package jnpf.dmsService;

import jnpf.dmsEntity.permission.entity.DmsFilePermissionEntity;
import jnpf.dmsEntity.storage.approval.*;
import jnpf.dmsIntegration.audit.DmsAuditAdapter;
import jnpf.dmsMapper.DmsApprovedReadAccessMapper;
import jnpf.dmsPermission.DmsPermissionProperties;
import jnpf.exception.DataException;
import lombok.RequiredArgsConstructor;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Propagation;
import org.springframework.transaction.annotation.Transactional;
import java.util.*;

/** Internal activation participant. No endpoint and no relaxation of the permission administrator API. */
@Service
@RequiredArgsConstructor
public class DmsApprovedReadAccessService {
    public static final String SERVICE_ID = "dms-approved-read";
    private final DmsApprovedReadAccessMapper mapper;
    private final DmsAuditAdapter audit;
    private final DmsPermissionProperties properties;

    @Transactional(propagation = Propagation.MANDATORY, rollbackFor = Exception.class)
    public void apply(DmsApprovedBatch batch, List<DmsApprovedItem> items, List<DmsApprovedItem> currentSource) {
        if (batch.getId() == null || batch.getTenantId() == null || batch.getActivatedAt() == null)
            throw new DataException("查阅授权必须在批准文件实际生效事务内执行");
        Map<String, DmsApprovedItem> current = new HashMap<>();
        for (DmsApprovedItem item : currentSource) {
            if (current.put(item.getSourceKey(), item) != null) throw new DataException("批准文件来源重复");
        }
        Map<DmsApprovedItem, List<DmsApprovedDepartmentScope.Department>> scopes = new LinkedHashMap<>();
        Set<String> departmentIds = new TreeSet<>();
        int count = 0;
        for (DmsApprovedItem item : items) {
            DmsApprovedItem source = current.remove(item.getSourceKey());
            if (source == null || !Objects.equals(item.getChangeType(), source.getChangeType())
                    || !Objects.equals(item.getBaseFileVersionId(), source.getBaseFileVersionId()))
                throw new DataException("查阅授权文件与批准来源不一致");
            if ("RETIRE".equals(item.getChangeType())) continue;
            if (!Objects.equals(DmsApprovedDepartmentScope.normalize(item.getReadAccessScope()),
                    DmsApprovedDepartmentScope.normalize(source.getReadAccessScope())))
                throw new DataException("查阅授权范围与批准快照不一致");
            if (!Set.of("CREATE", "REVISE", "REUSE").contains(item.getChangeType()) || item.getFileVersionId() == null)
                throw new DataException("查阅授权文件版本无效");
            List<DmsApprovedDepartmentScope.Department> scope = DmsApprovedDepartmentScope.parse(item.getReadAccessScope());
            count += scope.size();
            if (count > properties.getMaxGrantBatchSize()) throw new DataException("批准文件查阅授权超出批量上限");
            scopes.put(item, scope);
            scope.forEach(d -> departmentIds.add(d.id()));
        }
        if (!current.isEmpty()) throw new DataException("查阅授权文件集合不完整");
        if (!departmentIds.isEmpty()) {
            Set<String> actual = new HashSet<>();
            mapper.departments(batch.getTenantId(), new ArrayList<>(departmentIds)).forEach(d -> actual.add(d.id()));
            if (!actual.equals(departmentIds)) throw new DataException("查阅授权部门不存在、已停用或不属于当前租户");
        }
        // Center activation has already locked all documents in deterministic order in this same transaction.
        for (var entry : scopes.entrySet()) {
            DmsApprovedItem item = entry.getKey();
            // fileVersionId is the target activated by this review; never use baseFileVersionId for permissions.
            String sourceId = "approved-read:" + batch.getId() + ":" + item.getFileVersionId();
            List<DmsFilePermissionEntity> old = mapper.owned(batch.getTenantId(), item.getFileVersionId());
            if (old.stream().anyMatch(p -> sourceId.equals(p.getSourceId())))
                throw new DataException("批准查阅授权已存在，禁止重复激活或复活已撤销权限");
            List<DmsFilePermissionEntity> revoked = new ArrayList<>();
            for (DmsFilePermissionEntity p : old) {
                if (p.getRevokedAt() != null) continue;
                if (!"REUSE".equals(item.getChangeType())) throw new DataException("新版本已有其他批准查阅授权");
                if (mapper.revoke(batch.getTenantId(), p.getId()) != 1) throw new DataException("替换批准查阅授权失败");
                revoked.add(p);
            }
            List<DmsFilePermissionEntity> created = new ArrayList<>();
            for (var department : entry.getValue()) {
                DmsFilePermissionEntity p = new DmsFilePermissionEntity();
                p.setTenantId(batch.getTenantId()); p.setResourceType("FILE_VERSION");
                p.setResourceId(item.getFileVersionId()); p.setResourceScope("SELF");
                p.setPrincipalType("ORG"); p.setPrincipalId(department.id());
                p.setIncludeChildOrgs("DESCENDANTS".equals(department.scope()));
                p.setApprovedOrgScope(department.scope()); p.setActionCode("READ");
                p.setSourceType("WORKFLOW"); p.setSourceId(sourceId);
                p.setValidFrom(batch.getActivatedAt());
                p.setGrantReason("文件审核正式生效：" + batch.getAuditId() + "；部门范围：" + department.scope());
                p.setGrantedByType("SERVICE"); p.setGrantedById(SERVICE_ID);
                created.add(mapper.insert(p));
            }
            if (!revoked.isEmpty() || !created.isEmpty())
                audit.permissionChange("PERMISSION_GRANT", "更新文件审核查阅授权", old,
                        mapper.owned(batch.getTenantId(), item.getFileVersionId()), Collections.emptyList());
        }
    }
}