package cn.iocoder.yudao.module.system.framework.agent;

import cn.iocoder.yudao.framework.common.biz.system.permission.PermissionCommonApi;
import cn.iocoder.yudao.framework.common.enums.UserTypeEnum;
import cn.iocoder.yudao.framework.common.util.servlet.ServletUtils;
import cn.iocoder.yudao.framework.security.core.LoginUser;
import cn.iocoder.yudao.framework.security.core.util.SecurityFrameworkUtils;
import lombok.RequiredArgsConstructor;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Service;

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.time.LocalDateTime;
import java.util.Base64;
import java.util.Set;
import java.util.UUID;

/** 签发、校验和撤销智能体短期委托。Redis 只保存密钥摘要。 */
@Service
@RequiredArgsConstructor
public class SystemAgentDelegationService {

    private static final SecureRandom SECURE_RANDOM = new SecureRandom();

    @Value("${yudao.agent.bridge.delegation-ttl-seconds:1800}")
    private long delegationTtlSeconds;

    private final AgentDelegationStore delegationStore;
    private final PermissionCommonApi permissionApi;

    public AgentDelegationToken issue(String taskId, String moduleId, Long attachmentId,
                                      Set<String> operations, String permission) {
        return issue(taskId, moduleId, attachmentId == null ? Set.of() : Set.of(attachmentId),
                operations, permission);
    }

    public AgentDelegationToken issue(String taskId, String moduleId, Set<Long> attachmentIds,
                                      Set<String> operations, String permission) {
        Long userId = SecurityFrameworkUtils.getLoginUserId();
        if (userId == null) {
            throw new AgentBridgeException(HttpStatus.UNAUTHORIZED, "UNAUTHORIZED", "未登录或登录已过期");
        }
        if (!permissionApi.hasAnyPermissions(userId, permission)) {
            throw new AgentBridgeException(HttpStatus.FORBIDDEN, "FORBIDDEN", "当前用户缺少委托所需权限");
        }
        if (taskId == null || taskId.isBlank() || taskId.length() > 128 || operations == null || operations.isEmpty()
                || attachmentIds == null || attachmentIds.size() > 20 || attachmentIds.stream().anyMatch(id -> id == null || id <= 0)) {
            throw new AgentBridgeException(HttpStatus.BAD_REQUEST, "DELEGATION_SCOPE_INVALID", "委托任务或操作范围无效");
        }

        String id = UUID.randomUUID().toString();
        byte[] secretBytes = new byte[32];
        SECURE_RANDOM.nextBytes(secretBytes);
        String secret = Base64.getUrlEncoder().withoutPadding().encodeToString(secretBytes);
        String token = id + "." + secret;
        long ttlSeconds = Math.max(60, Math.min(delegationTtlSeconds, 3600));
        LocalDateTime now = LocalDateTime.now();

        AgentDelegation delegation = new AgentDelegation();
        delegation.setId(id);
        delegation.setSecretHash(sha256(secret));
        delegation.setTaskId(taskId);
        delegation.setUserId(userId);
        delegation.setModuleId(moduleId);
        delegation.setAttachmentId(attachmentIds.size() == 1 ? attachmentIds.iterator().next() : null);
        delegation.setAttachmentIds(Set.copyOf(attachmentIds));
        delegation.setOperations(Set.copyOf(operations));
        delegation.setPermission(permission);
        delegation.setIssuedAt(now);
        delegation.setExpiresAt(now.plusSeconds(ttlSeconds));
        delegationStore.save(delegation, ttlSeconds);
        return new AgentDelegationToken(id, token, delegation.getExpiresAt());
    }

    public AgentPrincipal require(String token, String taskId, String operation, String permission,
                                  String moduleId, Long attachmentId) {
        String[] tokenParts = token == null ? new String[0] : token.split("\\.", 2);
        if (tokenParts.length != 2) {
            throw invalidToken();
        }
        AgentDelegation delegation = delegationStore.get(tokenParts[0]);
        if (delegation == null || delegation.getExpiresAt() == null
                || !delegation.getExpiresAt().isAfter(LocalDateTime.now())
                || !constantTimeEquals(delegation.getSecretHash(), sha256(tokenParts[1]))) {
            throw invalidToken();
        }
        if (!delegation.getTaskId().equals(taskId) || !delegation.getOperations().contains(operation)
                || !delegation.getPermission().equals(permission)
                || (delegation.getModuleId() != null && !delegation.getModuleId().equals(moduleId))
                || !allowsAttachment(delegation, attachmentId)) {
            throw new AgentBridgeException(HttpStatus.FORBIDDEN, "DELEGATION_SCOPE_MISMATCH", "委托票据不允许当前操作");
        }
        if (!permissionApi.hasAnyPermissions(delegation.getUserId(), permission)) {
            throw new AgentBridgeException(HttpStatus.FORBIDDEN, "DELEGATION_PERMISSION_REVOKED", "委托用户权限已变更");
        }
        LoginUser loginUser = new LoginUser().setId(delegation.getUserId())
                .setUserType(UserTypeEnum.ADMIN.getValue())
                .setExpiresTime(delegation.getExpiresAt());
        SecurityFrameworkUtils.setLoginUser(loginUser, ServletUtils.getRequest());
        return new AgentPrincipal(delegation.getUserId(), "delegated:" + delegation.getId());
    }

    private static boolean allowsAttachment(AgentDelegation delegation, Long attachmentId) {
        if (delegation.getAttachmentIds() != null && !delegation.getAttachmentIds().isEmpty()) {
            return attachmentId != null && delegation.getAttachmentIds().contains(attachmentId);
        }
        return delegation.getAttachmentId() == null || delegation.getAttachmentId().equals(attachmentId);
    }

    public void revoke(String delegationId, Long currentUserId) {
        AgentDelegation delegation = delegationStore.get(delegationId);
        if (delegation == null) {
            return;
        }
        if (!delegation.getUserId().equals(currentUserId)) {
            throw new AgentBridgeException(HttpStatus.FORBIDDEN, "DELEGATION_FORBIDDEN", "无权撤销该委托票据");
        }
        delegationStore.delete(delegationId);
    }

    private static AgentBridgeException invalidToken() {
        return new AgentBridgeException(HttpStatus.UNAUTHORIZED, "DELEGATION_INVALID", "委托票据无效、已撤销或已过期");
    }

    private static boolean constantTimeEquals(String left, String right) {
        return left != null && right != null && MessageDigest.isEqual(left.getBytes(StandardCharsets.US_ASCII),
                right.getBytes(StandardCharsets.US_ASCII));
    }

    private static String sha256(String value) {
        try {
            return java.util.HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256")
                    .digest(value.getBytes(StandardCharsets.UTF_8)));
        } catch (NoSuchAlgorithmException ex) {
            throw new IllegalStateException("SHA-256 unavailable", ex);
        }
    }
}