package handler

import (
	"net/http"

	"github.com/gin-gonic/gin"
	"golang.org/x/crypto/bcrypt"
	"gorm.io/gorm"

	"github.com/wangjia/jiu/backend/internal/middleware"
	"github.com/wangjia/jiu/backend/internal/model"
	"github.com/wangjia/jiu/backend/internal/service"
	"github.com/wangjia/jiu/backend/internal/util"
)

type UserHandler struct {
	db *gorm.DB
}

func NewUserHandler(db *gorm.DB) *UserHandler {
	return &UserHandler{db: db}
}

// List GET /api/v1/users
func (h *UserHandler) List(c *gin.Context) {
	shopID := middleware.GetShopID(c)
	users := make([]model.User, 0)
	h.db.Where("shop_id = ? AND deleted_at IS NULL", shopID).
		Order("id ASC").Find(&users)
	util.RespondSuccess(c, users)
}

// Create POST /api/v1/users
func (h *UserHandler) Create(c *gin.Context) {
	shopID := middleware.GetShopID(c)
	var req struct {
		Username string `json:"username" binding:"required"`
		Password string `json:"password" binding:"required"`
		RealName string `json:"real_name"`
		Phone    string `json:"phone"`
		Role     string `json:"role"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}
	hash, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "密码加密失败"})
		return
	}
	role := req.Role
	if role == "" {
		role = "operator"
	}
	u := model.User{
		ShopID:       shopID,
		Username:     req.Username,
		PasswordHash: string(hash),
		RealName:     req.RealName,
		Phone:        req.Phone,
		Role:         role,
		IsActive:     true,
	}
	if err := h.db.Create(&u).Error; err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "用户名已存在"})
		return
	}
	util.RespondCreated(c, u)
}

// Update PUT /api/v1/users/:id
func (h *UserHandler) Update(c *gin.Context) {
	shopID := middleware.GetShopID(c)
	var u model.User
	if err := h.db.Where("id = ? AND shop_id = ? AND deleted_at IS NULL", c.Param("id"), shopID).
		First(&u).Error; err != nil {
		c.JSON(http.StatusNotFound, gin.H{"error": "用户不存在"})
		return
	}
	var req struct {
		RealName string `json:"real_name"`
		Phone    string `json:"phone"`
		Role     string `json:"role"`
		IsActive *bool  `json:"is_active"`
	}
	c.ShouldBindJSON(&req)
	updates := map[string]interface{}{}
	if req.RealName != "" {
		updates["real_name"] = req.RealName
	}
	if req.Phone != "" {
		updates["phone"] = req.Phone
	}
	if req.Role != "" {
		updates["role"] = req.Role
	}
	if req.IsActive != nil {
		updates["is_active"] = *req.IsActive
	}
	if len(updates) > 0 {
		h.db.Model(&u).Where("shop_id = ?", shopID).Updates(updates)
	}
	// 禁用用户时立即吊销其全部活跃会话，使其在线设备下次请求即被拦下。
	if req.IsActive != nil && !*req.IsActive {
		if err := service.RevokeUserSessions(h.db, shopID, u.ID, middleware.GetUserID(c), "disabled"); err != nil {
			// 吊销失败不阻断本次更新（用户已停用，refresh 也已被 is_active 拦截）。
			c.Error(err) //nolint:errcheck
		}
	}
	h.db.Where("id = ? AND shop_id = ?", u.ID, shopID).First(&u)
	util.RespondSuccess(c, u)
}

// ResetPassword PUT /api/v1/users/:id/reset-password
func (h *UserHandler) ResetPassword(c *gin.Context) {
	shopID := middleware.GetShopID(c)
	var u model.User
	if err := h.db.Where("id = ? AND shop_id = ? AND deleted_at IS NULL", c.Param("id"), shopID).
		First(&u).Error; err != nil {
		c.JSON(http.StatusNotFound, gin.H{"error": "用户不存在"})
		return
	}
	var req struct {
		Password string `json:"password" binding:"required"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}
	hash, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "密码加密失败"})
		return
	}
	h.db.Model(&u).Update("password_hash", string(hash))
	// 改密后吊销该用户全部活跃会话，旧设备 token 立即失效（防止凭旧凭据继续访问）。
	if err := service.RevokeUserSessions(h.db, shopID, u.ID, middleware.GetUserID(c), "pwd_reset"); err != nil {
		c.Error(err) //nolint:errcheck
	}
	c.JSON(http.StatusOK, gin.H{"message": "密码已重置"})
}