using Store.Users.Contracts.Enums;
using MAX.Framework.Validation;
using FreeSql;
using MAX.Core.DependencyInjection;
using MAX.Framework.Commons;
using MAX.Framework.Security;
using Store.Users.Contracts;
using Store.Users.Contracts.Dtos;
using Store.Users.Entities;
using Store.Users.Mappers;

namespace Store.Users.Services;

/// <summary>账户管理用例：所有操作从认证上下文确定操作者，禁止相信客户端传入的父账号或管理员标记。</summary>
public sealed partial class UserManagementService(IFreeSql orm, ICurrentUser currentUser,
    IUserQueryService query, IOnlineUserStore onlineUsers) : ITransientDependency
{
    private async Task<UserEntity> Actor(IFreeSql db, CancellationToken ct)
    {
        ct.ThrowIfCancellationRequested();
        if (!currentUser.IsAuthenticated || string.IsNullOrWhiteSpace(currentUser.UserName))
            throw new UnauthorizedAccessException();
        return await db.Select<UserEntity>().Where(u => u.UserName == currentUser.UserName).FirstAsync(ct)
            ?? throw new UnauthorizedAccessException("登录账户不存在");
    }

    /// <summary>仅本人、直属主账号或超级管理员可以读取账户详情。</summary>
    public async Task<UserInfo> GetUser(string? userName, CancellationToken ct)
    {
        var actor = await Actor(orm, ct);
        var name = string.IsNullOrWhiteSpace(userName) ? actor.UserName : userName.Trim();
        RequestValidator.Validate(new UserNameRequest { UserName = name });
        var target = await orm.Select<UserEntity>().Where(u => u.UserName == name).FirstAsync(ct)
            ?? throw new AppException("用户不存在");
        if (!UserAccessPolicy.CanUseSelfService(actor, target))
            throw new AppException("无权访问该账户", 403);
        return await query.GetUser(target.UserName);
    }

    /// <summary>管理员查询全部账户；普通主账号的列表范围为本人和直属子账号。</summary>
    public async Task<UserPage<UserInfo>> Search(UserSearchRequest request, bool subUsersOnly, CancellationToken ct)
    {
        RequestValidator.Validate(request);
        var actor = await Actor(orm, ct);
        if (!UserAccessPolicy.IsAdmin(actor) && !actor.IsMainUser) throw new AppException("子账号不能管理账户列表", 403);
        var select = orm.Select<UserEntity>();
        if (subUsersOnly)
        {
            var parentUserName = request.ParentUserName?.Trim();
            if (UserAccessPolicy.IsAdmin(actor))
            {
                // 管理员省略父账号时查询所有子账号，但不混入主账号。
                select = select.Where(u => u.ParentUserName != null && u.ParentUserName.Trim() != "");
                if (!string.IsNullOrWhiteSpace(parentUserName))
                    select = select.Where(u => u.ParentUserName == parentUserName);
            }
            else
            {
                if (!string.IsNullOrWhiteSpace(parentUserName)
                    && !string.Equals(parentUserName, actor.UserName, StringComparison.OrdinalIgnoreCase))
                    throw new AppException("只能查询自己的子账号", 403);
                select = select.Where(u => u.ParentUserName == actor.UserName && (u.SaLevel == null || u.SaLevel != UserAdminLevel.SuperAdmin));
            }
        }
        else if (!UserAccessPolicy.IsAdmin(actor))
            select = select.Where(u => u.Id == actor.Id || (u.ParentUserName == actor.UserName && (u.SaLevel == null || u.SaLevel != UserAdminLevel.SuperAdmin)));
        if (!subUsersOnly && !string.IsNullOrWhiteSpace(request.ParentUserName))
        {
            var parentName = request.ParentUserName.Trim();
            select = select.Where(u => u.ParentUserName == parentName);
        }
        if (request.GroupId.HasValue) select = select.Where(u => u.GroupId == request.GroupId.Value);
        if (!string.IsNullOrWhiteSpace(request.Keyword))
        {
            var keyword = request.Keyword.Trim();
            select = select.Where(u => u.UserName.Contains(keyword) || u.NickName.Contains(keyword)
                || u.Mobile.Contains(keyword) || u.Notes.Contains(keyword));
        }
        var total = await select.CountAsync(ct);
        var items = await select.OrderByDescending(u => u.Id).Page(request.Page, request.PageSize).ToListAsync(ct);
        var mapper = new UserMapper();
        return new UserPage<UserInfo>(total, items.Select(mapper.ToInfo).ToList());
    }

    /// <summary>创建账户并初始化余额。主账号仅由管理员创建，子账号的归属由服务端指定。</summary>
    public async Task<UserInfo> Create(UserCreateRequest request, bool subUser, CancellationToken ct)
    {
        RequestValidator.Validate(request);

        using var work = orm.CreateUnitOfWork();
        work.GetOrBeginTransaction();
        var db = work.Orm;
        var actor = await Actor(db, ct);
        // 锁住主账号，使其创建子账号和删除操作串行化。
        actor = await db.Select<UserEntity>().Where(u => u.Id == actor.Id).ForUpdate().FirstAsync(ct)
            ?? throw new AppException("操作者账户不存在");
        if (subUser ? !UserAccessPolicy.IsAdmin(actor) && !actor.IsMainUser : !UserAccessPolicy.IsAdmin(actor)) throw new AppException("无权创建该账户", 403);
        var parentName = "";
        if (subUser)
        {
            parentName = string.IsNullOrWhiteSpace(request.ParentUserName) ? actor.UserName : request.ParentUserName.Trim();
            if (!UserAccessPolicy.IsAdmin(actor) && !string.Equals(parentName, actor.UserName, StringComparison.OrdinalIgnoreCase))
                throw new AppException("只能在自己的账户下创建子账号", 403);
            var parent = await db.Select<UserEntity>().Where(u => u.UserName == parentName).ForUpdate().FirstAsync(ct)
                ?? throw new AppException("父账号不存在");
            if (!parent.IsMainUser) throw new AppException("父账号必须是主账号");
            parentName = parent.UserName;
        }
        var name = request.UserName.Trim();
        if (await db.Select<UserEntity>().Where(u => u.UserName == name).AnyAsync(ct)) throw new AppException("用户名已存在");
        var user = new UserEntity
        {
            UserName = name, ParentUserName = parentName, GroupId = subUser ? UserGroup.CustomerService : UserGroup.MainAccount,
            NickName = name, Mobile = "", CompanyName = "", Notes = "", CardId = "", Authority = "",
            ForbiddenPage = "", OemId = "", SaLevel = UserAdminLevel.Normal, ShopPointsPerMonth = 30,
            PostagePerOrder = 2.2m, RefundPostagePerOrder = 2.5m, GiftOemAmountPerOrder = 0,
            SyncLogisticsPerOrder = 0, Points = 0, Balance = 0, RechargePointsTotal = 0,
            RechargeAmountTotal = 0, AddTime = DateTime.Now, MdyTime = DateTime.Now
        };
        Apply(user, request, actor, subUser);
        await CheckOem(db, user, ct);
        user.Password = UserPassword.Hash(user, request.Password);
        user.Id = checked((int)await db.Insert(user).ExecuteIdentityAsync(ct));
        ct.ThrowIfCancellationRequested();
        work.Commit();
        return await query.GetUser(user.UserName);
    }

    /// <summary>修改资料。登录名保持稳定，避免破坏主子账号、商铺和历史流水中的关联。</summary>
    public async Task<UserInfo> Update(UserUpdateRequest request, bool subUser, CancellationToken ct)
    {
        RequestValidator.Validate(request);
        var id = request.Id;
        using var work = orm.CreateUnitOfWork();
        work.GetOrBeginTransaction();
        var db = work.Orm;
        var actor = await Actor(db, ct);
        var target = await db.Select<UserEntity>().Where(u => u.Id == id).ForUpdate().FirstAsync(ct)
            ?? throw new AppException("用户不存在");
        if (!UserAccessPolicy.CanManage(actor, target)) throw new AppException("无权修改该账户", 403);
        if (subUser && target.IsMainUser) throw new AppException("目标账户不是子账号");
        Apply(target, request, actor, !target.IsMainUser);
        await CheckOem(db, target, ct);
        target.MdyTime = DateTime.Now;
        // 仅写入资料列，不把读取到的余额和积分覆盖回数据库。
        await db.Update<UserEntity>().SetSource(target).UpdateColumns(u => new
        {
            u.NickName, u.Mobile, u.CompanyName, u.Notes, u.CardId, u.GroupId, u.SaLevel, u.Authority, u.ForbiddenPage,
            u.OemId, u.ShopPointsPerMonth, u.PostagePerOrder, u.RefundPostagePerOrder,
            u.GiftOemAmountPerOrder, u.SyncLogisticsPerOrder, u.MdyTime
        }).ExecuteAffrowsAsync(ct);
        ct.ThrowIfCancellationRequested();
        work.Commit();
        onlineUsers.SignOut(target.UserName);
        return await query.GetUser(target.UserName);
    }

    /// <summary>只有无余额、无积分、无子账号且无商铺关联的账户才能删除，保留历史流水。</summary>
    public async Task Delete(int id, CancellationToken ct)
    {
        RequestValidator.Validate(new UserIdRequest { Id = id });
        using var work = orm.CreateUnitOfWork();
        work.GetOrBeginTransaction();
        var db = work.Orm;
        var actor = await Actor(db, ct);
        var target = await db.Select<UserEntity>().Where(u => u.Id == id).ForUpdate().FirstAsync(ct)
            ?? throw new AppException("用户不存在");
        if (!UserAccessPolicy.CanManage(actor, target)) throw new AppException("无权删除该账户", 403);
        if ((target.Balance ?? 0) != 0 || target.Points != 0) throw new AppException("账户仍有余额或积分，不能删除");
        if (await db.Select<UserEntity>().Where(u => u.ParentUserName == target.UserName).AnyAsync(ct))
            throw new AppException("请先处理该账户的子账号");
        if (await db.Select<YourNamespace.ShopEntity>().Where(s => s.UserName == target.UserName).AnyAsync(ct))
            throw new AppException("账户仍有关联店铺，不能删除");
        if (await db.Delete<UserEntity>().Where(u => u.Id == id && u.Points == 0 && (u.Balance == null || u.Balance == 0))
            .ExecuteAffrowsAsync(ct) != 1) throw new AppException("账户状态已改变，请刷新后重试");
        ct.ThrowIfCancellationRequested();
        work.Commit();
        onlineUsers.SignOut(target.UserName);
    }

    /// <summary>非管理员本人改密校验原密码，管理员可重置任意账户密码；比较并更新后失效目标账户会话。</summary>
    public async Task ChangePassword(ChangePasswordRequest request, CancellationToken ct)
    {
        RequestValidator.Validate(request);
        var actor = await Actor(orm, ct);
        var name = string.IsNullOrWhiteSpace(request.UserName) ? actor.UserName : request.UserName.Trim();
        var target = await orm.Select<UserEntity>().Where(u => u.UserName == name).FirstAsync(ct)
            ?? throw new AppException("用户不存在");
        if (target.Id == actor.Id && !UserAccessPolicy.IsAdmin(actor))
        {
            RequestValidator.Validate(new UserPasswordProofRequest { OldPassword = request.OldPassword! });
            if (!UserPassword.Verify(target, request.OldPassword!)) throw new AppException("原密码错误");
        }
        else if (!UserAccessPolicy.CanManage(actor, target))
            throw new AppException("无权修改该账户密码", 403);
        var hash = UserPassword.Hash(target, request.NewPassword);
        if (await orm.Update<UserEntity>().Set(u => u.Password, hash).Set(u => u.MdyTime, DateTime.Now)
            .Where(u => u.Id == target.Id && u.Password == target.Password).ExecuteAffrowsAsync(ct) != 1)
            throw new AppException("密码已发生变化，请重新登录");
        onlineUsers.SignOut(target.UserName);
    }

    /// <summary>按账户归属查询积分流水；分页与账户详情使用相同的访问范围。</summary>
    public async Task<UserPage<UserPointsRecordEntity>> Points(string? userName, UserRecordSearchRequest request, CancellationToken ct)
    {
        RequestValidator.Validate(request);
        var user = await GetUser(userName, ct);
        var select = orm.Select<UserPointsRecordEntity>().Where(r => r.UserName == user.UserName);
        if (request.StartTime.HasValue) select = select.Where(r => r.AddTime >= request.StartTime.Value);
        if (request.EndTime.HasValue) select = select.Where(r => r.AddTime <= request.EndTime.Value);
        if (!string.IsNullOrWhiteSpace(request.Operation)) select = select.Where(r => r.OptionType == request.Operation);
        if (!string.IsNullOrWhiteSpace(request.ShopId)) select = select.Where(r => r.ShopId == request.ShopId);
        var total = await select.CountAsync(ct);
        var rows = await select.OrderByDescending(r => r.Id).Page(request.Page, request.PageSize).ToListAsync(ct);
        return new(total, rows);
    }

    /// <summary>余额流水排除旧系统已标记删除的记录。</summary>
    public async Task<UserPage<UserPaymentRecordEntity>> Balance(string? userName, UserRecordSearchRequest request, CancellationToken ct)
    {
        RequestValidator.Validate(request);
        var user = await GetUser(userName, ct);
        var select = orm.Select<UserPaymentRecordEntity>().Where(r => r.UserName == user.UserName && r.IsDeleted == 0);
        if (request.StartTime.HasValue) select = select.Where(r => r.CreateTime >= request.StartTime.Value);
        if (request.EndTime.HasValue) select = select.Where(r => r.CreateTime <= request.EndTime.Value);
        if (request.PaymentType.HasValue) select = select.Where(r => r.Type == request.PaymentType.Value);
        if (!string.IsNullOrWhiteSpace(request.OrderId)) select = select.Where(r => r.OrderId == request.OrderId);
        var total = await select.CountAsync(ct);
        var rows = await select.OrderByDescending(r => r.Id).Page(request.Page, request.PageSize).ToListAsync(ct);
        return new(total, rows);
    }

    private static async Task CheckOem(IFreeSql db, UserEntity user, CancellationToken ct)
    {
        if (!string.IsNullOrWhiteSpace(user.OemId) && !await db.Select<OEMEntity>().Where(o => o.OemId == user.OemId).AnyAsync(ct))
            throw new AppException("OEM编号不存在");
    }

    private static void Apply(UserEntity user, UserEditRequest request, UserEntity actor, bool subUser)
    {
        // 合法分组值已由 DTO 保证，这里检查主/子账号身份是否匹配。
        if (request.GroupId.HasValue && (subUser ? request.GroupId == UserGroup.MainAccount : request.GroupId != UserGroup.MainAccount))
            throw new AppException("主账号必须使用主号分组，子账号不能使用主号分组");
        // 普通主账号只能授予自己已有的权限，不能通过创建子账号提升权限。
        if (!UserAccessPolicy.IsAdmin(actor) && request.Authority != null)
        {
            var allowed = Split(actor.Authority);
            if (Split(request.Authority).Any(a => !allowed.Contains(a))) throw new AppException("不能授予超出自身范围的权限", 403);
        }
        if (!UserAccessPolicy.IsAdmin(actor) && (request.OemId != null || request.ShopPointsPerMonth != null
            || request.PostagePerOrder != null || request.RefundPostagePerOrder != null
            || request.GiftOemAmountPerOrder != null || request.SyncLogisticsPerOrder != null))
            throw new AppException("仅管理员可以修改计费配置", 403);
        if (request.SaLevel.HasValue)
        {
            if (!UserAccessPolicy.IsAdmin(actor)) throw new AppException("无权设置管理员级别", 403);
            user.SaLevel = request.SaLevel;
        }
        user.NickName = request.NickName?.Trim() ?? user.NickName;
        user.Mobile = request.Mobile?.Trim() ?? user.Mobile;
        user.CompanyName = request.CompanyName?.Trim() ?? user.CompanyName;
        user.Notes = request.Notes ?? user.Notes;
        user.CardId = request.CardId ?? user.CardId;
        user.GroupId = request.GroupId ?? user.GroupId;
        user.Authority = request.Authority == null ? user.Authority : string.Join(",", Split(request.Authority));
        user.ForbiddenPage = request.ForbiddenPage ?? user.ForbiddenPage;
        user.OemId = request.OemId?.Trim() ?? user.OemId;
        user.ShopPointsPerMonth = request.ShopPointsPerMonth ?? user.ShopPointsPerMonth;
        user.PostagePerOrder = request.PostagePerOrder ?? user.PostagePerOrder;
        user.RefundPostagePerOrder = request.RefundPostagePerOrder ?? user.RefundPostagePerOrder;
        user.GiftOemAmountPerOrder = request.GiftOemAmountPerOrder ?? user.GiftOemAmountPerOrder;
        user.SyncLogisticsPerOrder = request.SyncLogisticsPerOrder ?? user.SyncLogisticsPerOrder;
    }

    private static HashSet<string> Split(string? value) => (value ?? "").Split(',',
        StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries).ToHashSet(StringComparer.Ordinal);
}