package admin

import (
	"context"

	adminv1 "service.xpcool.com/api/admin/admin/admin"
	"service.xpcool.com/internal/consts"
	cryptolib "service.xpcool.com/internal/library/crypto"
	"service.xpcool.com/internal/library/response"
	"service.xpcool.com/internal/model/dto"
	admin "service.xpcool.com/internal/service/admin/admin/admin"
)

// resolvePassword 解析创建/重置管理员时的密码：
// 密文（encryptedKey+encryptedData，RSA+AES 混合加密）优先；明文仅开发环境 allowPlain 时可用。
func resolvePassword(ctx context.Context, encryptedKey, encryptedData, password string) (string, error) {
	if encryptedKey != "" && encryptedData != "" {
		v, err := cryptolib.Get().DecryptField(ctx, encryptedKey, encryptedData)
		if err != nil {
			return "", response.Error(consts.CodeInvalidParam, err.Error())
		}
		return v, nil
	}
	if cryptolib.Get().AllowPlain() {
		return password, nil
	}
	return "", response.Error(consts.CodeInvalidParam, "encrypted payload required")
}

// AdminList 分页查询管理员。
func (c *Controller) AdminList(ctx context.Context, req *adminv1.AdminListReq) (res *adminv1.AdminListRes, err error) {
	items, total, err := admin.AdminManage().List(ctx, dto.PageQuery{Page: req.Page, Size: req.Size, Keyword: req.Keyword})
	if err != nil {
		return nil, err
	}
	list := make([]*adminv1.AdminItem, 0, len(items))
	for _, it := range items {
		list = append(list, &adminv1.AdminItem{
			Id: it.Id, Username: it.Username, Nickname: it.Nickname, Status: it.Status,
			RoleIds: it.RoleIds, RoleNames: it.RoleNames, CreatedAt: it.CreatedAt,
		})
	}
	return &adminv1.AdminListRes{List: list, Total: total}, nil
}

// AdminCreate 创建管理员。
func (c *Controller) AdminCreate(ctx context.Context, req *adminv1.AdminCreateReq) (res *adminv1.AdminCreateRes, err error) {
	password, err := resolvePassword(ctx, req.EncryptedKey, req.EncryptedData, req.Password)
	if err != nil {
		return nil, err
	}
	id, err := admin.AdminManage().Create(ctx, dto.AdminCreateInput{
		Username: req.Username, Password: password, Nickname: req.Nickname,
		BarkDeviceId: req.BarkDeviceId, PushplusToken: req.PushplusToken, RoleIds: req.RoleIds,
	})
	if err != nil {
		return nil, err
	}
	return &adminv1.AdminCreateRes{Id: id}, nil
}

// AdminUpdate 更新管理员。
func (c *Controller) AdminUpdate(ctx context.Context, req *adminv1.AdminUpdateReq) (res *adminv1.AdminUpdateRes, err error) {
	if err = admin.AdminManage().Update(ctx, dto.AdminUpdateInput{Id: req.Id, Nickname: req.Nickname, Status: req.Status,
		BarkDeviceId: req.BarkDeviceId, PushplusToken: req.PushplusToken, RoleIds: req.RoleIds}); err != nil {
		return nil, err
	}
	return &adminv1.AdminUpdateRes{}, nil
}

// AdminResetPwd 重置管理员密码。
func (c *Controller) AdminResetPwd(ctx context.Context, req *adminv1.AdminResetPwdReq) (res *adminv1.AdminResetPwdRes, err error) {
	password, err := resolvePassword(ctx, req.EncryptedKey, req.EncryptedData, req.Password)
	if err != nil {
		return nil, err
	}
	if err = admin.AdminManage().ResetPassword(ctx, req.Id, password); err != nil {
		return nil, err
	}
	return &adminv1.AdminResetPwdRes{}, nil
}

// AdminDelete 删除管理员。
func (c *Controller) AdminDelete(ctx context.Context, req *adminv1.AdminDeleteReq) (res *adminv1.AdminDeleteRes, err error) {
	if err = admin.AdminManage().Delete(ctx, req.Id); err != nil {
		return nil, err
	}
	return &adminv1.AdminDeleteRes{}, nil
}