package tech.powerjob.server.auth.service.permission;

import com.google.common.collect.*;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Service;
import tech.powerjob.server.auth.Permission;
import tech.powerjob.server.auth.Role;
import tech.powerjob.server.auth.RoleScope;
import tech.powerjob.server.persistence.remote.model.AppInfoDO;
import tech.powerjob.server.persistence.remote.model.UserRoleDO;
import tech.powerjob.server.persistence.remote.repository.AppInfoRepository;
import tech.powerjob.server.persistence.remote.repository.UserRoleRepository;

import javax.annotation.Resource;
import java.util.*;

/**
 * PowerJobPermissionService
 *
 * @author tjq
 * @since 2024/2/11
 */
@Slf4j
@Service
public class PowerJobPermissionServiceImpl implements PowerJobPermissionService {

    @Resource
    private AppInfoRepository appInfoRepository;
    @Resource
    private UserRoleRepository userRoleRepository;

    @Override
    public boolean hasPermission(Long userId, RoleScope roleScope, Long target, Permission requiredPermission) {
        final List<UserRoleDO> userRoleList = Optional.ofNullable(userRoleRepository.findAllByUserId(userId)).orElse(Collections.emptyList());

        Multimap<Long, Role> appId2Role = ArrayListMultimap.create();
        Multimap<Long, Role> namespaceId2Role = ArrayListMultimap.create();

        List<Role> globalRoles = Lists.newArrayList();

        for (UserRoleDO userRole : userRoleList) {
            final Role role = Role.of(userRole.getRole());

            // 处理全局权限
            if (RoleScope.GLOBAL.getV() == userRole.getScope()) {
                if (Role.ADMIN.equals(role)) {
                    return true;
                }
                globalRoles.add(role);
            }

            if (RoleScope.NAMESPACE.getV() == userRole.getScope()) {
                namespaceId2Role.put(userRole.getTarget(), role);
            }
            if (RoleScope.APP.getV() == userRole.getScope()) {
                appId2Role.put(userRole.getTarget(), role);
            }
        }

        // 前置判断需要的权限（新增场景还没有 appId or namespaceId）
        if (requiredPermission == Permission.NONE) {
            return true;
        }

        // 检验全局穿透权限
        for (Role role : globalRoles) {
            if (role.getPermissions().contains(requiredPermission)) {
                return true;
            }
        }

        // 无超级管理员权限，校验普通权限
        if (RoleScope.APP.equals(roleScope)) {
            return checkAppPermission(target, requiredPermission, appId2Role, namespaceId2Role);
        }

        if (RoleScope.NAMESPACE.equals(roleScope)) {
            return checkNamespacePermission(target, requiredPermission, namespaceId2Role);
        }

        return false;
    }

    @Override
    public void grantRole(RoleScope roleScope, Long target, Long userId, Role role, String extra) {

        UserRoleDO userRoleDO = new UserRoleDO();
        userRoleDO.setGmtCreate(new Date());
        userRoleDO.setGmtModified(new Date());
        userRoleDO.setExtra(extra);

        userRoleDO.setScope(roleScope.getV());
        userRoleDO.setTarget(target);
        userRoleDO.setUserId(userId);
        userRoleDO.setRole(role.getV());

        userRoleRepository.saveAndFlush(userRoleDO);
        log.info("[PowerJobPermissionService] [grantPermission] saveAndFlush userRole successfully: {}", userRoleDO);
    }

    @Override
    public void retrieveRole(RoleScope roleScope, Long target, Long userId, Role role) {
        List<UserRoleDO> originUserRole = userRoleRepository.findAllByScopeAndTargetAndRoleAndUserId(roleScope.getV(), target, role.getV(), userId);
        log.info("[PowerJobPermissionService] [retrievePermission] origin rule: {}", originUserRole);
        Optional.ofNullable(originUserRole).orElse(Collections.emptyList()).forEach(r -> {
            userRoleRepository.deleteById(r.getId());
            log.info("[PowerJobPermissionService] [retrievePermission] delete UserRole: {}", r);
        });
    }

    @Override
    public Map<Role, Set<Long>> fetchUserWithPermissions(RoleScope roleScope, Long target) {
        List<UserRoleDO> permissionUserList = userRoleRepository.findAllByScopeAndTarget(roleScope.getV(), target);
        Map<Role, Set<Long>> ret = Maps.newHashMap();
        Optional.ofNullable(permissionUserList).orElse(Collections.emptyList()).forEach(userRoleDO -> {
            Role role = Role.of(userRoleDO.getRole());
            Set<Long> userIds = ret.computeIfAbsent(role, ignore -> Sets.newHashSet());
            userIds.add(userRoleDO.getUserId());
        });

        return ret;
    }

    @Override
    public Map<Role, List<Long>> fetchUserHadPermissionTargets(RoleScope roleScope, Long userId) {

        Map<Role, List<Long>> ret = Maps.newHashMap();
        List<UserRoleDO> userRoleDOList = userRoleRepository.findAllByUserIdAndScope(userId, roleScope.getV());

        Optional.ofNullable(userRoleDOList).orElse(Collections.emptyList()).forEach(r -> {
            Role role = Role.of(r.getRole());
            List<Long> targetIds = ret.computeIfAbsent(role, ignore -> Lists.newArrayList());
            targetIds.add(r.getTarget());
        });

        return ret;
    }

    private boolean checkAppPermission(Long targetId, Permission requiredPermission, Multimap<Long, Role> appId2Role, Multimap<Long, Role> namespaceId2Role) {

        final Collection<Role> appRoles = appId2Role.get(targetId);
        for (Role role : appRoles) {
            if (role.getPermissions().contains(requiredPermission)) {
                return true;
            }
        }

        // 校验 namespace 穿透权限
        Optional<AppInfoDO> appInfoOpt = appInfoRepository.findById(targetId);
        if (!appInfoOpt.isPresent()) {
            throw new IllegalArgumentException("can't find appInfo by appId in permission check: " + targetId);
        }
        Long namespaceId = Optional.ofNullable(appInfoOpt.get().getNamespaceId()).orElse(-1L);
        Collection<Role> namespaceRoles = namespaceId2Role.get(namespaceId);
        for (Role role : namespaceRoles) {
            if (role.getPermissions().contains(requiredPermission)) {
                return true;
            }
        }

        return false;
    }

    private boolean checkNamespacePermission(Long targetId, Permission requiredPermission, Multimap<Long, Role> namespaceId2Role) {
        Collection<Role> namespaceRoles = namespaceId2Role.get(targetId);
        for (Role role : namespaceRoles) {
            if (role.getPermissions().contains(requiredPermission)) {
                return true;
            }
        }

        return false;
    }

}