//
// Copyright (C) 2024 veypi <i@veypi.com>
// 2025-03-04 16:08:06
// Distributed under terms of the MIT license.
//

package auth

import (
	"github.com/veypi/vbase/cfg"
	"github.com/veypi/vbase/libs/crypto"
	"github.com/veypi/vbase/models"
	"github.com/veypi/vigo"
)

// UserPermissionInfo 用户权限信息
type UserPermissionInfo struct {
	Scope        string `json:"scope"`
	PermissionID string `json:"permission_id"`
	ResourceID   string `json:"resource_id"`
	Level        int    `json:"level"`
}

// UserInfoWithPerms 带权限的用户信息
type UserInfoWithPerms struct {
	ID          string               `json:"id"`
	Username    string               `json:"username"`
	Nickname    string               `json:"nickname"`
	Email       *string              `json:"email"`
	Phone       *string              `json:"phone"`
	Avatar      string               `json:"avatar"`
	Permissions []UserPermissionInfo `json:"permissions"`
}

// me 获取当前用户信息
func me(x *vigo.X) (*UserInfoWithPerms, error) {
	userID := cfg.Auth.UserID(x)
	if userID == "" {
		return nil, vigo.ErrUnauthorized
	}

	var user models.User
	if err := cfg.DB().First(&user, "id = ?", userID).Error; err != nil {
		return nil, vigo.ErrNotFound
	}

	// 获取用户权限列表
	var perms []models.Permission
	// 1. 获取用户直接拥有的权限
	if err := cfg.DB().Where("user_id = ?", userID).Find(&perms).Error; err != nil {
		return nil, vigo.ErrInternalServer.WithError(err)
	}

	// 2. 获取用户角色的权限
	var roleIDs []string
	cfg.DB().Model(&models.UserRole{}).Where("user_id = ?", userID).Pluck("role_id", &roleIDs)

	if len(roleIDs) > 0 {
		var rolePerms []models.Permission
		if err := cfg.DB().Where("role_id IN ?", roleIDs).Find(&rolePerms).Error; err != nil {
			return nil, vigo.ErrInternalServer.WithError(err)
		}
		perms = append(perms, rolePerms...)
	}

	// 转换权限格式
	userPerms := make([]UserPermissionInfo, 0, len(perms))
	for _, p := range perms {
		userPerms = append(userPerms, UserPermissionInfo{
			Scope:        p.Scope,
			PermissionID: p.PermissionID,
			ResourceID:   "", // ResourceID is no longer a separate field in Permission model, using PermissionID hierarchy
			Level:        p.Level,
		})
	}

	return &UserInfoWithPerms{
		ID:          user.ID,
		Username:    user.Username,
		Nickname:    user.Nickname,
		Email:       user.Email,
		Phone:       user.Phone,
		Avatar:      user.Avatar,
		Permissions: userPerms,
	}, nil
}

// UpdateMeRequest 更新自己请求
type UpdateMeRequest struct {
	Nickname *string `json:"nickname,omitempty" src:"json" desc:"昵称"`
	Avatar   *string `json:"avatar,omitempty" src:"json" desc:"头像"`
	Email    *string `json:"email,omitempty" src:"json" desc:"邮箱"`
	Phone    *string `json:"phone,omitempty" src:"json" desc:"手机号"`
}

// updateMe 更新当前用户信息
func updateMe(x *vigo.X, req *UpdateMeRequest) (*UserInfoWithPerms, error) {
	userID := cfg.Auth.UserID(x)
	if userID == "" {
		return nil, vigo.ErrUnauthorized
	}

	updates := make(map[string]any)
	if req.Nickname != nil {
		updates["nickname"] = *req.Nickname
	}
	if req.Avatar != nil {
		updates["avatar"] = *req.Avatar
	}
	if req.Phone != nil {
		updates["phone"] = *req.Phone
	}
	if req.Email != nil {
		// 检查邮箱是否被其他用户使用
		var count int64
		cfg.DB().Model(&models.User{}).Where("email = ? AND id != ?", *req.Email, userID).Count(&count)
		if count > 0 {
			return nil, vigo.ErrInvalidArg.WithString("email already exists")
		}
		updates["email"] = *req.Email
	}

	if err := cfg.DB().Model(&models.User{}).Where("id = ?", userID).Updates(updates).Error; err != nil {
		return nil, vigo.ErrInternalServer.WithError(err)
	}

	return me(x)
}

// ChangePasswordRequest 修改密码请求
type ChangePasswordRequest struct {
	OldPassword string `json:"old_password" src:"json" desc:"旧密码"`
	NewPassword string `json:"new_password" src:"json" desc:"新密码"`
}

// changePassword 修改密码
func changePassword(x *vigo.X, req *ChangePasswordRequest) error {
	userID := cfg.Auth.UserID(x)
	if userID == "" {
		return vigo.ErrUnauthorized
	}

	var user models.User
	if err := cfg.DB().First(&user, "id = ?", userID).Error; err != nil {
		return vigo.ErrNotFound
	}

	// 验证旧密码
	if !crypto.VerifyPassword(req.OldPassword, user.Password) {
		return vigo.ErrInvalidArg.WithString("old password is incorrect")
	}

	// 哈希新密码
	hashedPassword, err := crypto.HashPassword(req.NewPassword, 12)
	if err != nil {
		return vigo.ErrInternalServer.WithError(err)
	}

	// 更新密码
	if err := cfg.DB().Model(&user).Update("password", hashedPassword).Error; err != nil {
		return vigo.ErrInternalServer.WithError(err)
	}

	return nil
}
