package jnpf.base.service;

import jnpf.base.entity.VisualdevEntity;
import jnpf.base.model.flow.DataModel;
import jnpf.base.model.uploadedit.UploadEditDraft;
import jnpf.base.util.FlowFormDataUtil;
import jnpf.base.util.UploadEditStateMachine;
import jnpf.base.util.UploadEditWorkingCopy;
import jnpf.exception.DataException;
import jnpf.flowable.model.filepermission.FilePermissionPolicy.Action;
import jnpf.flowable.model.filepermission.FilePermissionView;
import jnpf.flowable.util.filepermission.FileAttachmentChanges;
import jnpf.model.visualjson.FieLdsModel;
import jnpf.model.visualjson.TableModel;
import jnpf.model.visualjson.analysis.*;
import jnpf.onlinedev.model.OnlineInfoModel;
import jnpf.util.JsonUtil;
import jnpf.util.TicketUtil;
import jnpf.util.UserProvider;
import lombok.RequiredArgsConstructor;
import org.springframework.beans.factory.ObjectProvider;
import org.springframework.stereotype.Service;
import java.util.*;
import java.util.function.Predicate;

/** 只校验受控实例的附件副作用；业务主子表仍由原生保存事务持久化。 */
@Service
@RequiredArgsConstructor
public class UploadFilePermissionService {
    private final ObjectProvider<VisualdevService> visualdevService;
    private final ObjectProvider<FlowFormDataUtil> formDataUtil;
    private final UploadFilePermissionQuery filePermissions;

    public static final class SaveContext {
        final Map<String, Object> baseline;
        final FilePermissionView permissions;
        final Set<String> sharedDraftIds = new HashSet<>();
        final Set<String> nativeDraftIds = new HashSet<>();
        SaveContext(Map<String, Object> baseline, FilePermissionView permissions) {
            this.baseline = baseline;
            this.permissions = permissions;
        }
    }

    /** 使用完整原生详情读取真实实例；请求体的 taskId/flowTaskId 不能开启或关闭校验。 */
    public SaveContext prepare(DataModel model) {
        if (model.getFormAllModel() == null || model.getFormAllModel().stream().noneMatch(this::hasUpload)) return null;
        VisualdevEntity released = visualdevService.getObject().getReleaseInfo(model.getVisualId());
        if (released == null) throw new DataException("附件所属发布表单不存在");
        Map<String, Object> baseline = formDataUtil.getObject().getFilePermissionDataInfo(released, model.getMainId(),
                OnlineInfoModel.builder().formAllModel(model.getFormAllModel()).build());
        if (baseline == null || baseline.isEmpty() || !contains(baseline, "flowTaskId")) throw new DataException("附件所属表单记录不存在");
        String taskId = Objects.toString(value(baseline, "flowTaskId"), "");
        if (taskId.trim().isEmpty()) return null;
        FilePermissionView view = filePermissions.current(taskId, model.getVisualId());
        if (FilePermissionNativeDraft.taskAbsent(view, taskId, model.getVisualId())
                && FilePermissionNativeDraft.matches(baseline, model.getMainId(), taskId)) return null;
        if (view == null || !Objects.equals(taskId, view.getTaskId()) || !Objects.equals(model.getVisualId(), view.getFormId())
                || !"ready".equals(view.getStatus()) || view.isEnabled() && (view.getRevision() == null || view.getRevision().isEmpty())) {
            throw new DataException("当前流程文件权限暂不可用，请稍后重试");
        }
        if (view.isEnabled() && !Objects.equals(model.getMainId(), Objects.toString(value(baseline, "id"), ""))) {
            throw new DataException("附件基准与原生保存记录不匹配");
        }
        return view.isEnabled() ? new SaveContext(baseline, view) : null;
    }

    /** DMS原生保存继承来源不要求打开在线编辑；调用方已确认目标表单和原生字段权限。 */
    List<Map<String, Object>> dmsMainAttachmentBaseline(DataModel model) {
        VisualdevEntity released = visualdevService.getObject().getReleaseInfo(model.getVisualId());
        if (released == null) throw new DataException("附件所属发布表单不存在");
        Map<String, Object> baseline = formDataUtil.getObject().getFilePermissionDataInfo(released, model.getMainId(),
                OnlineInfoModel.builder().formAllModel(model.getFormAllModel()).build());
        if (baseline == null || baseline.isEmpty()
                || !Objects.equals(model.getMainId(), Objects.toString(value(baseline, "id"), "")))
            throw new DataException("附件来源基准与原生记录不匹配");
        return UploadEditStateMachine.files(value(baseline, "wenjian"));
    }

    /** 在 prepareSave 已锁定并核验工作稿后、任何原生写入前调用。 */
    public void validate(SaveContext context, DataModel model, List<UploadEditDraft> drafts, Predicate<String> nativeDenied) {
        if (context == null) return;
        for (FormAllModel item : model.getFormAllModel()) {
            if (item.getChildList() != null) {
                validateChildren(context, model, item.getChildList(), drafts, nativeDenied);
            } else {
                FieLdsModel field = mainField(item);
                if (!upload(field) || !model.isWorkflowFileCheckpoint() && nativeDenied.test(field.getVModel())) continue;
                String key = field.getVModel();
                validateField(context, model, key, null, null, value(context.baseline, key), model.getDataNewMap(), key, drafts);
                if (model.isWorkflowFileCheckpoint()) model.getWorkflowWorkingFields().add(key);
            }
        }
    }

    private void validateChildren(SaveContext context, DataModel model, FormColumnTableModel child,
                                  List<UploadEditDraft> drafts, Predicate<String> nativeDenied) {
        if (Boolean.TRUE.equals(child.getDisabled()) || child.getChildList().stream().noneMatch(c -> upload(c.getFieLdsModel()))) return;
        String parent = child.getTableModel();
        TableModel table = model.getTableModelList().stream().filter(t -> Objects.equals(t.getTable(), child.getTableName()))
                .findFirst().orElseThrow(() -> new DataException("无法核验附件子表主键"));
        String primary = formDataUtil.getObject().getKey(table, model.getDbType());
        List<Map<String, Object>> before = rows(value(context.baseline, parent));
        List<Map<String, Object>> after = rows(model.getDataNewMap().get(parent));
        Map<String, Map<String, Object>> oldRows = index(before, primary, true);
        Map<String, Map<String, Object>> newRows = index(after, primary, false);
        for (FormColumnModel column : child.getChildList()) {
            FieLdsModel field = column.getFieLdsModel();
            if (!upload(field)) continue;
            String key = field.getVModel();
            String permissionKey = parent + "-" + key;
            // 原生整行删除不经过列 write 过滤，必须独立校验 REMOVE。
            if (!Boolean.TRUE.equals(model.getOnlyUpdate())) {
                for (Map.Entry<String, Map<String, Object>> old : oldRows.entrySet()) {
                    if (!newRows.containsKey(old.getKey()) && !UploadEditStateMachine.files(value(old.getValue(), key)).isEmpty()) {
                        require(context, permissionKey, Action.REMOVE);
                    }
                }
            }
            if (!model.isWorkflowFileCheckpoint() && nativeDenied.test(permissionKey)) continue;
            for (Map<String, Object> row : after) {
                String rowId = Objects.toString(value(row, primary), "");
                Map<String, Object> old = oldRows.get(rowId);
                validateField(context, model, permissionKey, parent, rowId, old == null ? null : value(old, key), row, key, drafts);
            }
            if (model.isWorkflowFileCheckpoint()) model.getWorkflowWorkingFields().add(permissionKey);
        }
    }

    private void validateField(SaveContext context, DataModel model, String permissionKey, String parent, String rowId,
                               Object oldValue, Map<String, Object> target, String key, List<UploadEditDraft> drafts) {
        List<Map<String, Object>> before = UploadEditStateMachine.files(oldValue);
        // 原生 SQL UPDATE 对省略的可写列写 NULL，不把缺少字段误判为 PATCH。
        Object submittedValue = parent == null ? target.get(key) : value(target, key);
        List<Map<String, Object>> after = UploadEditStateMachine.files(submittedValue);
        UploadEditDraft trusted = drafts.stream().filter(d -> !context.nativeDraftIds.contains(d.getId()) && Objects.equals(d.getRecordId(), model.getMainId())
                && (Objects.equals(d.getOwnerId(), UserProvider.getUser().getUserId()) || context.sharedDraftIds.contains(d.getId()))
                && Objects.equals(d.getModelId(), model.getVisualId()) && Objects.equals(d.getField(), key)
                && Objects.toString(d.getParentField(), "").equals(Objects.toString(parent, ""))
                && Objects.toString(d.getRowId(), "").equals(Objects.toString(rowId, ""))
                && UploadEditStateMachine.sameFiles(d.getBaselineJson(), before)
                && UploadEditStateMachine.sameFiles(d.getCurrentJson(), after)).findFirst().orElse(null);
        Map<String, String> origins = trusted == null ? Collections.emptyMap() : UploadEditStateMachine.editOrigins(trusted);
        List<String> effectiveAfter = new ArrayList<>();
        List<Map<String, Object>> canonical = new ArrayList<>();
        for (Map<String, Object> file : after) {
            String id = (String) file.get("fileId");
            String origin = origins.get(id);
            if (origin != null && !origin.equals(id)) {
                if (trusted == null || !context.sharedDraftIds.contains(trusted.getId())) require(context, permissionKey, Action.EDIT);
                require(context, permissionKey, Action.VIEW);
            }
            effectiveAfter.add(origin == null ? id : origin);
            Map<String, Object> existing = before.stream().filter(f -> id.equals(f.get("fileId"))).findFirst().orElse(null);
            if (existing == null && trusted != null && origin == null && id.contains("onlyoffice-edit-temp,")) {
                throw new DataException("旧工作稿缺少编辑来源，暂不能采用");
            }
            // 工作稿值经过版本匹配；新的普通文件必须提供本人本租户的上传凭据。
            boolean templateChanged = "wenjian".equals(key) && (parent == null || parent.isBlank())
                    && existing != null && !Objects.equals(existing.get(jnpf.base.util.UploadTemplateSource.FIELD),
                    file.get(jnpf.base.util.UploadTemplateSource.FIELD));
            if (templateChanged) require(context, permissionKey, Action.REPLACE);
            canonical.add(templateChanged ? trusted != null ? file : uploaded(file)
                    : existing != null ? existing : trusted != null ? file : uploaded(file));
        }
        try {
            for (Action action : FileAttachmentChanges.classify(ids(before), effectiveAfter)) require(context, permissionKey, action);
        } catch (IllegalArgumentException invalid) {
            throw new DataException(invalid.getMessage());
        }
        // 保留原生 NULL 语义；只规范实际提交的附件，避免同一 fileId 伪造回源 URL。
        if (submittedValue != null && !"".equals(submittedValue)) put(target, key, canonical);
        for (UploadEditDraft draft : drafts) {
            if (context.nativeDraftIds.contains(draft.getId()) && Objects.equals(draft.getField(), key)
                    && Objects.toString(draft.getParentField(), "").equals(Objects.toString(parent, ""))
                    && Objects.toString(draft.getRowId(), "").equals(Objects.toString(rowId, ""))) {
                draft.setCurrentJson(JsonUtil.getObjectToString(canonical));
            }
        }
    }

    /** 工作稿中上传/移除/替换也需实时裁决；打开编辑权限不能代替其他动作。 */
    public void validateDraftChange(UploadEditDraft draft, List<Map<String, Object>> next) {
        SaveContext context = draftContext(draft);
        if (context == null) return;
        List<Map<String, Object>> current = UploadEditStateMachine.files(draft.getCurrentJson());
        for (Action action : FileAttachmentChanges.classify(ids(current), ids(next))) {
            require(context, permissionField(draft), action);
        }
        requireTemplateReplacement(context, draft, current, next);
    }

    private void requireTemplateReplacement(SaveContext context, UploadEditDraft draft,
                                            List<Map<String, Object>> before, List<Map<String, Object>> after) {
        if (!"wenjian".equals(draft.getField()) || org.springframework.util.StringUtils.hasText(draft.getParentField())) return;
        for (Map<String, Object> file : after) for (Map<String, Object> old : before) {
            if (Objects.equals(file.get("fileId"), old.get("fileId"))
                    && !Objects.equals(file.get(jnpf.base.util.UploadTemplateSource.FIELD), old.get(jnpf.base.util.UploadTemplateSource.FIELD)))
                require(context, permissionField(draft), Action.REPLACE);
        }
    }

    /** 恢复正文要求 EDIT，恢复引用按真实增删替换检查，不能通过“放弃”绕过流程限制。 */
    public void validateDraftDiscard(UploadEditDraft draft) {
        validateDraftDiscard(draft, draftContext(draft));
    }
    private void validateDraftDiscard(UploadEditDraft draft, SaveContext context) {
        if (context == null) return;
        List<String> baseline = ids(UploadEditStateMachine.files(draft.getBaselineJson()));
        Map<String, String> origins = UploadEditStateMachine.editOrigins(draft);
        List<String> current = new ArrayList<>();
        for (String id : ids(UploadEditStateMachine.files(draft.getCurrentJson()))) {
            String origin = origins.get(id);
            if (origin != null && !id.equals(origin) && baseline.contains(origin)) {
                require(context, permissionField(draft), Action.EDIT);
                current.add(origin);
            } else {
                if (origin == null && !baseline.contains(id) && id.contains("onlyoffice-edit-temp,")) {
                    throw new DataException("旧工作稿缺少编辑来源，请重新核验附件权限");
                }
                current.add(id);
            }
        }
        for (Action action : FileAttachmentChanges.classify(current, baseline)) require(context, permissionField(draft), action);
        requireTemplateReplacement(context, draft, UploadEditStateMachine.files(draft.getCurrentJson()), UploadEditStateMachine.files(draft.getBaselineJson()));
    }

    /** 按钮提示复用实际恢复校验；不可用时关闭按钮，不使已成功的工作稿更新报错。 */
    public boolean canDiscardDraft(UploadEditDraft draft) {
        try {
            if (UploadEditStateMachine.sameFiles(draft.getBaselineJson(), draft.getCurrentJson())) return false;
            validateDraftDiscard(draft);
            return true;
        } catch (RuntimeException unavailable) {
            return false;
        }
    }

    /** Reuse only the current batch's already authenticated permission view. */
    public boolean canDiscardDraft(UploadEditDraft draft, FilePermissionView permissions) {
        if (permissions == null || !permissions.isEnabled()) return false;
        try {
            if (UploadEditStateMachine.sameFiles(draft.getBaselineJson(), draft.getCurrentJson())) return false;
            validateDraftDiscard(draft, new SaveContext(Collections.emptyMap(), permissions));
            return true;
        } catch (RuntimeException denied) { return false; }
    }

    private SaveContext draftContext(UploadEditDraft draft) {
        // 以真实表单详情解析实例，不能只依赖历史工作稿的 taskId。
        VisualdevEntity released = visualdevService.getObject().getReleaseInfo(draft.getModelId());
        if (released == null) throw new DataException("附件所属发布表单不存在");
        Map<String, Object> data = formDataUtil.getObject().getFilePermissionDataInfo(released, draft.getRecordId(), OnlineInfoModel.builder().build());
        if (data == null || data.isEmpty() || !contains(data, "flowTaskId")) throw new DataException("附件所属表单记录不存在");
        String taskId = Objects.toString(value(data, "flowTaskId"), "");
        if (taskId.isEmpty()) return null;
        FilePermissionView view = filePermissions.current(taskId, draft.getModelId());
        if (FilePermissionNativeDraft.taskAbsent(view, taskId, draft.getModelId())
                && FilePermissionNativeDraft.matches(data, draft.getRecordId(), taskId)) return null;
        if (view == null || !Objects.equals(taskId, view.getTaskId()) || !Objects.equals(draft.getModelId(), view.getFormId())
                || !"ready".equals(view.getStatus())) throw new DataException("当前流程文件权限暂不可用");
        return view.isEnabled() ? new SaveContext(data, view) : null;
    }

    private static String permissionField(UploadEditDraft draft) {
        return draft.getParentField() == null || draft.getParentField().isEmpty() ? draft.getField() : draft.getParentField() + "-" + draft.getField();
    }

    private static Map<String, Object> uploaded(Map<String, Object> file) {
        Object receipt = file.get("uploadReceipt");
        String payload = receipt instanceof String ? TicketUtil.parseTicket((String) receipt) : null;
        Map<?, ?> proof = payload == null ? Collections.emptyMap() : JsonUtil.getJsonToBean(payload, Map.class);
        if (proof == null || !"upload-edit-source".equals(proof.get("purpose"))
                || !UploadEditDraftService.tenant(UserProvider.getUser()).equals(proof.get("tenantId"))
                || !Objects.equals(UserProvider.getUser().getUserId(), proof.get("ownerId"))
                || !Objects.equals(file.get("fileId"), proof.get("fileId"))) {
            throw new DataException("无法核验新附件的上传来源，请重新上传");
        }
        Map<String, Object> accepted = new LinkedHashMap<>();
        for (String name : Arrays.asList("fileId", "name", "fileSize", "fileExtension", "url", "contentSavedAt")) accepted.put(name, proof.get(name));
        jnpf.base.util.UploadTemplateSource.inherit(accepted, proof);
        return accepted;
    }

    private static void require(SaveContext context, String field, Action action) {
        if (!context.permissions.allows(field, action)) throw new DataException("当前流程不允许附件操作：" + action);
    }
    private boolean hasUpload(FormAllModel item) {
        return item.getChildList() != null ? item.getChildList().getChildList().stream().anyMatch(c -> upload(c.getFieLdsModel())) : upload(mainField(item));
    }
    private static FieLdsModel mainField(FormAllModel item) {
        return item.getFormColumnModel() != null ? item.getFormColumnModel().getFieLdsModel()
                : item.getFormMastTableModel() != null ? item.getFormMastTableModel().getMastTable().getFieLdsModel() : null;
    }
    private static boolean upload(FieLdsModel field) {
        return field != null && field.getConfig() != null && "uploadFile".equals(field.getConfig().getJnpfKey());
    }
    private static List<String> ids(List<Map<String, Object>> files) {
        List<String> result = new ArrayList<>();
        for (Map<String, Object> file : files) result.add((String) file.get("fileId"));
        return result;
    }
    @SuppressWarnings("unchecked")
    private static List<Map<String, Object>> rows(Object value) {
        if (value == null) return Collections.emptyList();
        if (!(value instanceof List<?>)) throw new DataException("附件子表数据不是有效列表");
        for (Object row : (List<?>) value) if (!(row instanceof Map)) throw new DataException("附件子表行无效");
        return (List<Map<String, Object>>) value;
    }
    private static Map<String, Map<String, Object>> index(List<Map<String, Object>> rows, String primary, boolean required) {
        Map<String, Map<String, Object>> result = new LinkedHashMap<>();
        for (Map<String, Object> row : rows) {
            String id = Objects.toString(value(row, primary), "");
            if (id.isEmpty()) { if (required) throw new DataException("附件子表缺少主键"); else continue; }
            if (result.put(id, row) != null) throw new DataException("附件子表主键重复");
        }
        return result;
    }
    private static boolean contains(Map<String, Object> map, String key) {
        return map.keySet().stream().anyMatch(k -> k.equalsIgnoreCase(key));
    }
    private static Object value(Map<String, Object> map, String key) {
        boolean found = false;
        Object result = null;
        for (Map.Entry<String, Object> e : map.entrySet()) {
            if (!e.getKey().equalsIgnoreCase(key)) continue;
            if (found) throw new DataException("附件字段存在大小写冲突");
            found = true;
            result = e.getValue();
        }
        return result;
    }
    private static void put(Map<String, Object> map, String key, Object value) {
        String existing = map.keySet().stream().filter(k -> k.equalsIgnoreCase(key)).findFirst().orElse(key);
        map.put(existing, value);
    }
}