package controller

import (
	"fmt"
	"net/http"

	"ezops/model"

	"github.com/gin-gonic/gin"
	"github.com/go-ldap/ldap/v3"
)

// ListLDAPOUs 列出 LDAP 组织单元
// POST /api/v1/admin/ldap-config/ou-list
func (h *LDAPHandler) ListLDAPOUs(c *gin.Context) {
	var configs []model.LDAPConfig
	if err := h.db.Order("id").Find(&configs).Error; err != nil || len(configs) == 0 {
		c.JSON(http.StatusOK, model.Response{Code: 200, Data: []interface{}{}})
		return
	}
	cfg := configs[0]

	conn, err := dialLDAP(&cfg)
	if err != nil {
		c.JSON(http.StatusOK, model.Response{Code: 200, Data: []interface{}{}})
		return
	}
	defer conn.Close()
	if err := conn.Bind(cfg.AdminDN, cfg.AdminPassword); err != nil {
		c.JSON(http.StatusOK, model.Response{Code: 200, Data: []interface{}{}})
		return
	}

	type OU struct {
		DN          string `json:"dn"`
		Name        string `json:"name"`
		Description string `json:"description"`
	}
	var ous []OU
	seenDN := map[string]bool{}
	for _, filter := range ldapOUListFilters(&cfg) {
		searchReq := ldap.NewSearchRequest(
			cfg.BaseDN,
			ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
			filter,
			[]string{"ou", "cn", "name", "description"},
			nil,
		)
		sr, err := conn.Search(searchReq)
		if err != nil {
			continue
		}
		for _, e := range sr.Entries {
			if seenDN[e.DN] {
				continue
			}
			seenDN[e.DN] = true
			ous = append(ous, OU{
				DN:          e.DN,
				Name:        ldapOUEntryName(e),
				Description: e.GetAttributeValue("description"),
			})
		}
	}
	c.JSON(http.StatusOK, model.Response{Code: 200, Data: ous})
}

// CreateLDAPOU 创建组织单元
// POST /api/v1/admin/ldap-config/create-ou
func (h *LDAPHandler) CreateLDAPOU(c *gin.Context) {
	var req struct {
		OUName      string `json:"ou_name"`
		ParentDN    string `json:"parent_dn"`
		Description string `json:"description"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: err.Error()})
		return
	}

	var configs []model.LDAPConfig
	if err := h.db.Order("id").Find(&configs).Error; err != nil || len(configs) == 0 {
		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "LDAP未配置"})
		return
	}
	cfg := configs[0]

	if req.ParentDN == "" {
		req.ParentDN = cfg.BaseDN
	}
	ouDN := fmt.Sprintf("ou=%s,%s", ldap.EscapeFilter(req.OUName), req.ParentDN)

	conn, err := dialLDAP(&cfg)
	if err != nil {
		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "LDAP连接失败: " + err.Error()})
		return
	}
	defer conn.Close()
	if err := conn.Bind(cfg.AdminDN, cfg.AdminPassword); err != nil {
		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "管理员认证失败: " + err.Error()})
		return
	}

	addReq := ldap.NewAddRequest(ouDN, nil)
	addReq.Attribute("objectClass", []string{"organizationalUnit", "top"})
	addReq.Attribute("ou", []string{req.OUName})
	if req.Description != "" {
		addReq.Attribute("description", []string{req.Description})
	}
	if err := conn.Add(addReq); err != nil {
		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "创建OU失败: " + err.Error()})
		return
	}

	c.JSON(http.StatusOK, model.Response{Code: 200, Message: "OU创建成功", Data: gin.H{"dn": ouDN}})
}