package com.ruoyi.account.service;

import com.ruoyi.chargingPile.api.dto.GetSiteListDTO;
import com.ruoyi.chargingPile.api.feignClient.SiteClient;
import com.ruoyi.common.core.domain.R;
import com.ruoyi.common.core.exception.ServiceException;
import com.ruoyi.common.security.service.TokenService;
import com.ruoyi.common.security.utils.SecurityUtils;
import com.ruoyi.order.api.feignClient.ChargingOrderClient;
import com.ruoyi.system.api.domain.SysUser;
import com.ruoyi.system.api.feignClient.SysUserClient;
import com.ruoyi.system.api.model.LoginUser;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Service;

import javax.annotation.Resource;
import java.util.Collection;
import java.util.Collections;
import java.util.List;
import java.util.Objects;
import java.util.stream.Collectors;

/**
 * 合作商后台用户数据范围及只读权限控制。
 */
@Slf4j
@Service
public class PartnerAppUserAccessService {

    private static final Integer PARTNER_ROLE_TYPE = 2;
    private static final Integer COMPANY_ROLE_TYPE = 5;
    private static final Long IMPOSSIBLE_USER_ID = -1L;

    @Resource
    private TokenService tokenService;
    @Resource
    private SysUserClient sysUserClient;
    @Resource
    private SiteClient siteClient;
    @Resource
    private ChargingOrderClient chargingOrderClient;

    /**
     * 非合作商返回null，合作商返回允许查看的用户ID；空权限始终返回不可命中的ID。
     */
    public List<Long> getVisibleUserIdsForCurrentPartner() {
        SysUser sysUser = getCurrentSysUser();
        if (!isPartner(sysUser)) {
            return null;
        }
        if (sysUser.getObjectId() == null || sysUser.getUserId() == null) {
            return impossibleUserIds();
        }
        R<List<GetSiteListDTO>> siteResult = siteClient.getSiteListByUserId(sysUser.getUserId());
        if (siteResult == null || !R.isSuccess(siteResult) || siteResult.getData() == null) {
            return impossibleUserIds();
        }
        List<Integer> siteIds = siteResult.getData().stream()
                .filter(Objects::nonNull)
                .map(GetSiteListDTO::getId)
                .filter(Objects::nonNull)
                .filter(siteId -> siteId > 0)
                .distinct()
                .sorted()
                .collect(Collectors.toList());
        if (siteIds.isEmpty()) {
            return impossibleUserIds();
        }
        R<List<Long>> userResult = chargingOrderClient.getAppUserIdsBySiteIds(siteIds);
        if (userResult == null || !R.isSuccess(userResult) || userResult.getData() == null) {
            log.warn("查询合作商充电用户失败，partnerId={}", sysUser.getObjectId());
            return impossibleUserIds();
        }
        List<Long> userIds = userResult.getData().stream()
                .filter(Objects::nonNull)
                .distinct()
                .collect(Collectors.toList());
        return userIds.isEmpty() ? impossibleUserIds() : userIds;
    }

    public void assertUserVisible(Long userId) {
        List<Long> visibleUserIds = getVisibleUserIdsForCurrentPartner();
        if (visibleUserIds != null && (userId == null || !visibleUserIds.contains(userId))) {
            throw new ServiceException("无权查看该用户信息");
        }
    }

    public void assertUsersVisible(Collection<Long> userIds) {
        List<Long> visibleUserIds = getVisibleUserIdsForCurrentPartner();
        if (visibleUserIds == null) {
            return;
        }
        if (userIds == null || userIds.isEmpty()) {
            throw new ServiceException("无权操作所选用户");
        }
        for (Long userId : userIds) {
            if (userId == null || !visibleUserIds.contains(userId)) {
                throw new ServiceException("无权操作所选用户");
            }
        }
    }

    /**
     * 当前登录账号若为公司账号（roleType=5 且已绑定公司），返回其所属公司ID；非公司账号返回null。
     */
    public Integer getCurrentCompanyId() {
        SysUser sysUser = getCurrentSysUser();
        if (!isCompany(sysUser)) {
            return null;
        }
        return sysUser.getObjectId();
    }

    /**
     * 数据范围强制：公司账号只允许查询本公司数据，覆盖前端传入的公司筛选条件；非公司账号保持原值。
     */
    public Integer resolveCompanyFilter(Integer requestCompanyId) {
        Integer currentCompanyId = getCurrentCompanyId();
        return currentCompanyId != null ? currentCompanyId : requestCompanyId;
    }

    /**
     * 公司账号数据归属校验：记录不属于本公司时拒绝操作；非公司账号不做限制。
     */
    public void assertCompanyVisible(Integer recordCompanyId) {
        Integer currentCompanyId = getCurrentCompanyId();
        if (currentCompanyId == null) {
            return;
        }
        if (!Objects.equals(currentCompanyId, recordCompanyId)) {
            throw new ServiceException("无权操作其他公司的数据");
        }
    }

    private boolean isPartner(SysUser sysUser) {
        return sysUser != null && Objects.equals(PARTNER_ROLE_TYPE, sysUser.getRoleType());
    }

    private boolean isCompany(SysUser sysUser) {
        return sysUser != null && Objects.equals(COMPANY_ROLE_TYPE, sysUser.getRoleType())
                && sysUser.getObjectId() != null;
    }

    private List<Long> impossibleUserIds() {
        return Collections.singletonList(IMPOSSIBLE_USER_ID);
    }

    private SysUser getCurrentSysUser() {
        LoginUser loginUser = null;
        try {
            loginUser = tokenService.getLoginUser();
        } catch (Exception ignored) {
            // 尝试从安全上下文继续获取。
        }
        if (loginUser == null) {
            try {
                loginUser = SecurityUtils.getLoginUser();
            } catch (Exception ignored) {
                // 当前请求不是管理后台登录上下文。
            }
        }
        if (loginUser == null) {
            return null;
        }
        if (loginUser.getSysUser() != null && loginUser.getSysUser().getRoleType() != null) {
            return loginUser.getSysUser();
        }
        if (loginUser.getUserid() == null) {
            return loginUser.getSysUser();
        }
        R<SysUser> userResult = sysUserClient.getSysUser(loginUser.getUserid());
        return userResult != null && userResult.getData() != null ? userResult.getData() : loginUser.getSysUser();
    }
}