package alertreceiverconformance

import (
	"bytes"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"regexp"
	"slices"
	"sort"
	"strings"
	"time"

	"github.com/google/uuid"
)

const (
	CaptureSchema = "alert-receiver-capture-v1"
	ReportSchema  = "alert-receiver-conformance-report-v1"
)

var buildDigestPattern = regexp.MustCompile(`^sha256:[0-9a-f]{64}$`)

type CloudRoutes struct {
	Items []CloudRoute `json:"items"`
}

type CloudRoute struct {
	ID                      string    `json:"id"`
	TenantID                string    `json:"tenant_id"`
	Category                string    `json:"category"`
	Severity                string    `json:"severity"`
	Status                  string    `json:"status"`
	ReceiverGroup           string    `json:"receiver_group"`
	EscalationReceiverGroup string    `json:"escalation_receiver_group"`
	RunbookRef              string    `json:"runbook_ref"`
	CreatedAt               time.Time `json:"created_at"`
	UpdatedAt               time.Time `json:"updated_at"`
}

type CloudTests struct {
	Items []CloudTest `json:"items"`
}

type CloudTest struct {
	ID              string     `json:"id"`
	TestRef         string     `json:"test_ref"`
	RoutingPolicyID string     `json:"routing_policy_id"`
	ReceiverGroup   string     `json:"receiver_group"`
	Status          string     `json:"status"`
	AttemptCount    int        `json:"attempt_count"`
	CreatedAt       time.Time  `json:"created_at"`
	CompletedAt     *time.Time `json:"completed_at,omitempty"`
}

type CloudIncident struct {
	ID            string        `json:"id"`
	Status        string        `json:"status"`
	ReceiverGroup *string       `json:"receiver_group,omitempty"`
	FirstDetected time.Time     `json:"first_detected_at"`
	ResolvedAt    *time.Time    `json:"resolved_at,omitempty"`
	Actions       []CloudAction `json:"actions"`
}

type CloudAction struct {
	ActionType string    `json:"action_type"`
	CreatedAt  time.Time `json:"created_at"`
}

type ReceiverCapture struct {
	SchemaVersion    string             `json:"schema_version"`
	EvidenceSource   string             `json:"evidence_source"`
	CandidateVersion string             `json:"candidate_version"`
	BuildDigest      string             `json:"build_digest"`
	ReceiverSystem   string             `json:"receiver_system_ref"`
	CollectedAt      time.Time          `json:"collected_at"`
	GroupMappings    []GroupMapping     `json:"group_mappings"`
	TestReceipts     []TestReceipt      `json:"test_receipts"`
	FormalDrill      FormalDrillCapture `json:"formal_drill"`
}

type GroupMapping struct {
	ReceiverGroup    string    `json:"receiver_group"`
	MappedTargetRefs []string  `json:"mapped_target_refs"`
	VerifiedAt       time.Time `json:"verified_at"`
}

type TestReceipt struct {
	TestRef           string    `json:"test_ref"`
	EventID           string    `json:"event_id"`
	ReceiverGroup     string    `json:"receiver_group"`
	DeliveryCount     int       `json:"delivery_count"`
	SignatureVerified bool      `json:"signature_verified"`
	ReceivedAt        time.Time `json:"received_at"`
}

type FormalDrillCapture struct {
	IncidentID         string    `json:"incident_id"`
	ReceiverGroup      string    `json:"receiver_group"`
	DeliveryCount      int       `json:"delivery_count"`
	SignatureVerified  bool      `json:"signature_verified"`
	ControlledDrill    bool      `json:"controlled_drill"`
	ReceivedAt         time.Time `json:"received_at"`
	AcknowledgedAt     time.Time `json:"acknowledged_at"`
	AcknowledgementRef string    `json:"acknowledgement_ref"`
}

type RouteCoverage struct {
	RoutingPolicyID string `json:"routing_policy_id"`
	ReceiverGroup   string `json:"receiver_group"`
	TestRef         string `json:"test_ref"`
	Status          string `json:"status"`
}

type Check struct {
	Code   string `json:"code"`
	Status string `json:"status"`
	Detail string `json:"detail"`
}

type Report struct {
	SchemaVersion              string            `json:"schema_version"`
	Result                     string            `json:"result"`
	GeneratedAt                time.Time         `json:"generated_at"`
	CandidateVersion           string            `json:"candidate_version"`
	BuildDigest                string            `json:"build_digest"`
	EvidenceScope              string            `json:"evidence_scope"`
	ExternalValidationRequired bool              `json:"external_validation_required"`
	TenantID                   string            `json:"tenant_id"`
	ReceiverSystemRef          string            `json:"receiver_system_ref"`
	ActiveRouteCount           int               `json:"active_route_count"`
	MappedGroupCount           int               `json:"mapped_group_count"`
	TestReceiptCount           int               `json:"test_receipt_count"`
	FormalDrillVerified        bool              `json:"formal_drill_verified"`
	RouteCoverage              []RouteCoverage   `json:"route_coverage"`
	InputSHA256                map[string]string `json:"input_sha256"`
	Checks                     []Check           `json:"checks"`
	Disclaimer                 string            `json:"disclaimer"`
}

func ParseRoutes(content []byte) (CloudRoutes, error) {
	var routes CloudRoutes
	if err := decodeEnvelope(content, &routes); err != nil {
		return CloudRoutes{}, fmt.Errorf("decode alert routes: %w", err)
	}
	return routes, nil
}

func ParseTests(content []byte) (CloudTests, error) {
	var tests CloudTests
	if err := decodeEnvelope(content, &tests); err != nil {
		return CloudTests{}, fmt.Errorf("decode alert delivery tests: %w", err)
	}
	return tests, nil
}

func ParseIncident(content []byte) (CloudIncident, error) {
	var incident CloudIncident
	if err := decodeEnvelope(content, &incident); err != nil {
		return CloudIncident{}, fmt.Errorf("decode alert incident: %w", err)
	}
	return incident, nil
}

func ParseCapture(content []byte) (ReceiverCapture, error) {
	var capture ReceiverCapture
	if err := decodeStrict(content, &capture); err != nil {
		return ReceiverCapture{}, fmt.Errorf("decode alert receiver capture: %w", err)
	}
	return capture, nil
}

func ParseReport(content []byte) (Report, error) {
	var report Report
	if err := decodeStrict(content, &report); err != nil {
		return Report{}, fmt.Errorf("decode alert receiver report: %w", err)
	}
	return report, nil
}

func Evaluate(routes CloudRoutes, tests CloudTests, incident CloudIncident, capture ReceiverCapture, candidateVersion, buildDigest string, generatedAt time.Time) Report {
	candidateVersion = strings.TrimSpace(candidateVersion)
	buildDigest = strings.ToLower(strings.TrimSpace(buildDigest))
	report := Report{
		SchemaVersion: ReportSchema, Result: "PASS", GeneratedAt: generatedAt.UTC(), CandidateVersion: candidateVersion,
		BuildDigest: buildDigest, EvidenceScope: "MOCK_RECEIVER", ExternalValidationRequired: true,
		ReceiverSystemRef: capture.ReceiverSystem, MappedGroupCount: len(capture.GroupMappings), TestReceiptCount: len(capture.TestReceipts),
		RouteCoverage: []RouteCoverage{}, InputSHA256: map[string]string{}, Checks: []Check{},
		Disclaimer: "联通一致性报告只证明所提供的活动路由、云端投递、接收端验签回执和值班组映射相互匹配；不替代业务发布审批。",
	}
	if capture.EvidenceSource == "REAL" {
		report.EvidenceScope = "REAL_RECEIVER"
	}
	add := func(code string, ok bool, detail string) {
		status := "PASS"
		if !ok {
			status, report.Result = "FAIL", "FAIL"
		}
		report.Checks = append(report.Checks, Check{Code: code, Status: status, Detail: detail})
	}
	add("CAPTURE_SCHEMA", capture.SchemaVersion == CaptureSchema, "接收端证据必须使用"+CaptureSchema)
	add("EVIDENCE_SOURCE", capture.EvidenceSource == "REAL" || capture.EvidenceSource == "MOCK", "证据来源必须明确为REAL或MOCK")
	add("CANDIDATE_IDENTITY", candidateVersion != "" && buildDigestPattern.MatchString(buildDigest), "候选版本和sha256构建摘要必须完整")
	add("CAPTURE_CANDIDATE_BINDING", capture.CandidateVersion == candidateVersion && strings.ToLower(capture.BuildDigest) == buildDigest, "接收端证据必须绑定命令指定的同一候选版本和构建摘要")
	add("RECEIVER_IDENTITY", strings.TrimSpace(capture.ReceiverSystem) != "" && len(capture.ReceiverSystem) <= 200, "接收系统必须使用不含凭据的稳定引用")

	active := make([]CloudRoute, 0, len(routes.Items))
	tenant := ""
	routesOK := true
	for _, route := range routes.Items {
		if route.Status != "ACTIVE" {
			continue
		}
		active = append(active, route)
		if tenant == "" {
			tenant = route.TenantID
		}
		if !validUUID(route.ID) || !validUUID(route.TenantID) || route.TenantID != tenant || route.ReceiverGroup == "" || route.EscalationReceiverGroup == "" || route.RunbookRef == "" || route.CreatedAt.IsZero() || route.UpdatedAt.IsZero() {
			routesOK = false
		}
	}
	sort.Slice(active, func(i, j int) bool { return active[i].ID < active[j].ID })
	report.TenantID, report.ActiveRouteCount = tenant, len(active)
	add("ACTIVE_ROUTES", routesOK && len(active) > 0, "必须导出同一租户至少一条字段完整的活动路由")

	mappings, mappingsOK := validateMappings(capture.GroupMappings, capture.CollectedAt)
	allGroupsMapped := mappingsOK
	for _, route := range active {
		if !mappings[route.ReceiverGroup] || !mappings[route.EscalationReceiverGroup] {
			allGroupsMapped = false
		}
	}
	add("RECEIVER_GROUP_MAPPING", allGroupsMapped, "每条活动路由的主接收组和升级接收组必须映射到至少一个脱敏目标引用")

	receipts, receiptsOK := validateReceipts(capture.TestReceipts, capture.CollectedAt)
	coverageOK := routesOK && len(active) > 0 && receiptsOK
	correlationOK := true
	for _, route := range active {
		test, found := latestDeliveredTest(tests.Items, route)
		coverage := RouteCoverage{RoutingPolicyID: route.ID, ReceiverGroup: route.ReceiverGroup, Status: "FAIL"}
		if !found {
			coverageOK = false
			report.RouteCoverage = append(report.RouteCoverage, coverage)
			continue
		}
		coverage.TestRef = test.TestRef
		receipt, found := receipts[test.TestRef]
		if !found || receipt.ReceiverGroup != route.ReceiverGroup || receipt.DeliveryCount != 1 || !receipt.SignatureVerified {
			coverageOK = false
		} else {
			coverage.Status = "PASS"
			if test.CompletedAt == nil || absoluteDuration(receipt.ReceivedAt.Sub(*test.CompletedAt)) > 10*time.Minute {
				correlationOK = false
			}
		}
		report.RouteCoverage = append(report.RouteCoverage, coverage)
	}
	coverageOK = coverageOK && len(receipts) == len(active)
	add("DELIVERY_TEST_COVERAGE", coverageOK, "每条活动路由必须有一条DELIVERED云端测试和唯一接收端验签回执")
	add("DELIVERY_TIME_CORRELATION", coverageOK && correlationOK, "云端完成时间与接收端时间差不得超过10分钟")

	drillOK := validateFormalDrill(incident, capture.FormalDrill, mappings, capture.CollectedAt)
	report.FormalDrillVerified = drillOK
	add("FORMAL_ALERT_DRILL", drillOK, "必须绑定一条已解决、已确认、唯一验签送达且具有接收人确认引用的正式受控告警演练")
	if capture.EvidenceSource == "REAL" && drillOK && coverageOK && allGroupsMapped && correlationOK {
		report.ExternalValidationRequired = false
	}
	return report
}

func SHA256(content []byte) string {
	digest := sha256.Sum256(content)
	return hex.EncodeToString(digest[:])
}

func decodeEnvelope(content []byte, target any) error {
	var envelope struct {
		Data json.RawMessage `json:"data"`
	}
	if err := json.Unmarshal(content, &envelope); err != nil {
		return err
	}
	payload := content
	if len(envelope.Data) > 0 && string(envelope.Data) != "null" {
		payload = envelope.Data
	}
	return json.Unmarshal(payload, target)
}

func decodeStrict(content []byte, target any) error {
	decoder := json.NewDecoder(bytes.NewReader(content))
	decoder.DisallowUnknownFields()
	if err := decoder.Decode(target); err != nil {
		return err
	}
	var trailing any
	if err := decoder.Decode(&trailing); !errors.Is(err, io.EOF) {
		return errors.New("trailing JSON data")
	}
	return nil
}

func validateMappings(items []GroupMapping, collectedAt time.Time) (map[string]bool, bool) {
	result, ok := map[string]bool{}, !collectedAt.IsZero()
	for _, item := range items {
		if item.ReceiverGroup == "" || result[item.ReceiverGroup] || item.VerifiedAt.IsZero() || item.VerifiedAt.After(collectedAt) || len(item.MappedTargetRefs) == 0 {
			ok = false
		}
		targets := slices.Clone(item.MappedTargetRefs)
		sort.Strings(targets)
		for index, target := range targets {
			if strings.TrimSpace(target) == "" || len(target) > 200 || (index > 0 && target == targets[index-1]) {
				ok = false
			}
		}
		result[item.ReceiverGroup] = true
	}
	return result, ok
}

func validateReceipts(items []TestReceipt, collectedAt time.Time) (map[string]TestReceipt, bool) {
	result, ok := map[string]TestReceipt{}, !collectedAt.IsZero()
	for _, item := range items {
		if !validUUID(item.TestRef) || !validUUID(item.EventID) || item.ReceiverGroup == "" || item.DeliveryCount != 1 || !item.SignatureVerified || item.ReceivedAt.IsZero() || item.ReceivedAt.After(collectedAt) || result[item.TestRef].TestRef != "" {
			ok = false
		}
		result[item.TestRef] = item
	}
	return result, ok
}

func latestDeliveredTest(items []CloudTest, route CloudRoute) (CloudTest, bool) {
	var selected CloudTest
	for _, item := range items {
		if item.RoutingPolicyID != route.ID || item.Status != "DELIVERED" || item.ReceiverGroup != route.ReceiverGroup || !validUUID(item.ID) || !validUUID(item.TestRef) || item.AttemptCount < 1 || item.CreatedAt.IsZero() || item.CompletedAt == nil || item.CompletedAt.Before(item.CreatedAt) || item.CreatedAt.Before(route.CreatedAt) {
			continue
		}
		if selected.ID == "" || item.CompletedAt.After(*selected.CompletedAt) {
			selected = item
		}
	}
	return selected, selected.ID != ""
}

func validateFormalDrill(incident CloudIncident, drill FormalDrillCapture, mappings map[string]bool, collectedAt time.Time) bool {
	if !validUUID(incident.ID) || incident.ID != drill.IncidentID || incident.Status != "RESOLVED" || incident.ReceiverGroup == nil || *incident.ReceiverGroup != drill.ReceiverGroup || !mappings[drill.ReceiverGroup] || incident.FirstDetected.IsZero() || incident.ResolvedAt == nil {
		return false
	}
	acknowledged := false
	for _, action := range incident.Actions {
		if action.ActionType == "ACKNOWLEDGED" && !action.CreatedAt.IsZero() {
			acknowledged = true
		}
	}
	return acknowledged && drill.ControlledDrill && drill.DeliveryCount == 1 && drill.SignatureVerified && !drill.ReceivedAt.IsZero() && !drill.AcknowledgedAt.IsZero() && drill.ReceivedAt.Before(drill.AcknowledgedAt.Add(time.Nanosecond)) && !drill.AcknowledgedAt.After(collectedAt) && strings.TrimSpace(drill.AcknowledgementRef) != ""
}

func validUUID(value string) bool {
	_, err := uuid.Parse(value)
	return err == nil
}

func absoluteDuration(value time.Duration) time.Duration {
	if value < 0 {
		return -value
	}
	return value
}