package jnpf.dmsService;

import jnpf.dmsEntity.permission.entity.DmsAccessExclusionEntity;
import jnpf.dmsEntity.permission.entity.DmsPermissionResourceEntity;
import jnpf.dmsEntity.permission.enums.DmsActorType;
import jnpf.dmsEntity.permission.enums.DmsPermissionAction;
import jnpf.dmsEntity.permission.enums.DmsResourceType;
import jnpf.dmsEntity.permission.form.AccessExclusionBatchForm;
import jnpf.dmsEntity.permission.form.AccessExclusionItemForm;
import jnpf.dmsEntity.permission.form.AccessExclusionRevokeForm;
import jnpf.dmsEntity.permission.vo.DmsAccessExclusionVO;
import jnpf.dmsEntity.permission.vo.DmsCursorPageVO;
import jnpf.dmsIntegration.audit.DmsAuditAdapter;
import jnpf.dmsMapper.DmsAccessExclusionMapper;
import jnpf.dmsMapper.DmsPermissionResourceMapper;
import jnpf.dmsPermission.DmsCurrentIdentity;
import jnpf.dmsPermission.DmsCursorCodec;
import jnpf.dmsPermission.DmsPermissionError;
import jnpf.dmsPermission.DmsPermissionException;
import jnpf.dmsPermission.DmsPermissionProperties;
import jnpf.dmsPermission.DmsPrincipalValidator;
import jnpf.dmsPermission.DmsUserDisplayNameResolver;
import lombok.RequiredArgsConstructor;
import org.springframework.dao.DuplicateKeyException;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

import java.util.ArrayList;
import java.util.Comparator;
import java.util.Date;
import java.util.HashSet;
import java.util.LinkedHashMap;
import java.util.LinkedHashSet;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import java.util.Set;
import java.util.UUID;
import java.util.function.Function;
import java.util.stream.Collectors;

@Service
@RequiredArgsConstructor
public class DmsAccessExclusionService {
    private final DmsCurrentIdentity currentIdentity;
    private final DmsPermissionProperties properties;
    private final DmsPrincipalValidator principalValidator;
    private final DmsPermissionResourceMapper resourceMapper;
    private final DmsAccessExclusionMapper exclusionMapper;
    private final DmsCursorCodec cursorCodec;
    private final DmsAuditAdapter auditAdapter;
    private final DmsUserDisplayNameResolver userDisplayNameResolver;

    @Transactional
    public List<DmsAccessExclusionVO> create(AccessExclusionBatchForm form) {
        currentIdentity.requirePermissionAdministrator();
        validateBatchForm(form);
        String tenantId = currentIdentity.tenantId();
        String actorId = currentIdentity.userId();
        String sourceType = form.getSourceType().name();
        String sourceId = form.getSourceId().trim();
        List<AccessExclusionItemForm> items = normalizeAndValidate(form.getItems());

        exclusionMapper.lockSource(tenantId, sourceType, sourceId);
        List<DmsAccessExclusionEntity> existing = exclusionMapper.selectBySource(
                tenantId, sourceType, sourceId);
        if (!existing.isEmpty()) {
            verifyIdempotentRetry(existing, items);
            return existing.stream().map(this::toVO).collect(Collectors.toList());
        }

        validateResources(tenantId, items);
        principalValidator.validateUsers(items.stream().map(AccessExclusionItemForm::getUserId)
                .collect(Collectors.toCollection(LinkedHashSet::new)));
        List<DmsAccessExclusionEntity> entities = items.stream()
                .map(item -> toEntity(tenantId, actorId, sourceType, sourceId, item))
                .collect(Collectors.toList());
        try {
            if (exclusionMapper.insertBatch(entities) != entities.size()) {
                throw DmsPermissionException.of(DmsPermissionError.SOURCE_CONFLICT,
                        "排除集合未完整写入");
            }
        } catch (DuplicateKeyException ex) {
            throw DmsPermissionException.of(DmsPermissionError.SOURCE_CONFLICT,
                    "排除来源或排除项与已有数据冲突");
        }

        List<DmsAccessExclusionEntity> created = exclusionMapper.selectBySource(
                tenantId, sourceType, sourceId);
        if (created.size() != entities.size()) {
            throw DmsPermissionException.of(DmsPermissionError.SOURCE_CONFLICT,
                    "排除集合写入后不完整");
        }
        for (DmsAccessExclusionEntity exclusion : created) {
            auditAdapter.dataChange("CREATE", "创建 DMS 用户读取排除", "dms_access_exclusions",
                    exclusion.getId().toString(), exclusion.getExcludeReason(), null);
        }
        return created.stream().map(this::toVO).collect(Collectors.toList());
    }

    @Transactional(readOnly = true)
    public DmsCursorPageVO<DmsAccessExclusionVO> page(UUID resourceId, String userId,
                                                       String cursor, Integer pageSize) {
        currentIdentity.requirePermissionAdministrator();
        String normalizedUserId = trimToNull(userId);
        if (normalizedUserId != null && normalizedUserId.length() > 100) {
            invalid("userId 长度不能超过 100");
        }
        int limit = pageSize(pageSize);
        DmsCursorCodec.Cursor decoded = cursorCodec.decode(cursor);
        List<DmsAccessExclusionEntity> rows = exclusionMapper.selectPage(currentIdentity.tenantId(),
                resourceId, normalizedUserId, decoded.getTime(), decoded.getId(), limit + 1);
        boolean hasMore = rows.size() > limit;
        if (hasMore) {
            rows = rows.subList(0, limit);
        }
        DmsCursorPageVO<DmsAccessExclusionVO> result = new DmsCursorPageVO<>();
        List<DmsAccessExclusionVO> values = rows.stream().map(this::toVO).collect(Collectors.toList());
        Map<String, String> userNames = userDisplayNameResolver.resolve(values.stream()
                .map(DmsAccessExclusionVO::getUserId).collect(Collectors.toList()));
        values.forEach(value -> value.setUserName(userNames.get(value.getUserId())));
        result.setList(values);
        result.setHasMore(hasMore);
        if (hasMore && !rows.isEmpty()) {
            DmsAccessExclusionEntity last = rows.get(rows.size() - 1);
            result.setNextCursor(cursorCodec.encode(last.getCreatedAt(), last.getId()));
        }
        return result;
    }

    @Transactional
    public List<DmsAccessExclusionVO> revoke(AccessExclusionRevokeForm form) {
        currentIdentity.requirePermissionAdministrator();
        if (form == null || form.getExclusionIds() == null || form.getExclusionIds().isEmpty()
                || form.getExclusionIds().size() > properties.getMaxExclusionBatchSize()) {
            invalid("排除撤销批量大小必须在 1 到 " + properties.getMaxExclusionBatchSize() + " 之间");
        }
        String reason = trimToNull(form.getReason());
        if (reason == null || reason.length() > 1000) {
            invalid("撤销原因不能为空且长度不能超过 1000");
        }
        if (form.getExclusionIds().stream().anyMatch(Objects::isNull)) {
            invalid("排除 ID 不能为空");
        }

        String tenantId = currentIdentity.tenantId();
        String actorId = currentIdentity.userId();
        List<UUID> ids = new ArrayList<>(new LinkedHashSet<>(form.getExclusionIds()));
        ids.sort(Comparator.comparing(UUID::toString));
        List<DmsAccessExclusionEntity> locked = exclusionMapper.selectByTenantAndIdsForUpdate(tenantId, ids);
        if (locked.size() != ids.size()) {
            throw DmsPermissionException.of(DmsPermissionError.RESOURCE_NOT_FOUND,
                    "一个或多个读取排除不存在");
        }
        if (locked.stream().anyMatch(row -> row.getRevokedAt() != null)) {
            throw DmsPermissionException.of(DmsPermissionError.EXCLUSION_ALREADY_REVOKED,
                    "读取排除只允许撤销一次");
        }
        int changed = exclusionMapper.revokeBatch(tenantId, ids, DmsActorType.USER.name(), actorId, reason);
        if (changed != ids.size()) {
            throw DmsPermissionException.of(DmsPermissionError.REVISION_CONFLICT,
                    "读取排除撤销发生并发冲突");
        }
        List<DmsAccessExclusionEntity> revoked = exclusionMapper.selectByTenantAndIds(tenantId, ids);
        for (DmsAccessExclusionEntity exclusion : revoked) {
            auditAdapter.dataChange("UPDATE", "撤销 DMS 用户读取排除", "dms_access_exclusions",
                    exclusion.getId().toString(), reason, null);
        }
        return revoked.stream().map(this::toVO).collect(Collectors.toList());
    }

    private void validateBatchForm(AccessExclusionBatchForm form) {
        if (form == null || form.getSourceType() == null || form.getSourceId() == null
                || form.getSourceId().trim().isEmpty() || form.getSourceId().trim().length() > 200) {
            invalid("排除来源类型和 sourceId 不能为空，sourceId 长度不能超过 200");
        }
        if (form.getItems() == null || form.getItems().isEmpty()
                || form.getItems().size() > properties.getMaxExclusionBatchSize()) {
            invalid("排除批量大小必须在 1 到 " + properties.getMaxExclusionBatchSize() + " 之间");
        }
    }

    private List<AccessExclusionItemForm> normalizeAndValidate(List<AccessExclusionItemForm> source) {
        List<AccessExclusionItemForm> result = new ArrayList<>();
        Set<String> identities = new HashSet<>();
        for (AccessExclusionItemForm original : source) {
            if (original == null || original.getResourceType() == null || original.getResourceId() == null) {
                invalid("排除资源类型和资源 ID 不能为空");
            }
            if (original.getResourceType() != DmsResourceType.DOCUMENT
                    && original.getResourceType() != DmsResourceType.FILE_VERSION) {
                invalid("读取排除只支持 Document 和 FileVersion");
            }
            String userId = trimToNull(original.getUserId());
            if (userId == null || userId.length() > 100) {
                invalid("排除用户不能为空且长度不能超过 100");
            }
            String reason = trimToNull(original.getExcludeReason());
            if (reason != null && reason.length() > 1000) {
                invalid("排除原因长度不能超过 1000");
            }
            Date effectiveFrom = original.getValidFrom() == null ? new Date() : original.getValidFrom();
            if (original.getValidTo() != null && !original.getValidTo().after(effectiveFrom)) {
                invalid("validTo 必须晚于 validFrom");
            }

            AccessExclusionItemForm item = new AccessExclusionItemForm();
            item.setResourceType(original.getResourceType());
            item.setResourceId(original.getResourceId());
            item.setUserId(userId);
            item.setValidFrom(original.getValidFrom());
            item.setValidTo(original.getValidTo());
            item.setExcludeReason(reason);
            if (!identities.add(identity(item))) {
                invalid("同一排除批次包含重复排除项");
            }
            result.add(item);
        }
        result.sort(Comparator.comparing(this::identity));
        return result;
    }

    private void validateResources(String tenantId, List<AccessExclusionItemForm> items) {
        List<UUID> ids = items.stream().map(AccessExclusionItemForm::getResourceId).distinct()
                .collect(Collectors.toList());
        Map<UUID, DmsPermissionResourceEntity> resources = resourceMapper.selectByTenantAndIds(tenantId, ids)
                .stream().collect(Collectors.toMap(DmsPermissionResourceEntity::getId, Function.identity()));
        for (AccessExclusionItemForm item : items) {
            DmsPermissionResourceEntity resource = resources.get(item.getResourceId());
            if (resource == null || !item.getResourceType().name().equals(resource.getResourceType())) {
                throw DmsPermissionException.of(DmsPermissionError.RESOURCE_NOT_FOUND,
                        "排除资源不存在或类型不一致: " + item.getResourceId());
            }
        }
    }

    private void verifyIdempotentRetry(List<DmsAccessExclusionEntity> existing,
                                       List<AccessExclusionItemForm> requested) {
        if (existing.size() != requested.size() || existing.stream().anyMatch(row -> row.getRevokedAt() != null)) {
            throw DmsPermissionException.of(DmsPermissionError.SOURCE_CONFLICT,
                    "source_id 已存在，但排除集合数量不同或包含已撤销排除");
        }
        Map<String, DmsAccessExclusionEntity> byIdentity = existing.stream().collect(Collectors.toMap(
                this::identity, Function.identity(), (left, right) -> left, LinkedHashMap::new));
        for (AccessExclusionItemForm item : requested) {
            DmsAccessExclusionEntity row = byIdentity.get(identity(item));
            if (row == null || !sameDefinition(row, item)) {
                throw DmsPermissionException.of(DmsPermissionError.SOURCE_CONFLICT,
                        "source_id 已存在，但完整排除集合与本次请求不一致");
            }
        }
    }

    private boolean sameDefinition(DmsAccessExclusionEntity row, AccessExclusionItemForm item) {
        return (item.getValidFrom() == null || sameInstant(row.getValidFrom(), item.getValidFrom()))
                && sameInstant(row.getValidTo(), item.getValidTo())
                && Objects.equals(row.getExcludeReason(), item.getExcludeReason());
    }

    private DmsAccessExclusionEntity toEntity(String tenantId, String actorId, String sourceType, String sourceId,
                                               AccessExclusionItemForm item) {
        DmsAccessExclusionEntity entity = new DmsAccessExclusionEntity();
        entity.setTenantId(tenantId);
        entity.setResourceType(item.getResourceType().name());
        entity.setResourceId(item.getResourceId());
        entity.setUserId(item.getUserId());
        entity.setActionCode(DmsPermissionAction.READ.name());
        entity.setSourceType(sourceType);
        entity.setSourceId(sourceId);
        entity.setValidFrom(item.getValidFrom() == null ? new Date() : item.getValidFrom());
        entity.setValidTo(item.getValidTo());
        entity.setExcludeReason(item.getExcludeReason());
        entity.setExcludedByType(DmsActorType.USER.name());
        entity.setExcludedById(actorId);
        return entity;
    }

    private String identity(AccessExclusionItemForm item) {
        return item.getResourceType() + "|" + item.getResourceId() + "|" + item.getUserId() + "|READ";
    }

    private String identity(DmsAccessExclusionEntity item) {
        return item.getResourceType() + "|" + item.getResourceId() + "|" + item.getUserId()
                + "|" + item.getActionCode();
    }

    private boolean sameInstant(Date left, Date right) {
        return left == null ? right == null : right != null && left.toInstant().equals(right.toInstant());
    }

    private int pageSize(Integer requested) {
        int value = requested == null ? properties.getDefaultPageSize() : requested;
        if (value < 1 || value > properties.getMaxPageSize()) {
            invalid("pageSize 必须在 1 到 " + properties.getMaxPageSize() + " 之间");
        }
        return value;
    }

    private DmsAccessExclusionVO toVO(DmsAccessExclusionEntity value) {
        DmsAccessExclusionVO result = new DmsAccessExclusionVO();
        result.setId(value.getId());
        result.setResourceType(value.getResourceType());
        result.setResourceId(value.getResourceId());
        result.setUserId(value.getUserId());
        result.setActionCode(value.getActionCode());
        result.setSourceType(value.getSourceType());
        result.setSourceId(value.getSourceId());
        result.setValidFrom(value.getValidFrom());
        result.setValidTo(value.getValidTo());
        result.setExcludeReason(value.getExcludeReason());
        result.setExcludedByType(value.getExcludedByType());
        result.setExcludedById(value.getExcludedById());
        result.setRevokedAt(value.getRevokedAt());
        result.setRevokedByType(value.getRevokedByType());
        result.setRevokedById(value.getRevokedById());
        result.setRevokeReason(value.getRevokeReason());
        result.setRevision(value.getRevision());
        result.setCreatedAt(value.getCreatedAt());
        result.setUpdatedAt(value.getUpdatedAt());
        result.setStatus(status(value));
        return result;
    }

    private String status(DmsAccessExclusionEntity value) {
        Date now = new Date();
        if (value.getRevokedAt() != null) {
            return "REVOKED";
        }
        if (value.getValidFrom().after(now)) {
            return "PENDING";
        }
        if (value.getValidTo() != null && !now.before(value.getValidTo())) {
            return "EXPIRED";
        }
        return "ACTIVE";
    }

    private String trimToNull(String value) {
        return value == null || value.trim().isEmpty() ? null : value.trim();
    }

    private void invalid(String message) {
        throw DmsPermissionException.of(DmsPermissionError.INVALID_REQUEST, message);
    }
}