aiops/backend/internal/api/handlers/user.go

package handlers

import (
	"fmt"
	"net/http"
	"strconv"
	"strings"

	"ezops/internal/api/middleware"
	"ezops/internal/config"
	"ezops/internal/models"

	"github.com/gin-gonic/gin"
	"golang.org/x/crypto/bcrypt"
	"gorm.io/gorm"
)

// UserHandler 用户处理器
type UserHandler struct {
	db  *gorm.DB
	cfg *config.Config
}

// NewUserHandler 创建用户处理器
func NewUserHandler(db *gorm.DB, cfg *config.Config) *UserHandler {
	return &UserHandler{db: db, cfg: cfg}
}

// Login 用户登录
// @Summary 用户登录
// @Description 用户登录获取JWT令牌
// @Tags 用户
// @Accept json
// @Produce json
// @Param request body models.LoginRequest true "登录请求"
// @Success 200 {object} models.Response{data=models.LoginResponse}
// @Failure 400 {object} models.Response
// @Failure 401 {object} models.Response
// @Router /auth/login [post]
func (h *UserHandler) Login(c *gin.Context) {
	var req models.LoginRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, models.Response{
			Code:    400,
			Message: "请求参数错误: " + err.Error(),
		})
		return
	}

	var user models.User
	err := h.db.Where("username = ?", req.Username).First(&user).Error

	if err == nil {
		// 本地用户存在
		if user.Status != 1 {
			c.JSON(http.StatusUnauthorized, models.Response{
				Code:    401,
				Message: "账号已被禁用",
			})
			return
		}

		// 先尝试本地密码验证
		passOk := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(req.Password)) == nil

		if !passOk {
			// 本地密码失败 — LDAP 用户尝试 LDAP 认证
			if user.AuthSource == "ldap" || user.Password == "-" {
				ldapInfo, ldapErr := tryLDAPAuth(h.db, req.Username, req.Password)
				if ldapErr != nil {
					c.JSON(http.StatusUnauthorized, models.Response{
						Code:    401,
						Message: "用户名或密码错误",
					})
					return
				}
				// LDAP OK — 更新本地信息
				if ldapInfo != nil {
					updates := map[string]interface{}{}
					if ldapInfo.DisplayName != "" && ldapInfo.DisplayName != user.RealName {
						updates["real_name"] = ldapInfo.DisplayName
					}
					if ldapInfo.Email != "" && ldapInfo.Email != user.Email {
						updates["email"] = ldapInfo.Email
					}
					if len(updates) > 0 {
						h.db.Model(&user).Updates(updates)
					}
				}
			} else {
				c.JSON(http.StatusUnauthorized, models.Response{
					Code:    401,
					Message: "用户名或密码错误",
				})
				return
			}
		}
	} else if err == gorm.ErrRecordNotFound {
		// 本地用户不存在 — 尝试 LDAP 认证
		ldapInfo, ldapErr := tryLDAPAuth(h.db, req.Username, req.Password)
		if ldapErr != nil {
			c.JSON(http.StatusUnauthorized, models.Response{
				Code:    401,
				Message: "用户名或密码错误",
			})
			return
		}
		// LDAP 认证成功，自动创建本地用户
		newUser := models.User{
			Username:   ldapInfo.Username,
			Password:   "-",
			RealName:   ldapInfo.DisplayName,
			Email:      ldapInfo.Email,
			Status:     1,
			AuthSource: "ldap",
		}
		if newUser.RealName == "" {
			newUser.RealName = newUser.Username
		}
		if err := h.db.Create(&newUser).Error; err != nil {
			c.JSON(http.StatusInternalServerError, models.Response{
				Code:    500,
				Message: "创建LDAP用户失败: " + err.Error(),
			})
			return
		}
		user = newUser
	} else {
		c.JSON(http.StatusInternalServerError, models.Response{
			Code:    500,
			Message: "数据库错误",
		})
		return
	}

	// 生成JWT令牌
	token, err := middleware.GenerateToken(&user, &h.cfg.JWT)
	if err != nil {
		c.JSON(http.StatusInternalServerError, models.Response{
			Code:    500,
			Message: "生成令牌失败",
		})
		return
	}

	// 更新最后登录时间
	now := h.db.NowFunc()
	h.db.Model(&user).Update("last_login", &now)

	c.JSON(http.StatusOK, models.Response{
		Code:    200,
		Message: "登录成功",
		Data: models.LoginResponse{
			Token:     token,
			ExpiresIn: h.cfg.JWT.ExpireHour * 3600,
			User:      &user,
		},
	})
}

// Register 用户注册
// @Summary 用户注册
// @Description 注册新用户
// @Tags 用户
// @Accept json
// @Produce json
// @Param request body models.CreateUserRequest true "注册请求"
// @Success 200 {object} models.Response{data=models.User}
// @Failure 400 {object} models.Response
// @Router /auth/register [post]
func (h *UserHandler) Register(c *gin.Context) {
	var req models.CreateUserRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, models.Response{
			Code:    400,
			Message: "请求参数错误: " + err.Error(),
		})
		return
	}

	// 检查用户名是否已存在
	var existingUser models.User
	if err := h.db.Where("username = ?", req.Username).First(&existingUser).Error; err == nil {
		c.JSON(http.StatusBadRequest, models.Response{
			Code:    400,
			Message: "用户名已存在",
		})
		return
	}

	// 加密密码
	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
	if err != nil {
		c.JSON(http.StatusInternalServerError, models.Response{
			Code:    500,
			Message: "密码加密失败",
		})
		return
	}

	user := models.User{
		Username: req.Username,
		Password: string(hashedPassword),
		Email:    req.Email,
		Phone:    req.Phone,
		RealName: req.RealName,
		Status:   1,
	}

	if err := h.db.Create(&user).Error; err != nil {
		c.JSON(http.StatusInternalServerError, models.Response{
			Code:    500,
			Message: "创建用户失败",
		})
		return
	}

	c.JSON(http.StatusOK, models.Response{
		Code:    200,
		Message: "注册成功",
		Data:    user,
	})
}

// GetProfile 获取当前用户信息
// @Summary 获取当前用户信息
// @Description 获取当前登录用户的信息
// @Tags 用户
// @Produce json
// @Security Bearer
// @Success 200 {object} models.Response{data=models.User}
// @Router /user/profile [get]
func (h *UserHandler) GetProfile(c *gin.Context) {
	userID := middleware.GetUserID(c)

	var user models.User
	if err := h.db.Preload("Roles").First(&user, userID).Error; err != nil {
		c.JSON(http.StatusNotFound, models.Response{
			Code:    404,
			Message: "用户不存在",
		})
		return
	}

	c.JSON(http.StatusOK, models.Response{
		Code:    200,
		Message: "success",
		Data:    user,
	})
}

// UpdateProfile 更新当前用户信息
// @Summary 更新当前用户信息
// @Description 更新当前登录用户的信息
// @Tags 用户
// @Accept json
// @Produce json
// @Security Bearer
// @Param request body models.UpdateUserRequest true "更新请求"
// @Success 200 {object} models.Response{data=models.User}
// @Router /user/profile [put]
func (h *UserHandler) UpdateProfile(c *gin.Context) {
	userID := middleware.GetUserID(c)

	var req models.UpdateUserRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, models.Response{
			Code:    400,
			Message: "请求参数错误: " + err.Error(),
		})
		return
	}

	updates := map[string]interface{}{}
	if req.Email != "" {
		updates["email"] = req.Email
	}
	if req.Phone != "" {
		updates["phone"] = req.Phone
	}
	if req.RealName != "" {
		updates["real_name"] = req.RealName
	}

	if err := h.db.Model(&models.User{}).Where("id = ?", userID).Updates(updates).Error; err != nil {
		c.JSON(http.StatusInternalServerError, models.Response{
			Code:    500,
			Message: "更新失败",
		})
		return
	}

	var user models.User
	h.db.First(&user, userID)

	c.JSON(http.StatusOK, models.Response{
		Code:    200,
		Message: "更新成功",
		Data:    user,
	})
}

// ChangePassword 修改密码
// @Summary 修改密码
// @Description 修改当前用户密码
// @Tags 用户
// @Accept json
// @Produce json
// @Security Bearer
// @Param request body models.ChangePasswordRequest true "修改密码请求"
// @Success 200 {object} models.Response
// @Router /user/password [put]
func (h *UserHandler) ChangePassword(c *gin.Context) {
	userID := middleware.GetUserID(c)

	var req models.ChangePasswordRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, models.Response{
			Code:    400,
			Message: "请求参数错误: " + err.Error(),
		})
		return
	}

	var user models.User
	if err := h.db.First(&user, userID).Error; err != nil {
		c.JSON(http.StatusNotFound, models.Response{
			Code:    404,
			Message: "用户不存在",
		})
		return
	}

	if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(req.OldPassword)); err != nil {
		c.JSON(http.StatusBadRequest, models.Response{
			Code:    400,
			Message: "原密码错误",
		})
		return
	}

	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(req.NewPassword), bcrypt.DefaultCost)
	if err != nil {
		c.JSON(http.StatusInternalServerError, models.Response{
			Code:    500,
			Message: "密码加密失败",
		})
		return
	}

	if err := h.db.Model(&user).Update("password", string(hashedPassword)).Error; err != nil {
		c.JSON(http.StatusInternalServerError, models.Response{
			Code:    500,
			Message: "修改密码失败",
		})
		return
	}

	c.JSON(http.StatusOK, models.Response{
		Code:    200,
		Message: "密码修改成功",
	})
}

// ListUsers 获取用户列表
// @Summary 获取用户列表
// @Description 获取所有用户列表（管理员）
// @Tags 用户
// @Produce json
// @Security Bearer
// @Param page query int false "页码"
// @Param page_size query int false "每页数量"
// @Param keyword query string false "搜索关键词"
// @Success 200 {object} models.Response{data=models.ListResponse}
// @Router /users [get]
func (h *UserHandler) ListUsers(c *gin.Context) {
	var query models.PageQuery
	if err := c.ShouldBindQuery(&query); err != nil {
		c.JSON(http.StatusBadRequest, models.Response{
			Code:    400,
			Message: "请求参数错误",
		})
		return
	}

	db := h.db.Model(&models.User{})
	if query.Keyword != "" {
		db = db.Where("username LIKE ? OR email LIKE ? OR real_name LIKE ?",
			"%"+query.Keyword+"%", "%"+query.Keyword+"%", "%"+query.Keyword+"%")
	}

	var total int64
	db.Count(&total)

	var users []models.User
	db.Preload("Roles").Offset(query.GetOffset()).Limit(query.GetLimit()).Find(&users)

	c.JSON(http.StatusOK, models.Response{
		Code:    200,
		Message: "success",
		Data: models.ListResponse{
			List:  users,
			Total: total,
		},
	})
}

// GetUser 获取用户详情
// @Summary 获取用户详情
// @Description 获取指定用户的详细信息
// @Tags 用户
// @Produce json
// @Security Bearer
// @Param id path int true "用户ID"
// @Success 200 {object} models.Response{data=models.User}
// @Router /users/{id} [get]
func (h *UserHandler) GetUser(c *gin.Context) {
	id, _ := strconv.Atoi(c.Param("id"))

	var user models.User
	if err := h.db.Preload("Roles").First(&user, id).Error; err != nil {
		c.JSON(http.StatusNotFound, models.Response{
			Code:    404,
			Message: "用户不存在",
		})
		return
	}

	c.JSON(http.StatusOK, models.Response{
		Code:    200,
		Message: "success",
		Data:    user,
	})
}

// CreateUser 创建用户
// @Summary 创建用户
// @Description 创建新用户（管理员）
// @Tags 用户
// @Accept json
// @Produce json
// @Security Bearer
// @Param request body models.CreateUserRequest true "创建请求"
// @Success 200 {object} models.Response{data=models.User}
// @Router /users [post]
func (h *UserHandler) CreateUser(c *gin.Context) {
	var req models.CreateUserRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, models.Response{
			Code:    400,
			Message: "请求参数错误: " + err.Error(),
		})
		return
	}

	// 检查用户名是否已存在
	var existingUser models.User
	if err := h.db.Where("username = ?", req.Username).First(&existingUser).Error; err == nil {
		c.JSON(http.StatusBadRequest, models.Response{
			Code:    400,
			Message: "用户名已存在",
		})
		return
	}

	// 加密密码
	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
	if err != nil {
		c.JSON(http.StatusInternalServerError, models.Response{
			Code:    500,
			Message: "密码加密失败",
		})
		return
	}

	user := models.User{
		Username: req.Username,
		Password: string(hashedPassword),
		Email:    req.Email,
		Phone:    req.Phone,
		RealName: req.RealName,
		Status:   1,
	}

	if err := h.db.Create(&user).Error; err != nil {
		c.JSON(http.StatusInternalServerError, models.Response{
			Code:    500,
			Message: "创建用户失败",
		})
		return
	}

	// 关联角色
	if len(req.RoleIDs) > 0 {
		var roles []models.Role
		h.db.Find(&roles, req.RoleIDs)
		h.db.Model(&user).Association("Roles").Append(roles)
	}

	c.JSON(http.StatusOK, models.Response{
		Code:    200,
		Message: "创建成功",
		Data:    user,
	})
}

// UpdateUser 更新用户
// @Summary 更新用户
// @Description 更新指定用户信息（管理员）
// @Tags 用户
// @Accept json
// @Produce json
// @Security Bearer
// @Param id path int true "用户ID"
// @Param request body models.UpdateUserRequest true "更新请求"
// @Success 200 {object} models.Response{data=models.User}
// @Router /users/{id} [put]
func (h *UserHandler) UpdateUser(c *gin.Context) {
	id, _ := strconv.Atoi(c.Param("id"))

	var req models.UpdateUserRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, models.Response{
			Code:    400,
			Message: "请求参数错误: " + err.Error(),
		})
		return
	}

	var user models.User
	if err := h.db.First(&user, id).Error; err != nil {
		c.JSON(http.StatusNotFound, models.Response{
			Code:    404,
			Message: "用户不存在",
		})
		return
	}

	updates := map[string]interface{}{}
	if req.Email != "" {
		updates["email"] = req.Email
	}
	if req.Phone != "" {
		updates["phone"] = req.Phone
	}
	if req.RealName != "" {
		updates["real_name"] = req.RealName
	}
	if req.Status != nil {
		updates["status"] = *req.Status
	}

	if err := h.db.Model(&user).Updates(updates).Error; err != nil {
		c.JSON(http.StatusInternalServerError, models.Response{
			Code:    500,
			Message: "更新失败",
		})
		return
	}

	// 更新角色
	if len(req.RoleIDs) > 0 {
		var roles []models.Role
		h.db.Find(&roles, req.RoleIDs)
		h.db.Model(&user).Association("Roles").Replace(roles)
	}

	h.db.Preload("Roles").First(&user, id)

	c.JSON(http.StatusOK, models.Response{
		Code:    200,
		Message: "更新成功",
		Data:    user,
	})
}

// DeleteUser 删除用户
// @Summary 删除用户
// @Description 删除指定用户（管理员）
// @Tags 用户
// @Produce json
// @Security Bearer
// @Param id path int true "用户ID"
// @Success 200 {object} models.Response
// @Router /users/{id} [delete]
func (h *UserHandler) DeleteUser(c *gin.Context) {
	id, _ := strconv.Atoi(c.Param("id"))

	if err := h.db.Delete(&models.User{}, id).Error; err != nil {
		c.JSON(http.StatusInternalServerError, models.Response{
			Code:    500,
			Message: "删除失败",
		})
		return
	}

	c.JSON(http.StatusOK, models.Response{
		Code:    200,
		Message: "删除成功",
	})
}

// BatchImportUsers 批量导入用户
// POST /api/v1/admin/users/batch-import
func (h *UserHandler) BatchImportUsers(c *gin.Context) {
	var req struct {
		Users []struct {
			Username string `json:"username"`
			Nickname string `json:"nickname"`
			Email    string `json:"email"`
			Phone    string `json:"phone"`
			Password string `json:"password"`
			Role     string `json:"role"`
		} `json:"users"`
		SkipExisting bool `json:"skip_existing"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, models.Response{
			Code:    400,
			Message: "请求参数错误: " + err.Error(),
		})
		return
	}

	imported := 0
	skipped := 0
	var errors []string

	for i, u := range req.Users {
		if u.Username == "" {
			errors = append(errors, fmt.Sprintf("第%d行: 用户名为空", i+1))
			continue
		}
		// Check if exists
		var existing models.User
		if err := h.db.Where("username = ?", u.Username).First(&existing).Error; err == nil {
			if req.SkipExisting {
				skipped++
				continue
			}
			errors = append(errors, fmt.Sprintf("第%d行: 用户 %s 已存在", i+1, u.Username))
			skipped++
			continue
		}

		// Default password
		pwd := u.Password
		if pwd == "" {
			pwd = "admin123"
		}
		hashed, err := bcrypt.GenerateFromPassword([]byte(pwd), bcrypt.DefaultCost)
		if err != nil {
			errors = append(errors, fmt.Sprintf("第%d行: 密码加密失败", i+1))
			continue
		}

		user := models.User{
			Username:   u.Username,
			Password:   string(hashed),
			Email:      u.Email,
			Phone:      u.Phone,
			RealName:   u.Nickname,
			Status:     1,
			AuthSource: "local",
		}
		if err := h.db.Create(&user).Error; err != nil {
			errors = append(errors, fmt.Sprintf("第%d行: 创建用户 %s 失败", i+1, u.Username))
			continue
		}
		imported++
	}

	msg := fmt.Sprintf("导入完成: %d 成功, %d 跳过", imported, skipped)
	if len(errors) > 0 {
		msg += fmt.Sprintf(", %d 个错误", len(errors))
	}

	c.JSON(http.StatusOK, models.Response{
		Code:    200,
		Message: msg,
		Data: gin.H{
			"imported": imported,
			"skipped":  skipped,
			"errors":   errors,
		},
	})
}

// ImportTemplate 下载用户导入模板
// GET /api/v1/admin/users/import-template
func (h *UserHandler) ImportTemplate(c *gin.Context) {
	// UTF-8 BOM for Excel compatibility
	bom := "\xEF\xBB\xBF"
	csv := bom + "用户名,昵称,邮箱,手机号,角色,密码\n"
	csv += "zhangsan,张三,zhangsan@example.com,13800138000,developer,123456\n"
	csv += "lisi,李四,lisi@example.com,13800138001,developer,123456\n"

	c.Header("Content-Type", "text/csv; charset=utf-8")
	c.Header("Content-Disposition", "attachment; filename=users_import_template.csv")
	c.String(http.StatusOK, csv)
}

// ensure strings import is used
var _ = strings.TrimSpace