package jnpf.fileStorage;

import jnpf.base.ActionResult;
import jnpf.base.ActionResultCode;
import jnpf.exception.DataException;
import jnpf.file.WorkflowFileAccessApi;
import jnpf.model.fileaccess.WorkflowFileGrant;
import jnpf.model.fileaccess.WorkflowFileRequest;
import jnpf.util.JsonUtil;
import jnpf.util.TicketUtil;
import jnpf.util.UserProvider;
import lombok.Data;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import java.util.*;
import java.util.function.Function;

/** 流程动作准入与 Office 配置上下文绑定；文件传输使用原有公共能力。 */
@Service
public class WorkflowFileTicketService {
    private static final String PREVIEW_CONFIG = "workflow-file-preview-config-v2";
    private final WorkflowFileAccessApi access;
    private final Function<String, String> reader;
    private final Function<String, String> writer;

    @Autowired public WorkflowFileTicketService(WorkflowFileAccessApi access) {
        this(access, TicketUtil::parseTicket, payload -> TicketUtil.createTicket(payload, 300L));
    }
    WorkflowFileTicketService(WorkflowFileAccessApi access, Function<String, String> reader, Function<String, String> writer) {
        this.access = access; this.reader = reader; this.writer = writer;
    }

    @Data public static class Ticket {
        private String purpose;
        private WorkflowFileRequest source;
    }

    public List<WorkflowFileGrant> authorizeDownloads(List<WorkflowFileRequest> requests) {
        if (requests == null || requests.isEmpty() || requests.size() > 100) throw denied();
        List<WorkflowFileGrant> grants = new ArrayList<>();
        // 全部校验完成之后，调用方才可委托原单文件/打包下载。
        for (WorkflowFileRequest request : requests) grants.add(authorizeCurrent(request, "DOWNLOAD"));
        return grants;
    }

    public WorkflowFileGrant authorizePreview(WorkflowFileRequest request) {
        return authorizeCurrent(request, "VIEW");
    }

    /** 仅供服务器用已验证的结果签发配置上下文，不签发新的文件读取地址。 */
    public String previewTicket(WorkflowFileGrant grant) {
        Ticket ticket = new Ticket(); ticket.setPurpose(PREVIEW_CONFIG); ticket.setSource(grant.getContext());
        return writer.apply(JsonUtil.getObjectToString(ticket));
    }

    public WorkflowFileGrant previewAccess(String token) {
        if (token == null || !token.matches("[A-Za-z0-9_-]+")) throw denied();
        Ticket ticket;
        try { ticket = JsonUtil.getJsonToBean(reader.apply(token), Ticket.class); }
        catch (RuntimeException invalid) { throw denied(); }
        if (ticket == null || !PREVIEW_CONFIG.equals(ticket.getPurpose()) || ticket.getSource() == null) throw denied();
        WorkflowFileRequest source = ticket.getSource();
        // 配置获取仍使用当前登录用户，不在 DS 回源请求中模拟票据属主。
        if (!Objects.equals(UserProvider.getLoginUserId(), source.getOwnerId())
                || !Objects.equals(tenant(), source.getTenantId()) || !"VIEW".equals(source.getAction())) throw denied();
        WorkflowFileGrant grant = authorize(source);
        if (!Objects.equals(source.getRecordId(), grant.getContext().getRecordId())
                || !same(source.getTaskId(), grant.getContext().getTaskId())) throw denied();
        return grant;
    }

    private WorkflowFileGrant authorizeCurrent(WorkflowFileRequest request, String action) {
        if (request == null) throw denied();
        String user = UserProvider.getLoginUserId();
        if (user == null || user.isBlank()) throw denied();
        WorkflowFileRequest copy = JsonUtil.getJsonToBean(JsonUtil.getObjectToString(request), WorkflowFileRequest.class);
        copy.setOwnerId(user); copy.setTenantId(tenant()); copy.setAction(action);
        return authorize(copy);
    }

    private WorkflowFileGrant authorize(WorkflowFileRequest source) {
        ActionResult<WorkflowFileGrant> response = access.authorize(source);
        if (response == null || !ActionResultCode.SUCCESS.getCode().equals(response.getCode()) || response.getData() == null) throw denied();
        WorkflowFileGrant grant = response.getData();
        WorkflowFileRequest actual = grant.getContext();
        if (actual == null || grant.getFile() == null || !Objects.equals(source.getFileId(), grant.getFile().get("fileId"))
                || !Objects.equals(source.getFileId(), actual.getFileId()) || !Objects.equals(source.getTenantId(), actual.getTenantId())
                || !Objects.equals(source.getOwnerId(), actual.getOwnerId()) || !Objects.equals(source.getModelId(), actual.getModelId())
                || !Objects.equals(source.getField(), actual.getField()) || !Objects.equals(source.getAction(), actual.getAction())
                || !same(source.getParentField(), actual.getParentField()) || !same(source.getRowId(), actual.getRowId())
                || !same(source.getContentToken(), actual.getContentToken())
                || !same(source.getDraftId(), actual.getDraftId()) || !same(source.getLeaseId(), actual.getLeaseId())
                || source.getTaskId() != null && !Objects.equals(source.getTaskId(), actual.getTaskId())) throw denied();
        return grant;
    }
    private static String tenant() {
        String value = UserProvider.getUser().getTenantId();
        return value == null || value.isBlank() ? "0" : value;
    }
    private static boolean same(String a, String b) { return Objects.toString(a, "").equals(Objects.toString(b, "")); }
    private static DataException denied() { return new DataException("文件访问上下文无效、已过期或当前权限不足"); }
}