package pub

import (
	"context"
	"errors"
	"time"

	"perms-system-server/internal/consts"
	permModel "perms-system-server/internal/model/perm"
	"perms-system-server/internal/svc"

	"github.com/zeromicro/go-zero/core/stores/sqlx"
	"golang.org/x/crypto/bcrypt"
)

type SyncPermsResult struct {
	Added    int64
	Updated  int64
	Disabled int64
}

type SyncPermItem struct {
	Code   string
	Name   string
	Remark string
}

type SyncPermsError struct {
	Code    int
	Message string
}

func (e *SyncPermsError) Error() string {
	return e.Message
}

func ExecuteSyncPerms(ctx context.Context, svcCtx *svc.ServiceContext, appKey, appSecret string, perms []SyncPermItem) (*SyncPermsResult, error) {
	product, err := svcCtx.SysProductModel.FindOneByAppKey(ctx, appKey)
	if err != nil {
		return nil, &SyncPermsError{Code: 401, Message: "无效的appKey"}
	}
	if err := bcrypt.CompareHashAndPassword([]byte(product.AppSecret), []byte(appSecret)); err != nil {
		return nil, &SyncPermsError{Code: 401, Message: "appSecret验证失败"}
	}
	if product.Status != consts.StatusEnabled {
		return nil, &SyncPermsError{Code: 403, Message: "产品已被禁用"}
	}

	if len(perms) == 0 {
		return nil, &SyncPermsError{Code: 400, Message: "权限列表不能为空"}
	}

	// 去重请求列表，避免同一笔同步里 codes 互相冲突。
	codes := make([]string, 0, len(perms))
	seen := make(map[string]bool, len(perms))
	dedupPerms := make([]SyncPermItem, 0, len(perms))
	for _, item := range perms {
		if seen[item.Code] {
			continue
		}
		seen[item.Code] = true
		codes = append(codes, item.Code)
		dedupPerms = append(dedupPerms, item)
	}

	now := time.Now().Unix()
	var added, updated, disabled int64

	// 同 tx 内先 SELECT ... FOR UPDATE 锁 sys_product 行，再在 tx 内读取 existing 并写入：
	// 把同一 product 的并发同步串行化，避免两次同步都认为 code X 不存在并并发 INSERT 撞
	// sys_perm UNIQUE(productCode, code) 拿 1062（见审计 H-3）。
	err = svcCtx.SysPermModel.TransactCtx(ctx, func(txCtx context.Context, session sqlx.Session) error {
		if _, err := svcCtx.SysProductModel.LockByCodeTx(txCtx, session, product.Code); err != nil {
			if errors.Is(err, sqlx.ErrNotFound) {
				return &SyncPermsError{Code: 404, Message: "产品不存在"}
			}
			return err
		}

		existingMap, err := svcCtx.SysPermModel.FindMapByProductCodeWithTx(txCtx, session, product.Code)
		if err != nil {
			return err
		}

		var toInsert []*permModel.SysPerm
		var toUpdate []*permModel.SysPerm
		for _, item := range dedupPerms {
			existing, ok := existingMap[item.Code]
			if !ok {
				toInsert = append(toInsert, &permModel.SysPerm{
					ProductCode: product.Code,
					Name:        item.Name,
					Code:        item.Code,
					Remark:      item.Remark,
					Status:      consts.StatusEnabled,
					CreateTime:  now,
					UpdateTime:  now,
				})
				added++
				continue
			}
			if existing.Name != item.Name || existing.Remark != item.Remark || existing.Status != consts.StatusEnabled {
				existing.Name = item.Name
				existing.Remark = item.Remark
				existing.Status = consts.StatusEnabled
				existing.UpdateTime = now
				toUpdate = append(toUpdate, existing)
				updated++
			}
		}

		if len(toInsert) > 0 {
			if insertErr := svcCtx.SysPermModel.BatchInsertWithTx(txCtx, session, toInsert); insertErr != nil {
				return insertErr
			}
		}
		if len(toUpdate) > 0 {
			if updateErr := svcCtx.SysPermModel.BatchUpdateWithTx(txCtx, session, toUpdate); updateErr != nil {
				return updateErr
			}
		}
		var disableErr error
		disabled, disableErr = svcCtx.SysPermModel.DisableNotInCodesWithTx(txCtx, session, product.Code, codes, now)
		return disableErr
	})
	if err != nil {
		var se *SyncPermsError
		if errors.As(err, &se) {
			return nil, se
		}
		return nil, &SyncPermsError{Code: 500, Message: "同步权限事务失败"}
	}

	if added > 0 || updated > 0 || disabled > 0 {
		svcCtx.UserDetailsLoader.CleanByProduct(ctx, product.Code)
	}

	return &SyncPermsResult{
		Added:    added,
		Updated:  updated,
		Disabled: disabled,
	}, nil
}