using System.ComponentModel.DataAnnotations;
using System.Globalization;
using System.Net.Mime;
using System.Text;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Logging;
using Umbraco.Cms.Core;
using Umbraco.Cms.Core.ContentApps;
using Umbraco.Cms.Core.Dictionary;
using Umbraco.Cms.Core.Events;
using Umbraco.Cms.Core.Mapping;
using Umbraco.Cms.Core.Models;
using Umbraco.Cms.Core.Models.ContentEditing;
using Umbraco.Cms.Core.Models.Membership;
using Umbraco.Cms.Core.PropertyEditors;
using Umbraco.Cms.Core.Scoping;
using Umbraco.Cms.Core.Security;
using Umbraco.Cms.Core.Serialization;
using Umbraco.Cms.Core.Services;
using Umbraco.Cms.Core.Strings;
using Umbraco.Cms.Web.BackOffice.Filters;
using Umbraco.Cms.Web.BackOffice.ModelBinders;
using Umbraco.Cms.Web.Common.Attributes;
using Umbraco.Cms.Web.Common.Authorization;
using Umbraco.Cms.Web.Common.DependencyInjection;
using Umbraco.Cms.Web.Common.Filters;
using Umbraco.Cms.Web.Common.Security;
using Umbraco.Extensions;

namespace Umbraco.Cms.Web.BackOffice.Controllers;

/// <remarks>
///     This controller is decorated with the UmbracoApplicationAuthorizeAttribute which means that any user requesting
///     access to ALL of the methods on this controller will need access to the member application.
/// </remarks>
[PluginController(Constants.Web.Mvc.BackOfficeApiArea)]
[Authorize(Policy = AuthorizationPolicies.SectionAccessMembers)]
[OutgoingNoHyphenGuidFormat]
public class MemberController : ContentControllerBase
{
    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
    private readonly IDataTypeService _dataTypeService;
    private readonly IJsonSerializer _jsonSerializer;
    private readonly ILocalizedTextService _localizedTextService;
    private readonly IMemberManager _memberManager;
    private readonly IMemberService _memberService;
    private readonly IMemberTypeService _memberTypeService;
    private readonly IPasswordChanger<MemberIdentityUser> _passwordChanger;
    private readonly PropertyEditorCollection _propertyEditors;
    private readonly ICoreScopeProvider _scopeProvider;
    private readonly ITwoFactorLoginService _twoFactorLoginService;
    private readonly IShortStringHelper _shortStringHelper;
    private readonly IUmbracoMapper _umbracoMapper;

    /// <summary>
    ///     Initializes a new instance of the <see cref="MemberController" /> class.
    /// </summary>
    /// <param name="cultureDictionary">The culture dictionary</param>
    /// <param name="loggerFactory">The logger factory</param>
    /// <param name="shortStringHelper">The string helper</param>
    /// <param name="eventMessages">The event messages factory</param>
    /// <param name="localizedTextService">The entry point for localizing key services</param>
    /// <param name="propertyEditors">The property editors</param>
    /// <param name="umbracoMapper">The mapper</param>
    /// <param name="memberService">The member service</param>
    /// <param name="memberTypeService">The member type service</param>
    /// <param name="memberManager">The member manager</param>
    /// <param name="dataTypeService">The data-type service</param>
    /// <param name="backOfficeSecurityAccessor">The back office security accessor</param>
    /// <param name="jsonSerializer">The JSON serializer</param>
    /// <param name="passwordChanger">The password changer</param>
    /// <param name="scopeProvider">The core scope provider</param>
    /// <param name="twoFactorLoginService">The two factor login service</param>
    [ActivatorUtilitiesConstructor]
    public MemberController(
        ICultureDictionary cultureDictionary,
        ILoggerFactory loggerFactory,
        IShortStringHelper shortStringHelper,
        IEventMessagesFactory eventMessages,
        ILocalizedTextService localizedTextService,
        PropertyEditorCollection propertyEditors,
        IUmbracoMapper umbracoMapper,
        IMemberService memberService,
        IMemberTypeService memberTypeService,
        IMemberManager memberManager,
        IDataTypeService dataTypeService,
        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
        IJsonSerializer jsonSerializer,
        IPasswordChanger<MemberIdentityUser> passwordChanger,
        ICoreScopeProvider scopeProvider,
        ITwoFactorLoginService twoFactorLoginService)
        : base(cultureDictionary, loggerFactory, shortStringHelper, eventMessages, localizedTextService, jsonSerializer)
    {
        _propertyEditors = propertyEditors;
        _umbracoMapper = umbracoMapper;
        _memberService = memberService;
        _memberTypeService = memberTypeService;
        _memberManager = memberManager;
        _dataTypeService = dataTypeService;
        _localizedTextService = localizedTextService;
        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
        _jsonSerializer = jsonSerializer;
        _shortStringHelper = shortStringHelper;
        _passwordChanger = passwordChanger;
        _scopeProvider = scopeProvider;
        _twoFactorLoginService = twoFactorLoginService;
    }

    [Obsolete("Use constructor that also takes an ITwoFactorLoginService. Scheduled for removal in V13")]
    public MemberController(
        ICultureDictionary cultureDictionary,
        ILoggerFactory loggerFactory,
        IShortStringHelper shortStringHelper,
        IEventMessagesFactory eventMessages,
        ILocalizedTextService localizedTextService,
        PropertyEditorCollection propertyEditors,
        IUmbracoMapper umbracoMapper,
        IMemberService memberService,
        IMemberTypeService memberTypeService,
        IMemberManager memberManager,
        IDataTypeService dataTypeService,
        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
        IJsonSerializer jsonSerializer,
        IPasswordChanger<MemberIdentityUser> passwordChanger,
        ICoreScopeProvider scopeProvider)
        : this(
              cultureDictionary,
              loggerFactory,
              shortStringHelper,
              eventMessages,
              localizedTextService,
              propertyEditors,
              umbracoMapper,
              memberService,
              memberTypeService,
              memberManager,
              dataTypeService,
              backOfficeSecurityAccessor,
              jsonSerializer,
              passwordChanger,
              scopeProvider,
              StaticServiceProvider.Instance.GetRequiredService<ITwoFactorLoginService>())
    {
    }

    /// <summary>
    ///     The paginated list of members
    /// </summary>
    /// <param name="pageNumber">The page number to display</param>
    /// <param name="pageSize">The size of the page</param>
    /// <param name="orderBy">The ordering of the member list</param>
    /// <param name="orderDirection">The direction of the member list</param>
    /// <param name="orderBySystemField">The system field to order by</param>
    /// <param name="filter">The current filter for the list</param>
    /// <param name="memberTypeAlias">The member type</param>
    /// <returns>The paged result of members</returns>
    public PagedResult<MemberBasic> GetPagedResults(
        int pageNumber = 1,
        int pageSize = 100,
        string orderBy = "username",
        Direction orderDirection = Direction.Ascending,
        bool orderBySystemField = true,
        string filter = "",
        string? memberTypeAlias = null)
    {
        if (pageNumber <= 0 || pageSize <= 0)
        {
            throw new NotSupportedException("Both pageNumber and pageSize must be greater than zero");
        }

        IMember[] members = _memberService.GetAll(
            pageNumber - 1,
            pageSize,
            out var totalRecords,
            orderBy,
            orderDirection,
            orderBySystemField,
            memberTypeAlias,
            filter).ToArray();
        if (totalRecords == 0)
        {
            return new PagedResult<MemberBasic>(0, 0, 0);
        }

        var pagedResult = new PagedResult<MemberBasic>(totalRecords, pageNumber, pageSize)
        {
            Items = members.Select(x => _umbracoMapper.Map<MemberBasic>(x)).WhereNotNull()
        };
        return pagedResult;
    }

    /// <summary>
    ///     Returns a display node with a list view to render members
    /// </summary>
    /// <param name="listName">The member type to list</param>
    /// <returns>The member list for display</returns>
    public MemberListDisplay GetListNodeDisplay(string listName)
    {
        IMemberType? foundType = _memberTypeService.Get(listName);
        var name = foundType != null ? foundType.Name : listName;

        var apps = new List<ContentApp>
        {
            ListViewContentAppFactory.CreateContentApp(_dataTypeService, _propertyEditors, listName, "member", Constants.DataTypes.DefaultMembersListView)
        };
        apps[0].Active = true;

        var display = new MemberListDisplay
        {
            ContentTypeAlias = listName,
            ContentTypeName = name,
            Id = listName,
            IsContainer = true,
            Name = listName == Constants.Conventions.MemberTypes.AllMembersListId ? "All Members" : name,
            Path = "-1," + listName,
            ParentId = -1,
            ContentApps = apps
        };

        return display;
    }

    /// <summary>
    ///     Gets the content json for the member
    /// </summary>
    /// <param name="key">The Guid key of the member</param>
    /// <returns>The member for display</returns>
    [OutgoingEditorModelEvent]
    public MemberDisplay? GetByKey(Guid key)
    {
        IMember? foundMember = _memberService.GetByKey(key);
        if (foundMember == null)
        {
            HandleContentNotFound(key);
        }

        return _umbracoMapper.Map<MemberDisplay>(foundMember);
    }

    /// <summary>
    ///     Gets an empty content item for the
    /// </summary>
    /// <param name="contentTypeAlias">The content type</param>
    /// <returns>The empty member for display</returns>
    [OutgoingEditorModelEvent]
    public ActionResult<MemberDisplay?> GetEmpty(string? contentTypeAlias = null)
    {
        if (contentTypeAlias == null)
        {
            return NotFound();
        }

        IMemberType? contentType = _memberTypeService.Get(contentTypeAlias);
        if (contentType == null)
        {
            return NotFound();
        }

        var newPassword = _memberManager.GeneratePassword();

        IMember emptyContent = new Member(contentType);
        if (emptyContent.AdditionalData is not null)
        {
            emptyContent.AdditionalData["NewPassword"] = newPassword;
        }

        return _umbracoMapper.Map<MemberDisplay>(emptyContent);
    }

    /// <summary>
    ///     Saves member
    /// </summary>
    /// <param name="contentItem">The content item to save as a member</param>
    /// <returns>The resulting member display object</returns>
    [FileUploadCleanupFilter]
    [OutgoingEditorModelEvent]
    [MemberSaveValidation]
    public async Task<ActionResult<MemberDisplay?>> PostSave([ModelBinder(typeof(MemberBinder))] MemberSave contentItem)
    {
        if (contentItem == null)
        {
            throw new ArgumentNullException("The member content item was null");
        }

        // If we've reached here it means:
        // * Our model has been bound
        // * and validated
        // * any file attachments have been saved to their temporary location for us to use
        // * we have a reference to the DTO object and the persisted object
        // * Permissions are valid

        // map the properties to the persisted entity
        MapPropertyValues(contentItem);

        await ValidateMemberDataAsync(contentItem);

        // Unlike content/media - if there are errors for a member, we do NOT proceed to save them, we cannot so return the errors
        if (ModelState.IsValid == false)
        {
            MemberDisplay? forDisplay = _umbracoMapper.Map<MemberDisplay>(contentItem.PersistedContent);
            return ValidationProblem(forDisplay, ModelState);
        }

        // Create a scope here which will wrap all child data operations in a single transaction.
        // We'll complete this at the end of this method if everything succeeeds, else
        // all data operations will roll back.
        using ICoreScope scope = _scopeProvider.CreateCoreScope();

        // Depending on the action we need to first do a create or update using the membership manager
        // this ensures that passwords are formatted correctly and also performs the validation on the provider itself.
        switch (contentItem.Action)
        {
            case ContentSaveAction.Save:
                ActionResult<bool> updateSuccessful = await UpdateMemberAsync(contentItem);
                if (!(updateSuccessful.Result is null))
                {
                    return updateSuccessful.Result;
                }

                break;
            case ContentSaveAction.SaveNew:
                ActionResult<bool> createSuccessful = await CreateMemberAsync(contentItem);
                if (!(createSuccessful.Result is null))
                {
                    return createSuccessful.Result;
                }

                break;
            default:
                // we don't support anything else for members
                return NotFound();
        }

        // return the updated model
        MemberDisplay? display = _umbracoMapper.Map<MemberDisplay>(contentItem.PersistedContent);

        // lastly, if it is not valid, add the model state to the outgoing object and throw a 403
        if (!ModelState.IsValid)
        {
            return ValidationProblem(display, ModelState, StatusCodes.Status403Forbidden);
        }

        // put the correct messages in
        switch (contentItem.Action)
        {
            case ContentSaveAction.Save:
            case ContentSaveAction.SaveNew:
                display?.AddSuccessNotification(
                    _localizedTextService.Localize("speechBubbles", "editMemberSaved"),
                    _localizedTextService.Localize("speechBubbles", "editMemberSaved"));
                break;
        }

        // Mark transaction to commit all changes
        scope.Complete();

        return display;
    }

    /// <summary>
    ///     Maps the property values to the persisted entity
    /// </summary>
    /// <param name="contentItem">The member content item to map properties from</param>
    private void MapPropertyValues(MemberSave contentItem)
    {
        if (contentItem.PersistedContent is not null)
        {
            // Don't update the name if it is empty
            if (contentItem.Name.IsNullOrWhiteSpace() == false)
            {
                contentItem.PersistedContent.Name = contentItem.Name;
            }

            // map the custom properties - this will already be set for new entities in our member binder
            contentItem.PersistedContent.IsApproved = contentItem.IsApproved;
            contentItem.PersistedContent.Email = contentItem.Email.Trim();
            contentItem.PersistedContent.Username = contentItem.Username;
        }

        // use the base method to map the rest of the properties
        MapPropertyValuesForPersistence<IMember, MemberSave>(
            contentItem,
            contentItem.PropertyCollectionDto,
            (save, property) => property?.GetValue(), // get prop val
            (save, property, v) => property?.SetValue(v), // set prop val
            null); // member are all invariant
    }

    /// <summary>
    ///     Create a member from the supplied member content data
    ///     All member password processing and creation is done via the identity manager
    /// </summary>
    /// <param name="contentItem">Member content data</param>
    /// <returns>The identity result of the created member</returns>
    private async Task<ActionResult<bool>> CreateMemberAsync(MemberSave contentItem)
    {
        IMemberType? memberType = _memberTypeService.Get(contentItem.ContentTypeAlias);
        if (memberType == null)
        {
            throw new InvalidOperationException($"No member type found with alias {contentItem.ContentTypeAlias}");
        }

        var identityMember = MemberIdentityUser.CreateNew(
            contentItem.Username,
            contentItem.Email,
            memberType.Alias,
            contentItem.IsApproved,
            contentItem.Name);

        IdentityResult created = await _memberManager.CreateAsync(identityMember, contentItem.Password?.NewPassword!);

        if (created.Succeeded == false)
        {
            MemberDisplay? forDisplay = _umbracoMapper.Map<MemberDisplay>(contentItem.PersistedContent);
            foreach (IdentityError error in created.Errors)
            {
                switch (error.Code)
                {
                    case nameof(IdentityErrorDescriber.InvalidUserName):
                        ModelState.AddPropertyError(
                            new ValidationResult(error.Description, new[] { "value" }),
                            string.Format("{0}login", Constants.PropertyEditors.InternalGenericPropertiesPrefix));
                        break;
                    case nameof(IdentityErrorDescriber.PasswordMismatch):
                    case nameof(IdentityErrorDescriber.PasswordRequiresDigit):
                    case nameof(IdentityErrorDescriber.PasswordRequiresLower):
                    case nameof(IdentityErrorDescriber.PasswordRequiresNonAlphanumeric):
                    case nameof(IdentityErrorDescriber.PasswordRequiresUniqueChars):
                    case nameof(IdentityErrorDescriber.PasswordRequiresUpper):
                    case nameof(IdentityErrorDescriber.PasswordTooShort):
                        ModelState.AddPropertyError(
                            new ValidationResult(error.Description, new[] { "value" }),
                            string.Format("{0}password", Constants.PropertyEditors.InternalGenericPropertiesPrefix));
                        break;
                    case nameof(IdentityErrorDescriber.InvalidEmail):
                        ModelState.AddPropertyError(
                            new ValidationResult(error.Description, new[] { "value" }),
                            string.Format("{0}email", Constants.PropertyEditors.InternalGenericPropertiesPrefix));
                        break;
                    case nameof(IdentityErrorDescriber.DuplicateUserName):
                        ModelState.AddPropertyError(
                            new ValidationResult(error.Description, new[] { "value" }),
                            string.Format("{0}login", Constants.PropertyEditors.InternalGenericPropertiesPrefix));
                        break;
                    case nameof(IdentityErrorDescriber.DuplicateEmail):
                        ModelState.AddPropertyError(
                            new ValidationResult(error.Description, new[] { "value" }),
                            string.Format("{0}email", Constants.PropertyEditors.InternalGenericPropertiesPrefix));
                        break;
                }
            }

            return ValidationProblem(forDisplay, ModelState);
        }

        // now re-look up the member, which will now exist
        IMember? member = _memberService.GetByEmail(contentItem.Email);

        if (member is null)
        {
            return false;
        }

        // map the save info over onto the user
        member = _umbracoMapper.Map(contentItem, member);

        var creatorId = _backOfficeSecurityAccessor.BackOfficeSecurity?.CurrentUser?.Id ?? -1;
        member.CreatorId = creatorId;

        // assign the mapped property values that are not part of the identity properties
        var builtInAliases = ConventionsHelper.GetStandardPropertyTypeStubs(_shortStringHelper).Select(x => x.Key)
            .ToArray();
        foreach (ContentPropertyBasic property in contentItem.Properties)
        {
            if (builtInAliases.Contains(property.Alias) == false)
            {
                member.Properties[property.Alias]?.SetValue(property.Value);
            }
        }

        // now the member has been saved via identity, resave the member with mapped content properties
        _memberService.Save(member);
        contentItem.PersistedContent = member;

        ActionResult<bool> rolesChanged = await AddOrUpdateRoles(contentItem.Groups, identityMember);
        if (!rolesChanged.Value && rolesChanged.Result != null)
        {
            return rolesChanged.Result;
        }

        return true;
    }

    /// <summary>
    ///     Update existing member data
    /// </summary>
    /// <param name="contentItem">The member to save</param>
    /// <remarks>
    ///     We need to use both IMemberService and ASP.NET Identity to do our updates because Identity is responsible for
    ///     passwords/security.
    ///     When this method is called, the IMember will already have updated/mapped values from the http POST.
    ///     So then we do this in order:
    ///     1. Deal with sensitive property values on IMember
    ///     2. Use IMemberService to persist all changes
    ///     3. Use ASP.NET and MemberUserManager to deal with lockouts
    ///     4. Use ASP.NET, MemberUserManager and password changer to deal with passwords
    ///     5. Deal with groups/roles
    /// </remarks>
    private async Task<ActionResult<bool>> UpdateMemberAsync(MemberSave contentItem)
    {
        if (contentItem.PersistedContent is not null)
        {
            contentItem.PersistedContent.WriterId =
                _backOfficeSecurityAccessor.BackOfficeSecurity?.CurrentUser?.Id ?? -1;
        }

        // If the user doesn't have access to sensitive values, then we need to check if any of the built in member property types
        // have been marked as sensitive. If that is the case we cannot change these persisted values no matter what value has been posted.
        // There's only 3 special ones we need to deal with that are part of the MemberSave instance: Comments, IsApproved, IsLockedOut
        // but we will take care of this in a generic way below so that it works for all props.
        if (!_backOfficeSecurityAccessor.BackOfficeSecurity?.CurrentUser?.HasAccessToSensitiveData() ?? true)
        {
            IMemberType? memberType = contentItem.PersistedContent is null
                ? null
                : _memberTypeService.Get(contentItem.PersistedContent.ContentTypeId);
            var sensitiveProperties = memberType?
                .PropertyTypes.Where(x => memberType.IsSensitiveProperty(x.Alias))
                .ToList();

            if (sensitiveProperties is not null)
            {
                foreach (IPropertyType sensitiveProperty in sensitiveProperties)
                {
                    // TODO: This logic seems to deviate from the logic that is in v8 where we are explitly checking
                    // against 3 properties: Comments, IsApproved, IsLockedOut, is the v8 version incorrect?

                    ContentPropertyBasic? destProp =
                        contentItem.Properties.FirstOrDefault(x => x.Alias == sensitiveProperty.Alias);
                    if (destProp != null)
                    {
                        // if found, change the value of the contentItem model to the persisted value so it remains unchanged
                        var origValue = contentItem.PersistedContent?.GetValue(sensitiveProperty.Alias);
                        destProp.Value = origValue;
                    }
                }
            }
        }

        if (contentItem.PersistedContent is not null)
        {
            // First save the IMember with mapped values before we start updating data with aspnet identity
            _memberService.Save(contentItem.PersistedContent);
        }

        var needsResync = false;
            var memberId = contentItem.Id?.ToString();
            if (memberId is null)
            {
                return ValidationProblem("Member was not found");
            }
        MemberIdentityUser? identityMember = await _memberManager.FindByIdAsync(memberId);
        if (identityMember == null)
        {
            return ValidationProblem("Member was not found");
        }

        // Handle unlocking with the member manager (takes care of other nuances)
        if (identityMember.IsLockedOut && contentItem.IsLockedOut == false)
        {
            IdentityResult unlockResult =
                await _memberManager.SetLockoutEndDateAsync(identityMember, DateTimeOffset.Now.AddMinutes(-1));
            if (unlockResult.Succeeded == false)
            {
                return ValidationProblem(
                    $"Could not unlock for member {contentItem.Id} - error {unlockResult.Errors.ToErrorMessage()}");
            }

            needsResync = true;
        }
        else if (identityMember.IsLockedOut == false && contentItem.IsLockedOut)
        {
            // NOTE: This should not ever happen unless someone is mucking around with the request data.
            // An admin cannot simply lock a user, they get locked out by password attempts, but an admin can unlock them
            return ValidationProblem("An admin cannot lock a member");
        }

        // Handle disabling of 2FA
        if (!contentItem.IsTwoFactorEnabled)
        {
            IEnumerable<string> providers = await _twoFactorLoginService.GetEnabledTwoFactorProviderNamesAsync(contentItem.Key);
            foreach (var provider in providers)
            {
                await _twoFactorLoginService.DisableAsync(contentItem.Key, provider);
            }
        }

        // If we're changing the password...
        // Handle changing with the member manager & password changer (takes care of other nuances)
        if (contentItem.Password != null)
        {
            IdentityResult validatePassword =
                await _memberManager.ValidatePasswordAsync(contentItem.Password.NewPassword);
            if (validatePassword.Succeeded == false)
            {
                return ValidationProblem(validatePassword.Errors.ToErrorMessage());
            }

            if (!int.TryParse(identityMember.Id, NumberStyles.Integer, CultureInfo.InvariantCulture, out var intId))
            {
                return ValidationProblem("Member ID was not valid");
            }

            var changingPasswordModel = new ChangingPasswordModel
            {
                Id = intId,
                OldPassword = contentItem.Password.OldPassword,
                NewPassword = contentItem.Password.NewPassword
            };

            // Change and persist the password
            Attempt<PasswordChangedModel?> passwordChangeResult =
                await _passwordChanger.ChangePasswordWithIdentityAsync(changingPasswordModel, _memberManager, _backOfficeSecurityAccessor.BackOfficeSecurity?.CurrentUser);

            if (!passwordChangeResult.Success)
            {
                foreach (var memberName in passwordChangeResult.Result?.Error?.MemberNames ??
                                           Enumerable.Empty<string>())
                {
                    ModelState.AddModelError(memberName, passwordChangeResult.Result?.Error?.ErrorMessage ?? string.Empty);
                }

                return ValidationProblem(ModelState);
            }

            needsResync = true;
        }

        // Update the roles and check for changes
        ActionResult<bool> rolesChanged = await AddOrUpdateRoles(contentItem.Groups, identityMember);
        if (!rolesChanged.Value && rolesChanged.Result != null)
        {
            return rolesChanged.Result;
        }

        needsResync = true;

        // If there have been underlying changes made by ASP.NET Identity, then we need to resync the
        // IMember on the PersistedContent with what is stored since it will be mapped to display.
        if (needsResync && contentItem.PersistedContent is not null)
        {
            contentItem.PersistedContent = _memberService.GetById(contentItem.PersistedContent.Id)!;
        }

        return true;
    }

    private async Task<bool> ValidateMemberDataAsync(MemberSave contentItem)
    {
        if (contentItem.Name.IsNullOrWhiteSpace())
        {
            ModelState.AddPropertyError(
                new ValidationResult("Invalid user name", new[] { "value" }),
                $"{Constants.PropertyEditors.InternalGenericPropertiesPrefix}login");
            return false;
        }

        if (contentItem.Password != null && !contentItem.Password.NewPassword.IsNullOrWhiteSpace())
        {
            IdentityResult validPassword = await _memberManager.ValidatePasswordAsync(contentItem.Password.NewPassword);
            if (!validPassword.Succeeded)
            {
                ModelState.AddPropertyError(
                    new ValidationResult("Invalid password: " + MapErrors(validPassword.Errors), new[] { "value" }),
                    $"{Constants.PropertyEditors.InternalGenericPropertiesPrefix}password");
                return false;
            }
        }

        IMember? byUsername = _memberService.GetByUsername(contentItem.Username);
        if (byUsername != null && byUsername.Key != contentItem.Key)
        {
            ModelState.AddPropertyError(
                new ValidationResult("Username is already in use", new[] { "value" }),
                $"{Constants.PropertyEditors.InternalGenericPropertiesPrefix}login");
            return false;
        }

        IMember? byEmail = _memberService.GetByEmail(contentItem.Email);
        if (byEmail != null && byEmail.Key != contentItem.Key)
        {
            ModelState.AddPropertyError(
                new ValidationResult("Email address is already in use", new[] { "value" }),
                $"{Constants.PropertyEditors.InternalGenericPropertiesPrefix}email");
            return false;
        }

        return true;
    }

    private string MapErrors(IEnumerable<IdentityError> result)
    {
        var sb = new StringBuilder();
        IEnumerable<IdentityError> identityErrors = result.ToList();
        foreach (IdentityError error in identityErrors)
        {
            var errorString = $"{error.Description}";
            sb.AppendLine(errorString);
        }

        return sb.ToString();
    }

    /// <summary>
    ///     Add or update the identity roles
    /// </summary>
    /// <param name="groups">The groups to updates</param>
    /// <param name="identityMember">The member as an identity user</param>
    private async Task<ActionResult<bool>> AddOrUpdateRoles(IEnumerable<string>? groups, MemberIdentityUser identityMember)
    {
        var hasChanges = false;

        // We're gonna look up the current roles now because the below code can cause
        // events to be raised and developers could be manually adding roles to members in
        // their handlers. If we don't look this up now there's a chance we'll just end up
        // removing the roles they've assigned.
        IEnumerable<string> currentRoles = await _memberManager.GetRolesAsync(identityMember);

        // find the ones to remove and remove them
        IEnumerable<string> roles = currentRoles.ToList();
        var rolesToRemove = roles.Except(groups ?? Enumerable.Empty<string>()).ToArray();

        // Now let's do the role provider stuff - now that we've saved the content item (that is important since
        // if we are changing the username, it must be persisted before looking up the member roles).
        if (rolesToRemove.Any())
        {
            IdentityResult identityResult = await _memberManager.RemoveFromRolesAsync(identityMember, rolesToRemove);
            if (!identityResult.Succeeded)
            {
                return ValidationProblem(identityResult.Errors.ToErrorMessage());
            }

            hasChanges = true;
        }

        // find the ones to add and add them
        var toAdd = groups?.Except(roles).ToArray();
        if (toAdd?.Any() ?? false)
        {
            // add the ones submitted
            IdentityResult identityResult = await _memberManager.AddToRolesAsync(identityMember, toAdd);
            if (!identityResult.Succeeded)
            {
                return ValidationProblem(identityResult.Errors.ToErrorMessage());
            }

            hasChanges = true;
        }

        return hasChanges;
    }

    /// <summary>
    ///     Permanently deletes a member
    /// </summary>
    /// <param name="key">Guid of the member to delete</param>
    /// <returns>The result of the deletion</returns>
    [HttpPost]
    public IActionResult DeleteByKey(Guid key)
    {
        IMember? foundMember = _memberService.GetByKey(key);
        if (foundMember == null)
        {
            return HandleContentNotFound(key);
        }

        _memberService.Delete(foundMember);

        return Ok();
    }

    /// <summary>
    ///     Exports member data based on their unique Id
    /// </summary>
    /// <param name="key">The unique <see cref="Guid">member identifier</see></param>
    /// <returns>
    ///     <see cref="HttpResponseMessage" />
    /// </returns>
    [HttpGet]
    public IActionResult ExportMemberData(Guid key)
    {
        IUser? currentUser = _backOfficeSecurityAccessor.BackOfficeSecurity?.CurrentUser;

        if (currentUser?.HasAccessToSensitiveData() == false)
        {
            return Forbid();
        }

        MemberExportModel? member = ((MemberService)_memberService).ExportMember(key);
        if (member is null)
        {
            throw new NullReferenceException("No member found with key " + key);
        }

        var json = _jsonSerializer.Serialize(member);

        var fileName = $"{member.Name}_{member.Email}.txt";

        // Set custom header so umbRequestHelper.downloadFile can save the correct filename
        HttpContext.Response.Headers.Add("x-filename", fileName);

        return File(Encoding.UTF8.GetBytes(json), MediaTypeNames.Application.Octet, fileName);
    }
}