package httpx

import (
	"sync"

	"github.com/gin-gonic/gin"
)

// Permission 权限标识（对应 API 操作）。
type Permission string

// 预定义权限常量（覆盖全部 API 操作）。
const (
	// 内容管理
	PermContentRegister    Permission = "content:register"
	PermContentReview      Permission = "content:review"
	PermContentIssue       Permission = "content:issue"
	PermContentVerify      Permission = "content:verify"
	PermContentTranscode   Permission = "content:transcode"
	PermContentIngest      Permission = "content:ingest"
	PermContentPublish     Permission = "content:publish"
	PermContentInject      Permission = "content:inject"
	PermContentVersionChange Permission = "content:version_change"
	PermContentTakedown    Permission = "content:takedown"
	PermContentRestore     Permission = "content:restore"
	PermContentMerge       Permission = "content:merge"
	PermContentSplit       Permission = "content:split"
	PermContentAddEpisodes Permission = "content:add_episodes"
	// 查询
	PermQueryByMA           Permission = "query:by_ma"
	PermQueryByHash         Permission = "query:by_hash"
	PermQueryByProvincial   Permission = "query:by_provincial"
	PermQueryByLibraryID    Permission = "query:by_library_id"
	PermQueryMappings       Permission = "query:mappings"
	PermQueryEpisodes       Permission = "query:episodes"
	PermQueryReviews        Permission = "query:reviews"
	PermQueryContents       Permission = "query:contents"
	PermQueryProvenance     Permission = "query:provenance"
	PermQueryAccountability Permission = "query:accountability"
	PermQueryEvidence       Permission = "query:evidence"
	// 数据与分账
	PermPlaybackReport   Permission = "data:playback_report"
	PermPlaybackSummary  Permission = "data:playback_summary"
	PermSettlement       Permission = "data:settlement"
	// 确权与侵权
	PermInfringeMatch  Permission = "rights:infringe_match"
	PermAuthorize      Permission = "rights:authorize"
	PermAuthCheck      Permission = "rights:auth_check"
	// 跨省与终端
	PermCrossProvince  Permission = "cross:province_admit"
	PermTerminalVerify Permission = "terminal:verify"
	// 备案与监管
	PermBindFiling     Permission = "regulatory:bind_filing"
	PermQueryFiling    Permission = "regulatory:query_filing"
	PermNationalStats  Permission = "regulatory:national_stats"
	PermDailyReport    Permission = "regulatory:daily_report"
	PermListSegments   Permission = "admin:list_segments"
	PermRegisterSegment Permission = "admin:register_segment"
	// 大小屏融合
	PermResolve       Permission = "screen:resolve"
	PermScanVerify    Permission = "screen:scan_verify"
	PermRecordPurchase Permission = "rights:record_purchase"
	PermVerifyRights  Permission = "rights:verify_rights"
	// 系统管理
	PermManageUsers Permission = "admin:manage_users"
	PermManageOrgs  Permission = "admin:manage_orgs"
)

// RBACManager 基于角色的动态权限管理器。
// 支持运行时配置角色-权限映射，替代硬编码角色检查。
type RBACManager struct {
	mu    sync.RWMutex
	roles map[string]map[Permission]bool // role -> permission set
}

// NewRBACManager 创建权限管理器并预置默认角色权限。
func NewRBACManager() *RBACManager {
	r := &RBACManager{roles: make(map[string]map[Permission]bool)}
	r.loadDefaults()
	return r
}

// loadDefaults 加载默认四角色权限矩阵。
func (r *RBACManager) loadDefaults() {
	// 监管主体：全部权限
	r.SetRolePermissions("regulator", allPermissions())

	// 审核主体：审核、入库、转码、查询、验真
	r.SetRolePermissions("reviewer", []Permission{
		PermContentReview, PermContentTranscode, PermContentIngest,
		PermContentVerify, PermContentVersionChange,
		PermQueryByMA, PermQueryByHash, PermQueryByProvincial, PermQueryByLibraryID,
		PermQueryMappings, PermQueryEpisodes, PermQueryReviews, PermQueryContents,
		PermQueryProvenance, PermQueryAccountability, PermQueryEvidence,
		PermBindFiling, PermQueryFiling,
		PermResolve, PermScanVerify,
	})

	// 内容提供商：送审、查询、确权
	r.SetRolePermissions("cp", []Permission{
		PermContentRegister,
		PermQueryByMA, PermQueryByHash, PermQueryByProvincial, PermQueryByLibraryID,
		PermQueryMappings, PermQueryEpisodes, PermQueryReviews, PermQueryContents,
		PermQueryProvenance, PermQueryEvidence,
		PermInfringeMatch, PermAuthorize, PermAuthCheck,
		PermResolve, PermScanVerify, PermRecordPurchase, PermVerifyRights,
	})

	// 运营商：注入、发布、查询、播放回传
	r.SetRolePermissions("operator", []Permission{
		PermContentPublish, PermContentInject,
		PermContentVerify, PermTerminalVerify,
		PermQueryByMA, PermQueryByHash, PermQueryMappings, PermQueryEpisodes,
		PermQueryContents, PermQueryProvenance,
		PermPlaybackReport, PermPlaybackSummary, PermSettlement,
		PermResolve, PermScanVerify, PermVerifyRights,
	})
}

// SetRolePermissions 设置某角色的权限集合（覆盖原有）。
func (r *RBACManager) SetRolePermissions(role string, perms []Permission) {
	r.mu.Lock()
	defer r.mu.Unlock()
	set := make(map[Permission]bool, len(perms))
	for _, p := range perms {
		set[p] = true
	}
	r.roles[role] = set
}

// GrantPermission 为角色追加单个权限。
func (r *RBACManager) GrantPermission(role string, perm Permission) {
	r.mu.Lock()
	defer r.mu.Unlock()
	if r.roles[role] == nil {
		r.roles[role] = make(map[Permission]bool)
	}
	r.roles[role][perm] = true
}

// RevokePermission 移除角色的某个权限。
func (r *RBACManager) RevokePermission(role string, perm Permission) {
	r.mu.Lock()
	defer r.mu.Unlock()
	if r.roles[role] != nil {
		delete(r.roles[role], perm)
	}
}

// HasPermission 检查角色是否拥有指定权限。
func (r *RBACManager) HasPermission(role string, perm Permission) bool {
	r.mu.RLock()
	defer r.mu.RUnlock()
	perms, ok := r.roles[role]
	if !ok {
		return false
	}
	return perms[perm]
}

// ListPermissions 列出角色的全部权限。
func (r *RBACManager) ListPermissions(role string) []Permission {
	r.mu.RLock()
	defer r.mu.RUnlock()
	perms, ok := r.roles[role]
	if !ok {
		return nil
	}
	out := make([]Permission, 0, len(perms))
	for p := range perms {
		out = append(out, p)
	}
	return out
}

// ListRoles 列出全部已配置角色。
func (r *RBACManager) ListRoles() []string {
	r.mu.RLock()
	defer r.mu.RUnlock()
	out := make([]string, 0, len(r.roles))
	for role := range r.roles {
		out = append(out, role)
	}
	return out
}

// RequirePermission 返回 Gin 中间件，校验当前角色是否拥有指定权限。
// 用法：rg.POST("/content/issue", rbac.RequirePermission(httpx.PermContentIssue), h.issue)
func (r *RBACManager) RequirePermission(perm Permission) gin.HandlerFunc {
	return func(c *gin.Context) {
		role := RoleFromContext(c)
		if role == "" {
			Error(c, 401, "UNAUTHORIZED", "未认证")
			c.Abort()
			return
		}
		if !r.HasPermission(role, perm) {
			Error(c, 403, "FORBIDDEN", "角色 "+role+" 无权限: "+string(perm))
			c.Abort()
			return
		}
		c.Next()
	}
}

// allPermissions 返回全部权限列表（用于监管角色）。
func allPermissions() []Permission {
	return []Permission{
		PermContentRegister, PermContentReview, PermContentIssue, PermContentVerify,
		PermContentTranscode, PermContentIngest, PermContentPublish, PermContentInject,
		PermContentVersionChange, PermContentTakedown, PermContentRestore,
		PermContentMerge, PermContentSplit, PermContentAddEpisodes,
		PermQueryByMA, PermQueryByHash, PermQueryByProvincial, PermQueryByLibraryID,
		PermQueryMappings, PermQueryEpisodes, PermQueryReviews, PermQueryContents,
		PermQueryProvenance, PermQueryAccountability, PermQueryEvidence,
		PermPlaybackReport, PermPlaybackSummary, PermSettlement,
		PermInfringeMatch, PermAuthorize, PermAuthCheck,
		PermCrossProvince, PermTerminalVerify,
		PermBindFiling, PermQueryFiling, PermNationalStats, PermDailyReport,
		PermListSegments, PermRegisterSegment,
		PermResolve, PermScanVerify, PermRecordPurchase, PermVerifyRights,
		PermManageUsers, PermManageOrgs,
	}
}