opsxsql/backend/internal/handler/ticket.go

package handler

import (
	"encoding/json"
	"fmt"
	"net/http"
	"strconv"
	"strings"
	"time"

	"sql-platform/internal/middleware"
	"sql-platform/internal/model"

	"github.com/gin-gonic/gin"
)

// GET /api/v1/tickets/statistics
func TicketStatistics(c *gin.Context) {
	userID, _, role := middleware.GetCurrentUser(c)
	
	type statusCount struct {
		Status string `json:"status"`
		Count  int64  `json:"count"`
	}
	var counts []statusCount
	
	query := model.DB.Model(&model.Ticket{}).Select("status, count(*) as count")
	
	// Filter by user role
	switch role {
	case "developer":
		query = query.Where("applicant_id = ?", userID)
	case "dba", "auditor":
		// DBA sees tickets they submitted + tickets they need to approve
		query = query.Where(
			"applicant_id = ? OR id IN (SELECT ticket_id FROM ticket_approvals WHERE approver_id = ?)",
			userID, userID,
		)
	// admin sees everything
	}
	
	query.Group("status").Scan(&counts)
	
	stats := model.TicketStatistics{}
	for _, c := range counts {
		switch c.Status {
		case "pending":
			stats.Pending = int(c.Count)
		case "reviewing":
			stats.Reviewing = int(c.Count)
		case "executing":
			stats.Executing = int(c.Count)
		case "success":
			stats.Completed = int(c.Count)
		case "failed":
			stats.Failed = int(c.Count)
		case "rejected":
			stats.Rejected = int(c.Count)
		}
	}
	stats.Total = stats.Pending + stats.Reviewing + stats.Executing + stats.Completed + stats.Failed + stats.Rejected
	
	c.JSON(http.StatusOK, stats)
}

// GET /api/v1/tickets
func ListTickets(c *gin.Context) {
	userID, _, role := middleware.GetCurrentUser(c)
	status := c.Query("status")
	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
	limit, _ := strconv.Atoi(c.DefaultQuery("page_size", "20"))
	if page < 1 { page = 1 }
	if limit < 1 || limit > 100 { limit = 20 }
	
	query := model.DB.Model(&model.Ticket{}).Order("id DESC")
	
	// keyword search
	keyword := c.Query("keyword")
	if keyword != "" {
		query = query.Where("title LIKE ? OR ticket_no LIKE ?", "%"+keyword+"%", "%"+keyword+"%")
	}
	
	// Filter by user role
	switch role {
	case "developer":
		query = query.Where("applicant_id = ?", userID)
	case "dba", "auditor":
		query = query.Where(
			"applicant_id = ? OR id IN (SELECT ticket_id FROM ticket_approvals WHERE approver_id = ?)",
			userID, userID,
		)
	}
	
	if status != "" && status != "all" {
		query = query.Where("status = ?", status)
	}
	
	var total int64
	query.Count(&total)
	
	var tickets []model.Ticket
	query.Offset((page - 1) * limit).Limit(limit).Find(&tickets)
	
	c.JSON(http.StatusOK, gin.H{
		"items": tickets,
		"total": total,
		"page":  page,
		"page_size": limit,
	})
}

// GET /api/v1/tickets/:id
func GetTicket(c *gin.Context) {
	id := c.Param("id")
	var ticket model.Ticket
	if err := model.DB.First(&ticket, id).Error; err != nil {
		c.JSON(http.StatusNotFound, gin.H{"detail": "Ticket not found"})
		return
	}
	
	// Get approvals
	var approvals []model.TicketApproval
	model.DB.Where("ticket_id = ?", id).Order("step_number").Find(&approvals)
	
	// Get SQL items
	var sqlItems []model.TicketSQLItem
	model.DB.Where("ticket_id = ?", id).Order("seq").Find(&sqlItems)
	
	// Flatten ticket fields into response + add nested data
	result := gin.H{}
	// Marshal ticket to JSON then unmarshal to map for flattening
	ticketBytes, _ := json.Marshal(ticket)
	json.Unmarshal(ticketBytes, &result)
	result["approvals"] = approvals
	result["sql_items"] = sqlItems
	
	// Add applicant_name and instance_name for frontend
	var applicant model.User
	if err := model.DB.First(&applicant, ticket.ApplicantID).Error; err == nil {
		result["applicant_name"] = applicant.DisplayName
	}
	var inst model.Instance
	if err := model.DB.First(&inst, ticket.InstanceID).Error; err == nil {
		result["instance_name"] = inst.Name
	}
	
	c.JSON(http.StatusOK, result)
}

// POST /api/v1/tickets
func CreateTicket(c *gin.Context) {
	userID, _, _ := middleware.GetCurrentUser(c)
	
	var input struct {
		Title          string  `json:"title" binding:"required"`
		DBType         string  `json:"db_type" binding:"required"`
		InstanceID     int     `json:"instance_id" binding:"required"`
		TargetDatabase string  `json:"target_database" binding:"required"`
		SQLContent     string  `json:"sql_content" binding:"required"`
		RollbackSQL    *string `json:"rollback_sql"`
		Priority       *string `json:"priority"`
		Reason         *string `json:"reason"`
		WorkflowID     *int    `json:"workflow_id"`
		RiskLevel      *string `json:"risk_level"`
		ExecStrategy   *string `json:"exec_strategy"`
	}
	
	if err := c.ShouldBindJSON(&input); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
		return
	}
	
	status := "pending"
	priority := "medium"
	riskLevel := "low"
	execStrategy := "stop_on_error"
	
	if input.Priority != nil {
		priority = *input.Priority
	}
	if input.RiskLevel != nil {
		riskLevel = *input.RiskLevel
	}
	if input.ExecStrategy != nil {
		execStrategy = *input.ExecStrategy
	}
	
	// Generate ticket number
	now := time.Now()
	ticketNo := now.Format("20060102") + "-" + fmt.Sprintf("%04d", time.Now().UnixNano()%10000)
	
	ticket := model.Ticket{
		Title:          input.Title,
		DBType:         input.DBType,
		InstanceID:     input.InstanceID,
		TargetDatabase: input.TargetDatabase,
		SQLContent:     input.SQLContent,
		RollbackSQL:    input.RollbackSQL,
		Status:         &status,
		Priority:       &priority,
		ApplicantID:    userID,
		Reason:         input.Reason,
		WorkflowID:     input.WorkflowID,
		RiskLevel:      &riskLevel,
		ExecStrategy:   &execStrategy,
		TicketNo:       &ticketNo,
	}
	
	if err := model.DB.Create(&ticket).Error; err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"detail": err.Error()})
		return
	}
	
	// Auto-create approval record: step 1, approver = instance owner or admin
	stepName := "审核"
	stepType := "audit"
	approverRole := "admin"
	// Find first admin as default approver
	var adminUser model.User
	if err := model.DB.Where("role = ? AND is_active = 1", "admin").First(&adminUser).Error; err == nil {
		adminID := adminUser.ID
		approval := model.TicketApproval{
			TicketID:    ticket.ID,
			StepNumber:  1,
			StepName:    &stepName,
			StepType:    &stepType,
			ApproverID:  &adminID,
			ApproverRole: &approverRole,
		}
		model.DB.Create(&approval)
	}
	
	c.JSON(http.StatusCreated, ticket)
}

// POST /api/v1/tickets/:id/approve
func ApproveTicket(c *gin.Context) {
	id := c.Param("id")
	userID, _, _ := middleware.GetCurrentUser(c)
	
	var ticket model.Ticket
	if err := model.DB.First(&ticket, id).Error; err != nil {
		c.JSON(http.StatusNotFound, gin.H{"detail": "Ticket not found"})
		return
	}
	
	var input struct {
		Action  string  `json:"action" binding:"required"` // approve, reject
		Comment *string `json:"comment"`
	}
	if err := c.ShouldBindJSON(&input); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
		return
	}
	
	now := time.Now()
	
	// Update approval record
	var approval model.TicketApproval
	if err := model.DB.Where("ticket_id = ? AND approver_id = ? AND action IS NULL", id, userID).First(&approval).Error; err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"detail": "No pending approval for you"})
		return
	}
	
	approval.Action = &input.Action
	approval.Comment = input.Comment
	approval.ActualApproverID = &userID
	approval.CompletedAt = &now
	model.DB.Save(&approval)
	
	// Update ticket status
	newStatus := "approved"
	if input.Action == "reject" {
		newStatus = "rejected"
	} else if input.Action == "approve" {
		// Check if there are more pending approvals
		var pendingCount int64
		model.DB.Model(&model.TicketApproval{}).Where("ticket_id = ? AND action IS NULL", id).Count(&pendingCount)
		if pendingCount > 0 {
			newStatus = "reviewing"
		}
	}
	
	ticket.Status = &newStatus
	ticket.ReviewTime = &now
	model.DB.Save(&ticket)
	
	c.JSON(http.StatusOK, gin.H{"ticket": ticket, "approval": approval})
}

// POST /api/v1/tickets/:id/execute
func ExecuteTicket(c *gin.Context) {
	id := c.Param("id")
	
	var ticket model.Ticket
	if err := model.DB.First(&ticket, id).Error; err != nil {
		c.JSON(http.StatusNotFound, gin.H{"detail": "Ticket not found"})
		return
	}
	
	// Check ticket status
	if ticket.Status != nil && *ticket.Status != "approved" {
		c.JSON(http.StatusBadRequest, gin.H{"detail": "Ticket must be approved before execution"})
		return
	}
	
	// Get instance info
	var instance model.Instance
	if err := model.DB.First(&instance, ticket.InstanceID).Error; err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"detail": "Instance not found"})
		return
	}
	
	status := "executing"
	ticket.Status = &status
	now := time.Now()
	ticket.ExecuteTime = &now
	model.DB.Save(&ticket)
	
	// Execute SQL based on db_type
	var execResult string
	var execErr string
	
	if ticket.DBType == "redis" {
		execErr = "Redis command execution not yet supported in ticket workflow"
	} else {
		// MySQL/PG execution
		db, err := getDBConnection(&instance, ticket.TargetDatabase)
		if err != nil {
			execErr = fmt.Sprintf("DB connection failed: %v", err)
		} else {
			defer db.Close()
			// Split multi-statement by semicolons
			statements := splitSQL(ticket.SQLContent)
			var results []string
			for _, stmt := range statements {
				stmt = strings.TrimSpace(stmt)
				if stmt == "" {
					continue
				}
				_, err := db.Exec(stmt)
				if err != nil {
					results = append(results, fmt.Sprintf("[FAIL] %s: %v", truncateStr(stmt, 50), err))
					// stop_on_error
					execErr = err.Error()
					break
			} else {
					results = append(results, fmt.Sprintf("[OK] %s", truncateStr(stmt, 50)))
				}
			}
			if len(results) > 0 {
				execResult = strings.Join(results, "\n")
			}
		}
	}
	
	// Update final status
	if execErr != "" {
		failStatus := "failed"
		ticket.Status = &failStatus
		ticket.ExecuteResult = &execErr
	} else {
		doneStatus := "success"
		ticket.Status = &doneStatus
		ticket.ExecuteResult = &execResult
	}
	model.DB.Save(&ticket)
	
	c.JSON(http.StatusOK, gin.H{"message": "Execution completed", "ticket": ticket})
}

func splitSQL(sql string) []string {
	return strings.Split(sql, ";")
}

func truncateStr(s string, maxLen int) string {
	if len(s) <= maxLen {
		return s
	}
	return s[:maxLen] + "..."
}


// POST /api/v1/tickets/:id/cancel
func CancelTicket(c *gin.Context) {
	id := c.Param("id")
	userID, _, _ := middleware.GetCurrentUser(c)
	
	var ticket model.Ticket
	if err := model.DB.First(&ticket, id).Error; err != nil {
		c.JSON(http.StatusNotFound, gin.H{"detail": "Ticket not found"})
		return
	}
	
	// Only applicant or admin can cancel
	if ticket.ApplicantID != userID {
		_, _, role := middleware.GetCurrentUser(c)
		if role != "admin" {
			c.JSON(http.StatusForbidden, gin.H{"detail": "Only applicant or admin can cancel"})
			return
		}
	}
	
	if ticket.Status != nil && (*ticket.Status != "pending" && *ticket.Status != "reviewing") {
		c.JSON(http.StatusBadRequest, gin.H{"detail": "Can only cancel pending or reviewing tickets"})
		return
	}
	
	status := "cancelled"
	ticket.Status = &status
	now := time.Now()
	ticket.ReviewTime = &now
	model.DB.Save(&ticket)
	
	c.JSON(http.StatusOK, gin.H{"message": "Ticket cancelled", "ticket": ticket})
}

// POST /api/v1/tickets/:id/rollback
func RollbackTicket(c *gin.Context) {
	id := c.Param("id")
	
	var ticket model.Ticket
	if err := model.DB.First(&ticket, id).Error; err != nil {
		c.JSON(http.StatusNotFound, gin.H{"detail": "Ticket not found"})
		return
	}
	
	if ticket.RollbackSQL == nil || *ticket.RollbackSQL == "" {
		c.JSON(http.StatusBadRequest, gin.H{"detail": "No rollback SQL available"})
		return
	}
	
	// Get instance
	var instance model.Instance
	if err := model.DB.First(&instance, ticket.InstanceID).Error; err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"detail": "Instance not found"})
		return
	}
	
	if ticket.DBType == "redis" {
		c.JSON(http.StatusBadRequest, gin.H{"detail": "Redis rollback not supported"})
		return
	}
	
	db, err := getDBConnection(&instance, ticket.TargetDatabase)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"detail": fmt.Sprintf("Connection failed: %v", err)})
		return
	}
	defer db.Close()
	
	// Execute rollback SQL
	statements := splitSQL(*ticket.RollbackSQL)
	var results []string
	var execErr string
	for _, stmt := range statements {
		stmt = strings.TrimSpace(stmt)
		if stmt == "" {
			continue
		}
		_, err := db.Exec(stmt)
		if err != nil {
			results = append(results, fmt.Sprintf("[FAIL] %s: %v", truncateStr(stmt, 50), err))
			execErr = err.Error()
			break
		} else {
			results = append(results, fmt.Sprintf("[OK] %s", truncateStr(stmt, 50)))
		}
	}
	
	if execErr != "" {
		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Rollback failed", "error": execErr, "results": results})
		return
	}
	
	status := "rollback"
	ticket.Status = &status
	execResult := strings.Join(results, "\n")
	ticket.ExecuteResult = &execResult
	model.DB.Save(&ticket)
	
	c.JSON(http.StatusOK, gin.H{"message": "Rollback completed", "results": results})
}

// GET /api/v1/tickets/:id/timeline
func GetTicketTimeline(c *gin.Context) {
	id := c.Param("id")
	var ticket model.Ticket
	if err := model.DB.First(&ticket, id).Error; err != nil {
		c.JSON(http.StatusNotFound, gin.H{"detail": "Ticket not found"})
		return
	}
	
	type TimelineEntry struct {
		ID        int     `json:"id"`
		Action    string  `json:"action"`
		User      string  `json:"user"`
		Comment   *string `json:"comment"`
		Timestamp string  `json:"timestamp"`
		Status    string  `json:"status"`
	}
	
	var timeline []TimelineEntry
	
	// 1. Created event
	timeline = append(timeline, TimelineEntry{
		ID:        1,
		Action:    "created",
		User:      getApplicantName(ticket.ApplicantID),
		Timestamp: ticket.CreateTime.Format(time.RFC3339),
		Status:    "pending",
	})
	
	// 2. Approval events from ticket_approvals
	var approvals []model.TicketApproval
	model.DB.Where("ticket_id = ?", id).Order("step_number").Find(&approvals)
	for _, a := range approvals {
		action := "pending_review"
		userName := getUserName(a.ActualApproverID)
		if a.Action != nil {
			action = *a.Action
		}
		ts := a.CreatedAt.Format(time.RFC3339)
		if a.CompletedAt != nil {
			ts = a.CompletedAt.Format(time.RFC3339)
		}
		timeline = append(timeline, TimelineEntry{
			ID:        a.ID,
			Action:    action,
			User:      userName,
			Comment:   a.Comment,
			Timestamp: ts,
		})
	}
	
	// 3. Executed event
	if ticket.ExecuteTime != nil {
		execAction := "executed"
		if ticket.Status != nil && *ticket.Status == "failed" {
			execAction = "execution_failed"
		} else if ticket.Status != nil && *ticket.Status == "completed" {
			execAction = "executed"
		}
		timeline = append(timeline, TimelineEntry{
			ID:        99,
			Action:    execAction,
			Timestamp: ticket.ExecuteTime.Format(time.RFC3339),
			Status:    func() string { if ticket.Status != nil { return *ticket.Status }; return "" }(),
		})
	}
	
	c.JSON(http.StatusOK, gin.H{"timeline": timeline})
}

// GET /api/v1/tickets/:id/approvals
func GetTicketApprovals(c *gin.Context) {
	id := c.Param("id")
	
	var approvals []model.TicketApproval
	if err := model.DB.Where("ticket_id = ?", id).Order("step_number").Find(&approvals).Error; err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"detail": err.Error()})
		return
	}
	
	// Enrich with approver names
	type ApprovalResponse struct {
		model.TicketApproval
		ApproverName string `json:"approver_name"`
	}
	
	var result []ApprovalResponse
	for _, a := range approvals {
		ar := ApprovalResponse{TicketApproval: a}
		ar.ApproverName = getUserName(a.ApproverID)
		result = append(result, ar)
	}
	
	c.JSON(http.StatusOK, result)
}

// Helper: get user name by ID (pointer-safe)
func getUserName(userID *int) string {
	if userID == nil {
		return ""
	}
	var user model.User
	if model.DB.First(&user, *userID).Error == nil {
		return user.DisplayName
	}
	return ""
}

// Helper: get applicant name by ID
func getApplicantName(userID int) string {
	var user model.User
	if model.DB.First(&user, userID).Error == nil {
		return user.DisplayName
	}
	return ""
}