package jnpf.dmsService;

import jnpf.dmsEntity.permission.entity.DmsFilePermissionEntity;
import jnpf.dmsEntity.permission.entity.DmsPermissionResourceEntity;
import jnpf.dmsEntity.permission.enums.DmsActorType;
import jnpf.dmsEntity.permission.enums.DmsPermissionAction;
import jnpf.dmsEntity.permission.enums.DmsPrincipalType;
import jnpf.dmsEntity.permission.enums.DmsResourceScope;
import jnpf.dmsEntity.permission.enums.DmsResourceType;
import jnpf.dmsEntity.permission.form.PermissionGrantBatchForm;
import jnpf.dmsEntity.permission.form.PermissionGrantItemForm;
import jnpf.dmsEntity.permission.form.PermissionRevokeForm;
import jnpf.dmsEntity.permission.vo.DmsPermissionGrantVO;
import jnpf.dmsIntegration.audit.DmsAuditAdapter;
import jnpf.dmsMapper.DmsFilePermissionMapper;
import jnpf.dmsMapper.DmsPermissionResourceMapper;
import jnpf.dmsPermission.DmsCurrentIdentity;
import jnpf.dmsPermission.DmsPermissionError;
import jnpf.dmsPermission.DmsPermissionException;
import jnpf.dmsPermission.DmsPermissionProperties;
import jnpf.dmsPermission.DmsPrincipalValidator;
import lombok.RequiredArgsConstructor;
import org.springframework.dao.DuplicateKeyException;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

import java.util.ArrayList;
import java.util.Collections;
import java.util.Comparator;
import java.util.Date;
import java.util.HashMap;
import java.util.HashSet;
import java.util.LinkedHashMap;
import java.util.LinkedHashSet;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import java.util.Set;
import java.util.UUID;
import java.util.function.Function;
import java.util.stream.Collectors;

@Service
@RequiredArgsConstructor
public class DmsPermissionGrantService {
    private static final String FOLDER_CREATOR_CREATE_SOURCE_PREFIX = "folder-creator-create:";
    private static final String FOLDER_CREATOR_CREATE_REASON = "目录创建者默认 CREATE 权限";

    private final DmsCurrentIdentity currentIdentity;
    private final DmsPermissionProperties properties;
    private final DmsPrincipalValidator principalValidator;
    private final DmsPermissionResourceMapper resourceMapper;
    private final DmsFilePermissionMapper permissionMapper;
    private final DmsAuditAdapter auditAdapter;

    @Transactional
    public List<DmsPermissionGrantVO> grant(PermissionGrantBatchForm form) {
        currentIdentity.requirePermissionAdministrator();
        if (form.getItems().size() > properties.getMaxGrantBatchSize()) {
            throw DmsPermissionException.of(DmsPermissionError.INVALID_REQUEST,
                    "授权批量大小不能超过 " + properties.getMaxGrantBatchSize());
        }
        String tenantId = currentIdentity.tenantId();
        String sourceType = form.getSourceType().name();
        String sourceId = form.getSourceId().trim();
        List<PermissionGrantItemForm> items = normalizeAndValidate(form.getItems());
        permissionMapper.lockSource(tenantId, sourceType, sourceId);
        List<DmsFilePermissionEntity> existing = permissionMapper.selectBySource(tenantId, sourceType, sourceId);
        if (!existing.isEmpty()) {
            verifyIdempotentRetry(existing, items);
            return existing.stream().map(this::toVO).collect(Collectors.toList());
        }

        validateResources(tenantId, items);
        principalValidator.validate(items);
        List<DmsFilePermissionEntity> created = new ArrayList<>();
        try {
            for (PermissionGrantItemForm item : items) {
                DmsFilePermissionEntity permission = toEntity(tenantId, sourceType, sourceId, item);
                created.add(permissionMapper.insertReturning(permission));
            }
        } catch (DuplicateKeyException ex) {
            throw DmsPermissionException.of(DmsPermissionError.SOURCE_CONFLICT,
                    "授权来源或授权项与已有数据冲突");
        }
        for (DmsFilePermissionEntity permission : created) {
            auditAdapter.dataChange("CREATE", "创建 DMS 文件权限", "dms_file_permissions",
                    permission.getId().toString(), permission.getGrantReason(), null);
        }
        return created.stream().map(this::toVO).collect(Collectors.toList());
    }

    @Transactional
    public DmsFilePermissionEntity ensureFolderCreatorCreatePermission(String tenantId, UUID folderId,
                                                                        String creatorUserId) {
        String sourceType = "SYSTEM";
        String sourceId = FOLDER_CREATOR_CREATE_SOURCE_PREFIX + folderId;
        permissionMapper.lockSource(tenantId, sourceType, sourceId);
        List<DmsFilePermissionEntity> existing = permissionMapper.selectBySource(tenantId, sourceType, sourceId);
        if (!existing.isEmpty()) {
            if (existing.size() != 1 || !sameFolderCreatorCreatePermission(
                    existing.get(0), tenantId, folderId, creatorUserId, sourceId)) {
                throw DmsPermissionException.of(DmsPermissionError.SOURCE_CONFLICT,
                        "目录创建者默认权限来源与已有授权不一致");
            }
            return existing.get(0);
        }

        DmsFilePermissionEntity permission = new DmsFilePermissionEntity();
        permission.setTenantId(tenantId);
        permission.setResourceType(DmsResourceType.FOLDER.name());
        permission.setResourceId(folderId);
        permission.setResourceScope(DmsResourceScope.SELF.name());
        permission.setPrincipalType(DmsPrincipalType.USER.name());
        permission.setPrincipalId(creatorUserId);
        permission.setIncludeChildOrgs(false);
        permission.setActionCode(DmsPermissionAction.CREATE.name());
        permission.setSourceType(sourceType);
        permission.setSourceId(sourceId);
        permission.setValidFrom(new Date());
        permission.setGrantReason(FOLDER_CREATOR_CREATE_REASON);
        permission.setGrantedByType(DmsActorType.USER.name());
        permission.setGrantedById(creatorUserId);
        try {
            permission = permissionMapper.insertReturning(permission);
        } catch (DuplicateKeyException ex) {
            throw DmsPermissionException.of(DmsPermissionError.SOURCE_CONFLICT,
                    "目录创建者默认权限与已有授权冲突");
        }
        auditAdapter.dataChange("CREATE", "创建 DMS 目录创建者默认权限", "dms_file_permissions",
                permission.getId().toString(), FOLDER_CREATOR_CREATE_REASON, null);
        return permission;
    }

    @Transactional
    public List<DmsPermissionGrantVO> revoke(PermissionRevokeForm form) {
        currentIdentity.requirePermissionAdministrator();
        String tenantId = currentIdentity.tenantId();
        String actorId = currentIdentity.userId();
        String reason = form.getReason().trim();
        List<UUID> ids = new ArrayList<>(new LinkedHashSet<>(form.getPermissionIds()));
        ids.sort(Comparator.comparing(UUID::toString));
        List<DmsFilePermissionEntity> locked = new ArrayList<>();
        for (UUID id : ids) {
            DmsFilePermissionEntity permission = permissionMapper.selectByTenantAndIdForUpdate(tenantId, id);
            if (permission == null) {
                throw DmsPermissionException.of(DmsPermissionError.RESOURCE_NOT_FOUND,
                        "权限不存在: " + id);
            }
            if (permission.getRevokedAt() != null
                    && (!DmsActorType.USER.name().equals(permission.getRevokedByType())
                    || !actorId.equals(permission.getRevokedById())
                    || !reason.equals(permission.getRevokeReason()))) {
                throw DmsPermissionException.of(DmsPermissionError.REVISION_CONFLICT,
                        "权限已被其他请求撤销: " + id);
            }
            locked.add(permission);
        }
        for (DmsFilePermissionEntity permission : locked) {
            if (permission.getRevokedAt() == null) {
                int changed = permissionMapper.revoke(tenantId, permission.getId(), DmsActorType.USER.name(),
                        actorId, reason);
                if (changed != 1) {
                    throw DmsPermissionException.of(DmsPermissionError.REVISION_CONFLICT,
                            "权限撤销发生并发冲突: " + permission.getId());
                }
                auditAdapter.dataChange("UPDATE", "撤销 DMS 文件权限", "dms_file_permissions",
                        permission.getId().toString(), reason, null);
            }
        }
        return ids.stream().map(id -> toVO(permissionMapper.selectByTenantAndId(tenantId, id)))
                .collect(Collectors.toList());
    }

    private List<PermissionGrantItemForm> normalizeAndValidate(List<PermissionGrantItemForm> source) {
        List<PermissionGrantItemForm> result = new ArrayList<>();
        Set<String> identities = new HashSet<>();
        for (PermissionGrantItemForm original : source) {
            PermissionGrantItemForm item = copy(original);
            validateItem(item);
            String identity = identity(item);
            if (!identities.add(identity)) {
                throw DmsPermissionException.of(DmsPermissionError.INVALID_REQUEST,
                        "同一授权批次包含重复授权项");
            }
            result.add(item);
        }
        result.sort(Comparator.comparing(this::identity));
        return result;
    }

    private PermissionGrantItemForm copy(PermissionGrantItemForm value) {
        PermissionGrantItemForm result = new PermissionGrantItemForm();
        result.setResourceType(value.getResourceType());
        result.setResourceId(value.getResourceId());
        result.setResourceScope(value.getResourceScope());
        result.setPrincipalType(value.getPrincipalType());
        result.setPrincipalId(value.getPrincipalId().trim());
        result.setIncludeChildOrgs(value.isIncludeChildOrgs());
        result.setActionCode(value.getActionCode());
        result.setValidFrom(value.getValidFrom());
        result.setValidTo(value.getValidTo());
        result.setMaxUseCount(value.getMaxUseCount());
        result.setGrantReason(trimToNull(value.getGrantReason()));
        return result;
    }

    private void validateItem(PermissionGrantItemForm item) {
        if (item.getResourceType() != DmsResourceType.FOLDER
                && item.getResourceScope() != DmsResourceScope.SELF) {
            invalid("Document 和 FileVersion 只允许 SELF 范围");
        }
        if (item.getActionCode() == DmsPermissionAction.CREATE
                && item.getResourceType() != DmsResourceType.FOLDER) {
            invalid("CREATE 只允许授予 Folder");
        }
        if (item.isIncludeChildOrgs() && item.getPrincipalType() != DmsPrincipalType.ORG) {
            invalid("includeChildOrgs 只适用于 ORG 主体");
        }
        if (item.getMaxUseCount() != null && item.getPrincipalType() != DmsPrincipalType.USER) {
            invalid("按次权限只允许授予 USER 主体");
        }
        Date effectiveFrom = item.getValidFrom() == null ? new Date() : item.getValidFrom();
        if (item.getValidTo() != null && !item.getValidTo().after(effectiveFrom)) {
            invalid("validTo 必须晚于 validFrom");
        }
    }

    private void validateResources(String tenantId, List<PermissionGrantItemForm> items) {
        List<UUID> ids = items.stream().map(PermissionGrantItemForm::getResourceId).distinct()
                .collect(Collectors.toList());
        Map<UUID, DmsPermissionResourceEntity> resources = resourceMapper.selectByTenantAndIds(tenantId, ids)
                .stream().collect(Collectors.toMap(DmsPermissionResourceEntity::getId, Function.identity()));
        for (PermissionGrantItemForm item : items) {
            DmsPermissionResourceEntity resource = resources.get(item.getResourceId());
            if (resource == null || !item.getResourceType().name().equals(resource.getResourceType())) {
                throw DmsPermissionException.of(DmsPermissionError.RESOURCE_NOT_FOUND,
                        "授权资源不存在或类型不一致: " + item.getResourceId());
            }
        }
    }

    private void verifyIdempotentRetry(List<DmsFilePermissionEntity> existing,
                                       List<PermissionGrantItemForm> requested) {
        if (existing.size() != requested.size() || existing.stream().anyMatch(row -> row.getRevokedAt() != null)) {
            throw DmsPermissionException.of(DmsPermissionError.SOURCE_CONFLICT,
                    "source_id 已存在，但授权集合数量不同或包含已撤销权限");
        }
        Map<String, DmsFilePermissionEntity> byIdentity = existing.stream().collect(Collectors.toMap(
                this::identity, Function.identity(), (left, right) -> left, LinkedHashMap::new));
        for (PermissionGrantItemForm item : requested) {
            DmsFilePermissionEntity row = byIdentity.get(identity(item));
            if (row == null || !sameDefinition(row, item)) {
                throw DmsPermissionException.of(DmsPermissionError.SOURCE_CONFLICT,
                        "source_id 已存在，但完整授权集合与本次请求不一致");
            }
        }
    }

    private boolean sameDefinition(DmsFilePermissionEntity row, PermissionGrantItemForm item) {
        return (item.getValidFrom() == null || sameInstant(row.getValidFrom(), item.getValidFrom()))
                && sameInstant(row.getValidTo(), item.getValidTo())
                && Objects.equals(row.getMaxUseCount(), item.getMaxUseCount())
                && Objects.equals(row.getGrantReason(), item.getGrantReason());
    }

    private boolean sameFolderCreatorCreatePermission(DmsFilePermissionEntity row, String tenantId,
                                                       UUID folderId, String creatorUserId, String sourceId) {
        return tenantId.equals(row.getTenantId())
                && DmsResourceType.FOLDER.name().equals(row.getResourceType())
                && folderId.equals(row.getResourceId())
                && DmsResourceScope.SELF.name().equals(row.getResourceScope())
                && DmsPrincipalType.USER.name().equals(row.getPrincipalType())
                && creatorUserId.equals(row.getPrincipalId())
                && Boolean.FALSE.equals(row.getIncludeChildOrgs())
                && DmsPermissionAction.CREATE.name().equals(row.getActionCode())
                && "SYSTEM".equals(row.getSourceType())
                && sourceId.equals(row.getSourceId())
                && row.getValidTo() == null
                && row.getMaxUseCount() == null
                && FOLDER_CREATOR_CREATE_REASON.equals(row.getGrantReason())
                && DmsActorType.USER.name().equals(row.getGrantedByType())
                && creatorUserId.equals(row.getGrantedById());
    }

    private DmsFilePermissionEntity toEntity(String tenantId, String sourceType, String sourceId,
                                             PermissionGrantItemForm item) {
        DmsFilePermissionEntity entity = new DmsFilePermissionEntity();
        entity.setTenantId(tenantId);
        entity.setResourceType(item.getResourceType().name());
        entity.setResourceId(item.getResourceId());
        entity.setResourceScope(item.getResourceScope().name());
        entity.setPrincipalType(item.getPrincipalType().name());
        entity.setPrincipalId(item.getPrincipalId());
        entity.setIncludeChildOrgs(item.isIncludeChildOrgs());
        entity.setActionCode(item.getActionCode().name());
        entity.setSourceType(sourceType);
        entity.setSourceId(sourceId);
        entity.setValidFrom(item.getValidFrom() == null ? new Date() : item.getValidFrom());
        entity.setValidTo(item.getValidTo());
        entity.setMaxUseCount(item.getMaxUseCount());
        entity.setGrantReason(item.getGrantReason());
        entity.setGrantedByType(DmsActorType.USER.name());
        entity.setGrantedById(currentIdentity.userId());
        return entity;
    }

    private String identity(PermissionGrantItemForm item) {
        return item.getResourceType() + "|" + item.getResourceId() + "|" + item.getResourceScope()
                + "|" + item.getPrincipalType() + "|" + item.getPrincipalId() + "|"
                + item.isIncludeChildOrgs() + "|" + item.getActionCode();
    }

    private String identity(DmsFilePermissionEntity item) {
        return item.getResourceType() + "|" + item.getResourceId() + "|" + item.getResourceScope()
                + "|" + item.getPrincipalType() + "|" + item.getPrincipalId() + "|"
                + item.getIncludeChildOrgs() + "|" + item.getActionCode();
    }

    private boolean sameInstant(Date left, Date right) {
        return left == null ? right == null : right != null && left.toInstant().equals(right.toInstant());
    }

    private String trimToNull(String value) {
        return value == null || value.trim().isEmpty() ? null : value.trim();
    }

    private void invalid(String message) {
        throw DmsPermissionException.of(DmsPermissionError.INVALID_REQUEST, message);
    }

    public DmsPermissionGrantVO toVO(DmsFilePermissionEntity value) {
        DmsPermissionGrantVO result = new DmsPermissionGrantVO();
        result.setId(value.getId());
        result.setResourceType(value.getResourceType());
        result.setResourceId(value.getResourceId());
        result.setResourceScope(value.getResourceScope());
        result.setPrincipalType(value.getPrincipalType());
        result.setPrincipalId(value.getPrincipalId());
        result.setIncludeChildOrgs(value.getIncludeChildOrgs());
        result.setActionCode(value.getActionCode());
        result.setSourceType(value.getSourceType());
        result.setSourceId(value.getSourceId());
        result.setValidFrom(value.getValidFrom());
        result.setValidTo(value.getValidTo());
        result.setMaxUseCount(value.getMaxUseCount());
        result.setUsedCount(value.getUsedCount());
        result.setGrantReason(value.getGrantReason());
        result.setRevokedAt(value.getRevokedAt());
        result.setRevokeReason(value.getRevokeReason());
        result.setRevision(value.getRevision());
        result.setCreatedAt(value.getCreatedAt());
        result.setUpdatedAt(value.getUpdatedAt());
        return result;
    }
}