package platform

import (
	"errors"
	"strings"

	"git.apinb.com/bsm-sdk/core/errcode"
	"git.apinb.com/bsm-sdk/core/infra"
	"git.apinb.com/bsm-sdk/core/middleware"
	"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
	"git.apinb.com/heqiapp/platforms/backend/api/internal/logic/common"
	"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
	"github.com/gin-gonic/gin"
	"golang.org/x/crypto/bcrypt"
	"gorm.io/gorm"
)

var errSystemPlatformRole = errors.New("system platform roles cannot be modified")

const platformMenusContextKey = "platform_authorized_menus"

func platformMenuAllowsPath(menus []models.PlatformMenu, requestPath string) bool {
	marker := "/platform/v1/"
	index := strings.Index(requestPath, marker)
	if index < 0 {
		return false
	}
	relative := strings.Trim(requestPath[index+len(marker):], "/")
	resource := strings.Split(relative, "/")[0]
	domain := platformRouteDomain(resource)
	for _, menu := range menus {
		if menu.MenuCode == domain {
			return true
		}
		menuPath := strings.Trim(menu.Path, "/")
		if menuPath != "" && strings.Split(menuPath, "/")[0] == domain {
			return true
		}
	}
	return false
}

func platformRouteDomain(resource string) string {
	prefix := strings.Split(resource, "_")[0]
	switch prefix {
	case "product":
		return "device"
	case "gasorder":
		return "delivery"
	case "fin":
		return "finance"
	case "cms":
		return "content"
	case "cs":
		return "customer_service"
	case "platform":
		return "platform"
	default:
		return prefix
	}
}

// RequirePlatformMenuAccess enforces role-menu authorization after JWT authentication.
func RequirePlatformMenuAccess() gin.HandlerFunc {
	return func(ctx *gin.Context) {
		if strings.Contains(ctx.Request.URL.Path, "/platform/v1/auth/") {
			ctx.Next()
			return
		}
		claims, err := middleware.ParseAuth(ctx)
		if err != nil {
			infra.Response.Error(ctx, err)
			ctx.Abort()
			return
		}
		if claims.Role == "root" {
			ctx.Next()
			return
		}
		menus, err := common.LoadPlatformMenus(claims.Role)
		if err != nil || !platformMenuAllowsPath(menus, ctx.Request.URL.Path) {
			infra.Response.Error(ctx, errcode.ErrPermissionDenied)
			ctx.Abort()
			return
		}
		ctx.Set(platformMenusContextKey, menus)
		ctx.Next()
	}
}

// ListPlatformRole 查询平台角色分页列表。
func ListPlatformRole(ctx *gin.Context) { common.ListPage[models.PlatformRole](ctx) }

// GetPlatformRole 查询一个平台角色。
func GetPlatformRole(ctx *gin.Context) { common.GetByIdentity[models.PlatformRole](ctx) }

// CreatePlatformRole 创建非内置平台角色。
func CreatePlatformRole(ctx *gin.Context) {
	if !common.RequirePlatformRoot(ctx) {
		return
	}
	var request models.PlatformRole
	if err := ctx.ShouldBindJSON(&request); err != nil || request.RoleCode == "" || request.Name == "" || request.RoleCode == "root" {
		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
		return
	}
	request.Entity = common.NewEntity("enabled")
	request.IsSystem = false
	if request.DataScope == "" {
		request.DataScope = "global"
	}
	if err := impl.DBService.Create(&request).Error; err != nil {
		infra.Response.Error(ctx, err)
		return
	}
	common.RespondCreatedResource(ctx, request)
}

// UpdatePlatformRole 更新非内置平台角色。
func UpdatePlatformRole(ctx *gin.Context) {
	if !common.RequirePlatformRoot(ctx) {
		return
	}
	var request struct {
		Name      string `json:"name" binding:"required,max=64"`
		DataScope string `json:"data_scope" binding:"required,max=32"`
	}
	if err := ctx.ShouldBindJSON(&request); err != nil {
		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
		return
	}
	var role models.PlatformRole
	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
		common.RespondRecordError(ctx, err)
		return
	}
	if role.IsSystem {
		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
		return
	}
	common.UpdateAllowedByIdentity(ctx, &models.PlatformRole{}, gin.H{"name": request.Name, "data_scope": request.DataScope}, []string{"name", "data_scope"})
}

type platformMenuRequest struct {
	ParentIdentity string `json:"parent_identity"`
	MenuCode       string `json:"menu_code" binding:"required,max=64"`
	Name           string `json:"name" binding:"required,max=64"`
	Icon           string `json:"icon" binding:"max=64"`
	Path           string `json:"path" binding:"max=255"`
	SortNo         int    `json:"sort_no"`
}

type platformMenuView struct {
	Identity       string `json:"identity"`
	ParentIdentity string `json:"parent_identity,omitempty"`
	MenuCode       string `json:"menu_code"`
	Name           string `json:"name"`
	Icon           string `json:"icon"`
	Path           string `json:"path"`
	SortNo         int    `json:"sort_no"`
	Status         string `json:"status"`
}

func platformMenuViews(list []models.PlatformMenu) []platformMenuView {
	identities := make(map[uint64]string, len(list))
	for _, item := range list {
		identities[item.ID] = item.Identity
	}
	views := make([]platformMenuView, 0, len(list))
	for _, item := range list {
		views = append(views, platformMenuView{Identity: item.Identity, ParentIdentity: identities[item.ParentID], MenuCode: item.MenuCode, Name: item.Name, Icon: item.Icon, Path: item.Path, SortNo: item.SortNo, Status: item.Status})
	}
	return views
}

func GetPlatformMenu(ctx *gin.Context) {
	var menu models.PlatformMenu
	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&menu).Error; err != nil {
		common.RespondRecordError(ctx, err)
		return
	}
	list := []models.PlatformMenu{menu}
	if menu.ParentID != 0 {
		var parent models.PlatformMenu
		if err := impl.DBService.Select("id", "identity").First(&parent, menu.ParentID).Error; err == nil {
			list = append(list, parent)
		}
	}
	views := platformMenuViews(list)
	infra.Response.Success(ctx, views[0])
}

func CreatePlatformMenu(ctx *gin.Context) {
	if !common.RequirePlatformRoot(ctx) {
		return
	}
	var request platformMenuRequest
	if err := ctx.ShouldBindJSON(&request); err != nil {
		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
		return
	}
	parentID, err := common.ResolveIdentityID(&models.PlatformMenu{}, request.ParentIdentity, false)
	if err != nil {
		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
		return
	}
	menu := models.PlatformMenu{Entity: common.NewEntity("enabled"), ParentID: parentID, MenuCode: request.MenuCode, Name: request.Name, Icon: request.Icon, Path: request.Path, SortNo: request.SortNo}
	if err := impl.DBService.Create(&menu).Error; err != nil {
		infra.Response.Error(ctx, err)
		return
	}
	common.RespondCreatedResource(ctx, menu)
}

func UpdatePlatformMenu(ctx *gin.Context) {
	if !common.RequirePlatformRoot(ctx) {
		return
	}
	var request platformMenuRequest
	if err := ctx.ShouldBindJSON(&request); err != nil {
		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
		return
	}
	parentID, err := common.ResolveIdentityID(&models.PlatformMenu{}, request.ParentIdentity, false)
	if err != nil {
		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
		return
	}
	common.UpdateAllowedByIdentity(ctx, &models.PlatformMenu{}, gin.H{"parent_id": parentID, "name": request.Name, "icon": request.Icon, "path": request.Path, "sort_no": request.SortNo}, []string{"parent_id", "name", "icon", "path", "sort_no"})
}

func UpdatePlatformMenuStatus(ctx *gin.Context) {
	if !common.RequirePlatformRoot(ctx) {
		return
	}
	common.UpdateRecordStatus(ctx, &models.PlatformMenu{})
}

func ArchivePlatformMenu(ctx *gin.Context) {
	if !common.RequirePlatformRoot(ctx) {
		return
	}
	common.ArchiveRecord(ctx, &models.PlatformMenu{})
}

type platformRoleMenusRequest struct {
	MenuIdentities []string `json:"menu_identities"`
}

// ReplacePlatformRoleMenus replaces every menu assignment for a role atomically.
func ReplacePlatformRoleMenus(ctx *gin.Context) {
	if !common.RequirePlatformRoot(ctx) {
		return
	}
	var request platformRoleMenusRequest
	if err := ctx.ShouldBindJSON(&request); err != nil {
		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
		return
	}
	if err := impl.DBService.Transaction(func(transaction *gorm.DB) error {
		var role models.PlatformRole
		if err := transaction.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
			return err
		}
		if role.IsSystem {
			return errSystemPlatformRole
		}
		var menus []models.PlatformMenu
		if len(request.MenuIdentities) > 0 {
			if err := transaction.Where("identity IN ?", request.MenuIdentities).Find(&menus).Error; err != nil {
				return err
			}
			if len(menus) != len(request.MenuIdentities) {
				return gorm.ErrRecordNotFound
			}
		}
		if err := transaction.Where("platform_role_id = ?", role.ID).Delete(&models.PlatformRoleMenu{}).Error; err != nil {
			return err
		}
		for _, menu := range menus {
			relation := models.PlatformRoleMenu{PlatformRoleID: role.ID, PlatformMenuID: menu.ID}
			if err := transaction.Create(&relation).Error; err != nil {
				return err
			}
		}
		return nil
	}); err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			infra.Response.Error(ctx, errcode.ErrRecordNotFound)
			return
		}
		if errors.Is(err, errSystemPlatformRole) {
			infra.Response.Error(ctx, errcode.ErrInvalidArgument)
			return
		}
		infra.Response.Error(ctx, err)
		return
	}
	infra.Response.Success(ctx, gin.H{"updated": true})
}

// ListPlatformRoleMenuIdentities returns the current assignment for the role editor.
func ListPlatformRoleMenuIdentities(ctx *gin.Context) {
	if !common.RequirePlatformRoot(ctx) {
		return
	}
	var role models.PlatformRole
	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
		common.RespondRecordError(ctx, err)
		return
	}
	var identities []string
	if err := impl.DBService.Model(&models.PlatformMenu{}).
		Joins("JOIN platform_role_menu ON platform_role_menu.platform_menu_id = platform_menu.id").
		Where("platform_role_menu.platform_role_id = ?", role.ID).
		Order("platform_menu.sort_no asc, platform_menu.id asc").
		Pluck("platform_menu.identity", &identities).Error; err != nil {
		infra.Response.Error(ctx, err)
		return
	}
	infra.Response.Success(ctx, gin.H{"menu_identities": identities})
}

// UpdatePlatformRoleStatus 更新非内置平台角色状态，系统角色始终受保护。
func UpdatePlatformRoleStatus(ctx *gin.Context) {
	if !common.RequirePlatformRoot(ctx) {
		return
	}
	var request struct {
		Status string `json:"status" binding:"required,max=32"`
	}
	if err := ctx.ShouldBindJSON(&request); err != nil {
		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
		return
	}
	var role models.PlatformRole
	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
		common.RespondRecordError(ctx, err)
		return
	}
	if role.IsSystem {
		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
		return
	}
	common.UpdateAllowedByIdentity(ctx, &models.PlatformRole{}, gin.H{"status": request.Status}, []string{"status"})
}

// ArchivePlatformRole 归档非内置平台角色，系统角色始终受保护。
func ArchivePlatformRole(ctx *gin.Context) {
	if !common.RequirePlatformRoot(ctx) {
		return
	}
	var role models.PlatformRole
	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
		common.RespondRecordError(ctx, err)
		return
	}
	if role.IsSystem {
		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
		return
	}
	common.UpdateAllowedByIdentity(ctx, &models.PlatformRole{}, gin.H{"status": "archived"}, []string{"status"})
}

// ListPlatformMenu 返回菜单树构建所需的有序菜单列表。
func ListPlatformMenu(ctx *gin.Context) {
	claims, err := middleware.ParseAuth(ctx)
	if err != nil {
		infra.Response.Error(ctx, err)
		return
	}
	list, err := common.LoadPlatformMenus(claims.Role)
	if err != nil {
		infra.Response.Error(ctx, err)
		return
	}
	infra.Response.Success(ctx, gin.H{"total": len(list), "list": platformMenuViews(list)})
}

// ListPlatformAccount 查询平台账号列表，手机号在展示层脱敏。
func ListPlatformAccount(ctx *gin.Context) {
	page, size := common.PageSize(ctx)
	var list []models.PlatformAccount
	var total int64
	query := common.ApplyKeywordFilter(ctx, impl.DBService.Model(&models.PlatformAccount{}), &models.PlatformAccount{})
	if err := query.Count(&total).Error; err != nil {
		infra.Response.Error(ctx, err)
		return
	}
	if err := query.Order("created_at desc").Offset((page - 1) * size).Limit(size).Find(&list).Error; err != nil {
		infra.Response.Error(ctx, err)
		return
	}
	views := make([]map[string]any, 0, len(list))
	for _, item := range list {
		view := platformAccountView(item)
		common.ProtectPreciseLocation(ctx, &models.PlatformAccount{}, view)
		views = append(views, view)
	}
	infra.Response.Success(ctx, gin.H{"total": total, "list": views})
}

type platformAccountRequest struct {
	Username         string `json:"username" binding:"required,max=64"`
	Password         string `json:"password" binding:"required,min=8,max=128"`
	DisplayName      string `json:"display_name" binding:"max=64"`
	Avatar           string `json:"avatar" binding:"max=512"`
	PlatformRoleCode string `json:"platform_role_code" binding:"required,max=64"`
	Phone            string `json:"phone" binding:"max=32"`
}

func platformAccountView(account models.PlatformAccount) map[string]any {
	return map[string]any{
		"identity": account.Identity, "username": account.Username,
		"display_name": account.DisplayName, "avatar": account.Avatar, "phone": account.Phone,
		"platform_role_code": account.PlatformRoleCode, "status": account.Status,
	}
}

func GetPlatformAccount(ctx *gin.Context) {
	var account models.PlatformAccount
	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&account).Error; err != nil {
		common.RespondRecordError(ctx, err)
		return
	}
	view := platformAccountView(account)
	infra.Response.Success(ctx, common.ProtectPreciseLocation(ctx, &models.PlatformAccount{}, view))
}

func CreatePlatformAccount(ctx *gin.Context) {
	if !common.RequirePlatformRoot(ctx) {
		return
	}
	var request platformAccountRequest
	if err := ctx.ShouldBindJSON(&request); err != nil {
		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
		return
	}
	if !isAssignablePlatformRole(request.PlatformRoleCode) {
		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
		return
	}
	hash, err := platformPasswordHash(request.Password)
	if err != nil {
		infra.Response.Error(ctx, err)
		return
	}
	account := models.PlatformAccount{Entity: common.NewEntity("enabled"), Username: request.Username, DisplayName: request.DisplayName, Avatar: request.Avatar, PasswordHash: hash, PlatformRoleCode: request.PlatformRoleCode, Phone: request.Phone}
	if err := impl.DBService.Create(&account).Error; err != nil {
		infra.Response.Error(ctx, err)
		return
	}
	view := platformAccountView(account)
	infra.Response.Success(ctx, common.ProtectPreciseLocation(ctx, &models.PlatformAccount{}, view))
}

func UpdatePlatformAccount(ctx *gin.Context) {
	var request struct {
		DisplayName      string  `json:"display_name" binding:"max=64"`
		Avatar           string  `json:"avatar" binding:"max=512"`
		PlatformRoleCode *string `json:"platform_role_code" binding:"omitempty,max=64"`
		Phone            string  `json:"phone" binding:"max=32"`
	}
	if err := ctx.ShouldBindJSON(&request); err != nil {
		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
		return
	}
	values := gin.H{"display_name": request.DisplayName, "avatar": request.Avatar, "phone": request.Phone}
	if request.PlatformRoleCode != nil {
		if !common.RequirePlatformRoot(ctx) {
			return
		}
		if !isAssignablePlatformRole(*request.PlatformRoleCode) {
			infra.Response.Error(ctx, errcode.ErrInvalidArgument)
			return
		}
		values["platform_role_code"] = *request.PlatformRoleCode
	}
	common.UpdateAllowedByIdentity(ctx, &models.PlatformAccount{}, values, []string{"display_name", "avatar", "platform_role_code", "phone"})
}

// UpdatePlatformAccountStatus updates a platform account lifecycle state.
func UpdatePlatformAccountStatus(ctx *gin.Context) {
	if !common.RequirePlatformRoot(ctx) {
		return
	}
	common.UpdateRecordStatus(ctx, &models.PlatformAccount{})
}

// ArchivePlatformAccount archives a platform account without deleting audit history.
func ArchivePlatformAccount(ctx *gin.Context) {
	if !common.RequirePlatformRoot(ctx) {
		return
	}
	common.ArchiveRecord(ctx, &models.PlatformAccount{})
}

func platformPasswordHash(password string) (string, error) {
	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
	return string(hash), err
}

func isAssignablePlatformRole(roleCode string) bool {
	if roleCode == "" || roleCode == "root" {
		return false
	}
	var role models.PlatformRole
	return impl.DBService.Where("role_code = ? AND status = ? AND is_system = ?", roleCode, "enabled", false).First(&role).Error == nil
}