package jnpf.bizcommon.audit.service;

import jnpf.audit.AuditConsts;
import jnpf.audit.model.AuditEventDTO;
import jnpf.bizcommon.audit.service.sign.AuditSignEvidence;
import jnpf.bizcommon.audit.service.sign.AuditSignEvidenceReader;
import jnpf.bizcommon.audit.service.sign.AuditSignMetaData;
import jnpf.util.JsonUtil;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Service;

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.Collections;
import java.util.LinkedHashMap;
import java.util.Map;

/** 为数据接口操作事实补充请求所携带的电子签名事实。 */
@Slf4j
@Service
@RequiredArgsConstructor
public class DataInterfaceSignAuditService {

    private static final String SIGN_ACTION = "SIGN";
    private static final String REQUEST_SIGN_FIELD = "__request_biz_sign__";

    private final AuditSignEvidenceReader signEvidenceReader;
    private final AuditEventService auditEventService;

    /**
     * 只处理显式携带 relatedSignId 的数据接口事件。异常向上交给审计投递器进入 spool 重试，
     * 调用发生在审计服务内部，不会影响原始业务请求。
     */
    public void recordRelatedSign(AuditEventDTO businessEvent) {
        if (businessEvent == null || isBlank(businessEvent.getRelatedSignId())
                || !AuditConsts.TYPE_DATA_CHANGE.equals(businessEvent.getEventType())
                || !"DATA_INTERFACE".equals(businessEvent.getBizType())) {
            return;
        }

        String signId = businessEvent.getRelatedSignId().trim();
        Map<String, AuditSignEvidence> evidences = signEvidenceReader.read(
                Collections.singletonList(signId), businessEvent.getTenantId());
        AuditSignEvidence evidence = evidences.get(signId);
        if (evidence == null) {
            log.warn("[DATA-INTERFACE-AUDIT] 未查询到同租户签名记录，跳过签名事件 clientEventId={}",
                    businessEvent.getClientEventId());
            return;
        }
        if (isBlank(evidence.operatorId())
                || !evidence.operatorId().equals(businessEvent.getOperatorId())) {
            log.warn("[DATA-INTERFACE-AUDIT] 签名归属与当前操作人不一致，跳过签名事件 clientEventId={}",
                    businessEvent.getClientEventId());
            return;
        }

        AuditSignMetaData metaData = AuditSignMetaData.parse(evidence.metaData());
        String signatureRole = metaData.isReviewButton() ? "REVIEW" : "PRIMARY";
        Map<String, Object> extra = new LinkedHashMap<>();
        extra.put("signField", REQUEST_SIGN_FIELD);
        extra.put("signatureRole", signatureRole);
        extra.put("auditSource", "DATA_INTERFACE");
        if (!isBlank(evidence.accountName())) {
            extra.put("accountName", evidence.accountName());
        }
        if (!isBlank(evidence.opType())) {
            extra.put("opType", evidence.opType());
        }

        AuditEventDTO signEvent = AuditEventDTO.builder()
                .clientEventId(signClientEventId(businessEvent.getOperationId(), signId))
                .operationId(businessEvent.getOperationId())
                .eventTime(evidence.signedAt() == null
                        ? businessEvent.getEventTime() : evidence.signedAt())
                .tenantId(businessEvent.getTenantId())
                .operatorId(evidence.operatorId())
                .operatorName(businessEvent.getOperatorName())
                .operatorOrgId(businessEvent.getOperatorOrgId())
                .appName(businessEvent.getAppName())
                .bizModule(businessEvent.getBizModule())
                .ip(businessEvent.getIp())
                .ipRegion(businessEvent.getIpRegion())
                .browser(businessEvent.getBrowser())
                .os(businessEvent.getOs())
                .requestUri(businessEvent.getRequestUri())
                .eventType(AuditConsts.TYPE_E_SIGNATURE)
                .actionCode(SIGN_ACTION)
                .actionLabel(metaData.isReviewButton() ? "复审签名" : "电子签名")
                .sourceLayer(3)
                .targetTable(AuditSignEvidenceReader.SIGN_TABLE)
                .targetId(signId)
                .bizType(businessEvent.getBizType())
                .bizCode(businessEvent.getBizCode())
                .reason(evidence.note())
                .extra(JsonUtil.getObjectToString(extra))
                .recordTitle(businessEvent.getRecordTitle())
                .entryType(businessEvent.getEntryType())
                .entryId(businessEvent.getEntryId())
                .entryName(businessEvent.getEntryName())
                .build();
        auditEventService.saveIdempotent(signEvent);
    }

    private static String signClientEventId(String operationId, String signId) {
        String source = value(operationId) + "\n" + value(signId);
        try {
            byte[] digest = MessageDigest.getInstance("SHA-256")
                    .digest(source.getBytes(StandardCharsets.UTF_8));
            StringBuilder hex = new StringBuilder("DIS-");
            for (byte item : digest) {
                hex.append(String.format("%02x", item & 0xff));
            }
            return hex.toString();
        } catch (Exception e) {
            throw new IllegalStateException("生成数据接口签名事件幂等键失败", e);
        }
    }

    private static String value(String text) {
        return text == null ? "" : text;
    }

    private static boolean isBlank(String text) {
        return text == null || text.trim().isEmpty();
    }
}