package jnpf.base.service;

import jnpf.base.entity.VisualdevEntity;
import jnpf.base.mapper.UploadEditDraftMapper;
import jnpf.base.model.uploadedit.UploadEditContext;
import jnpf.base.model.uploadedit.UploadEditDraft;
import jnpf.base.util.FlowFormDataUtil;
import jnpf.base.util.UploadEditStateMachine;
import jnpf.base.util.UploadEditWorkingCopy;
import jnpf.exception.DataException;
import jnpf.flowable.WorkFlowApi;
import jnpf.flowable.entity.TaskEntity;
import jnpf.flowable.model.filepermission.FilePermissionPolicy.Action;
import jnpf.flowable.model.filepermission.FilePermissionView;
import jnpf.model.fileaccess.WorkflowFileGrant;
import jnpf.model.fileaccess.WorkflowFileRequest;
import jnpf.onlinedev.model.OnlineInfoModel;
import jnpf.util.JsonUtil;
import jnpf.util.UserProvider;
import lombok.RequiredArgsConstructor;
import org.springframework.beans.factory.ObjectProvider;
import org.springframework.stereotype.Service;
import org.springframework.util.StringUtils;
import java.util.*;

/** 通用附件读取准入；不依赖 onlineEdit，不从请求中的 taskId 推断实际归属。 */
@Service
@RequiredArgsConstructor
public class WorkflowFileAccessService {
    private final ObjectProvider<VisualdevService> visualdevService;
    private final ObjectProvider<FlowFormDataUtil> formDataUtil;
    private final UploadEditDraftMapper drafts;
    private final WorkFlowApi workflows;

    public WorkflowFileGrant authorize(WorkflowFileRequest request) {
        if (request == null || !text(request.getModelId()) || !text(request.getRecordId())
                || !text(request.getField()) || !text(request.getFileId())) throw denied();
        String user = UserProvider.getLoginUserId();
        String tenant = UploadEditDraftService.tenant(UserProvider.getUser());
        if (!text(user) || !Objects.equals(user, request.getOwnerId()) || !Objects.equals(tenant, request.getTenantId())) throw denied();
        Action action;
        try { action = Action.valueOf(request.getAction()); } catch (RuntimeException invalid) { throw denied(); }
        if (action != Action.VIEW && action != Action.DOWNLOAD) throw denied();
        VisualdevEntity model = visualdevService.getObject().getReleaseInfo(request.getModelId());
        if (model == null) throw denied();
        Map<String, Object> form = JsonUtil.getJsonToBean(model.getFormData(), Map.class);
        Map<String, Object> field = findField(form.get("fields"), request.getField(), request.getParentField());
        if (field == null || !"uploadFile".equals(((Map<?, ?>) field.get("__config__")).get("jnpfKey"))) throw denied();
        Map<String, Object> data = formDataUtil.getObject().getFilePermissionDataInfo(model, request.getRecordId(), OnlineInfoModel.builder().build());
        if (data == null || !text(string(data.get("id"))) || !data.containsKey("flowTaskId")) throw denied();
        String taskId = string(data.get("flowTaskId"));
        // 此入口专供启用实例权限的新分支；无实例/上游查询失败均不得降级为旧接口。
        TaskEntity task = text(taskId) ? workflows.getInfoSubmit(taskId) : null;
        if (task == null || !Objects.equals(taskId, task.getId())
                || text(request.getTaskId()) && !request.getTaskId().equals(taskId)) throw denied();
        FilePermissionView permissions = workflows.filePermissions(taskId, request.getModelId());
        if (permissions == null || !permissions.isEnabled() || !Objects.equals(taskId, permissions.getTaskId())
                || !Objects.equals(request.getModelId(), permissions.getFormId()) || !"ready".equals(permissions.getStatus())) throw denied();
        String fieldKey = text(request.getParentField()) ? request.getParentField() + "-" + request.getField() : request.getField();
        if (!permissions.allows(fieldKey, action)) throw denied();
        if (text(request.getLeaseId()) && (action != Action.VIEW || !text(request.getDraftId())
                || !permissions.allows(fieldKey, Action.EDIT) || !Boolean.TRUE.equals(field.get("onlineEdit")))) throw denied();
        boolean allowDownload = (!field.containsKey("allowDownload") || Boolean.TRUE.equals(field.get("allowDownload")))
                && permissions.allows(fieldKey, Action.DOWNLOAD);
        if (action == Action.DOWNLOAD && !allowDownload) throw denied();
        // DMS shared preview reads the same immutable saved content as the submission manifest.
        boolean sharedContent = text(request.getDraftId()) && !text(request.getLeaseId());
        UploadEditContext context = context(request);
        context.setRecordId(string(data.get("id")));
        List<Map<String, Object>> baseline = UploadEditStateMachine.files(UploadEditAccess.fieldValue(data, context));
        List<Map<String, Object>> candidates = baseline;
        if (text(request.getLeaseId()) || sharedContent) {
            UploadEditDraft draft = drafts.find(tenant, request.getDraftId());
            if (draft == null || !Objects.equals(request.getDraftId(), draft.getId()) || !Objects.equals(tenant, draft.getTenantId()) || !(UploadEditWorkingCopy.shared(draft) && Objects.equals(taskId, draft.getTaskId())) && !Objects.equals(user, draft.getOwnerId())
                    || !Objects.equals(request.getModelId(), draft.getModelId()) || !Objects.equals(context.getRecordId(), draft.getRecordId())
                    || !Objects.equals(request.getField(), draft.getField()) || !same(request.getParentField(), draft.getParentField())
                    || !same(request.getRowId(), draft.getRowId()) || !UploadEditStateMachine.sameFiles(draft.getBaselineJson(), baseline)) throw denied();
            if (sharedContent && (!UploadEditWorkingCopy.shared(draft) || !Objects.equals(taskId, draft.getTaskId())
                    || !Boolean.TRUE.equals(field.get("onlineEdit")) || !(Set.of("dms_wenjian_xinzeng_shenhe", "dms_wenjian_xiuding_shenhe").contains(Objects.toString(form.get("tableName"), ""))
                        && ((!text(context.getParentField()) && "wenjian".equals(context.getField()))
                            || ("jilu_mingxi".equals(context.getParentField()) && "jilu_wenjian".equals(context.getField()))))
                    || !Objects.equals(request.getContentToken(), UploadEditStateMachine.contentToken(draft.getCurrentJson())))) throw denied();
            if (text(request.getLeaseId())) {
                String activeFile = draft.getLeaseResultFileId() == null ? draft.getLeaseFileId() : draft.getLeaseResultFileId();
                if (!Objects.equals(user, draft.getOwnerId()) || !Objects.equals(request.getLeaseId(), draft.getLeaseId()) || !Objects.equals(request.getFileId(), activeFile)) throw denied();
            }
            candidates = UploadEditStateMachine.files(draft.getCurrentJson());
        }
        Map<String, Object> file = candidates.stream().filter(f -> request.getFileId().equals(f.get("fileId")))
                .findFirst().orElseThrow(WorkflowFileAccessService::denied);
        WorkflowFileRequest canonical = JsonUtil.getJsonToBean(JsonUtil.getObjectToString(request), WorkflowFileRequest.class);
        canonical.setRecordId(context.getRecordId());
        canonical.setTaskId(taskId);
        WorkflowFileGrant result = new WorkflowFileGrant();
        result.setContext(canonical);
        result.setFile(new LinkedHashMap<>(file));
        result.setControlled(true);
        result.setAllowDownload(allowDownload);
        result.setRevision(permissions.getRevision());
        return result;
    }

    private static UploadEditContext context(WorkflowFileRequest request) {
        UploadEditContext context = new UploadEditContext();
        context.setModelId(request.getModelId()); context.setRecordId(request.getRecordId()); context.setField(request.getField());
        context.setParentField(request.getParentField()); context.setRowId(request.getRowId()); context.setMenuId(request.getMenuId());
        return context;
    }

    @SuppressWarnings("unchecked")
    private static Map<String, Object> findField(Object fields, String field, String parent) {
        if (!(fields instanceof List<?>)) return null;
        for (Object item : (List<?>) fields) {
            if (!(item instanceof Map<?, ?>)) continue;
            Map<?, ?> node = (Map<?, ?>) item;
            if (!(node.get("__config__") instanceof Map<?, ?>)) continue;
            Map<?, ?> config = (Map<?, ?>) node.get("__config__");
            if (text(parent) && parent.equals(node.get("__vModel__")) && "table".equals(config.get("jnpfKey")))
                return findField(config.get("children"), field, null);
            if (!text(parent) && field.equals(node.get("__vModel__"))) return (Map<String, Object>) node;
            if (!"table".equals(config.get("jnpfKey"))) {
                Map<String, Object> found = findField(config.get("children"), field, parent);
                if (found != null) return found;
            }
        }
        return null;
    }
    private static boolean same(String a, String b) { return Objects.toString(a, "").equals(Objects.toString(b, "")); }
    private static boolean text(String value) { return StringUtils.hasText(value); }
    private static String string(Object value) { return Objects.toString(value, ""); }
    private static DataException denied() { return new DataException("附件不属于当前表单位置，或当前没有文件访问权限"); }
}