"""角色权限服务 — 基于角色的权限查询。

权限逻辑:
- admin/dba/auditor 权限由角色硬编码决定，不需要查权限组
- developer 权限由关联的权限组决定
- 工单操作权限完全由角色决定

权限组类型 (access_type):
- readonly: 只读查看 — 关联只读库/从库，用于查询数据
- write: 写入变更 — 关联读写库/主库，用于数据变更工单
"""

from __future__ import annotations

import json
import logging
from typing import Dict, List, Optional

from sqlalchemy import select
from sqlalchemy.ext.asyncio import AsyncSession

from app.models.user import User
from app.models.instance import Instance
from app.models.instance_group import InstanceGroup, user_groups, instance_group_members

logger = logging.getLogger(__name__)

# ============================================================
# 角色权限映射（硬编码）
# ============================================================
# access_type 值:
#   "all"    — 全部实例全部库
#   "groups" — 由权限组决定
#   None     — 无权限
# ticket 值: list of allowed ticket actions
ROLE_PERMISSIONS: Dict[str, dict] = {
    "admin": {
        "readonly": "all",
        "write": "all",
        "ticket": ["create", "approve", "reject", "execute", "cancel"],
    },
    "dba": {
        "readonly": "all",
        "write": "all",
        "ticket": ["approve", "reject", "execute"],
    },
    "auditor": {
        "readonly": "all",
        "write": None,
        "ticket": ["approve", "reject"],
    },
    "developer": {
        "readonly": "groups",
        "write": "groups",
        "ticket": ["create", "cancel_own"],
    },
}


def _get_role_config(role: str) -> dict:
    """获取角色配置，未知角色按最小权限处理。"""
    return ROLE_PERMISSIONS.get(role, {"readonly": None, "write": None, "ticket": []})


# ============================================================
# Public API
# ============================================================


async def get_user_permissions(db: AsyncSession, user: User) -> dict:
    """返回用户的实际权限概览。"""
    role_config = _get_role_config(user.role)
    result = {
        "role": user.role,
        "access": {
            "readonly": role_config.get("readonly"),
            "write": role_config.get("write"),
        },
        "ticket": role_config.get("ticket", []),
        "groups": [],
    }

    has_group_access = any(
        v == "groups" for k, v in role_config.items() if k in ("readonly", "write")
    )
    if has_group_access:
        result["groups"] = await _get_user_groups_detail(db, user)

    return result


async def can_access_database(
    db: AsyncSession,
    user: User,
    instance_id: int,
    database: str,
    access_type: str,
) -> bool:
    """判断用户是否可以对指定实例的指定库执行指定类型的操作。

    Args:
        access_type: "readonly" / "write"
    """
    if access_type not in ("readonly", "write"):
        return False

    role_config = _get_role_config(user.role)
    access_value = role_config.get(access_type)

    if access_value == "all":
        return True
    if access_value is None:
        return False
    if access_value == "groups":
        return await _check_group_access(db, user, instance_id, database, access_type)

    return False


def can_ticket_action(user: User, action: str) -> bool:
    """判断用户是否可以执行指定工单操作。"""
    role_config = _get_role_config(user.role)
    return action in role_config.get("ticket", [])


async def get_accessible_instances(
    db: AsyncSession,
    user: User,
    access_type: str = "readonly",
) -> List[Instance]:
    """获取用户可访问的实例列表（按 access_type 过滤）。

    - admin/dba: 返回所有实例
    - auditor: readonly 返回所有，write 返回空
    - developer: 返回其权限组关联的实例（通过 instance_group_members）
    """
    role_config = _get_role_config(user.role)
    access_value = role_config.get(access_type)

    if access_value == "all":
        result = await db.execute(select(Instance))
        return list(result.scalars().all())

    if access_value is None:
        return []

    # "groups" — 查询权限组关联的实例 via instance_group_members
    group_ids = await _get_user_group_ids(db, user)
    if not group_ids:
        return []

    # Query instance_group_members for the matching access_type
    result = await db.execute(
        select(instance_group_members.c.instance_id)
        .where(
            instance_group_members.c.group_id.in_(group_ids),
            instance_group_members.c.access_type == access_type,
        )
    )
    instance_ids = list({row[0] for row in result.all()})

    if not instance_ids:
        return []

    inst_result = await db.execute(
        select(Instance).where(Instance.id.in_(instance_ids))
    )
    return list(inst_result.scalars().all())


# ============================================================
# Internal helpers
# ============================================================


async def _get_user_group_ids(db: AsyncSession, user: User) -> List[int]:
    """获取用户关联的所有权限组 ID。"""
    result = await db.execute(
        select(user_groups.c.group_id).where(user_groups.c.user_id == user.id)
    )
    return [row[0] for row in result.all()]


async def _get_user_groups_detail(db: AsyncSession, user: User) -> List[dict]:
    """获取用户关联权限组的详细信息。"""
    group_ids = await _get_user_group_ids(db, user)
    if not group_ids:
        return []

    result = await db.execute(
        select(InstanceGroup).where(InstanceGroup.id.in_(group_ids))
    )
    groups = result.scalars().all()

    details = []
    for g in groups:
        # Get instance IDs by access_type from instance_group_members
        ro_result = await db.execute(
            select(instance_group_members.c.instance_id).where(
                instance_group_members.c.group_id == g.id,
                instance_group_members.c.access_type == "readonly",
            )
        )
        wr_result = await db.execute(
            select(instance_group_members.c.instance_id).where(
                instance_group_members.c.group_id == g.id,
                instance_group_members.c.access_type == "write",
            )
        )
        ro_ids = [row[0] for row in ro_result.all()]
        wr_ids = [row[0] for row in wr_result.all()]
        details.append({
            "group_id": g.id,
            "group_name": g.name,
            "readonly_instance_ids": ro_ids,
            "write_instance_ids": wr_ids,
            "allowed_databases": g.get_allowed_databases(),
        })
    return details


async def _check_group_access(
    db: AsyncSession,
    user: User,
    instance_id: int,
    database: str,
    access_type: str,
) -> bool:
    """检查用户通过权限组是否能访问指定实例+库。"""
    inst_result = await db.execute(
        select(Instance).where(Instance.id == instance_id)
    )
    instance = inst_result.scalar_one_or_none()
    if not instance:
        return False

    # Public instance (no group_id) — readonly allowed
    if instance.group_id is None:
        return access_type == "readonly"

    group_ids = await _get_user_group_ids(db, user)

    # Check if any of the user's groups contain this instance with matching access_type
    result = await db.execute(
        select(instance_group_members).where(
            instance_group_members.c.instance_id == instance_id,
            instance_group_members.c.group_id.in_(group_ids),
            instance_group_members.c.access_type == access_type,
        )
    )
    member_row = result.first()
    if not member_row:
        # For readonly access, write access_type also grants readonly
        if access_type == "readonly":
            wr_result = await db.execute(
                select(instance_group_members).where(
                    instance_group_members.c.instance_id == instance_id,
                    instance_group_members.c.group_id.in_(group_ids),
                    instance_group_members.c.access_type == "write",
                )
            )
            member_row = wr_result.first()

    if not member_row:
        return False

    # Check allowed_databases from the group
    group_result = await db.execute(
        select(InstanceGroup).where(InstanceGroup.id == member_row.group_id)
    )
    group = group_result.scalar_one_or_none()
    if not group:
        return False

    allowed_dbs = group.get_allowed_databases()
    if not allowed_dbs:
        return True

    return database in allowed_dbs