package jnpf.dmsService;

import jnpf.dmsEntity.permission.entity.DmsFilePermissionEntity;
import jnpf.dmsEntity.permission.entity.DmsPermissionUsageEntity;
import jnpf.dmsEntity.permission.enums.DmsPrincipalType;
import jnpf.dmsEntity.permission.enums.DmsResourceType;
import jnpf.dmsEntity.permission.model.DmsResourcePath;
import jnpf.dmsEntity.permission.vo.DmsCursorPageVO;
import jnpf.dmsEntity.permission.vo.DmsPermissionGrantVO;
import jnpf.dmsEntity.permission.vo.DmsPrincipalOptionVO;
import jnpf.dmsEntity.permission.vo.DmsPermissionUsageVO;
import jnpf.dmsMapper.DmsFilePermissionMapper;
import jnpf.dmsMapper.DmsPermissionGroupMapper;
import jnpf.dmsMapper.DmsPermissionUsageMapper;
import jnpf.dmsPermission.DmsCurrentIdentity;
import jnpf.dmsPermission.DmsCursorCodec;
import jnpf.dmsPermission.DmsPermissionError;
import jnpf.dmsPermission.DmsPermissionException;
import jnpf.dmsPermission.DmsPermissionMatcher;
import jnpf.dmsPermission.DmsPermissionProperties;
import jnpf.dmsPermission.DmsResourceResolver;
import jnpf.dmsPermission.DmsUserDisplayNameResolver;
import jnpf.permission.OrganizeApi;
import jnpf.permission.PositionApi;
import jnpf.permission.RoleApi;
import jnpf.permission.entity.PositionEntity;
import jnpf.permission.entity.RoleEntity;
import jnpf.permission.entity.PermissionGroupEntity;
import jnpf.permission.entity.OrganizeEntity;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

import java.util.Date;
import java.util.Collections;
import java.util.List;
import java.util.Map;
import java.util.LinkedHashMap;
import java.util.UUID;
import java.util.function.Function;
import java.util.stream.Collectors;

@Service
@Slf4j
@RequiredArgsConstructor
public class DmsPermissionAdminQueryService {
    private final DmsCurrentIdentity currentIdentity;
    private final DmsPermissionProperties properties;
    private final DmsCursorCodec cursorCodec;
    private final DmsFilePermissionMapper permissionMapper;
    private final DmsPermissionGroupMapper permissionGroupMapper;
    private final DmsPermissionUsageMapper usageMapper;
    private final DmsPermissionGrantService grantService;
    private final DmsResourceResolver resourceResolver;
    private final DmsPermissionMatcher matcher;
    private final DmsUserDisplayNameResolver userDisplayNameResolver;
    private final OrganizeApi organizeApi;
    private final PositionApi positionApi;
    private final RoleApi roleApi;

    @Transactional(readOnly = true)
    public DmsCursorPageVO<DmsPermissionGrantVO> grants(UUID resourceId, String principalType,
                                                        String principalId, String cursor, Integer pageSize) {
        currentIdentity.requirePermissionAdministrator();
        String normalizedPrincipalType = normalizePrincipalType(principalType);
        int limit = pageSize(pageSize);
        DmsCursorCodec.Cursor decoded = cursorCodec.decode(cursor);
        List<DmsFilePermissionEntity> rows = permissionMapper.selectPage(currentIdentity.tenantId(), resourceId,
                normalizedPrincipalType, trimToNull(principalId), decoded.getTime(), decoded.getId(), limit + 1);
        return page(rows, limit);
    }

    @Transactional(readOnly = true)
    public DmsPermissionGrantVO grant(UUID id) {
        currentIdentity.requirePermissionAdministrator();
        DmsFilePermissionEntity value = permissionMapper.selectByTenantAndId(currentIdentity.tenantId(), id);
        if (value == null) {
            throw DmsPermissionException.of(DmsPermissionError.RESOURCE_NOT_FOUND, "权限不存在: " + id);
        }
        DmsPermissionGrantVO result = enriched(value, false);
        enrichPrincipalNames(Collections.singletonList(result));
        return result;
    }

    @Transactional(readOnly = true)
    public List<DmsPermissionGrantVO> resourceGrants(DmsResourceType resourceType, UUID resourceId) {
        currentIdentity.requirePermissionAdministrator();
        String tenantId = currentIdentity.tenantId();
        DmsResourcePath path = resourceResolver.resolve(tenantId, resourceType, resourceId);
        List<UUID> candidateIds = resourceResolver.candidateResourceIds(path);
        List<DmsPermissionGrantVO> result = permissionMapper.selectForResourceIds(tenantId, candidateIds, 1000).stream()
                .filter(permission -> matcher.coversResource(permission, path))
                .map(permission -> enriched(permission, !permission.getResourceId().equals(resourceId)))
                .collect(Collectors.toList());
        enrichPrincipalNames(result);
        return result;
    }

    @Transactional(readOnly = true)
    public List<DmsPermissionUsageVO> usages(UUID permissionId, Integer pageSize) {
        currentIdentity.requirePermissionAdministrator();
        String tenantId = currentIdentity.tenantId();
        if (permissionMapper.selectByTenantAndId(tenantId, permissionId) == null) {
            throw DmsPermissionException.of(DmsPermissionError.RESOURCE_NOT_FOUND,
                    "权限不存在: " + permissionId);
        }
        return usageMapper.selectByPermission(tenantId, permissionId, pageSize(pageSize)).stream()
                .map(this::usageVO).collect(Collectors.toList());
    }

    @Transactional(readOnly = true)
    public List<DmsPrincipalOptionVO> permissionGroups(String keyword, Integer pageSize) {
        currentIdentity.requirePermissionAdministrator();
        return permissionGroupMapper.selectEnabled(trimToNull(keyword), pageSize(pageSize)).stream()
                .map(group -> new DmsPrincipalOptionVO(group.getId(), group.getFullName()))
                .collect(Collectors.toList());
    }

    private DmsCursorPageVO<DmsPermissionGrantVO> page(List<DmsFilePermissionEntity> rows, int limit) {
        DmsCursorPageVO<DmsPermissionGrantVO> result = new DmsCursorPageVO<>();
        boolean hasMore = rows.size() > limit;
        if (hasMore) {
            rows = rows.subList(0, limit);
        }
        List<DmsPermissionGrantVO> values = rows.stream().map(row -> enriched(row, false))
                .collect(Collectors.toList());
        enrichPrincipalNames(values);
        result.setList(values);
        result.setHasMore(hasMore);
        if (hasMore && !rows.isEmpty()) {
            DmsFilePermissionEntity last = rows.get(rows.size() - 1);
            result.setNextCursor(cursorCodec.encode(last.getCreatedAt(), last.getId()));
        }
        return result;
    }

    private void enrichPrincipalNames(List<DmsPermissionGrantVO> values) {
        Map<String, String> names = userDisplayNameResolver.resolve(values.stream()
                .filter(value -> DmsPrincipalType.USER.name().equals(value.getPrincipalType()))
                .map(DmsPermissionGrantVO::getPrincipalId)
                .collect(Collectors.toList()));
        values.stream()
                .filter(value -> DmsPrincipalType.USER.name().equals(value.getPrincipalType()))
                .forEach(value -> value.setPrincipalName(names.get(value.getPrincipalId())));
        enrichNames(values, DmsPrincipalType.ORG, organizeApi::getListByIds,
                OrganizeEntity::getId, OrganizeEntity::getFullName);
        enrichNames(values, DmsPrincipalType.POSITION, positionApi::getListByIds,
                PositionEntity::getId, PositionEntity::getFullName);
        enrichNames(values, DmsPrincipalType.ROLE, roleApi::getListByIds,
                RoleEntity::getId, RoleEntity::getFullName);
        enrichNames(values, DmsPrincipalType.GROUP, permissionGroupMapper::selectDisplayByIds,
                PermissionGroupEntity::getId, PermissionGroupEntity::getFullName);
    }

    private <T> void enrichNames(List<DmsPermissionGrantVO> values, DmsPrincipalType type,
                                 Function<List<String>, List<T>> lookup,
                                 Function<T, String> idGetter, Function<T, String> nameGetter) {
        List<String> ids = values.stream()
                .filter(value -> type.name().equals(value.getPrincipalType()))
                .map(DmsPermissionGrantVO::getPrincipalId)
                .filter(id -> id != null && !id.trim().isEmpty())
                .distinct()
                .collect(Collectors.toList());
        if (ids.isEmpty()) {
            return;
        }
        List<T> principals;
        try {
            principals = lookup.apply(ids);
        } catch (RuntimeException ex) {
            log.warn("DMS {} display name lookup failed for {} principals", type, ids.size(), ex);
            return;
        }
        if (principals == null || principals.isEmpty()) {
            return;
        }
        Map<String, String> names = new LinkedHashMap<>();
        for (T principal : principals) {
            if (principal == null) {
                continue;
            }
            String name = trimToNull(nameGetter.apply(principal));
            if (name != null) {
                names.putIfAbsent(idGetter.apply(principal), name);
            }
        }
        values.stream()
                .filter(value -> type.name().equals(value.getPrincipalType()))
                .forEach(value -> value.setPrincipalName(names.get(value.getPrincipalId())));
    }

    private DmsPermissionGrantVO enriched(DmsFilePermissionEntity value, boolean inherited) {
        DmsPermissionGrantVO result = grantService.toVO(value);
        result.setInherited(inherited);
        result.setStatus(status(value));
        if (value.getMaxUseCount() != null) {
            result.setRemainingUseCount(value.getMaxUseCount() - value.getUsedCount());
        }
        return result;
    }

    private String status(DmsFilePermissionEntity value) {
        Date now = new Date();
        if (value.getRevokedAt() != null) {
            return "REVOKED";
        }
        if (value.getValidFrom().after(now)) {
            return "PENDING";
        }
        if (value.getValidTo() != null && !now.before(value.getValidTo())) {
            return "EXPIRED";
        }
        if (value.getMaxUseCount() != null && value.getUsedCount() >= value.getMaxUseCount()) {
            return "EXHAUSTED";
        }
        return "ACTIVE";
    }

    private DmsPermissionUsageVO usageVO(DmsPermissionUsageEntity value) {
        DmsPermissionUsageVO result = new DmsPermissionUsageVO();
        result.setId(value.getId());
        result.setPermissionId(value.getPermissionId());
        result.setUserId(value.getUserId());
        result.setActionCode(value.getActionCode());
        result.setActualResourceType(value.getActualResourceType());
        result.setActualResourceId(value.getActualResourceId());
        result.setOperationId(value.getOperationId());
        result.setSessionExpiresAt(value.getSessionExpiresAt());
        result.setUsedAt(value.getUsedAt());
        return result;
    }

    private int pageSize(Integer requested) {
        int value = requested == null ? properties.getDefaultPageSize() : requested;
        if (value < 1 || value > properties.getMaxPageSize()) {
            throw DmsPermissionException.of(DmsPermissionError.INVALID_REQUEST,
                    "pageSize 必须在 1 到 " + properties.getMaxPageSize() + " 之间");
        }
        return value;
    }

    private String normalizePrincipalType(String value) {
        if (value == null || value.trim().isEmpty()) {
            return null;
        }
        try {
            return DmsPrincipalType.valueOf(value.trim().toUpperCase()).name();
        } catch (IllegalArgumentException ex) {
            throw DmsPermissionException.of(DmsPermissionError.INVALID_REQUEST, "principalType 无效");
        }
    }

    private String trimToNull(String value) {
        return value == null || value.trim().isEmpty() ? null : value.trim();
    }
}