import type { PoolConnection, ResultSetHeader, RowDataPacket } from 'mysql2/promise';
import type { MySqlPool } from '../db/mysql.js';

export interface LoginContext {
  tenantId: string;
  platformAppId: string;
  appId: string;
}

export interface AuthUser {
  id: string;
  tenantId: string;
  userType: string;
  status: string;
  roleVersion: number;
  nickname: string;
  avatarUrl: string;
  phone: string;
}

export interface AuthSession {
  id: string;
  tenantId: string;
  platformAppId: string;
  user: AuthUser;
  expiresAt: Date;
}

interface LoginContextRow extends RowDataPacket {
  tenantId: string;
  platformAppId: string;
  appId: string;
}

interface UserRow extends RowDataPacket {
  id: string;
  tenantId: string;
  userType: string;
  status: string;
  roleVersion: number;
  nickname: string;
  avatarUrl: string;
  phone: string;
}

interface SessionRow extends UserRow {
  sessionId: string;
  platformAppId: string;
  expiresAt: Date;
}

export class AuthRepository {
  constructor(private readonly pool: MySqlPool) {}

  async resolveLoginContext(appId: string, tenantId?: string): Promise<LoginContext | null> {
    const tenantFilter = tenantId ? 'AND ta.tenant_id = ?' : '';
    const [rows] = await this.pool.execute<LoginContextRow[]>(
      `SELECT ta.tenant_id AS tenantId, pa.id AS platformAppId, pa.appid AS appId
       FROM qipai_platform_apps pa
       INNER JOIN qipai_tenant_apps ta
         ON ta.platform_app_id = pa.id
        AND ta.status = 'ACTIVE' AND ta.deleted_at IS NULL
       INNER JOIN qipai_tenants t
         ON t.id = ta.tenant_id
        AND t.status = 'ACTIVE' AND t.deleted_at IS NULL
       WHERE pa.appid = ? AND pa.status = 'ACTIVE' AND pa.deleted_at IS NULL
         ${tenantFilter}
       ORDER BY ta.is_default DESC, ta.tenant_id ASC
       LIMIT 2`,
      tenantId ? [appId, tenantId] : [appId]
    );
    if (!tenantId && rows.length > 1) throw new Error('TENANT_SELECTION_REQUIRED');
    const row = rows[0];
    return row ? {
      tenantId: String(row.tenantId),
      platformAppId: String(row.platformAppId),
      appId: row.appId
    } : null;
  }

  async loginWithWechat(input: {
    context: LoginContext;
    openid: string;
    unionid?: string;
    sessionId: string;
    expiresAt: Date;
    ip: string;
    userAgent: string;
  }): Promise<AuthSession> {
    const connection = await this.pool.getConnection();
    try {
      await connection.beginTransaction();
      let user = await this.findUserByIdentity(connection, input.context, input.openid);
      if (!user) {
        const [created] = await connection.execute<ResultSetHeader>(
          `INSERT INTO qipai_users (tenant_id, user_type, status)
           VALUES (?, 'CUSTOMER', 'ACTIVE')`,
          [input.context.tenantId]
        );
        const userId = String(created.insertId);
        await connection.execute(
          `INSERT INTO qipai_user_identities
             (tenant_id, platform_app_id, user_id, openid, unionid)
           VALUES (?, ?, ?, ?, ?)`,
          [
            input.context.tenantId,
            input.context.platformAppId,
            userId,
            input.openid,
            input.unionid ?? null
          ]
        );
        user = await this.findUserById(connection, input.context.tenantId, userId);
      } else if (input.unionid) {
        await connection.execute(
          `UPDATE qipai_user_identities SET unionid = COALESCE(unionid, ?)
           WHERE tenant_id = ? AND platform_app_id = ? AND user_id = ?`,
          [input.unionid, input.context.tenantId, input.context.platformAppId, user.id]
        );
      }
      if (!user || user.status !== 'ACTIVE') throw new Error('USER_DISABLED');
      await connection.execute(
        `INSERT IGNORE INTO qipai_roles (tenant_id, code, name) VALUES
          (?, 'CUSTOMER', '顾客'),
          (?, 'CLEANER', '保洁员'),
          (?, 'STAFF', '门店员工'),
          (?, 'STORE_ADMIN', '门店管理员'),
          (?, 'TENANT_ADMIN', '租户管理员'),
          (?, 'PLATFORM_ADMIN', '平台管理员')`,
        Array(6).fill(input.context.tenantId)
      );
      await connection.execute(
        `INSERT IGNORE INTO qipai_user_roles (tenant_id, user_id, role_id)
         SELECT ?, ?, id FROM qipai_roles
         WHERE tenant_id = ? AND code = 'CUSTOMER' AND status = 'ACTIVE'`,
        [input.context.tenantId, user.id, input.context.tenantId]
      );
      await connection.execute(
        `INSERT IGNORE INTO qipai_role_permissions (tenant_id, role_id, permission_id)
         SELECT ?, r.id, p.id FROM qipai_roles r
         INNER JOIN qipai_permissions p ON
           (r.code = 'CUSTOMER' AND p.code IN ('profile.read', 'order.self.read'))
           OR (r.code = 'STORE_ADMIN'
               AND p.code IN ('user.read', 'staff.manage', 'session.reset',
                              'store.operation.read', 'store.operation.write'))
           OR (r.code IN ('TENANT_ADMIN', 'PLATFORM_ADMIN')
               AND p.code IN ('user.read', 'staff.manage', 'session.reset', 'tenant.manage'))
         WHERE r.tenant_id = ?`,
        [input.context.tenantId, input.context.tenantId]
      );
      await connection.execute(
        `INSERT INTO qipai_auth_sessions
          (id, tenant_id, platform_app_id, user_id, role_version, expires_at, ip, user_agent)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
        [
          input.sessionId,
          input.context.tenantId,
          input.context.platformAppId,
          user.id,
          user.roleVersion,
          input.expiresAt,
          input.ip,
          input.userAgent.slice(0, 255)
        ]
      );
      await connection.execute(
        `UPDATE qipai_users SET last_login_at = UTC_TIMESTAMP(3)
         WHERE tenant_id = ? AND id = ?`,
        [input.context.tenantId, user.id]
      );
      await connection.commit();
      return {
        id: input.sessionId,
        tenantId: input.context.tenantId,
        platformAppId: input.context.platformAppId,
        user,
        expiresAt: input.expiresAt
      };
    } catch (error) {
      await connection.rollback();
      throw error;
    } finally {
      connection.release();
    }
  }

  async validateSession(sessionId: string, tenantId: string, userId: string): Promise<AuthSession | null> {
    const [rows] = await this.pool.execute<SessionRow[]>(
      `SELECT s.id AS sessionId, s.tenant_id AS tenantId,
              s.platform_app_id AS platformAppId, s.expires_at AS expiresAt,
              u.id, u.user_type AS userType, u.status,
              u.role_version AS roleVersion, u.nickname,
              u.avatar_url AS avatarUrl, u.phone
       FROM qipai_auth_sessions s
       INNER JOIN qipai_users u
         ON u.id = s.user_id AND u.tenant_id = s.tenant_id AND u.deleted_at IS NULL
       WHERE s.id = ? AND s.tenant_id = ? AND s.user_id = ?
         AND s.status = 'ACTIVE' AND s.revoked_at IS NULL
         AND s.expires_at > UTC_TIMESTAMP(3)
         AND u.status = 'ACTIVE'
         AND u.role_version = s.role_version
       LIMIT 1`,
      [sessionId, tenantId, userId]
    );
    const row = rows[0];
    if (!row) return null;
    await this.pool.execute(
      'UPDATE qipai_auth_sessions SET last_seen_at = UTC_TIMESTAMP(3) WHERE id = ?',
      [sessionId]
    );
    return {
      id: row.sessionId,
      tenantId: String(row.tenantId),
      platformAppId: String(row.platformAppId),
      expiresAt: row.expiresAt,
      user: mapUser(row)
    };
  }

  async revokeSession(sessionId: string, reason = 'LOGOUT'): Promise<boolean> {
    const [result] = await this.pool.execute<ResultSetHeader>(
      `UPDATE qipai_auth_sessions
       SET status = 'REVOKED', revoked_at = UTC_TIMESTAMP(3), revoke_reason = ?
       WHERE id = ? AND status = 'ACTIVE'`,
      [reason, sessionId]
    );
    return result.affectedRows === 1;
  }

  private async findUserByIdentity(
    connection: PoolConnection,
    context: LoginContext,
    openid: string
  ): Promise<AuthUser | null> {
    const [rows] = await connection.execute<UserRow[]>(
      `SELECT u.id, u.tenant_id AS tenantId, u.user_type AS userType, u.status,
              u.role_version AS roleVersion, u.nickname,
              u.avatar_url AS avatarUrl, u.phone
       FROM qipai_user_identities i
       INNER JOIN qipai_users u
         ON u.id = i.user_id AND u.tenant_id = i.tenant_id AND u.deleted_at IS NULL
       WHERE i.tenant_id = ? AND i.platform_app_id = ?
         AND i.openid = ? AND i.deleted_at IS NULL
       LIMIT 1 FOR UPDATE`,
      [context.tenantId, context.platformAppId, openid]
    );
    return rows[0] ? mapUser(rows[0]) : null;
  }

  private async findUserById(
    connection: PoolConnection,
    tenantId: string,
    userId: string
  ): Promise<AuthUser | null> {
    const [rows] = await connection.execute<UserRow[]>(
      `SELECT id, tenant_id AS tenantId, user_type AS userType, status,
              role_version AS roleVersion, nickname, avatar_url AS avatarUrl, phone
       FROM qipai_users WHERE tenant_id = ? AND id = ? AND deleted_at IS NULL`,
      [tenantId, userId]
    );
    return rows[0] ? mapUser(rows[0]) : null;
  }
}

function mapUser(row: UserRow): AuthUser {
  return {
    id: String(row.id),
    tenantId: String(row.tenantId),
    userType: row.userType,
    status: row.status,
    roleVersion: row.roleVersion,
    nickname: row.nickname,
    avatarUrl: row.avatarUrl,
    phone: row.phone
  };
}