package handlers

import (
	"net/http"
	"strconv"

	"ezops/internal/models"

	"github.com/gin-gonic/gin"
)

// AssignCredential 将凭据分配给服务器（解密凭据并写入 password/ssh_key） // Logan.Li
func (h *CredentialHandler) AssignCredential(c *gin.Context) {
	serverID, err := strconv.ParseUint(c.Param("id"), 10, 32)
	if err != nil {
		c.JSON(http.StatusBadRequest, models.Response{Code: 400, Message: "无效的服务器ID"})
		return
	}

	var req struct {
		CredentialID uint `json:"credential_id"`
	}
	if err := c.ShouldBindJSON(&req); err != nil || req.CredentialID == 0 {
		c.JSON(http.StatusBadRequest, models.Response{Code: 400, Message: "请选择凭据"})
		return
	}

	var cred models.Credential
	if err := h.db.First(&cred, req.CredentialID).Error; err != nil {
		c.JSON(http.StatusNotFound, models.Response{Code: 404, Message: "凭据不存在"})
		return
	}

	plain, err := h.crypt.Decrypt(cred.Content)
	if err != nil {
		c.JSON(http.StatusInternalServerError, models.Response{Code: 500, Message: "凭据解密失败"})
		return
	}

	var server models.Server
	if err := h.db.First(&server, serverID).Error; err != nil {
		c.JSON(http.StatusNotFound, models.Response{Code: 404, Message: "服务器不存在"})
		return
	}

	if cred.SecretType == "ssh" {
		server.SSHKey = plain
		server.AuthType = "key"
		server.Password = ""
	} else {
		server.Password = plain
		server.AuthType = "password"
		server.SSHKey = ""
	}

	if err := h.db.Save(&server).Error; err != nil {
		c.JSON(http.StatusInternalServerError, models.Response{Code: 500, Message: "分配失败: " + err.Error()})
		return
	}

	c.JSON(http.StatusOK, models.Response{Code: 200, Message: "凭据已关联"})
}