package handlers

import (
	"fmt"
	"net/http"
	"time"

	"ezops/internal/models"

	"github.com/gin-gonic/gin"
	"github.com/go-ldap/ldap/v3"
)

// ListLDAPOUs 列出 LDAP 组织单元
// POST /api/v1/admin/ldap-config/ou-list
func (h *LDAPHandler) ListLDAPOUs(c *gin.Context) {
	var configs []models.LDAPConfig
	if err := h.db.Order("id").Find(&configs).Error; err != nil || len(configs) == 0 {
		c.JSON(http.StatusOK, models.Response{Code: 200, Data: []interface{}{}})
		return
	}
	cfg := configs[0]
	port := 389
	if cfg.LDAPPort != nil {
		port = *cfg.LDAPPort
	}

	conn, err := ldap.DialURL(fmt.Sprintf("ldap://%s:%d", cfg.LDAPHost, port))
	if err != nil {
		c.JSON(http.StatusOK, models.Response{Code: 200, Data: []interface{}{}})
		return
	}
	defer conn.Close()
	conn.SetTimeout(5 * time.Second)
	if err := conn.Bind(cfg.AdminDN, cfg.AdminPassword); err != nil {
		c.JSON(http.StatusOK, models.Response{Code: 200, Data: []interface{}{}})
		return
	}

	searchReq := ldap.NewSearchRequest(
		cfg.BaseDN,
		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
		"(objectClass=organizationalUnit)",
		[]string{"ou", "description"},
		nil,
	)
	sr, err := conn.Search(searchReq)
	if err != nil {
		c.JSON(http.StatusOK, models.Response{Code: 200, Data: []interface{}{}})
		return
	}

	type OU struct {
		DN          string `json:"dn"`
		Name        string `json:"name"`
		Description string `json:"description"`
	}
	var ous []OU
	for _, e := range sr.Entries {
		ous = append(ous, OU{
			DN:          e.DN,
			Name:        e.GetAttributeValue("ou"),
			Description: e.GetAttributeValue("description"),
		})
	}
	c.JSON(http.StatusOK, models.Response{Code: 200, Data: ous})
}

// CreateLDAPOU 创建组织单元
// POST /api/v1/admin/ldap-config/create-ou
func (h *LDAPHandler) CreateLDAPOU(c *gin.Context) {
	var req struct {
		OUName      string `json:"ou_name"`
		ParentDN    string `json:"parent_dn"`
		Description string `json:"description"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, models.Response{Code: 400, Message: err.Error()})
		return
	}

	var configs []models.LDAPConfig
	if err := h.db.Order("id").Find(&configs).Error; err != nil || len(configs) == 0 {
		c.JSON(http.StatusBadRequest, models.Response{Code: 400, Message: "LDAP未配置"})
		return
	}
	cfg := configs[0]
	port := 389
	if cfg.LDAPPort != nil {
		port = *cfg.LDAPPort
	}

	if req.ParentDN == "" {
		req.ParentDN = cfg.BaseDN
	}
	ouDN := fmt.Sprintf("ou=%s,%s", ldap.EscapeFilter(req.OUName), req.ParentDN)

	conn, err := ldap.DialURL(fmt.Sprintf("ldap://%s:%d", cfg.LDAPHost, port))
	if err != nil {
		c.JSON(http.StatusInternalServerError, models.Response{Code: 500, Message: "LDAP连接失败: " + err.Error()})
		return
	}
	defer conn.Close()
	conn.SetTimeout(5 * time.Second)
	if err := conn.Bind(cfg.AdminDN, cfg.AdminPassword); err != nil {
		c.JSON(http.StatusInternalServerError, models.Response{Code: 500, Message: "管理员认证失败: " + err.Error()})
		return
	}

	addReq := ldap.NewAddRequest(ouDN, nil)
	addReq.Attribute("objectClass", []string{"organizationalUnit", "top"})
	addReq.Attribute("ou", []string{req.OUName})
	if req.Description != "" {
		addReq.Attribute("description", []string{req.Description})
	}
	if err := conn.Add(addReq); err != nil {
		c.JSON(http.StatusInternalServerError, models.Response{Code: 500, Message: "创建OU失败: " + err.Error()})
		return
	}

	c.JSON(http.StatusOK, models.Response{Code: 200, Message: "OU创建成功", Data: gin.H{"dn": ouDN}})
}