import type { PoolConnection, ResultSetHeader, RowDataPacket } from 'mysql2/promise';
import type { AccessProfile } from '../auth/rbac-repository.js';
import type { MySqlPool } from '../db/mysql.js';
import type { MarketingBenefitService } from '../wallets/marketing-benefit-service.js';

export const orderActions = [
  'SUBMIT', 'CONFIRM_PAYMENT', 'RESERVE', 'START', 'FINISH', 'CANCEL',
  'BEGIN_REFUND', 'COMPLETE_REFUND', 'CLOSE'
] as const;
export type OrderAction = typeof orderActions[number];
export type OrderStatus =
  | 'DRAFT' | 'PENDING_PAYMENT' | 'PAID' | 'RESERVED' | 'IN_PROGRESS'
  | 'FINISHED' | 'CANCELLED' | 'REFUNDING' | 'REFUNDED' | 'CLOSED';

export interface OrderActor {
  tenantId: string;
  userId: string;
  actorType: 'USER' | 'SYSTEM';
  source: 'APP' | 'ADMIN' | 'PAYMENT' | 'WORKER' | 'SYSTEM';
  traceId: string;
  ip: string;
  userAgent: string;
  access?: AccessProfile;
}

interface OrderRow extends RowDataPacket {
  id: string;
  storeId: string;
  status: OrderStatus;
  statusVersion: number;
}
interface HistoryRow extends RowDataPacket {
  id: string;
  fromStatus: OrderStatus | null;
  toStatus: OrderStatus;
  action: OrderAction | 'CREATED' | 'EXPIRED' | 'MIGRATED';
  actorType: string;
  actorId: string | null;
  source: string;
  reason: string;
  traceId: string;
  createdAt: Date;
}

const targetByAction: Record<OrderAction, OrderStatus> = {
  SUBMIT: 'PENDING_PAYMENT',
  CONFIRM_PAYMENT: 'PAID',
  RESERVE: 'RESERVED',
  START: 'IN_PROGRESS',
  FINISH: 'FINISHED',
  CANCEL: 'CANCELLED',
  BEGIN_REFUND: 'REFUNDING',
  COMPLETE_REFUND: 'REFUNDED',
  CLOSE: 'CLOSED'
};

const allowedActions: Record<OrderStatus, readonly OrderAction[]> = {
  DRAFT: ['SUBMIT', 'CANCEL', 'CLOSE'],
  PENDING_PAYMENT: ['CONFIRM_PAYMENT', 'CANCEL', 'CLOSE'],
  PAID: ['RESERVE', 'START', 'CANCEL', 'BEGIN_REFUND'],
  RESERVED: ['START', 'CANCEL', 'BEGIN_REFUND'],
  IN_PROGRESS: ['FINISH', 'BEGIN_REFUND'],
  FINISHED: ['BEGIN_REFUND', 'CLOSE'],
  CANCELLED: ['BEGIN_REFUND', 'CLOSE'],
  REFUNDING: ['COMPLETE_REFUND'],
  REFUNDED: ['CLOSE'],
  CLOSED: []
};

export class OrderStateError extends Error {
  constructor(public readonly code: string) { super(code); }
}

export class OrderStateRepository {
  constructor(
    private readonly pool: MySqlPool,
    private readonly benefits?: Pick<MarketingBenefitService, 'releaseReservedInTransaction'>,
    private readonly cleaningTasks?: {
      createForFinishedOrder(
        connection: PoolConnection,
        input: { tenantId: string; orderId: string; actorId: string; traceId: string }
      ): Promise<void>;
    }
  ) {}

  async transition(actor: OrderActor, orderId: string, action: OrderAction, reason = '') {
    return this.transaction(async (connection) => {
      const order = await this.loadOrder(connection, actor.tenantId, orderId, true);
      await this.assertAuthorized(connection, actor, order, action);
      const duplicate = await this.findByTrace(connection, actor.tenantId, orderId, actor.traceId);
      if (duplicate) {
        return {
          orderId,
          status: duplicate.toStatus,
          statusVersion: null,
          historyId: duplicate.id,
          idempotent: true
        };
      }
      if (!allowedActions[order.status].includes(action)) {
        throw new OrderStateError('ORDER_TRANSITION_NOT_ALLOWED');
      }
      const targetStatus = targetByAction[action];
      const nextVersion = Number(order.statusVersion) + 1;
      await connection.execute(
        `UPDATE qipai_orders
         SET status = ?, status_version = ?, status_updated_at = UTC_TIMESTAMP(3)
         WHERE tenant_id = ? AND id = ?`,
        [targetStatus, nextVersion, actor.tenantId, orderId]
      );
      await this.applyReservationState(connection, actor.tenantId, orderId, targetStatus);
      if (targetStatus === 'FINISHED' && this.cleaningTasks) {
        await this.cleaningTasks.createForFinishedOrder(connection, {
          tenantId: actor.tenantId,
          orderId,
          actorId: actor.userId,
          traceId: actor.traceId
        });
      }
      const [result] = await connection.execute<ResultSetHeader>(
        `INSERT INTO qipai_order_status_history
          (tenant_id, order_id, from_status, to_status, action, actor_type,
           actor_id, source, reason, trace_id, metadata)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, JSON_OBJECT('statusVersion', ?))`,
        [actor.tenantId, orderId, order.status, targetStatus, action,
          actor.actorType, actor.userId, actor.source, reason.slice(0, 512),
          actor.traceId, nextVersion]
      );
      await connection.execute(
        `INSERT INTO qipai_audit_logs
          (tenant_id, actor_type, actor_id, action, resource_type, resource_id,
           trace_id, ip, user_agent, metadata)
         VALUES (?, ?, ?, 'ORDER_STATUS_CHANGED', 'ORDER', ?, ?, ?, ?,
           JSON_OBJECT('fromStatus', ?, 'toStatus', ?, 'orderAction', ?))`,
        [actor.tenantId, actor.actorType, actor.userId, orderId, actor.traceId,
          actor.ip, actor.userAgent.slice(0, 255), order.status, targetStatus, action]
      );
      return {
        orderId,
        status: targetStatus,
        statusVersion: nextVersion,
        historyId: String(result.insertId),
        idempotent: false
      };
    });
  }

  async history(tenantId: string, userId: string, orderId: string, access: AccessProfile) {
    const order = await this.loadOrder(this.pool, tenantId, orderId, false);
    const manager = canManageStore(access, order.storeId);
    if (!manager) {
      const [rows] = await this.pool.execute<RowDataPacket[]>(
        `SELECT 1 FROM qipai_order_user_access
         WHERE tenant_id = ? AND order_id = ? AND user_id = ?`,
        [tenantId, orderId, userId]
      );
      if (!rows[0]) throw new OrderStateError('ORDER_ACCESS_FORBIDDEN');
    }
    const [rows] = await this.pool.execute<HistoryRow[]>(
      `SELECT id, from_status AS fromStatus, to_status AS toStatus, action,
              actor_type AS actorType, actor_id AS actorId, source, reason,
              trace_id AS traceId, created_at AS createdAt
       FROM qipai_order_status_history
       WHERE tenant_id = ? AND order_id = ? ORDER BY id`,
      [tenantId, orderId]
    );
    return rows.map((row) => ({
      ...row,
      id: String(row.id),
      actorId: row.actorId === null ? null : String(row.actorId)
    }));
  }

  private async assertAuthorized(
    connection: PoolConnection, actor: OrderActor, order: OrderRow, action: OrderAction
  ) {
    if (actor.source !== 'APP') {
      if (!actor.access || !canManageStore(actor.access, order.storeId)) {
        throw new OrderStateError('ORDER_MANAGEMENT_FORBIDDEN');
      }
      return;
    }
    if (action !== 'CANCEL') throw new OrderStateError('ORDER_ACTION_FORBIDDEN');
    const [rows] = await connection.execute<RowDataPacket[]>(
      `SELECT 1 FROM qipai_order_user_access
       WHERE tenant_id = ? AND order_id = ? AND user_id = ? AND revoked_at IS NULL`,
      [actor.tenantId, order.id, actor.userId]
    );
    if (!rows[0]) throw new OrderStateError('ORDER_ACCESS_FORBIDDEN');
  }

  private async loadOrder(
    connection: Pick<MySqlPool, 'execute'> | PoolConnection,
    tenantId: string,
    orderId: string,
    lock: boolean
  ) {
    const [rows] = await connection.execute<OrderRow[]>(
      `SELECT id, store_id AS storeId, status, status_version AS statusVersion
       FROM qipai_orders
       WHERE tenant_id = ? AND id = ? AND deleted_at IS NULL
       ${lock ? 'FOR UPDATE' : ''}`,
      [tenantId, orderId]
    );
    if (!rows[0]) throw new OrderStateError('ORDER_NOT_FOUND');
    return rows[0];
  }

  private async findByTrace(
    connection: PoolConnection, tenantId: string, orderId: string, traceId: string
  ) {
    const [rows] = await connection.execute<HistoryRow[]>(
      `SELECT id, to_status AS toStatus
       FROM qipai_order_status_history
       WHERE tenant_id = ? AND order_id = ? AND trace_id = ? LIMIT 1`,
      [tenantId, orderId, traceId]
    );
    return rows[0] ?? null;
  }

  private async applyReservationState(
    connection: PoolConnection, tenantId: string, orderId: string, status: OrderStatus
  ) {
    if (['PAID', 'RESERVED', 'IN_PROGRESS', 'FINISHED'].includes(status)) {
      await connection.execute(
        `UPDATE qipai_room_reservations
         SET status = 'CONSUMED', expires_at = GREATEST(expires_at, ends_at)
         WHERE tenant_id = ? AND order_id = ? AND status = 'HELD'`,
        [tenantId, orderId]
      );
    } else if (['CANCELLED', 'REFUNDED', 'CLOSED'].includes(status)) {
      await connection.execute(
        `UPDATE qipai_room_reservations
         SET status = 'RELEASED', released_at = COALESCE(released_at, UTC_TIMESTAMP(3))
         WHERE tenant_id = ? AND order_id = ? AND status IN ('HELD', 'CONSUMED')`,
        [tenantId, orderId]
      );
      await connection.execute(
        `UPDATE qipai_order_user_access
         SET revoked_at = COALESCE(revoked_at, UTC_TIMESTAMP(3))
         WHERE tenant_id = ? AND order_id = ?`,
        [tenantId, orderId]
      );
      if (this.benefits) {
        const [users] = await connection.execute<RowDataPacket[]>(
          `SELECT user_id AS userId FROM qipai_order_user_access
           WHERE tenant_id = ? AND order_id = ? ORDER BY id LIMIT 1`,
          [tenantId, orderId]
        );
        if (users[0]?.userId) {
          await this.benefits.releaseReservedInTransaction(connection, {
            tenantId,
            userId: String(users[0].userId),
            orderId,
            traceId: `order-benefit-release-${orderId}`
          });
        }
      }
    }
  }

  private async transaction<T>(work: (connection: PoolConnection) => Promise<T>) {
    const connection = await this.pool.getConnection();
    try {
      await connection.beginTransaction();
      const result = await work(connection);
      await connection.commit();
      return result;
    } catch (error) {
      await connection.rollback();
      throw error;
    } finally {
      connection.release();
    }
  }
}

function canManageStore(access: AccessProfile, storeId: string) {
  return access.capabilities.includes('tenant.manage')
    || access.roles.includes('PLATFORM_ADMIN')
    || (access.capabilities.includes('store.operation.write') && access.storeIds.includes(storeId));
}