package jnpf.dmsPermission;

import jnpf.base.UserInfo;
import jnpf.dmsEntity.permission.entity.DmsFilePermissionEntity;
import jnpf.dmsEntity.permission.entity.DmsPermissionUsageEntity;
import jnpf.dmsEntity.permission.enums.DmsPermissionAction;
import jnpf.dmsEntity.permission.form.PermissionDecisionForm;
import jnpf.dmsEntity.permission.model.DmsResourcePath;
import jnpf.dmsEntity.permission.model.DmsSubjectSet;
import jnpf.dmsEntity.permission.vo.DmsPermissionDecisionVO;
import jnpf.dmsMapper.DmsFilePermissionMapper;
import jnpf.dmsMapper.DmsPermissionUsageMapper;
import jnpf.dmsService.DmsPermissionDecisionService;
import lombok.RequiredArgsConstructor;
import org.springframework.dao.DuplicateKeyException;
import org.springframework.stereotype.Component;
import org.springframework.transaction.annotation.Transactional;

import java.util.Collections;
import java.util.Date;
import java.util.UUID;

@Component
@RequiredArgsConstructor
public class DmsPermissionGuard {
    private final DmsCurrentIdentity currentIdentity;
    private final DmsPermissionDecisionService decisionService;
    private final DmsFilePermissionMapper permissionMapper;
    private final DmsPermissionUsageMapper usageMapper;
    private final DmsResourceResolver resourceResolver;
    private final DmsSubjectResolver subjectResolver;
    private final DmsPermissionGroupMembershipResolver groupMembershipResolver;
    private final DmsPermissionMatcher matcher;
    private final DmsAccessExclusionResolver exclusionResolver;

    @Transactional
    public <T> T execute(DmsPermissionExecutionContext context, DmsPermissionOperation<T> operation) {
        validateContext(context, operation);
        UserInfo user = currentIdentity.requireUser();
        String tenantId = currentIdentity.tenantId(user);
        if (context.getOperationId() != null) {
            DmsPermissionUsageEntity prior = usageMapper.selectByOperation(tenantId, user.getUserId(),
                    context.getOperationId());
            if (prior != null) {
                DmsResourcePath path = resourceResolver.resolve(tenantId, context.getResourceType(),
                        context.getResourceId());
                ensureNotReadExcluded(context, tenantId, user.getUserId().trim(), path);
                validateReplay(prior, context, user, tenantId, path);
                return operation.replay();
            }
        }

        PermissionDecisionForm request = new PermissionDecisionForm();
        request.setResourceType(context.getResourceType());
        request.setResourceId(context.getResourceId());
        request.setActionCode(context.getActionCode());
        DmsPermissionDecisionVO decision = decisionService.evaluate(request);
        if (!decision.isAllowed()) {
            throw DmsPermissionException.of(DmsPermissionError.PERMISSION_DENIED,
                    "当前用户没有所需的 " + context.getActionCode() + " 权限");
        }
        DmsFilePermissionEntity permission = permissionMapper.selectByTenantAndIdForUpdate(tenantId,
                decision.getMatchedPermissionId());
        if (permission == null) {
            throw DmsPermissionException.of(DmsPermissionError.PERMISSION_DENIED, "匹配权限已不存在");
        }
        if (context.getOperationId() != null) {
            DmsPermissionUsageEntity concurrentPrior = usageMapper.selectByOperation(tenantId,
                    user.getUserId(), context.getOperationId());
            if (concurrentPrior != null) {
                DmsResourcePath path = resourceResolver.resolve(tenantId, context.getResourceType(),
                        context.getResourceId());
                ensureNotReadExcluded(context, tenantId, user.getUserId().trim(), path);
                validateReplay(concurrentPrior, context, user, tenantId, path);
                return operation.replay();
            }
        }
        DmsResourcePath path = resourceResolver.resolve(tenantId, context.getResourceType(),
                context.getResourceId());
        ensureNotReadExcluded(context, tenantId, user.getUserId().trim(), path);
        validateLockedPermission(permission, context, user, tenantId, path);
        if (permission.getMaxUseCount() == null) {
            return operation.execute();
        }
        if (context.getOperationId() == null) {
            throw DmsPermissionException.of(DmsPermissionError.INVALID_REQUEST,
                    "执行按次权限必须提供 operationId");
        }

        Date sessionExpiresAt = normalizedSessionExpiry(context);
        T result = operation.execute();
        DmsPermissionUsageEntity usage = new DmsPermissionUsageEntity();
        usage.setTenantId(tenantId);
        usage.setPermissionId(permission.getId());
        usage.setUserId(user.getUserId());
        usage.setActionCode(context.getActionCode().name());
        usage.setActualResourceType(context.getResourceType().name());
        usage.setActualResourceId(context.getResourceId());
        usage.setOperationId(context.getOperationId());
        usage.setSessionExpiresAt(sessionExpiresAt);
        try {
            usageMapper.insert(usage);
        } catch (DuplicateKeyException ex) {
            throw DmsPermissionException.of(DmsPermissionError.IDEMPOTENCY_CONFLICT,
                    "operationId 已被并发请求使用，请按相同 operationId 重试");
        }
        return result;
    }

    private void validateLockedPermission(DmsFilePermissionEntity permission,
                                          DmsPermissionExecutionContext context, UserInfo user,
                                          String tenantId, DmsResourcePath path) {
        Date now = new Date();
        if (!tenantId.equals(permission.getTenantId())
                || !context.getActionCode().name().equals(permission.getActionCode())
                || permission.getRevokedAt() != null
                || permission.getValidFrom().after(now)
                || (permission.getValidTo() != null && !now.before(permission.getValidTo()))) {
            throw DmsPermissionException.of(DmsPermissionError.PERMISSION_DENIED,
                    "匹配权限在执行前已失效");
        }
        if (permission.getMaxUseCount() != null
                && permission.getUsedCount() >= permission.getMaxUseCount()) {
            throw DmsPermissionException.of(DmsPermissionError.PERMISSION_EXHAUSTED,
                    "匹配权限的使用次数已用尽");
        }
        DmsSubjectSet subjects = subjectResolver.resolve(user);
        if ("GROUP".equals(permission.getPrincipalType())) {
            groupMembershipResolver.resolve(Collections.singleton(permission.getPrincipalId()), subjects);
        }
        if (!matcher.matches(permission, path, subjects)) {
            throw DmsPermissionException.of(DmsPermissionError.PERMISSION_DENIED,
                    "当前主体或资源在执行前已不再匹配权限");
        }
    }

    private void validateReplay(DmsPermissionUsageEntity prior, DmsPermissionExecutionContext context,
                                UserInfo user, String tenantId, DmsResourcePath path) {
        if (!context.getResourceType().name().equals(prior.getActualResourceType())
                || !context.getResourceId().equals(prior.getActualResourceId())
                || !context.getActionCode().name().equals(prior.getActionCode())) {
            throw DmsPermissionException.of(DmsPermissionError.IDEMPOTENCY_CONFLICT,
                    "operationId 已用于不同资源或动作");
        }
        if ((context.getActionCode() == DmsPermissionAction.READ
                || context.getActionCode() == DmsPermissionAction.UPDATE)
                && prior.getSessionExpiresAt() != null && !new Date().before(prior.getSessionExpiresAt())) {
            throw DmsPermissionException.of(DmsPermissionError.IDEMPOTENCY_CONFLICT,
                    "operationId 对应的权限会话已过期，请使用新的 operationId");
        }
        DmsFilePermissionEntity permission = permissionMapper.selectByTenantAndId(tenantId,
                prior.getPermissionId());
        Date now = new Date();
        if (permission == null || permission.getRevokedAt() != null || permission.getValidFrom().after(now)
                || (permission.getValidTo() != null && !now.before(permission.getValidTo()))) {
            throw DmsPermissionException.of(DmsPermissionError.PERMISSION_DENIED,
                    "原按次权限已撤销或不在有效期内");
        }
        DmsSubjectSet subjects = subjectResolver.resolve(user);
        if ("GROUP".equals(permission.getPrincipalType())) {
            groupMembershipResolver.resolve(Collections.singleton(permission.getPrincipalId()), subjects);
        }
        if (!permission.getActionCode().equals(context.getActionCode().name())
                || !matcher.matches(permission, path, subjects)) {
            throw DmsPermissionException.of(DmsPermissionError.PERMISSION_DENIED,
                    "当前主体或资源不再匹配原按次权限");
        }
    }

    private void ensureNotReadExcluded(DmsPermissionExecutionContext context, String tenantId,
                                       String userId, DmsResourcePath path) {
        if (context.getActionCode() == DmsPermissionAction.READ
                && exclusionResolver.isExcluded(tenantId, userId, path)) {
            throw DmsPermissionException.of(DmsPermissionError.PERMISSION_DENIED,
                    "当前用户的 READ 权限已被排除");
        }
    }

    private Date normalizedSessionExpiry(DmsPermissionExecutionContext context) {
        if (context.getActionCode() != DmsPermissionAction.READ
                && context.getActionCode() != DmsPermissionAction.UPDATE) {
            return null;
        }
        Date expiry = context.getSessionExpiresAt();
        if (expiry != null && !expiry.after(new Date())) {
            throw DmsPermissionException.of(DmsPermissionError.INVALID_REQUEST,
                    "sessionExpiresAt 必须晚于当前时间");
        }
        return expiry;
    }

    private <T> void validateContext(DmsPermissionExecutionContext context, DmsPermissionOperation<T> operation) {
        if (context == null || operation == null || context.getResourceType() == null
                || context.getResourceId() == null || context.getActionCode() == null) {
            throw DmsPermissionException.of(DmsPermissionError.INVALID_REQUEST,
                    "PermissionGuard 执行上下文不完整");
        }
    }
}