# -*- coding: utf-8 -*-
"""
hr-system 权限与数据范围底座（F11 / T08）

职责：
  1. 角色管理：sys 角色 CRUD、权限点分配（复用 rbac 基座做路径级功能权限）
  2. 管理员管理：创建管理员、绑定角色
  3. sys_data_scope 数据范围双维度配置（组织维度 org + 花名册字段维度 field）
  4. get_data_scope(user_id)：查询叠加机制，注册为公共横切能力，
     供 hr-roster / hr-report / hr-flow 导出等模块调用
  5. 内置 admin + 四角色（员工自助/经理/HR管理员/系统管理员）权限初始化

依赖：apppublic、sqlor、ahserver、appbase、rbac（基础模块，直接引用）
端口：9280（见 conf/config.json）
"""

import json
import time
import uuid

from apppublic import log
from sqlor import Db

# ---------------------------------------------------------------------------
# 常量
# ---------------------------------------------------------------------------

SCOPE_TYPE_ORG = "org"      # 组织维度
SCOPE_TYPE_FIELD = "field"  # 花名册字段维度

# 内置角色编码（与 init/data.json 保持一致）
ROLE_EMPLOYEE = "employee"
ROLE_MANAGER = "manager"
ROLE_HR_ADMIN = "hr_admin"
ROLE_SYS_ADMIN = "sys_admin"
ROLE_ADMIN = "admin"

BUILTIN_ROLES = (ROLE_EMPLOYEE, ROLE_MANAGER, ROLE_HR_ADMIN, ROLE_SYS_ADMIN)

_db = None


def _get_db():
    """获取 hrs 库连接（依赖 appbase 加载 conf/config.json 的 databases.hrs）。"""
    global _db
    if _db is None:
        _db = Db("hrs")
    return _db


def _now():
    return time.strftime("%Y-%m-%d %H:%M:%S")


def _uuid():
    return uuid.uuid4().hex


# ---------------------------------------------------------------------------
# 1. 角色管理（复用 rbac 基座 sys_role / sys_role_permission）
# ---------------------------------------------------------------------------

def role_list(req):
    """角色列表（含已分配权限点数量）。"""
    db = _get_db()
    rows = db.query(
        "SELECT r.id, r.role_code, r.role_name, r.remark, r.created_at, "
        "       (SELECT COUNT(*) FROM sys_role_permission rp WHERE rp.role_id = r.id) AS perm_count "
        "FROM sys_role r ORDER BY r.created_at"
    )
    return {"code": 0, "data": rows}


def role_detail(req):
    """角色详情 + 已分配权限点 id 列表。"""
    role_id = req.get("id") or req.get("role_id")
    if not role_id:
        return {"code": 1, "msg": "缺少角色 id"}
    db = _get_db()
    role = db.query_one("SELECT * FROM sys_role WHERE id = %s", (role_id,))
    if not role:
        return {"code": 1, "msg": "角色不存在"}
    perms = db.query(
        "SELECT perm_id FROM sys_role_permission WHERE role_id = %s", (role_id,)
    )
    role["perm_ids"] = [p["perm_id"] for p in perms]
    return {"code": 0, "data": role}


def role_create(req):
    """创建角色（sys 角色）。"""
    db = _get_db()
    role_code = (req.get("role_code") or "").strip()
    role_name = (req.get("role_name") or "").strip()
    if not role_code or not role_name:
        return {"code": 1, "msg": "角色编码与名称必填"}
    exists = db.query_one("SELECT id FROM sys_role WHERE role_code = %s", (role_code,))
    if exists:
        return {"code": 1, "msg": "角色编码已存在"}
    rid = _uuid()
    db.execute(
        "INSERT INTO sys_role (id, role_code, role_name, remark, created_by, created_at, updated_at) "
        "VALUES (%s, %s, %s, %s, %s, %s, %s)",
        (rid, role_code, role_name, req.get("remark", ""), req.get("operator_id", ""),
         _now(), _now()),
    )
    return {"code": 0, "data": {"id": rid}}


def role_update(req):
    """更新角色基础信息。"""
    role_id = req.get("id") or req.get("role_id")
    if not role_id:
        return {"code": 1, "msg": "缺少角色 id"}
    db = _get_db()
    db.execute(
        "UPDATE sys_role SET role_name = %s, remark = %s, updated_by = %s, updated_at = %s "
        "WHERE id = %s",
        (req.get("role_name", ""), req.get("remark", ""),
         req.get("operator_id", ""), _now(), role_id),
    )
    return {"code": 0}


def role_delete(req):
    """删除角色（内置四角色 + admin 禁止删除）。"""
    role_id = req.get("id") or req.get("role_id")
    if not role_id:
        return {"code": 1, "msg": "缺少角色 id"}
    db = _get_db()
    role = db.query_one("SELECT role_code FROM sys_role WHERE id = %s", (role_id,))
    if not role:
        return {"code": 1, "msg": "角色不存在"}
    if role["role_code"] in BUILTIN_ROLES or role["role_code"] == ROLE_ADMIN:
        return {"code": 1, "msg": "内置角色禁止删除"}
    db.execute("DELETE FROM sys_role_permission WHERE role_id = %s", (role_id,))
    db.execute("DELETE FROM sys_user_role WHERE role_id = %s", (role_id,))
    db.execute("DELETE FROM sys_role WHERE id = %s", (role_id,))
    return {"code": 0}


def role_assign_perms(req):
    """角色权限点分配：全量覆盖 role 的 perm_id 列表。

    入参：
      role_id: str
      perm_ids: list[str]  权限点 id（rbac wildcard 展开后的叶子权限点）
    """
    role_id = req.get("role_id") or req.get("id")
    if not role_id:
        return {"code": 1, "msg": "缺少角色 id"}
    perm_ids = req.get("perm_ids") or []
    db = _get_db()
    role = db.query_one("SELECT id FROM sys_role WHERE id = %s", (role_id,))
    if not role:
        return {"code": 1, "msg": "角色不存在"}
    db.execute("DELETE FROM sys_role_permission WHERE role_id = %s", (role_id,))
    if perm_ids:
        rows = [(role_id, pid) for pid in perm_ids]
        db.executemany(
            "INSERT INTO sys_role_permission (role_id, perm_id) VALUES (%s, %s)", rows
        )
    return {"code": 0, "data": {"count": len(perm_ids)}}


# ---------------------------------------------------------------------------
# 2. 管理员管理（sys_user + sys_user_role 绑定）
# ---------------------------------------------------------------------------

def admin_list(req):
    """管理员列表（含角色绑定）。"""
    db = _get_db()
    rows = db.query(
        "SELECT u.id, u.username, u.real_name, u.status, u.created_at, "
        "       (SELECT GROUP_CONCAT(r.role_code) FROM sys_user_role ur "
        "        JOIN sys_role r ON r.id = ur.role_id WHERE ur.user_id = u.id) AS role_codes "
        "FROM sys_user u ORDER BY u.created_at"
    )
    return {"code": 0, "data": rows}


def admin_create(req):
    """创建管理员（用户 + 绑定角色）。"""
    db = _get_db()
    username = (req.get("username") or "").strip()
    if not username:
        return {"code": 1, "msg": "用户名必填"}
    exists = db.query_one("SELECT id FROM sys_user WHERE username = %s", (username,))
    if exists:
        return {"code": 1, "msg": "用户名已存在"}
    uid = _uuid()
    # 初始密码：无则由 rbac 默认口令（生产环境需强制改密，SRS §2.2-1）
    pwd = req.get("password") or ""
    db.execute(
        "INSERT INTO sys_user (id, username, real_name, password, status, created_at, updated_at) "
        "VALUES (%s, %s, %s, %s, %s, %s, %s)",
        (uid, username, req.get("real_name", ""), pwd,
         req.get("status", 1), _now(), _now()),
    )
    role_ids = req.get("role_ids") or []
    if role_ids:
        db.executemany(
            "INSERT INTO sys_user_role (user_id, role_id) VALUES (%s, %s)",
            [(uid, rid) for rid in role_ids],
        )
    return {"code": 0, "data": {"id": uid}}


def admin_bind_roles(req):
    """管理员绑定角色（全量覆盖）。"""
    user_id = req.get("user_id") or req.get("id")
    if not user_id:
        return {"code": 1, "msg": "缺少用户 id"}
    role_ids = req.get("role_ids") or []
    db = _get_db()
    db.execute("DELETE FROM sys_user_role WHERE user_id = %s", (user_id,))
    if role_ids:
        db.executemany(
            "INSERT INTO sys_user_role (user_id, role_id) VALUES (%s, %s)",
            [(user_id, rid) for rid in role_ids],
        )
    return {"code": 0}


def admin_disable(req):
    """停用/启用管理员。"""
    user_id = req.get("user_id") or req.get("id")
    if not user_id:
        return {"code": 1, "msg": "缺少用户 id"}
    db = _get_db()
    db.execute("UPDATE sys_user SET status = %s, updated_at = %s WHERE id = %s",
               (req.get("status", 0), _now(), user_id))
    return {"code": 0}


# ---------------------------------------------------------------------------
# 3. sys_data_scope 双维度配置
# ---------------------------------------------------------------------------

def scope_list(req):
    """数据范围配置列表。"""
    db = _get_db()
    rows = db.query(
        "SELECT s.*, u.username, u.real_name FROM sys_data_scope s "
        "LEFT JOIN sys_user u ON u.id = s.admin_user_id ORDER BY s.created_at"
    )
    # 反序列化 JSON 字段供前端渲染
    for r in rows:
        r["org_ids"] = _json_loads(r.get("org_ids_json"), [])
        r["field_ids"] = _json_loads(r.get("field_ids_json"), [])
    return {"code": 0, "data": rows}


def _json_loads(raw, default):
    if not raw:
        return default
    try:
        return json.loads(raw)
    except (TypeError, ValueError):
        return default


def scope_save(req):
    """保存/更新数据范围配置（按 admin_user_id 唯一，upsert）。

    双维度：
      org_ids:   list[str] 组织维度（保存后 get_data_scope 会展开子树）
      field_ids: list[str] 花名册字段维度（可见字段白名单；空=全部可见）
      scope_type: 'org' / 'field' / 'all'（all 表示双维度同时启用）
    """
    db = _get_db()
    admin_user_id = req.get("admin_user_id") or req.get("user_id")
    if not admin_user_id:
        return {"code": 1, "msg": "缺少管理员用户"}
    scope_type = req.get("scope_type") or SCOPE_TYPE_ORG
    org_ids = req.get("org_ids") or []
    field_ids = req.get("field_ids") or []
    org_json = json.dumps(org_ids, ensure_ascii=False)
    field_json = json.dumps(field_ids, ensure_ascii=False)

    exists = db.query_one(
        "SELECT id FROM sys_data_scope WHERE admin_user_id = %s", (admin_user_id,)
    )
    if exists:
        db.execute(
            "UPDATE sys_data_scope SET scope_type = %s, org_ids_json = %s, field_ids_json = %s, "
            "remark = %s, updated_by = %s, updated_at = %s WHERE id = %s",
            (scope_type, org_json, field_json, req.get("remark", ""),
             req.get("operator_id", ""), _now(), exists["id"]),
        )
        return {"code": 0, "data": {"id": exists["id"]}}
    sid = _uuid()
    db.execute(
        "INSERT INTO sys_data_scope (id, admin_user_id, scope_type, org_ids_json, field_ids_json, "
        "remark, created_by, updated_by, created_at, updated_at) "
        "VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s)",
        (sid, admin_user_id, scope_type, org_json, field_json, req.get("remark", ""),
         req.get("operator_id", ""), req.get("operator_id", ""), _now(), _now()),
    )
    return {"code": 0, "data": {"id": sid}}


def scope_delete(req):
    """删除数据范围配置。"""
    scope_id = req.get("id")
    if not scope_id:
        return {"code": 1, "msg": "缺少配置 id"}
    db = _get_db()
    db.execute("DELETE FROM sys_data_scope WHERE id = %s", (scope_id,))
    return {"code": 0}


# ---------------------------------------------------------------------------
# 4. get_data_scope：查询叠加机制（公共横切能力）
# ---------------------------------------------------------------------------

def _expand_org_tree(db, org_ids):
    """组织维度子树展开：递归收集 org_unit 子节点（parent_id 自引用）。"""
    if not org_ids:
        return []
    result = set(org_ids)
    frontier = list(org_ids)
    seen = set(org_ids)
    while frontier:
        placeholders = ",".join(["%s"] * len(frontier))
        children = db.query(
            "SELECT id FROM org_unit WHERE parent_id IN (%s)" % placeholders, frontier
        )
        frontier = []
        for c in children:
            cid = c["id"]
            if cid not in seen:
                seen.add(cid)
                result.add(cid)
                frontier.append(cid)
    return sorted(result)


def get_data_scope(user_id):
    """获取指定用户的数据范围（组织 + 花名册字段双维度，多角色叠加）。

    叠加规则：
      - 组织维度：用户各角色对应 scope 的 org_ids 取并集（子树展开后）
      - 字段维度：取各 scope 的 field_ids 并集；若某 scope 未配置字段维度则视为
        “该角色字段不受限”，最终 field_all = True（否则为显式白名单）
      - admin / sys_admin 角色：返回 org_all = True（全组织，不受限）

    返回：
      {
        "org_all": bool,
        "org_ids": [str],        # 展开子树后的组织 id 集合
        "field_all": bool,
        "field_ids": [str],      # 花名册字段白名单
        "role_codes": [str]
      }
    该函数注册到 ServerEnv 公共上下文，供 roster/report/export 调用。
    """
    db = _get_db()
    # 用户绑定的角色
    roles = db.query(
        "SELECT r.role_code FROM sys_user_role ur "
        "JOIN sys_role r ON r.id = ur.role_id WHERE ur.user_id = %s",
        (user_id,),
    )
    role_codes = [r["role_code"] for r in roles]

    result = {
        "org_all": False,
        "org_ids": [],
        "field_all": False,
        "field_ids": [],
        "role_codes": role_codes,
    }

    # 系统管理员 / 内置 admin 拥有全量数据范围
    if ROLE_SYS_ADMIN in role_codes or ROLE_ADMIN in role_codes:
        result["org_all"] = True
        result["field_all"] = True
        return result

    scope_rows = db.query(
        "SELECT scope_type, org_ids_json, field_ids_json FROM sys_data_scope "
        "WHERE admin_user_id = %s",
        (user_id,),
    )
    if not scope_rows:
        # 无任何数据范围配置：按最小权限（空）返回，保证“默认拒绝”
        return result

    org_union = set()
    field_union = set()
    field_restricted = False
    for row in scope_rows:
        scope_type = row.get("scope_type") or ""
        org_ids = _json_loads(row.get("org_ids_json"), [])
        field_ids = _json_loads(row.get("field_ids_json"), [])

        if scope_type in (SCOPE_TYPE_ORG, "all") and org_ids:
            org_union.update(org_ids)
        if scope_type in (SCOPE_TYPE_FIELD, "all"):
            field_restricted = True
            field_union.update(field_ids)

    result["org_ids"] = _expand_org_tree(db, sorted(org_union))
    if field_restricted:
        result["field_ids"] = sorted(field_union)
    else:
        # 未配置字段维度 → 字段不受限
        result["field_all"] = True
    return result


def scope_query(req):
    """端点：查询当前（或指定）用户的数据范围，便于前端/联调自测。"""
    user_id = req.get("user_id") or req.get("operator_id") or req.get("uid")
    if not user_id:
        return {"code": 1, "msg": "缺少 user_id"}
    return {"code": 0, "data": get_data_scope(user_id)}


# ---------------------------------------------------------------------------
# 5. 内置 admin + 四角色权限初始化
# ---------------------------------------------------------------------------

def init_permission(db=None):
    """幂等初始化：内置 admin + 四角色 + 基础权限点。

    返回 {roles: int, users: int, perms: int}。
    权限点来源于各模块端点清单（wildcard 展开），此处建立基线授权；
    各业务模块初始化时按需追加自身权限点并授权给对应角色。
    """
    db = db or _get_db()
    now = _now()
    counts = {"roles": 0, "users": 0, "perms": 0}

    roles = [
        (ROLE_EMPLOYEE, "员工自助", "员工本人查看/修改个人档案、发起自助申请"),
        (ROLE_MANAGER, "经理", "管理本部门员工、发起并审批本部门人事异动"),
        (ROLE_HR_ADMIN, "HR管理员", "管理全公司人事业务，受数据范围约束"),
        (ROLE_SYS_ADMIN, "系统管理员", "系统配置、角色/管理员/数据范围/审计管理"),
    ]
    role_id_map = {}
    for code, name, remark in roles:
        row = db.query_one("SELECT id FROM sys_role WHERE role_code = %s", (code,))
        if not row:
            rid = _uuid()
            db.execute(
                "INSERT INTO sys_role (id, role_code, role_name, remark, created_by, created_at, updated_at) "
                "VALUES (%s, %s, %s, %s, %s, %s, %s)",
                (rid, code, name, remark, "system", now, now),
            )
            counts["roles"] += 1
        else:
            rid = row["id"]
        role_id_map[code] = rid

    # 内置 admin（如不存在）
    admin_row = db.query_one("SELECT id FROM sys_user WHERE username = 'admin'")
    if not admin_row:
        uid = _uuid()
        db.execute(
            "INSERT INTO sys_user (id, username, real_name, password, status, created_at, updated_at) "
            "VALUES (%s, %s, %s, %s, %s, %s, %s)",
            (uid, "admin", "系统管理员", "", 1, now, now),
        )
        counts["users"] += 1
    else:
        uid = admin_row["id"]

    # 内置 admin 绑定全部角色（等价于 sys_admin 全量权限）
    for code, rid in role_id_map.items():
        exists = db.query_one(
            "SELECT 1 AS x FROM sys_user_role WHERE user_id = %s AND role_id = %s",
            (uid, rid),
        )
        if not exists:
            db.execute(
                "INSERT INTO sys_user_role (user_id, role_id) VALUES (%s, %s)", (uid, rid)
            )

    # 基线权限点（rbac 路径级权限点，code 采用 "模块:路径" 命名）
    base_perms = [
        # 权限底座自身
        ("hr_system:role_admin", "角色权限配置", "/hr_system/role_admin"),
        ("hr_system:data_scope", "数据范围配置", "/hr_system/data_scope"),
        ("hr_system:audit_log", "操作日志查询", "/hr_system/audit_log"),
    ]
    perm_id_map = {}
    for code, name, path in base_perms:
        row = db.query_one("SELECT id FROM sys_permission WHERE perm_code = %s", (code,))
        if not row:
            pid = _uuid()
            db.execute(
                "INSERT INTO sys_permission (id, perm_code, perm_name, perm_path, created_at) "
                "VALUES (%s, %s, %s, %s, %s)",
                (pid, code, name, path, now),
            )
            counts["perms"] += 1
        else:
            pid = row["id"]
        perm_id_map[code] = pid

    # 系统管理员获得权限底座全部权限点
    for pid in perm_id_map.values():
        exists = db.query_one(
            "SELECT 1 AS x FROM sys_role_permission WHERE role_id = %s AND perm_id = %s",
            (role_id_map[ROLE_SYS_ADMIN], pid),
        )
        if not exists:
            db.execute(
                "INSERT INTO sys_role_permission (role_id, perm_id) VALUES (%s, %s)",
                (role_id_map[ROLE_SYS_ADMIN], pid),
            )

    return counts


# ---------------------------------------------------------------------------
# 端点注册表（供 ahserver 主程序 app/hr_web.py 加载）
# ---------------------------------------------------------------------------

ENDPOINTS = {
    "role_list": role_list,
    "role_detail": role_detail,
    "role_create": role_create,
    "role_update": role_update,
    "role_delete": role_delete,
    "role_assign_perms": role_assign_perms,
    "admin_list": admin_list,
    "admin_create": admin_create,
    "admin_bind_roles": admin_bind_roles,
    "admin_disable": admin_disable,
    "scope_list": scope_list,
    "scope_save": scope_save,
    "scope_delete": scope_delete,
    "scope_query": scope_query,
}


def register(server_env):
    """注册到 ahserver ServerEnv：暴露公共能力与端点。

    server_env.register_public('get_data_scope', get_data_scope)
    server_env.register_api(ENDPOINTS)
    """
    server_env.register_public("get_data_scope", get_data_scope)
    server_env.register_api(ENDPOINTS)
    log.info("hr-system 权限底座已注册：get_data_scope + %d 个端点", len(ENDPOINTS))