OK,
        })?,
    })
}

#[tracing::instrument(level = "debug", skip_all)]
async fn xsts_authorize(
    client: &Client,
    user_token: &str,
) -> Result<XboxTokenResponse, MinecraftAuthError> {
    let res = auth_retry(|| {
        client
            .post("https://xsts.auth.xboxlive.com/xsts/authorize")
            .header("Accept", "application/json")
            .header("x-xbl-contract-version", "1")
            .json(&json!({
                "Properties": {
                    "SandboxId": "RETAIL",
                    "UserTokens": [user_token]
                },
                "RelyingParty": "rp://api.minecraftservices.com/",
                "TokenType": "JWT"
            }))
            .send()
    })
    .await
    .map_err(|source| MinecraftAuthError::RequestError {
        step: MinecraftAuthStep::XstsAuthorize,
        source,
    })?;

    let token: XboxTokenResponse =
        parse_json_response(res, MinecraftAuthStep::XstsAuthorize).await?;
    check_xbox_error(MinecraftAuthStep::XstsAuthorize, &token)?;
    Ok(token)
}

#[derive(Deserialize)]
struct MinecraftToken {
    access_token: String,
}

#[tracing::instrument(level = "debug", skip_all)]
async fn minecraft_login(
    client: &Client,
    uhs: &str,
    xsts_token: &str,
) -> Result<MinecraftToken, MinecraftAuthError> {
    let res = auth_retry(|| {
        client
            .post("https://api.minecraftservices.com/authentication/login_with_xbox")
            .header("Accept", "application/json")
            .json(&json!({
                "identityToken": format!("XBL3.0 x={uhs};{xsts_token}"),
            }))
            .send()
    })
    .await
    .map_err(|source| MinecraftAuthError::RequestError {
        step: MinecraftAuthStep::MinecraftToken,
        source,
    })?;

    parse_json_response(res, MinecraftAuthStep::MinecraftToken).await
}

#[derive(Deserialize)]
struct MinecraftProfile {
    id: Option<Uuid>,
    name: String,
}

#[tracing::instrument(level = "debug", skip_all)]
async fn minecraft_profile(
    client: &Client,
    token: &str,
) -> Result<MinecraftProfile, MinecraftAuthError> {
    let res = auth_retry(|| {
        client
            .get("https://api.minecraftservices.com/minecraft/profile")
            .header("Accept", "application/json")
            .bearer_auth(token)
            .send()
    })
    .await
    .map_err(|source| MinecraftAuthError::RequestError {
        step: MinecraftAuthStep::MinecraftProfile,
        source,
    })?;

    parse_json_response(res, MinecraftAuthStep::MinecraftProfile).await
}

#[derive(Deserialize)]
#[serde(rename_all = "camelCase")]
struct MinecraftEntitlements {}

#[tracing::instrument(level = "debug", skip_all)]
async fn minecraft_entitlements(
    client: &Client,
    token: &str,
) -> Result<MinecraftEntitlements, MinecraftAuthError> {
    let res = auth_retry(|| {
        client
            .get("https://api.minecraftservices.com/entitlements/mcstore")
            .header("Accept", "application/json")
            .bearer_auth(token)
            .send()
    })
    .await
    .map_err(|source| MinecraftAuthError::RequestError {
        step: MinecraftAuthStep::MinecraftEntitlements,
        source,
    })?;

    parse_json_response(res, MinecraftAuthStep::MinecraftEntitlements).await
}

#[derive(Deserialize)]
struct OAuthErrorResponse {
    error: String,
    error_description: Option<String>,
}

#[derive(Deserialize)]
struct MsaTokenResponse {
    access_token: String,
    refresh_token: String,
    expires_in: u64,
}

struct XblUserToken {
    token: String,
}

#[derive(Debug, Deserialize)]
#[serde(rename_all = "PascalCase")]
struct XboxTokenResponse {
    #[serde(default)]
    #[serde(rename = "XErr")]
    x_err: u64,
    #[serde(default)]
    #[serde(rename = "Message")]
    message: String,
    #[serde(rename = "Redirect", default)]
    redirect: Option<String>,
    #[serde(default)]
    token: Option<String>,
    #[serde(default)]
    display_claims: Option<DisplayClaims>,
}

#[derive(Debug, Deserialize)]
struct DisplayClaims {
    #[serde(default)]
    xui: Vec<XuiClaim>,
}

#[derive(Debug, Deserialize)]
struct XuiClaim {
    uhs: String,
}

fn check_xbox_error(
    step: MinecraftAuthStep,
    token: &XboxTokenResponse,
) -> Result<(), MinecraftAuthError> {
    if token.x_err == 0 {
        return Ok(());
    }

    let message = friendly_xbox_error(token.x_err)
        .map(String::from)
        .unwrap_or_else(|| {
            if token.message.is_empty() {
                format!("Xbox rejected sign-in (error {}).", token.x_err)
            } else {
                token.message.clone()
            }
        });

    Err(MinecraftAuthError::XboxError {
        step,
        error_code: token.x_err,
        message,
        redirect: token.redirect.clone(),
    })
}

async fn parse_json_response<T: for<'de> Deserialize<'de>>(
    res: reqwest::Response,
    step: MinecraftAuthStep,
) -> Result<T, MinecraftAuthError> {
    let status = res.status();
    let text = res
        .text()
        .await
        .map_err(|source| MinecraftAuthError::RequestError { step, source })?;

    if !status.is_success() {
        tracing::error!(sentry = false, ?step, %status, body = %text, "MSA endpoint returned a non-success status");
    }

    serde_json::from_str(&text).map_err(|source| {
        if !status.is_success() {
            MinecraftAuthError::ServiceError {
                step,
                status_code: status,
            }
        } else {
            MinecraftAuthError::DeserializeError {
                step,
                raw: text,
                source,
                status_code: status,
            }
        }
    })
}

async fn auth_retry<F>(request_fn: impl Fn() -> F) -> Result<reqwest::Response, reqwest::Error>
where
    F: Future<Output = Result<reqwest::Response, reqwest::Error>>,
{
    const RETRY_COUNT: usize = 5;
    const RETRY_WAIT: Duration = Duration::from_millis(250);
    let mut resp = request_fn().await;

    for i in 0..RETRY_COUNT {
        match &resp {
            Ok(_) => break,
            Err(err) if (err.is_connect() || err.is_timeout()) && i < RETRY_COUNT - 1 => {
                tokio::time::sleep(RETRY_WAIT).await;
                resp = request_fn().await;
            }
            _ => break,
        }
    }

    resp
}