package jnpf.flowable.util;

import java.nio.file.*;
import java.io.InputStream;
import java.util.*;
import org.apache.ibatis.builder.xml.XMLMapperBuilder;
import org.apache.ibatis.session.Configuration;
import jnpf.flowable.entity.TemplateNodeEntity;
import jnpf.flowable.model.filepermission.*;
import jnpf.flowable.model.filepermission.FilePermissionPolicy.*;
import jnpf.flowable.service.NativeFilePermissionRuntimeSource;
import jnpf.flowable.util.filepermission.*;

/** 可在现有 Checks 入口执行；覆盖原生运行事实投影而非只验证规则 JSON。 */
public class FilePermissionRuntimeChecks {
    private static int checks;
    public static void main(String[] args) throws Exception {
        FilePermissionSnapshot snapshot = snapshot("ACTIVE", "CURRENT_HANDLERS", "qa", null);
        FilePermissionNativeState state = state(1, "qa,review");
        state.getMembers().add(member("operator", "qa", "qa-user", 1, 0));
        state.getMembers().add(member("operator", "review", "review-user", 1, 0));
        FilePermissionRuntime.Facts qa = project(snapshot, state, "qa-user");
        check(qa.verified && qa.currentHandlers.get("qa").contains("qa-user"), "native current handlers");
        check(!resolve(snapshot, qa).allows("files", Action.DOWNLOAD), "active-node handler denial");
        check(resolve(snapshot, project(snapshot, state, "review-user")).allows("files", Action.DOWNLOAD), "parallel node isolation");
        check(resolve(snapshot, qa).allows("rows-files", Action.DOWNLOAD), "child field independent");
        check(resolve(snapshot, qa).allows("files", Action.EDIT), "current handler native writable");
        state.getMembers().get(0).setStartHandleTime(null);
        FilePermissionRuntime.Facts assigned = project(snapshot, state, "qa-user");
        check(assigned.verified && assigned.participants.get("qa").contains("qa-user"), "assigned candidate remains participant");
        check(!assigned.currentHandlers.containsKey("qa") && !resolve(snapshot, assigned).allows("files", Action.EDIT), "assigned candidate is not current handler before start");
        state.getMembers().get(0).setStartHandleTime(new Date(1L));
        check(project(snapshot, state, "qa-user").currentHandlers.get("qa").contains("qa-user"), "started candidate becomes current handler");
        check(!resolve(snapshot, project(snapshot, state, "creator")).allows("files", Action.EDIT), "creator not writable during approval");
        check(resolve(snapshot, project(snapshot, state, "creator")).allows("files", Action.VIEW), "creator can read start form");
        check(!project(snapshot, state, "stranger").verified, "unrelated user not admitted");
        qa.transitioning = true;
        check(!resolve(snapshot, qa).allows("files", Action.VIEW), "mixed state denied");
        qa.transitioning = false;
        qa.nativeUpperBounds.get("files").put(Action.VIEW, false);
        check(!resolve(snapshot, qa).allows("files", Action.VIEW), "native read restriction retained");

        FilePermissionSnapshot completed = snapshot("COMPLETED", "PARTICIPANTS", null, null);
        state.setStatus(2); state.setCurrentNodeCode(null);
        FilePermissionView end = resolve(completed, project(completed, state, "qa-user"));
        check(!end.allows("files", Action.DOWNLOAD) && end.allows("files", Action.VIEW), "terminal download denied and view retained");
        check(!end.allows("files", Action.EDIT), "terminal not writable");
        FilePermissionSnapshot cancelled = snapshot("CANCELLED", "CREATOR", null, null);
        state.setStatus(7);
        check(!resolve(cancelled, project(cancelled, state, "creator")).allows("files", Action.DOWNLOAD), "cancelled trigger");
        FilePermissionSnapshot terminated = snapshot("TERMINATED", "CREATOR", null, null);
        state.setStatus(4);
        check(!resolve(terminated, project(terminated, state, "creator")).allows("files", Action.DOWNLOAD), "terminated trigger");

        FilePermissionSnapshot keep = snapshot("ENTERED", "CREATOR", "qa", "KEEP");
        state.setStatus(8);
        FilePermissionNativeState.Member back = member("record", "qa", "qa-user", -1, null);
        back.setHandleType(3); state.getMembers().add(back);
        FilePermissionRuntime.Facts returned = project(keep, state, "creator");
        check(returned.verified && returned.activeEnteredRules.contains("rule"), "KEEP retains entered evidence on return");
        check(!resolve(keep, returned).allows("files", Action.DOWNLOAD), "KEEP still denies after return");
        check(resolve(keep, returned).allows("files", Action.EDIT), "draft/back creator writable");
        FilePermissionSnapshot release = snapshot("ENTERED", "CREATOR", "qa", "RELEASE");
        release = read(release.withEnteredNodes(Collections.singleton("qa")));
        FilePermissionRuntime.Facts activeRelease = project(release, state, "creator");
        check(activeRelease.verified && activeRelease.activeEnteredRules.contains("rule"), "RELEASE active after trigger entry");
        check(!resolve(release, activeRelease).allows("files", Action.DOWNLOAD), "active RELEASE rule denies action");
        release = read(release.withReturnedPastNodes(Collections.singleton("review")));
        check(project(release, state, "creator").activeEnteredRules.contains("rule"), "return after trigger retains RELEASE rule");
        release = read(release.withReturnedPastNodes(Collections.singleton("qa")));
        FilePermissionRuntime.Facts released = project(release, state, "creator");
        check(released.verified && !released.activeEnteredRules.contains("rule"), "return before trigger releases RELEASE rule");
        check(resolve(release, released).allows("files", Action.DOWNLOAD), "released rule restores inherited action");
        release = read(release.withEnteredNodes(Collections.singleton("qa")));
        check(project(release, state, "creator").activeEnteredRules.contains("rule"), "trigger re-entry reactivates RELEASE rule");
        state.setFlowType(3);
        check(!project(keep, state, "creator").verified, "unmapped free-flow unavailable");
        state.setFlowType(1); state.setStatus(10);
        check(!project(keep, state, "creator").verified, "exception state unavailable");
        state.setStatus(1); state.setCurrentNodeCode("unknown");
        check(!project(keep, state, "creator").verified, "unknown active node unavailable");
        state.setCurrentNodeCode("qa"); state.setMembers(new ArrayList<>());
        check(!project(keep, state, "creator").verified, "current handler not yet persisted unavailable");
        state.getMembers().add(member("operator", "qa", "future", -2, 0));
        check(!project(keep, state, "future").verified, "future operator not admitted");
        state.setStatus(0);
        FilePermissionRuntime.Facts draft = project(keep, state, "creator");
        check(draft.verified && !draft.activeEnteredRules.contains("rule"), "future operator is not entered evidence");
        check(resolve(keep, draft).allows("files", Action.DOWNLOAD), "not-yet-entered rule inactive");

        List<TemplateNodeEntity> nodes = nodes();
        nodes.get(0).setNodeJson("{\"formOperates\":[{\"id\":\"rows\",\"read\":true,\"write\":false}]}");
        FilePermissionRuntime.Facts bounds = NativeFilePermissionRuntimeSource.project("0", "form", "creator", keep, state, nodes, form());
        check(!resolve(keep, bounds).allows("rows-files", Action.EDIT), "child mutation bounded by parent write");
        check(resolve(keep, bounds).allows("files", Action.EDIT), "parent restriction does not affect main file");
        nodes.get(0).setNodeJson("{\"formOperates\":[{\"id\":\"files\",\"read\":false,\"write\":true}]}");
        bounds = NativeFilePermissionRuntimeSource.project("0", "form", "creator", keep, state, nodes, form());
        check(!resolve(keep, bounds).allows("files", Action.EDIT), "write cannot bypass read restriction");
        check(!NativeFilePermissionRuntimeSource.project("0", "foreign", "creator", keep, state, nodes, form()).verified, "foreign form not admitted");
        Map<String,Object> disabled = form(); ((Map<String,Object>) ((List<?>)disabled.get("fields")).get(0)).put("onlineEdit", false);
        bounds = NativeFilePermissionRuntimeSource.project("0", "form", "creator", keep, state, nodes(), disabled);
        check(!resolve(keep, bounds).allows("files", Action.EDIT) && resolve(keep, bounds).allows("files", Action.DOWNLOAD), "online edit switch independent of downloads");
        FilePermissionView legacy = FilePermissionView.legacy("task", "form");
        check(!legacy.isEnabled() && legacy.allows("files", Action.DOWNLOAD), "legacy defers to original checks");
        legacy.setStatus("error");
        check(!legacy.allows("files", Action.DOWNLOAD), "malformed legacy response denied");
        check(!FilePermissionView.unavailable("task", "form", "offline").allows("files", Action.DOWNLOAD), "unavailable not legacy");

        Configuration configuration = new Configuration();
        Path xml = Path.of("jnpf-flowable/jnpf-flowable-biz/src/main/resources/mapper/FilePermissionRuntimeMapper.xml");
        try (InputStream stream = Files.newInputStream(xml)) { new XMLMapperBuilder(stream, configuration, xml.toString(), configuration.getSqlFragments()).parse(); }
        org.apache.ibatis.mapping.MappedStatement statement = configuration.getMappedStatement("jnpf.flowable.mapper.FilePermissionRuntimeMapper.find");
        String sql = statement.getBoundSql(Map.of("taskId", "task")).getSql();
        check(sql.contains("UNION ALL") && statement.getBoundSql(Map.of("taskId", "task")).getParameterMappings().size() == 4, "state SQL binds all four task scopes");
        check(sql.contains("f_start_handle_time") && statement.getResultMaps().get(0).getResultMappings().stream()
                .anyMatch(mapping -> "members".equals(mapping.getProperty()) && mapping.getNestedResultMapId() != null), "state SQL includes start-handle time");
        check(statement.getResultMaps().get(0).hasNestedResultMaps(), "explicit native state and member mappings");
        System.out.println("FilePermissionRuntimeChecks: " + checks + " passed");
    }
    private static FilePermissionNativeState state(int status, String active) {
        FilePermissionNativeState state = new FilePermissionNativeState(); state.setTaskId("task"); state.setCreatorId("creator");
        state.setFlowId("flow"); state.setFlowType(1); state.setStatus(status); state.setCurrentNodeCode(active); return state;
    }
    private static FilePermissionNativeState.Member member(String kind, String node, String user, Integer status, Integer completion) {
        FilePermissionNativeState.Member m = new FilePermissionNativeState.Member(); m.setId(kind + node + user); m.setKind(kind); m.setNodeCode(node);
        m.setUserId(user); m.setStatus(status); m.setCompletion(completion);
        if ("operator".equals(kind) && status != null && status >= 0) m.setStartHandleTime(new Date(1L));
        return m;
    }
    private static FilePermissionSnapshot snapshot(String trigger, String subject, String node, String onReturn) {
        Map<String,Object> rule = new HashMap<>(Map.of("id", "rule", "formId", "form", "field", "files", "subject", subject,
                "trigger", trigger, "actions", Map.of("DOWNLOAD", "DENY")));
        if (node != null) rule.put("triggerNodeId", node);
        if (onReturn != null) rule.put("onReturn", onReturn);
        return FilePermissionSnapshot.read(FilePermissionSnapshot.create("0", "task", "flow", Map.of("version", 1, "rules", List.of(rule))), "0", "task");
    }
    private static FilePermissionSnapshot read(String json) { return FilePermissionSnapshot.read(json, "0", "task"); }
    private static List<TemplateNodeEntity> nodes() {
        List<TemplateNodeEntity> list = new ArrayList<>();
        for (String code : List.of("start", "qa", "review")) {
            TemplateNodeEntity node = new TemplateNodeEntity(); node.setNodeCode(code); node.setNodeType(code.equals("start") ? "start" : "approver");
            node.setFormId("form"); node.setNodeJson("{}"); list.add(node);
        }
        return list;
    }
    private static Map<String,Object> form() {
        Map<String,Object> upload = new HashMap<>(Map.of("__vModel__", "files", "onlineEdit", true, "__config__", Map.of("jnpfKey", "uploadFile")));
        return new HashMap<>(Map.of("fields", List.of(upload, Map.of("__vModel__", "rows", "__config__", Map.of("jnpfKey", "table", "children", List.of(upload))))));
    }
    private static FilePermissionRuntime.Facts project(FilePermissionSnapshot snapshot, FilePermissionNativeState state, String user) {
        return NativeFilePermissionRuntimeSource.project("0", "form", user, snapshot, state, nodes(), form());
    }
    private static FilePermissionView resolve(FilePermissionSnapshot snapshot, FilePermissionRuntime.Facts facts) { return FilePermissionRuntime.resolve(snapshot.getRules(), facts); }
    private static void check(boolean value, String label) { if (!value) throw new AssertionError(label); checks++; }
}