# -*- coding: utf-8 -*-
"""
小程序认证路由 —— 微信登录、申请提交、状态查询、店铺切换、令牌刷新。

端点清单：
- POST /api/xcx/login      — 微信登录（查找/创建用户 + 签发 JWT）
- POST /api/xcx/apply       — 提交入驻申请
- GET  /api/xcx/me          — 查询自身状态 + 申请列表
- GET  /api/xcx/me/sites    — 查询关联店铺
- POST /api/xcx/switch-site — 切换当前店铺
- POST /api/xcx/refresh     — 刷新令牌
- POST /api/xcx/dev-login   — 开发模式 mock 登录（仅 WX_DEV_MODE=true）
- POST /api/xcx/dev-switch-role    — 切换角色（仅 WX_DEV_MODE=true）
- POST /api/xcx/dev-switch-status  — 切换用户状态（仅 WX_DEV_MODE=true）
- POST /api/xcx/dev-switch-binding — 切换人员绑定（仅 WX_DEV_MODE=true）
- GET  /api/xcx/dev-context        — 查询调试上下文（仅 WX_DEV_MODE=true）
"""

from __future__ import annotations

import logging

from fastapi import APIRouter, Depends, HTTPException, status
from jose import JWTError
from psycopg2 import errors as pg_errors

from app.auth.dependencies import (
    CurrentUser,
    get_current_user,
    get_current_user_or_limited,
)
from app.auth.jwt import (
    create_limited_token_pair,
    create_token_pair,
    decode_refresh_token,
)
from app import config
from app.database import get_connection
from app.services.application import (
    create_application,
    get_user_applications,
)
from app.schemas.xcx_auth import (
    ApplicationRequest,
    ApplicationResponse,
    DevLoginRequest,
    DevSwitchBindingRequest,
    DevSwitchRoleRequest,
    DevSwitchStatusRequest,
    DevContextResponse,
    RefreshTokenRequest,
    SiteInfo,
    SwitchSiteRequest,
    UserStatusResponse,
    WxLoginRequest,
    WxLoginResponse,
)
from app.services.wechat import WeChatAuthError, code2session
from app.services.role import get_user_permissions

logger = logging.getLogger(__name__)

router = APIRouter(prefix="/api/xcx", tags=["小程序认证"])


# ── 辅助：查询用户在指定 site_id 下的角色 code 列表 ──────────

def _get_user_roles_at_site(conn, user_id: int, site_id: int) -> list[str]:
    """查询用户在指定 site_id 下的角色 code 列表。"""
    with conn.cursor() as cur:
        cur.execute(
            """
            SELECT r.code
              FROM auth.user_site_roles usr
              JOIN auth.roles r ON usr.role_id = r.id
             WHERE usr.user_id = %s AND usr.site_id = %s
            """,
            (user_id, site_id),
        )
        return [row[0] for row in cur.fetchall()]


def _get_user_default_site(conn, user_id: int) -> int | None:
    """获取用户第一个关联的 site_id（按创建时间排序）。"""
    with conn.cursor() as cur:
        cur.execute(
            """
            SELECT DISTINCT site_id
              FROM auth.user_site_roles
             WHERE user_id = %s
             ORDER BY site_id
             LIMIT 1
            """,
            (user_id,),
        )
        row = cur.fetchone()
        return row[0] if row else None


# ── POST /api/xcx/login ──────────────────────────────────

@router.post("/login", response_model=WxLoginResponse)
async def wx_login(body: WxLoginRequest):
    """
    微信登录。

    流程：code → code2session(openid) → 查找/创建 auth.users → 签发 JWT。
    - disabled 用户返回 403
    - 新用户自动创建（status=new），前端引导至申请页
    - approved 用户签发包含 site_id + roles 的完整令牌
    - new/pending/rejected 用户签发受限令牌
    """
    # 1. 调用微信 code2Session
    try:
        wx_result = await code2session(body.code)
    except WeChatAuthError as exc:
        raise HTTPException(status_code=exc.http_status, detail=exc.detail)
    except RuntimeError as exc:
        # 微信配置缺失
        logger.error("微信配置错误: %s", exc)
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail="服务器配置错误",
        )

    openid = wx_result["openid"]
    unionid = wx_result.get("unionid")

    # 2. 查找/创建用户
    conn = get_connection()
    try:
        with conn.cursor() as cur:
            cur.execute(
                "SELECT id, status FROM auth.users WHERE wx_openid = %s",
                (openid,),
            )
            row = cur.fetchone()

            if row is None:
                # 新用户：创建 new 记录（尚未提交申请）
                try:
                    cur.execute(
                        """
                        INSERT INTO auth.users (wx_openid, wx_union_id, status)
                        VALUES (%s, %s, 'new')
                        RETURNING id, status
                        """,
                        (openid, unionid),
                    )
                    row = cur.fetchone()
                    conn.commit()
                except pg_errors.UniqueViolation:
                    # 并发创建：回滚后查询已有记录
                    conn.rollback()
                    cur.execute(
                        "SELECT id, status FROM auth.users WHERE wx_openid = %s",
                        (openid,),
                    )
                    row = cur.fetchone()

            user_id, user_status = row

            # 3. disabled 用户拒绝登录
            if user_status == "disabled":
                raise HTTPException(
                    status_code=status.HTTP_403_FORBIDDEN,
                    detail="账号已被禁用",
                )

            # 4. 签发令牌
            if user_status == "approved":
                # 查找默认 site_id 和角色
                default_site_id = _get_user_default_site(conn, user_id)
                if default_site_id is not None:
                    roles = _get_user_roles_at_site(conn, user_id, default_site_id)
                    tokens = create_token_pair(user_id, default_site_id, roles=roles)
                else:
                    # approved 但无 site 绑定（异常边界），签发受限令牌
                    tokens = create_limited_token_pair(user_id)
            else:
                # new / pending / rejected → 受限令牌
                tokens = create_limited_token_pair(user_id)

    finally:
        conn.close()

    return WxLoginResponse(
        access_token=tokens["access_token"],
        refresh_token=tokens["refresh_token"],
        token_type=tokens["token_type"],
        user_status=user_status,
        user_id=user_id,
    )


# ── POST /api/xcx/apply ──────────────────────────────────

@router.post("/apply", response_model=ApplicationResponse)
async def submit_application(
    body: ApplicationRequest,
    user: CurrentUser = Depends(get_current_user_or_limited),
):
    """
    提交入驻申请。

    委托 application service 处理：
    检查重复 pending → site_code 映射 → 创建记录 → 更新 nickname。
    """
    result = await create_application(
        user_id=user.user_id,
        site_code=body.site_code,
        applied_role_text=body.applied_role_text,
        phone=body.phone,
        employee_number=body.employee_number,
        nickname=body.nickname,
    )
    return ApplicationResponse(**result)


# ── GET /api/xcx/me ───────────────────────────────────────

@router.get("/me", response_model=UserStatusResponse)
async def get_my_status(
    user: CurrentUser = Depends(get_current_user_or_limited),
):
    """
    查询自身状态 + 所有申请记录。

    pending / approved / rejected 用户均可访问。
    """
    conn = get_connection()
    try:
        with conn.cursor() as cur:
            # 查询用户基本信息
            cur.execute(
                "SELECT id, status, nickname FROM auth.users WHERE id = %s",
                (user.user_id,),
            )
            user_row = cur.fetchone()
            if user_row is None:
                raise HTTPException(
                    status_code=status.HTTP_401_UNAUTHORIZED,
                    detail="用户不存在",
                )

            user_id, user_status, nickname = user_row
    finally:
        conn.close()

    # 委托 service 查询申请列表
    app_list = await get_user_applications(user_id)
    applications = [ApplicationResponse(**a) for a in app_list]

    return UserStatusResponse(
        user_id=user_id,
        status=user_status,
        nickname=nickname,
        applications=applications,
    )


# ── GET /api/xcx/me/sites ────────────────────────────────

@router.get("/me/sites", response_model=list[SiteInfo])
async def get_my_sites(
    user: CurrentUser = Depends(get_current_user),
):
    """
    查询当前用户关联的所有店铺及对应角色。

    仅 approved 用户可访问（通过 get_current_user 依赖保证）。
    """
    conn = get_connection()
    try:
        with conn.cursor() as cur:
            cur.execute(
                """
                SELECT usr.site_id,
                       COALESCE(scm.site_name, '未知店铺') AS site_name,
                       r.code  AS role_code,
                       r.name  AS role_name
                  FROM auth.user_site_roles usr
                  JOIN auth.roles r ON usr.role_id = r.id
                  LEFT JOIN auth.site_code_mapping scm ON usr.site_id = scm.site_id
                 WHERE usr.user_id = %s
                 ORDER BY usr.site_id, r.code
                """,
                (user.user_id,),
            )
            rows = cur.fetchall()
    finally:
        conn.close()

    # 按 site_id 分组
    sites_map: dict[int, SiteInfo] = {}
    for site_id, site_name, role_code, role_name in rows:
        if site_id not in sites_map:
            sites_map[site_id] = SiteInfo(
                site_id=site_id, site_name=site_name, roles=[]
            )
        sites_map[site_id].roles.append({"code": role_code, "name": role_name})

    return list(sites_map.values())


# ── POST /api/xcx/switch-site ────────────────────────────

@router.post("/switch-site", response_model=WxLoginResponse)
async def switch_site(
    body: SwitchSiteRequest,
    user: CurrentUser = Depends(get_current_user),
):
    """
    切换当前店铺。

    验证用户在目标 site_id 下有角色绑定，然后签发包含新 site_id 的 JWT。
    """
    conn = get_connection()
    try:
        with conn.cursor() as cur:
            # 验证用户在目标 site_id 下有角色
            cur.execute(
                """
                SELECT 1 FROM auth.user_site_roles
                 WHERE user_id = %s AND site_id = %s
                 LIMIT 1
                """,
                (user.user_id, body.site_id),
            )
            if cur.fetchone() is None:
                raise HTTPException(
                    status_code=status.HTTP_403_FORBIDDEN,
                    detail="您在该店铺下没有角色绑定",
                )

            roles = _get_user_roles_at_site(conn, user.user_id, body.site_id)

            # 查询用户状态
            cur.execute(
                "SELECT status FROM auth.users WHERE id = %s",
                (user.user_id,),
            )
            user_row = cur.fetchone()
            user_status = user_row[0] if user_row else "pending"

    finally:
        conn.close()

    tokens = create_token_pair(user.user_id, body.site_id, roles=roles)

    return WxLoginResponse(
        access_token=tokens["access_token"],
        refresh_token=tokens["refresh_token"],
        token_type=tokens["token_type"],
        user_status=user_status,
        user_id=user.user_id,
    )


# ── POST /api/xcx/refresh ────────────────────────────────

@router.post("/refresh", response_model=WxLoginResponse)
async def refresh_token(body: RefreshTokenRequest):
    """
    刷新令牌。

    解码 refresh_token → 根据用户当前状态签发新的令牌对。
    - 受限 refresh_token（limited=True）→ 签发新的受限令牌对
    - 完整 refresh_token → 签发新的完整令牌对（保持原 site_id）
    """
    try:
        payload = decode_refresh_token(body.refresh_token)
    except JWTError:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="无效的刷新令牌",
        )

    user_id = int(payload["sub"])
    is_limited = payload.get("limited", False)

    conn = get_connection()
    try:
        with conn.cursor() as cur:
            # 查询用户当前状态
            cur.execute(
                "SELECT id, status FROM auth.users WHERE id = %s",
                (user_id,),
            )
            user_row = cur.fetchone()
            if user_row is None:
                raise HTTPException(
                    status_code=status.HTTP_401_UNAUTHORIZED,
                    detail="用户不存在",
                )

            _, user_status = user_row

            if user_status == "disabled":
                raise HTTPException(
                    status_code=status.HTTP_403_FORBIDDEN,
                    detail="账号已被禁用",
                )

            if is_limited or user_status != "approved":
                # 受限令牌刷新 → 仍签发受限令牌
                tokens = create_limited_token_pair(user_id)
            else:
                # 完整令牌刷新 → 使用原 site_id 签发
                site_id = payload.get("site_id")
                if site_id is None:
                    # 回退到默认 site
                    site_id = _get_user_default_site(conn, user_id)
                if site_id is not None:
                    roles = _get_user_roles_at_site(conn, user_id, site_id)
                    tokens = create_token_pair(user_id, site_id, roles=roles)
                else:
                    tokens = create_limited_token_pair(user_id)

    finally:
        conn.close()

    return WxLoginResponse(
        access_token=tokens["access_token"],
        refresh_token=tokens["refresh_token"],
        token_type=tokens["token_type"],
        user_status=user_status,
        user_id=user_id,
    )

# ── POST /api/xcx/dev-login（仅开发模式） ─────────────────

if config.WX_DEV_MODE:

    @router.post("/dev-login", response_model=WxLoginResponse)
    async def dev_login(body: DevLoginRequest):
        """
        开发模式 mock 登录。

        直接根据 openid 查找/创建用户，跳过微信 code2Session。
        - 已有用户：status 参数为空时保留当前状态，非空时覆盖
        - 新用户：status 参数为空时默认 new，非空时使用指定值
        仅在 WX_DEV_MODE=true 时注册。
        """
        openid = body.openid
        target_status = body.status  # 可能为 None

        conn = get_connection()
        try:
            with conn.cursor() as cur:
                # 查找已有用户
                cur.execute(
                    "SELECT id, status FROM auth.users WHERE wx_openid = %s",
                    (openid,),
                )
                row = cur.fetchone()

                if row is None:
                    # 新用户：使用指定状态或默认 new
                    init_status = target_status or "new"
                    cur.execute(
                        """
                        INSERT INTO auth.users (wx_openid, status)
                        VALUES (%s, %s)
                        RETURNING id, status
                        """,
                        (openid, init_status),
                    )
                    row = cur.fetchone()
                    conn.commit()
                else:
                    # 已有用户：仅在显式传入 status 时覆盖
                    if target_status is not None:
                        user_id_existing = row[0]
                        cur.execute(
                            "UPDATE auth.users SET status = %s, updated_at = NOW() WHERE id = %s",
                            (target_status, user_id_existing),
                        )
                        conn.commit()
                        row = (user_id_existing, target_status)

                user_id, user_status = row

                # 签发令牌（逻辑与正常登录一致）
                if user_status == "approved":
                    default_site_id = _get_user_default_site(conn, user_id)
                    if default_site_id is not None:
                        roles = _get_user_roles_at_site(conn, user_id, default_site_id)
                        tokens = create_token_pair(user_id, default_site_id, roles=roles)
                    else:
                        tokens = create_limited_token_pair(user_id)
                else:
                    tokens = create_limited_token_pair(user_id)

        finally:
            conn.close()

        return WxLoginResponse(
            access_token=tokens["access_token"],
            refresh_token=tokens["refresh_token"],
            token_type=tokens["token_type"],
            user_status=user_status,
            user_id=user_id,
        )

    # ── GET /api/xcx/dev-context（仅开发模式） ────────────────

    @router.get("/dev-context", response_model=DevContextResponse)
    async def dev_context(
        user: CurrentUser = Depends(get_current_user_or_limited),
    ):
        """
        返回当前用户的完整调试上下文。

        包含：用户信息、当前门店、角色、权限、人员绑定、所有关联门店。
        允许受限令牌访问（返回基础信息，门店/角色/权限为空）。
        """
        conn = get_connection()
        try:
            with conn.cursor() as cur:
                # 用户基本信息
                cur.execute(
                    "SELECT wx_openid, status, nickname FROM auth.users WHERE id = %s",
                    (user.user_id,),
                )
                u_row = cur.fetchone()
                if u_row is None:
                    raise HTTPException(status_code=404, detail="用户不存在")
                openid, u_status, nickname = u_row

                # 当前门店名称
                site_name = None
                if user.site_id:
                    cur.execute(
                        "SELECT site_name FROM auth.site_code_mapping WHERE site_id = %s",
                        (user.site_id,),
                    )
                    sn_row = cur.fetchone()
                    site_name = sn_row[0] if sn_row else None

                # 当前门店下的角色
                roles = _get_user_roles_at_site(conn, user.user_id, user.site_id) if user.site_id else []

                # 当前门店下的权限
                permissions = await get_user_permissions(user.user_id, user.site_id) if user.site_id else []

                # 人员绑定
                binding = None
                if user.site_id:
                    cur.execute(
                        """
                        SELECT assistant_id, staff_id, binding_type
                          FROM auth.user_assistant_binding
                         WHERE user_id = %s AND site_id = %s
                         LIMIT 1
                        """,
                        (user.user_id, user.site_id),
                    )
                    b_row = cur.fetchone()
                    if b_row:
                        binding = {
                            "assistant_id": b_row[0],
                            "staff_id": b_row[1],
                            "binding_type": b_row[2],
                        }

                # 所有关联门店
                cur.execute(
                    """
                    SELECT usr.site_id,
                           COALESCE(scm.site_name, '') AS site_name,
                           r.code, r.name
                      FROM auth.user_site_roles usr
                      JOIN auth.roles r ON usr.role_id = r.id
                      LEFT JOIN auth.site_code_mapping scm ON usr.site_id = scm.site_id
                     WHERE usr.user_id = %s
                     ORDER BY usr.site_id, r.code
                    """,
                    (user.user_id,),
                )
                site_rows = cur.fetchall()
        finally:
            conn.close()

        sites_map: dict[int, dict] = {}
        for sid, sname, rcode, rname in site_rows:
            if sid not in sites_map:
                sites_map[sid] = {"site_id": sid, "site_name": sname, "roles": []}
            sites_map[sid]["roles"].append({"code": rcode, "name": rname})

        return DevContextResponse(
            user_id=user.user_id,
            openid=openid,
            status=u_status,
            nickname=nickname,
            site_id=user.site_id,
            site_name=site_name,
            roles=roles,
            permissions=permissions,
            binding=binding,
            all_sites=list(sites_map.values()),
        )

    # ── POST /api/xcx/dev-switch-role（仅开发模式） ───────────

    @router.post("/dev-switch-role", response_model=WxLoginResponse)
    async def dev_switch_role(
        body: DevSwitchRoleRequest,
        user: CurrentUser = Depends(get_current_user),
    ):
        """
        切换当前用户在当前门店下的角色。

        删除旧角色绑定，插入新角色绑定，重签 token。
        """
        valid_roles = ("coach", "staff", "site_admin", "tenant_admin")
        if body.role_code not in valid_roles:
            raise HTTPException(
                status_code=400,
                detail=f"无效角色，可选: {', '.join(valid_roles)}",
            )

        conn = get_connection()
        try:
            with conn.cursor() as cur:
                # 查询目标角色 ID
                cur.execute(
                    "SELECT id FROM auth.roles WHERE code = %s",
                    (body.role_code,),
                )
                role_row = cur.fetchone()
                if role_row is None:
                    raise HTTPException(status_code=400, detail=f"角色 {body.role_code} 不存在")
                role_id = role_row[0]

                # 删除当前门店下的所有角色
                cur.execute(
                    "DELETE FROM auth.user_site_roles WHERE user_id = %s AND site_id = %s",
                    (user.user_id, user.site_id),
                )

                # 插入新角色
                cur.execute(
                    """
                    INSERT INTO auth.user_site_roles (user_id, site_id, role_id)
                    VALUES (%s, %s, %s)
                    ON CONFLICT (user_id, site_id, role_id) DO NOTHING
                    """,
                    (user.user_id, user.site_id, role_id),
                )
                conn.commit()

                # 重签 token
                roles = _get_user_roles_at_site(conn, user.user_id, user.site_id)
                cur.execute("SELECT status FROM auth.users WHERE id = %s", (user.user_id,))
                u_status = cur.fetchone()[0]
        finally:
            conn.close()

        tokens = create_token_pair(user.user_id, user.site_id, roles=roles)
        return WxLoginResponse(
            access_token=tokens["access_token"],
            refresh_token=tokens["refresh_token"],
            token_type=tokens["token_type"],
            user_status=u_status,
            user_id=user.user_id,
        )

    # ── POST /api/xcx/dev-switch-status（仅开发模式） ─────────

    @router.post("/dev-switch-status", response_model=WxLoginResponse)
    async def dev_switch_status(
        body: DevSwitchStatusRequest,
        user: CurrentUser = Depends(get_current_user_or_limited),
    ):
        """
        切换当前用户状态，重签 token。

        允许受限令牌访问（pending 用户也需要能切换状态）。
        """
        valid_statuses = ("new", "pending", "approved", "rejected", "disabled")
        if body.status not in valid_statuses:
            raise HTTPException(
                status_code=400,
                detail=f"无效状态，可选: {', '.join(valid_statuses)}",
            )

        conn = get_connection()
        try:
            with conn.cursor() as cur:
                cur.execute(
                    "UPDATE auth.users SET status = %s, updated_at = NOW() WHERE id = %s",
                    (body.status, user.user_id),
                )
                conn.commit()

                # 根据新状态签发对应令牌
                if body.status == "approved":
                    default_site_id = _get_user_default_site(conn, user.user_id)
                    if default_site_id is not None:
                        roles = _get_user_roles_at_site(conn, user.user_id, default_site_id)
                        tokens = create_token_pair(user.user_id, default_site_id, roles=roles)
                    else:
                        tokens = create_limited_token_pair(user.user_id)
                else:
                    tokens = create_limited_token_pair(user.user_id)
        finally:
            conn.close()

        return WxLoginResponse(
            access_token=tokens["access_token"],
            refresh_token=tokens["refresh_token"],
            token_type=tokens["token_type"],
            user_status=body.status,
            user_id=user.user_id,
        )

    # ── POST /api/xcx/dev-switch-binding（仅开发模式） ────────

    @router.post("/dev-switch-binding")
    async def dev_switch_binding(
        body: DevSwitchBindingRequest,
        user: CurrentUser = Depends(get_current_user),
    ):
        """
        切换当前用户在当前门店下的人员绑定。

        删除旧绑定，插入新绑定。
        """
        valid_types = ("assistant", "staff", "manager")
        if body.binding_type not in valid_types:
            raise HTTPException(
                status_code=400,
                detail=f"无效绑定类型，可选: {', '.join(valid_types)}",
            )

        conn = get_connection()
        try:
            with conn.cursor() as cur:
                # 删除当前门店下的旧绑定
                cur.execute(
                    "DELETE FROM auth.user_assistant_binding WHERE user_id = %s AND site_id = %s",
                    (user.user_id, user.site_id),
                )

                # 插入新绑定
                cur.execute(
                    """
                    INSERT INTO auth.user_assistant_binding
                        (user_id, site_id, assistant_id, staff_id, binding_type)
                    VALUES (%s, %s, %s, %s, %s)
                    """,
                    (user.user_id, user.site_id, body.assistant_id, body.staff_id, body.binding_type),
                )
                conn.commit()
        finally:
            conn.close()

        return {"ok": True, "binding_type": body.binding_type}
