package cn.iocoder.yudao.module.system.controller.admin.agent;

import cn.iocoder.yudao.framework.common.biz.system.permission.dto.DeptDataPermissionRespDTO;
import cn.iocoder.yudao.framework.common.pojo.CommonResult;
import cn.iocoder.yudao.framework.security.core.service.SecurityFrameworkService;
import cn.iocoder.yudao.module.system.framework.agent.AgentPrincipal;
import cn.iocoder.yudao.module.system.framework.agent.SystemAgentBridgeGuard;
import cn.iocoder.yudao.module.system.service.permission.PermissionService;
import jakarta.annotation.Resource;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestHeader;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.ArrayList;
import java.util.Comparator;
import java.util.HexFormat;
import java.util.List;
import java.util.Set;

import static cn.iocoder.yudao.framework.common.pojo.CommonResult.success;

/** 为智能体规划返回经过服务端裁剪的菜单、按钮、字段和数据范围能力。 */
@RestController
@RequestMapping("/agent/bridge")
public class SystemAgentCapabilityController {

    private static final List<CapabilityDefinition> CATALOG = List.of(
            new CapabilityDefinition("mdm.item.import", "mdm.item", "import", "mdm:item:import",
                    Set.of("code", "name", "specification", "categoryCode", "unitMeasureCode")),
            new CapabilityDefinition("srm.supplier.create", "srm.supplier", "create", "srm:supplier:create",
                    Set.of("code", "name", "shortName", "type", "companyNature", "registeredCapital",
                            "businessLicenseNo", "taxNo", "legalPerson", "address", "website", "contactName",
                            "contactMobile", "contactEmail", "bankName", "bankAccount", "status", "remark")),
            new CapabilityDefinition("mes.bom.create", "mes.bom", "create", "mes:md-item:create",
                    Set.of("parentCode", "componentCode", "quantity", "status", "remark")),
            new CapabilityDefinition("mes.qc-template.prepare", "mes.qc-template", "prepare",
                    "mes:qc-template:create", Set.of("code", "name", "types", "indicatorCode",
                    "standardValue", "thresholdMax", "thresholdMin", "unitCode", "itemCode", "remark")),
            new CapabilityDefinition("mes.mps.prepare", "mes.mps", "prepare", "mes:pro-mps:create",
                    Set.of("productCode", "quantity", "unitCode", "requestDate", "saleOrderNo", "remark")),
            new CapabilityDefinition("mes.route.prepare", "mes.route", "prepare", "mes:pro-route:create",
                    Set.of("routeCode", "routeName", "itemCode", "processCode", "sort", "yieldRate",
                            "keyFlag", "remark"))
    );

    @Resource
    private SystemAgentBridgeGuard bridgeGuard;
    @Resource
    private SecurityFrameworkService securityFrameworkService;
    @Resource
    private PermissionService permissionService;

    @GetMapping("/capabilities")
    public CommonResult<CapabilityCatalogResp> capabilities(
            @RequestHeader(value = "X-Agent-Service-Token", required = false) String serviceToken) {
        AgentPrincipal principal = bridgeGuard.requireAuthenticated(serviceToken);
        DeptDataPermissionRespDTO dataScope = permissionService.getDeptDataPermission(principal.userId());
        List<CapabilityResp> capabilities = new ArrayList<>();
        for (CapabilityDefinition definition : CATALOG) {
            if (securityFrameworkService.hasPermission(definition.permission())) {
                capabilities.add(new CapabilityResp(definition.tool(), definition.module(), definition.operation(),
                        definition.fields().stream().sorted().toList(), scopeSummary(dataScope), true));
            }
        }
        String policyRevision = digest(policyMaterial(principal.userId(), capabilities, dataScope));
        String authorizationScope = "scope:" + digest(principal.userId() + ":" + policyRevision).substring(0, 32);
        return success(new CapabilityCatalogResp(policyRevision, authorizationScope,
                scopeSummary(dataScope), capabilities));
    }

    private static String scopeSummary(DeptDataPermissionRespDTO scope) {
        if (Boolean.TRUE.equals(scope.getAll())) {
            return "全部授权数据";
        }
        int departments = scope.getDeptIds() == null ? 0 : scope.getDeptIds().size();
        if (Boolean.TRUE.equals(scope.getSelf()) && departments > 0) {
            return "本人及授权部门数据";
        }
        if (Boolean.TRUE.equals(scope.getSelf())) {
            return "仅本人数据";
        }
        return departments > 0 ? "授权部门数据" : "无部门数据范围";
    }

    private static String policyMaterial(Long userId, List<CapabilityResp> capabilities,
                                         DeptDataPermissionRespDTO scope) {
        List<Long> deptIds = scope.getDeptIds() == null ? List.of()
                : scope.getDeptIds().stream().sorted(Comparator.naturalOrder()).toList();
        return userId + "|" + Boolean.TRUE.equals(scope.getAll()) + "|" + Boolean.TRUE.equals(scope.getSelf())
                + "|" + deptIds + "|" + capabilities.stream().map(CapabilityResp::tool).sorted().toList();
    }

    private static String digest(String value) {
        try {
            return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256")
                    .digest(value.getBytes(StandardCharsets.UTF_8)));
        } catch (NoSuchAlgorithmException ex) {
            throw new IllegalStateException("JVM 缺少 SHA-256", ex);
        }
    }

    private record CapabilityDefinition(String tool, String module, String operation, String permission,
                                        Set<String> fields) {
    }

    public record CapabilityResp(String tool, String module, String operation, List<String> allowedFields,
                                 String scopeSummary, boolean canExecute) {
    }

    public record CapabilityCatalogResp(String policyRevision, String authorizationScope, String scopeSummary,
                                        List<CapabilityResp> capabilities) {
    }
}