package handler

import (
	"net/http"
	"strconv"
	"strings"

	"bj_power_wms/ent"
	"bj_power_wms/ent/user"
	"bj_power_wms/internal/svc"

	"golang.org/x/crypto/bcrypt"
)

// 密码最小长度（注册 / 改密 / 重置统一）
const minPasswordLen = 6

// rolePermissions 角色 → 菜单/功能权限码。
// 与前端 MainLayout 的菜单 code 一一对应；admin 拥有全部权限（含 user:manage）。
var rolePermissions = map[string][]string{
	"admin": {
		"dashboard:view", "inbound:view", "outbound:view", "inventory:view",
		"inspection:view", "stocktake:view", "semi:view", "package:view",
		"ledger:view", "zone:view", "material:view", "user:manage",
	},
	"operator": {
		"dashboard:view", "inbound:view", "outbound:view", "inventory:view",
		"stocktake:view", "semi:view", "package:view",
		"ledger:view", "zone:view", "material:view",
	},
	"inspector": {
		"dashboard:view", "inspection:view", "inventory:view",
		"stocktake:view", "ledger:view", "zone:view", "material:view",
	},
}

// permissionsForRole 取角色对应的权限码列表（未知角色按 operator 处理）
func permissionsForRole(role string) []string {
	if p, ok := rolePermissions[role]; ok {
		return p
	}
	return rolePermissions["operator"]
}

// roleOrDefault 规范化角色值，非法值回退 operator
func roleOrDefault(r string) string {
	switch r {
	case "admin", "operator", "inspector":
		return r
	default:
		return "operator"
	}
}

// roleFromRequest 取当前登录用户角色（鉴权中间件已在 X-Role 写入）
func roleFromRequest(r *http.Request) string {
	return strings.TrimSpace(r.Header.Get("X-Role"))
}

// uidFromRequest 取当前登录用户ID（鉴权中间件已在 X-UserID 写入）
func uidFromRequestWMS(r *http.Request) int {
	n, _ := strconv.Atoi(strings.TrimSpace(r.Header.Get("X-UserID")))
	return n
}

// requireAdmin 仅管理员可访问（用于账号管理类接口）
func requireAdmin(next func(w http.ResponseWriter, r *http.Request)) func(w http.ResponseWriter, r *http.Request) {
	return func(w http.ResponseWriter, r *http.Request) {
		if roleFromRequest(r) != "admin" {
			fail(w, http.StatusForbidden, "仅管理员可操作")
			return
		}
		next(w, r)
	}
}

// userInfoHandler GET /api/user/info 当前登录用户信息 + 权限码
func userInfoHandler(ctx *svc.ServiceContext) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		username := r.Header.Get("X-Username")
		u, err := ctx.EntClient.User.Query().Where(user.UsernameEQ(username)).Only(ctx0())
		if err != nil {
			fail(w, http.StatusUnauthorized, "用户不存在")
			return
		}
		ok(w, map[string]any{
			"id":              u.ID,
			"username":        u.Username,
			"realName":        u.RealName,
			"role":            u.Role,
			"dept":            u.Dept,
			"isActive":        u.IsActive,
			"permissionCodes": permissionsForRole(u.Role),
		})
	}
}

// userDTO 脱敏后的用户视图（不含密码哈希）
func userDTO(u *ent.User) map[string]any {
	return map[string]any{
		"id":           u.ID,
		"username":     u.Username,
		"realName":     u.RealName,
		"role":         u.Role,
		"dept":         u.Dept,
		"phone":        u.Phone,
		"isActive":     u.IsActive,
		"lastLoginAt":  u.LastLoginAt,
		"createdAt":    u.CreatedAt,
	}
}

// listUsersHandler GET /api/user/list 管理员查看全部用户
func listUsersHandler(ctx *svc.ServiceContext) http.HandlerFunc {
	return requireAdmin(func(w http.ResponseWriter, r *http.Request) {
		list, err := ctx.EntClient.User.Query().Order(ent.Asc("id")).All(ctx0())
		if err != nil {
			fail(w, http.StatusInternalServerError, err.Error())
			return
		}
		out := make([]map[string]any, 0, len(list))
		for _, u := range list {
			out = append(out, userDTO(u))
		}
		ok(w, map[string]any{"list": out})
	})
}

// createUserHandler POST /api/user/create 管理员新建账号
func createUserHandler(ctx *svc.ServiceContext) http.HandlerFunc {
	return requireAdmin(func(w http.ResponseWriter, r *http.Request) {
		var req struct {
			Username string `json:"username"`
			Password string `json:"password"`
			RealName string `json:"realName"`
			Role     string `json:"role"`
			Dept     string `json:"dept"`
		}
		if err := parseJSON(r, &req); err != nil {
			fail(w, http.StatusBadRequest, "参数错误")
			return
		}
		if req.Username == "" || req.Password == "" {
			fail(w, http.StatusBadRequest, "用户名和密码必填")
			return
		}
		if len(req.Password) < minPasswordLen {
			fail(w, http.StatusBadRequest, "密码长度至少 6 位")
			return
		}
		exists, _ := ctx.EntClient.User.Query().Where(user.UsernameEQ(req.Username)).Exist(ctx0())
		if exists {
			fail(w, http.StatusConflict, "用户名已存在")
			return
		}
		hash, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
		if err != nil {
			fail(w, http.StatusInternalServerError, "密码加密失败")
			return
		}
		role := roleOrDefault(req.Role)
		u, err := ctx.EntClient.User.Create().
			SetUsername(req.Username).
			SetPassword(string(hash)).
			SetNillableRealName(strPtr(req.RealName)).
			SetRole(role).
			SetNillableDept(strPtr(req.Dept)).
			Save(ctx0())
		if err != nil {
			fail(w, http.StatusInternalServerError, err.Error())
			return
		}
		ok(w, userDTO(u))
	})
}

// updateUserHandler POST /api/user/update 管理员编辑账号（可选重置密码）
func updateUserHandler(ctx *svc.ServiceContext) http.HandlerFunc {
	return requireAdmin(func(w http.ResponseWriter, r *http.Request) {
		var req struct {
			ID        int     `json:"id"`
			RealName  string  `json:"realName"`
			Role      string  `json:"role"`
			Dept      string  `json:"dept"`
			IsActive  *bool   `json:"isActive"`
			Password  string  `json:"password"`
		}
		if err := parseJSON(r, &req); err != nil || req.ID <= 0 {
			fail(w, http.StatusBadRequest, "参数错误")
			return
		}
		target, err := ctx.EntClient.User.Get(ctx0(), req.ID)
		if err != nil {
			fail(w, http.StatusNotFound, "用户不存在")
			return
		}
		upd := target.Update()
		if req.RealName != "" {
			upd.SetRealName(req.RealName)
		}
		if req.Role != "" {
			upd.SetRole(roleOrDefault(req.Role))
		}
		if req.Dept != "" {
			upd.SetNillableDept(strPtr(req.Dept))
		}
		if req.IsActive != nil {
			upd.SetIsActive(*req.IsActive)
		}
		// 可选重置密码：填写且 >=6 位才生效
		if req.Password != "" {
			if len(req.Password) < minPasswordLen {
				fail(w, http.StatusBadRequest, "密码长度至少 6 位")
				return
			}
			hash, e2 := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
			if e2 != nil {
				fail(w, http.StatusInternalServerError, "密码加密失败")
				return
			}
			upd.SetPassword(string(hash))
		}
		u, err := upd.Save(ctx0())
		if err != nil {
			fail(w, http.StatusInternalServerError, err.Error())
			return
		}
		ok(w, userDTO(u))
	})
}

// deleteUserHandler POST /api/user/delete 管理员删除账号
func deleteUserHandler(ctx *svc.ServiceContext) http.HandlerFunc {
	return requireAdmin(func(w http.ResponseWriter, r *http.Request) {
		var req struct {
			ID int `json:"id"`
		}
		if err := parseJSON(r, &req); err != nil || req.ID <= 0 {
			fail(w, http.StatusBadRequest, "参数错误")
			return
		}
		// 禁止删除自己
		if uidFromRequestWMS(r) == req.ID {
			fail(w, http.StatusBadRequest, "不能删除当前登录账号")
			return
		}
		target, err := ctx.EntClient.User.Get(ctx0(), req.ID)
		if err != nil {
			fail(w, http.StatusNotFound, "用户不存在")
			return
		}
		// 禁止删除最后一个管理员
		if target.Role == "admin" {
			n, _ := ctx.EntClient.User.Query().Where(user.RoleEQ("admin")).Count(ctx0())
			if n <= 1 {
				fail(w, http.StatusBadRequest, "至少保留一个管理员账号")
				return
			}
		}
		if err := ctx.EntClient.User.DeleteOneID(req.ID).Exec(ctx0()); err != nil {
			fail(w, http.StatusInternalServerError, err.Error())
			return
		}
		ok(w, nil)
	})
}