package cn.iocoder.yudao.module.system.service.storage;

import cn.iocoder.yudao.framework.security.core.util.SecurityFrameworkUtils;
import cn.iocoder.yudao.module.system.controller.admin.storage.vo.SystemStorageAttachmentSaveReqVO;
import cn.iocoder.yudao.module.system.dal.dataobject.storage.SystemAgentImportSessionDO;
import cn.iocoder.yudao.module.system.dal.dataobject.storage.SystemStorageAttachmentDO;
import cn.iocoder.yudao.module.system.dal.dataobject.storage.SystemStorageBlobDO;
import cn.iocoder.yudao.module.system.dal.mysql.storage.SystemAgentImportSessionMapper;
import cn.iocoder.yudao.module.system.dal.mysql.storage.SystemStorageAttachmentMapper;
import cn.iocoder.yudao.module.system.framework.agent.AgentBridgeException;
import cn.iocoder.yudao.module.system.framework.storage.config.StorageProperties;
import jakarta.annotation.Resource;
import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

import java.io.IOException;
import java.io.InputStream;
import java.nio.file.Files;
import java.nio.file.Path;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.HexFormat;
import java.util.List;
import java.util.Objects;

@Service
public class SystemAgentImportBridgeService {

    public static final long MAX_FILE_BYTES = 8L * 1024 * 1024;
    public static final String RECORD_TYPE = "agent_import_session";

    @Resource
    private SystemAgentImportSessionMapper sessionMapper;
    @Resource
    private SystemStorageAttachmentMapper attachmentMapper;
    @Resource
    private SystemStorageBlobService blobService;
    @Resource
    private SystemStorageAttachmentService attachmentService;
    @Resource
    private StorageProperties storageProperties;

    @Transactional(rollbackFor = Exception.class)
    public Long createSession() {
        Long userId = SecurityFrameworkUtils.getLoginUserId();
        if (userId == null) {
            throw new AgentBridgeException(HttpStatus.UNAUTHORIZED, "UNAUTHORIZED", "未登录或登录已过期");
        }
        SystemAgentImportSessionDO session = new SystemAgentImportSessionDO();
        session.setOwnerUserId(userId);
        session.setStatus("active");
        sessionMapper.insert(session);
        return session.getId();
    }

    @Transactional(rollbackFor = Exception.class)
    public Long bindAttachment(Long sessionId, Long blobId) {
        requireOwnedSession(sessionId);
        SystemStorageBlobDO blob = blobService.getStorageBlob(blobId);
        requireOwnedBlob(blob);
        SystemStorageAttachmentSaveReqVO req = new SystemStorageAttachmentSaveReqVO();
        req.setApplication("file");
        req.setRecordType(RECORD_TYPE);
        req.setRecordId(sessionId);
        SystemStorageAttachmentSaveReqVO.BlobItem item = new SystemStorageAttachmentSaveReqVO.BlobItem();
        item.setBlobId(blobId);
        req.setBlobItems(List.of(item));
        attachmentService.bindAttachments(req);
        // 通用 bind 对同一会话是替换语义：重复绑定时旧附件行会被删除。
        return attachmentMapper.selectListByApplicationAndRecordTypeAndRecordId("file", RECORD_TYPE, sessionId)
                .stream().filter(row -> blobId.equals(row.getStorageBlobId()))
                .map(SystemStorageAttachmentDO::getId).findFirst()
                .orElseThrow(() -> new AgentBridgeException(HttpStatus.CONFLICT, "ATTACHMENT_BIND_FAILED",
                        "附件绑定失败，请重新上传后再试", true, null));
    }

    public SystemAgentAttachmentRef requireOwnedAttachmentRef(Long attachmentId) {
        SystemStorageAttachmentDO attachment = attachmentMapper.selectById(attachmentId);
        if (attachment == null) {
            throw new AgentBridgeException(HttpStatus.CONFLICT, "ATTACHMENT_REPLACED",
                    "附件已失效（可能被重新上传替换），请重新上传后再试", true, null);
        }
        if (!RECORD_TYPE.equals(attachment.getRecordType())) {
            throw new AgentBridgeException(HttpStatus.FORBIDDEN, "ATTACHMENT_FORBIDDEN", "附件不可访问");
        }
        requireOwnedSession(attachment.getRecordId());
        SystemStorageBlobDO blob = blobService.getStorageBlob(attachment.getStorageBlobId());
        requireOwnedBlob(blob);
        Path file = resolveBlobFile(blob);
        String filename = blob.getOriginalFilename();
        if (filename == null || filename.isBlank()) {
            filename = "attachment";
        }
        return new SystemAgentAttachmentRef(attachmentId, attachment.getRecordId(), filename,
                blob.getByteSize(), file);
    }

    public String sha256OfAttachment(Long attachmentId) {
        SystemAgentAttachmentRef ref = requireOwnedAttachmentRef(attachmentId);
        try (InputStream in = Files.newInputStream(ref.path())) {
            MessageDigest digest = MessageDigest.getInstance("SHA-256");
            byte[] buffer = new byte[8192];
            long total = 0;
            int read;
            while ((read = in.read(buffer)) != -1) {
                total += read;
                if (total > MAX_FILE_BYTES) {
                    throw new AgentBridgeException(HttpStatus.FORBIDDEN, "FILE_TOO_LARGE", "附件超过 8 MiB");
                }
                digest.update(buffer, 0, read);
            }
            return HexFormat.of().formatHex(digest.digest());
        } catch (IOException ex) {
            throw new AgentBridgeException(HttpStatus.FORBIDDEN, "ATTACHMENT_UNREADABLE", "附件不可访问");
        } catch (NoSuchAlgorithmException ex) {
            throw new IllegalStateException("SHA-256 不可用", ex);
        }
    }

    private Path resolveBlobFile(SystemStorageBlobDO blob) {
        try {
            Path root = Path.of(storageProperties.getPath()).toRealPath();
            Path file = root.resolve(blob.getPath() == null ? "" : blob.getPath())
                    .resolve(blob.getUidFilename()).toRealPath();
            if (!file.startsWith(root) || !Files.isRegularFile(file)
                    || Files.size(file) > MAX_FILE_BYTES) {
                throw new AgentBridgeException(HttpStatus.FORBIDDEN, "ATTACHMENT_UNREADABLE", "附件不可访问");
            }
            return file;
        } catch (IOException ex) {
            throw new AgentBridgeException(HttpStatus.FORBIDDEN, "ATTACHMENT_UNREADABLE", "附件不可访问");
        }
    }

    private void requireOwnedSession(Long sessionId) {
        SystemAgentImportSessionDO session = sessionMapper.selectById(sessionId);
        Long userId = SecurityFrameworkUtils.getLoginUserId();
        if (session == null || userId == null || !Objects.equals(session.getOwnerUserId(), userId)
                || !"active".equals(session.getStatus())) {
            throw new AgentBridgeException(HttpStatus.FORBIDDEN, "SESSION_FORBIDDEN", "补录会话不可访问");
        }
    }

    private void requireOwnedBlob(SystemStorageBlobDO blob) {
        Long userId = SecurityFrameworkUtils.getLoginUserId();
        if (blob == null || userId == null || !String.valueOf(userId).equals(blob.getCreator())
                || blob.getByteSize() == null || blob.getByteSize() > MAX_FILE_BYTES) {
            throw new AgentBridgeException(HttpStatus.FORBIDDEN, "BLOB_FORBIDDEN", "文件不可访问或超过 8 MiB");
        }
    }
}