#!/usr/bin/env python
# -*- coding: utf-8 -*-
"""
Auth API - 认证相关接口
"""
from datetime import timedelta, datetime, timezone

from fastapi import APIRouter, Depends, HTTPException, status, Request
from fastapi.security import OAuth2PasswordRequestForm
from sqlalchemy.ext.asyncio import AsyncSession

from app.config import settings
from app.database import get_db
from app.base_schema import ResponseModel
from utils.redis import RedisClient
from core.auth.schema import (
    LoginRequest,
    TokenResponse,
    RefreshTokenRequest,
    LoginUserInfo,
)
from core.user.service import UserService
from core.login_log.service import LoginLogService
from utils.client_info import get_client_info, get_device_id
from utils.security import (
    create_access_token,
    create_refresh_token,
    verify_refresh_token,
    get_current_user,
)

router = APIRouter(prefix="", tags=["认证管理"])

# Redis中存储refresh token的key前缀
REFRESH_TOKEN_PREFIX = "refresh_token:"
# Redis中存储token黑名单的key前缀
TOKEN_BLACKLIST_PREFIX = "token_blacklist:"


@router.post("/login", response_model=TokenResponse, summary="用户登录")
async def login(
    request: Request,
    data: LoginRequest,
    db: AsyncSession = Depends(get_db)
):
    """
    用户登录（JSON格式，供前端使用）
    
    - **username**: 用户名
    - **password**: 密码
    
    返回access_token和refresh_token
    """
    # 获取客户端信息和设备标识
    client_info = get_client_info(request)
    device_id = get_device_id(request)
    
    # 验证用户
    user = await UserService.authenticate(db, data.username, data.password)
    if not user:
        # 记录登录失败日志
        await LoginLogService.record_login(
            db=db,
            username=data.username,
            status=0,
            login_ip=client_info["login_ip"],
            failure_reason=2,  # 密码错误
            failure_message="用户名或密码错误",
            user_agent=client_info["user_agent"],
            browser_type=client_info["browser_type"],
            os_type=client_info["os_type"],
            device_type=client_info["device_type"],
            login_type="password",
        )
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="用户名或密码错误",
            headers={"WWW-Authenticate": "Bearer"},
        )
    
    # 检查用户状态
    if not user.is_active:
        # 记录登录失败日志
        await LoginLogService.record_login(
            db=db,
            username=data.username,
            user_id=user.id,
            status=0,
            login_ip=client_info["login_ip"],
            failure_reason=3,  # 用户已禁用
            failure_message="用户已被禁用",
            user_agent=client_info["user_agent"],
            browser_type=client_info["browser_type"],
            os_type=client_info["os_type"],
            device_type=client_info["device_type"],
            login_type="password",
        )
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="用户已被禁用"
        )
    
    if user.user_status != 1:
        status_msg = {0: "用户已禁用", 2: "用户已锁定"}.get(user.user_status, "用户状态异常")
        failure_reason = 3 if user.user_status == 0 else 4  # 3=禁用, 4=锁定
        # 记录登录失败日志
        await LoginLogService.record_login(
            db=db,
            username=data.username,
            user_id=user.id,
            status=0,
            login_ip=client_info["login_ip"],
            failure_reason=failure_reason,
            failure_message=status_msg,
            user_agent=client_info["user_agent"],
            browser_type=client_info["browser_type"],
            os_type=client_info["os_type"],
            device_type=client_info["device_type"],
            login_type="password",
        )
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail=status_msg
        )
    
    # 生成token（token中只存身份标识，不存角色等动态信息）
    access_token_expires = timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
    refresh_token_expires = timedelta(days=settings.REFRESH_TOKEN_EXPIRE_DAYS)
    
    token_data = {
        "sub": user.id,
        "username": user.username,
    }
    access_token = create_access_token(token_data, access_token_expires, device_id=device_id)
    refresh_token = create_refresh_token(token_data, refresh_token_expires, device_id=device_id)
    
    # 将用户动态信息缓存到 Redis（中间件从此处获取角色等信息）
    from utils.user_info_cache import set_cached_user_info
    role_ids = await UserService.get_user_role_ids(db, user.id)
    await set_cached_user_info(user.id, role_ids, user.dept_id, user.is_superuser)
    
    # 将refresh token存入Redis
    redis = await RedisClient.get_client()
    
    # 如果不允许多设备登录，删除该用户的所有旧设备token
    if not settings.ALLOW_MULTI_DEVICE_LOGIN:
        # 查找并删除该用户的所有refresh token和access token
        refresh_pattern = f"{REFRESH_TOKEN_PREFIX}{user.id}:*"
        access_pattern = f"access_token:{user.id}:*"
        
        # 删除所有refresh token
        cursor = 0
        while True:
            cursor, keys = await redis.scan(cursor, match=refresh_pattern, count=100)
            if keys:
                await redis.delete(*keys)
            if cursor == 0:
                break
        
        # 删除所有access token
        cursor = 0
        while True:
            cursor, keys = await redis.scan(cursor, match=access_pattern, count=100)
            if keys:
                await redis.delete(*keys)
            if cursor == 0:
                break
    
    # 存储新的refresh token
    await redis.set(
        f"{REFRESH_TOKEN_PREFIX}{user.id}:{device_id}",
        refresh_token,
        ex=int(refresh_token_expires.total_seconds())
    )
    
    # 存储 access token（用于判断设备在线状态）
    await redis.set(
        f"access_token:{user.id}:{device_id}",
        access_token,
        ex=int(access_token_expires.total_seconds())
    )
    
    # 存储设备信息
    device_info_key = f"device_info:{user.id}:{device_id}"
    await redis.hset(device_info_key, mapping={
        "device_type": client_info["device_type"],
        "browser_type": client_info["browser_type"] or "Unknown",
        "os_type": client_info["os_type"] or "Unknown",
        "ip_address": client_info["login_ip"],
        "last_active_time": datetime.now(timezone.utc).isoformat()
    })
    await redis.expire(device_info_key, int(refresh_token_expires.total_seconds()))
    
    # 更新最后登录时间和IP
    await UserService.update_login_info(db, user.id, login_type="password")
    
    # 记录登录成功日志
    await LoginLogService.record_login(
        db=db,
        username=user.username,
        user_id=user.id,
        status=1,
        login_ip=client_info["login_ip"],
        user_agent=client_info["user_agent"],
        browser_type=client_info["browser_type"],
        os_type=client_info["os_type"],
        device_type=client_info["device_type"],
        login_type="password",
    )
    
    return TokenResponse(
        accessToken=access_token,
        refreshToken=refresh_token,
        tokenType="bearer",
        expireTime=settings.ACCESS_TOKEN_EXPIRE_MINUTES * 60,
    )


@router.post("/login/oauth2", response_model=TokenResponse, summary="OAuth2登录(OAuth2)", include_in_schema=True)
async def login_oauth2(
    request: Request,
    form_data: OAuth2PasswordRequestForm = Depends(),
    db: AsyncSession = Depends(get_db)
):
    """
    用户登录（OAuth2表单格式，供Swagger使用）
    
    - **username**: 用户名
    - **password**: 密码
    
    返回access_token和refresh_token（标准OAuth2格式）
    """
    # 获取客户端信息和设备标识
    client_info = get_client_info(request)
    device_id = get_device_id(request)
    
    # 验证用户
    user = await UserService.authenticate(db, form_data.username, form_data.password)
    if not user:
        # 记录登录失败日志
        await LoginLogService.record_login(
            db=db,
            username=form_data.username,
            status=0,
            login_ip=client_info["login_ip"],
            failure_reason=2,
            failure_message="用户名或密码错误",
            user_agent=client_info["user_agent"],
            browser_type=client_info["browser_type"],
            os_type=client_info["os_type"],
            device_type=client_info["device_type"],
            login_type="password",
        )
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="用户名或密码错误",
            headers={"WWW-Authenticate": "Bearer"},
        )
    
    # 检查用户状态
    if not user.is_active:
        await LoginLogService.record_login(
            db=db,
            username=form_data.username,
            user_id=user.id,
            status=0,
            login_ip=client_info["login_ip"],
            failure_reason=3,
            failure_message="用户已被禁用",
            user_agent=client_info["user_agent"],
            browser_type=client_info["browser_type"],
            os_type=client_info["os_type"],
            device_type=client_info["device_type"],
            login_type="password",
        )
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="用户已被禁用"
        )
    
    if user.user_status != 1:
        status_msg = {0: "用户已禁用", 2: "用户已锁定"}.get(user.user_status, "用户状态异常")
        failure_reason = 3 if user.user_status == 0 else 4
        await LoginLogService.record_login(
            db=db,
            username=form_data.username,
            user_id=user.id,
            status=0,
            login_ip=client_info["login_ip"],
            failure_reason=failure_reason,
            failure_message=status_msg,
            user_agent=client_info["user_agent"],
            browser_type=client_info["browser_type"],
            os_type=client_info["os_type"],
            device_type=client_info["device_type"],
            login_type="password",
        )
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail=status_msg
        )
    
    # 生成token（token中只存身份标识，不存角色等动态信息）
    access_token_expires = timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
    refresh_token_expires = timedelta(days=settings.REFRESH_TOKEN_EXPIRE_DAYS)
    
    token_data = {
        "sub": user.id,
        "username": user.username,
    }
    access_token = create_access_token(token_data, access_token_expires, device_id=device_id)
    refresh_token = create_refresh_token(token_data, refresh_token_expires, device_id=device_id)
    
    # 将用户动态信息缓存到 Redis（中间件从此处获取角色等信息）
    from utils.user_info_cache import set_cached_user_info
    role_ids = await UserService.get_user_role_ids(db, user.id)
    await set_cached_user_info(user.id, role_ids, user.dept_id, user.is_superuser)
    
    # 将refresh token存入Redis
    redis = await RedisClient.get_client()
    
    # 如果不允许多设备登录，删除该用户的所有旧设备token
    if not settings.ALLOW_MULTI_DEVICE_LOGIN:
        # 查找并删除该用户的所有refresh token和access token
        refresh_pattern = f"{REFRESH_TOKEN_PREFIX}{user.id}:*"
        access_pattern = f"access_token:{user.id}:*"
        
        # 删除所有refresh token
        cursor = 0
        while True:
            cursor, keys = await redis.scan(cursor, match=refresh_pattern, count=100)
            if keys:
                await redis.delete(*keys)
            if cursor == 0:
                break
        
        # 删除所有access token
        cursor = 0
        while True:
            cursor, keys = await redis.scan(cursor, match=access_pattern, count=100)
            if keys:
                await redis.delete(*keys)
            if cursor == 0:
                break
    
    # 存储新的refresh token
    await redis.set(
        f"{REFRESH_TOKEN_PREFIX}{user.id}:{device_id}",
        refresh_token,
        ex=int(refresh_token_expires.total_seconds())
    )
    
    # 存储 access token（用于判断设备在线状态）
    await redis.set(
        f"access_token:{user.id}:{device_id}",
        access_token,
        ex=int(access_token_expires.total_seconds())
    )
    
    # 存储设备信息
    device_info_key = f"device_info:{user.id}:{device_id}"
    await redis.hset(device_info_key, mapping={
        "device_type": client_info["device_type"],
        "browser_type": client_info["browser_type"] or "Unknown",
        "os_type": client_info["os_type"] or "Unknown",
        "ip_address": client_info["login_ip"],
        "last_active_time": datetime.now(timezone.utc).isoformat()
    })
    await redis.expire(device_info_key, int(refresh_token_expires.total_seconds()))
    
    # 更新最后登录时间
    await UserService.update_login_info(db, user.id, login_type="password")
    
    # 记录登录成功日志
    await LoginLogService.record_login(
        db=db,
        username=user.username,
        user_id=user.id,
        status=1,
        login_ip=client_info["login_ip"],
        user_agent=client_info["user_agent"],
        browser_type=client_info["browser_type"],
        os_type=client_info["os_type"],
        device_type=client_info["device_type"],
        login_type="password",
    )
    
    return TokenResponse(
        accessToken=access_token,
        refreshToken=refresh_token,
        tokenType="bearer",
        expireTime=settings.ACCESS_TOKEN_EXPIRE_MINUTES * 60,
    )


@router.post("/refresh_token", response_model=TokenResponse, summary="刷新Token")
async def refresh_token(
    request: Request,
    data: RefreshTokenRequest,
    db: AsyncSession = Depends(get_db)
):
    """
    使用refresh_token获取新的access_token
    
    - **refresh_token**: 刷新令牌（在请求体中传递）
    
    返回新的access_token和refresh_token
    """
    print(f"[刷新Token] 收到请求")
    
    # 验证refresh token
    payload = verify_refresh_token(data.refresh_token)
    if not payload:
        print(f"[刷新Token] ❌ JWT验证失败")
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="无效的刷新令牌",
            headers={"WWW-Authenticate": "Bearer"},
        )
    
    user_id = payload.get("sub")
    device_id = payload.get("device_id")
    print(f"[刷新Token] JWT验证成功: user_id={user_id}, device_id={device_id}")
    
    if not user_id:
        print(f"[刷新Token] ❌ user_id为空")
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="无效的刷新令牌",
            headers={"WWW-Authenticate": "Bearer"},
        )
    
    # 如果 token 中没有 device_id，使用当前请求生成（兼容旧版本）
    if not device_id:
        device_id = get_device_id(request)
        print(f"[刷新Token] 生成device_id: {device_id}")
    
    # 检查refresh token是否在Redis中（防止已登出的token被使用）
    redis = await RedisClient.get_client()
    redis_key = f"{REFRESH_TOKEN_PREFIX}{user_id}:{device_id}"
    redis_key_prev = f"{REFRESH_TOKEN_PREFIX}{user_id}:{device_id}:prev"
    
    stored_token = await redis.get(redis_key)
    stored_prev_token = await redis.get(redis_key_prev)
    
    print(f"[刷新Token] Redis检查: current={stored_token is not None}, prev={stored_prev_token is not None}")
    
    # 如果Redis中没有任何token，说明用户已登出
    if not stored_token:
        print(f"[刷新Token] ❌ Redis中没有token，用户可能已登出")
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="刷新令牌已失效，请重新登录",
            headers={"WWW-Authenticate": "Bearer"},
        )
    
    # 验证token：当前token或上一个token都可以（处理并发刷新）
    is_current_token = (stored_token == data.refresh_token)
    is_prev_token = (stored_prev_token == data.refresh_token)
    
    print(f"[刷新Token] Token匹配: current={is_current_token}, prev={is_prev_token}")
    
    if not is_current_token and not is_prev_token:
        print(f"[刷新Token] ❌ Token不匹配")
        print(f"[刷新Token] 请求token前50字符: {data.refresh_token[:50]}")
        print(f"[刷新Token] Redis current前50字符: {stored_token[:50] if stored_token else 'None'}")
        print(f"[刷新Token] Redis prev前50字符: {stored_prev_token[:50] if stored_prev_token else 'None'}")
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="刷新令牌已失效",
            headers={"WWW-Authenticate": "Bearer"},
        )
    
    # 检查用户是否存在且有效
    user = await UserService.get_by_id(db, user_id)
    if not user or not user.is_active or user.user_status != 1:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="用户不存在或已被禁用",
            headers={"WWW-Authenticate": "Bearer"},
        )
    
    # 生成新的token（token中只存身份标识）
    access_token_expires = timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
    refresh_token_expires = timedelta(days=settings.REFRESH_TOKEN_EXPIRE_DAYS)
    
    token_data = {
        "sub": user.id,
        "username": user.username,
    }
    new_access_token = create_access_token(token_data, access_token_expires, device_id=device_id)
    new_refresh_token = create_refresh_token(token_data, refresh_token_expires, device_id=device_id)
    
    # 刷新 Redis 用户信息缓存（确保角色等信息是最新的）
    from utils.user_info_cache import set_cached_user_info
    role_ids = await UserService.get_user_role_ids(db, user.id)
    await set_cached_user_info(user.id, role_ids, user.dept_id, user.is_superuser)
    
    # 更新Redis中的refresh token（使用设备标识）
    redis = await RedisClient.get_client()
    
    # 保存当前token为上一个token（用于处理并发刷新）
    # 只有当使用的是当前token时才保存，避免旧token被重复使用
    if is_current_token and stored_token:
        await redis.set(
            f"{REFRESH_TOKEN_PREFIX}{user.id}:{device_id}:prev",
            stored_token,
            ex=60  # 上一个token只保留60秒，足够处理并发请求
        )
    
    # 存储新的refresh token
    await redis.set(
        f"{REFRESH_TOKEN_PREFIX}{user.id}:{device_id}",
        new_refresh_token,
        ex=int(refresh_token_expires.total_seconds())
    )
    
    # 更新 access token（用于判断设备在线状态）
    await redis.set(
        f"access_token:{user.id}:{device_id}",
        new_access_token,
        ex=int(access_token_expires.total_seconds())
    )
    
    return TokenResponse(
        accessToken=new_access_token,
        refreshToken=new_refresh_token,
        tokenType="bearer",
        expireTime=settings.ACCESS_TOKEN_EXPIRE_MINUTES * 60,
    )


@router.get("/logout", response_model=ResponseModel, summary="用户登出")
async def logout(request: Request):
    """
    用户登出
    
    需要携带有效的access_token
    """
    user_id = request.state.user_id
    device_id = get_device_id(request)
    
    # 删除Redis中的 refresh token 和 access token（仅删除当前设备的token）
    redis = await RedisClient.get_client()
    await redis.delete(f"{REFRESH_TOKEN_PREFIX}{user_id}:{device_id}")
    await redis.delete(f"{REFRESH_TOKEN_PREFIX}{user_id}:{device_id}:prev")
    await redis.delete(f"access_token:{user_id}:{device_id}")
    
    return ResponseModel(message="登出成功")


@router.get("/userinfo", response_model=LoginUserInfo, summary="获取当前用户信息")
async def get_me(
    current_user = Depends(get_current_user),
    db: AsyncSession = Depends(get_db)
):
    """
    获取当前登录用户信息
    
    需要携带有效的access_token
    """
    # 获取岗位名称
    post_name = None
    if hasattr(current_user, 'post') and current_user.post:
        post_name = current_user.post.name
    
    # 获取角色ID列表
    role_ids = await UserService.get_user_role_ids(db, current_user.id)
    
    return LoginUserInfo(
        id=current_user.id,
        username=current_user.username,
        email=current_user.email,
        mobile=current_user.mobile,
        avatar=current_user.avatar,
        name=current_user.name,
        gender=current_user.gender if current_user.gender is not None else 0,
        gender_display=current_user.get_gender_display(),
        user_type=current_user.user_type if current_user.user_type is not None else 1,
        user_type_display=current_user.get_user_type_display(),
        user_status=current_user.user_status if current_user.user_status is not None else 1,
        user_status_display=current_user.get_user_status_display(),
        birthday=current_user.birthday,
        city=current_user.city,
        address=current_user.address,
        bio=current_user.bio,
        is_superuser=current_user.is_superuser,
        is_active=current_user.is_active,
        dept_id=current_user.dept_id,
        post_id=current_user.post_id,
        post_name=post_name,
        manager_id=current_user.manager_id,
        role_ids=role_ids,
        last_login=current_user.last_login,
        last_login_ip=current_user.last_login_ip,
        last_login_type=current_user.last_login_type,
        sort=current_user.sort,
        is_deleted=current_user.is_deleted,
        sys_create_datetime=current_user.sys_create_datetime,
        sys_update_datetime=current_user.sys_update_datetime,
    )


@router.get("/menus", response_model=dict, summary="获取当前用户的菜单")
async def get_user_menus(
    current_user = Depends(get_current_user),
    db: AsyncSession = Depends(get_db)
):
    """
    获取当前用户有权访问的菜单树
    
    - 超级管理员返回所有菜单
    - 普通用户返回角色关联的菜单
    """
    from sqlalchemy import select
    from sqlalchemy.orm import selectinload
    from core.menu.model import Menu
    from core.role.model import Role
    
    # 超级管理员获取所有菜单
    if current_user.is_superuser:
        result = await db.execute(
            select(Menu).where(
                Menu.is_deleted == False  # noqa: E712
            ).order_by(Menu.sort, Menu.sys_create_datetime)
        )
        all_menus = list(result.scalars().all())
    else:
        # 普通用户获取角色关联的菜单（支持多角色）
        from core.user.service import UserService
        role_ids = await UserService.get_user_role_ids(db, current_user.id)
        
        if not role_ids:
            return {"menus": [], "home": None}
        
        # 获取所有角色的菜单并合并（去重）
        all_menus_dict = {}
        for role_id in role_ids:
            result = await db.execute(
                select(Role)
                .options(selectinload(Role.menus))
                .where(
                    Role.id == role_id,
                    Role.status == True,  # noqa: E712
                    Role.is_deleted == False  # noqa: E712
                )
            )
            role = result.scalar_one_or_none()
            
            if role and role.menus:
                for menu in role.menus:
                    if not menu.is_deleted:
                        all_menus_dict[menu.id] = menu
        
        all_menus = list(all_menus_dict.values())
    
    # 构建菜单树
    menu_map = {}
    root_menus = []
    
    for menu in all_menus:
        menu_node = {
            "id": menu.id,
            "name": menu.name,
            "title": menu.title,
            "path": menu.path,
            "component": menu.component,
            "icon": menu.icon,
            "menu_type": menu.type,
            "parent_id": menu.parent_id,
            "sort": menu.sort,
            "is_hidden": menu.hideInMenu,
            "is_cache": menu.keepAlive,
            "is_affix": menu.affixTab,
            "redirect": menu.redirect,
            "children": [],
        }
        menu_map[menu.id] = menu_node
    
    # 建立父子关系
    for menu in all_menus:
        if menu.parent_id and menu.parent_id in menu_map:
            menu_map[menu.parent_id]["children"].append(menu_map[menu.id])
        else:
            root_menus.append(menu_map[menu.id])
    
    # 按sort排序
    def sort_menus(menus):
        menus.sort(key=lambda x: x.get("sort", 0))
        for menu in menus:
            if menu.get("children"):
                sort_menus(menu["children"])
    
    sort_menus(root_menus)
    
    # 获取首页
    home = None
    for menu in all_menus:
        if menu.affixTab and menu.type == "menu":
            home = menu.path
            break
    
    return {"menus": root_menus, "home": home}


@router.get("/permissions", response_model=dict, summary="获取当前用户的权限")
async def get_user_permissions(
    current_user = Depends(get_current_user),
    db: AsyncSession = Depends(get_db)
):
    """
    获取当前用户的权限码列表
    
    - 超级管理员返回 ["*"]（代表所有权限）
    - 普通用户返回角色关联的权限码列表
    """
    from sqlalchemy import select
    from sqlalchemy.orm import selectinload
    from core.role.model import Role
    
    # 超级管理员拥有所有权限
    if current_user.is_superuser:
        return {"permissions": ["*"], "is_superuser": True}
    
    # 普通用户获取所有角色关联的权限（支持多角色）
    from core.user.service import UserService
    role_ids = await UserService.get_user_role_ids(db, current_user.id)
    
    if not role_ids:
        return {"permissions": [], "is_superuser": False}
    
    # 遍历所有角色，收集权限码并去重
    permission_codes_set = set()
    for role_id in role_ids:
        result = await db.execute(
            select(Role)
            .options(selectinload(Role.permissions))
            .where(
                Role.id == role_id,
                Role.status == True,  # noqa: E712
                Role.is_deleted == False  # noqa: E712
            )
        )
        role = result.scalar_one_or_none()
        if role and role.permissions:
            for perm in role.permissions:
                if perm.is_active:
                    permission_codes_set.add(perm.code)
    
    return {"permissions": list(permission_codes_set), "is_superuser": False}
