package hardwarelicense

import (
	"context"
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"crypto/sha256"
	"encoding/hex"
	"errors"
	"fmt"
	"io"
	"regexp"
	"strings"
	"time"

	"data-terminal-cloud/internal/audit"
	"data-terminal-cloud/internal/deviceactivation"
	"data-terminal-cloud/internal/deviceauth"
	"data-terminal-cloud/internal/identity"

	"github.com/jackc/pgx/v5"
	"github.com/jackc/pgx/v5/pgxpool"
)

var (
	ErrInvalid         = errors.New("invalid hardware license input")
	ErrAccessDenied    = errors.New("hardware license access denied")
	ErrNotFound        = errors.New("hardware license not found")
	ErrUnavailable     = errors.New("no hardware license is available")
	ErrAssignment      = errors.New("hardware license assignment mismatch")
	ErrExpired         = errors.New("hardware license expired")
	ErrAcknowledgement = errors.New("hardware license acknowledgement invalid")
	ErrVersionConflict = errors.New("hardware license version conflict")
)

var referencePattern = regexp.MustCompile(`^[a-zA-Z0-9_\-.:@/]{1,200}$`)

type Service struct {
	pool  *pgxpool.Pool
	audit *audit.Repository
	aead  cipher.AEAD
}

type ImportInput struct {
	LicenseRef string
	Payload    string
	InstanceID string
	ProductKey string
	ExpiresAt  time.Time
}

type Item struct {
	ID                string     `json:"id"`
	LicenseRef        string     `json:"license_ref"`
	Provider          string     `json:"provider"`
	InstanceID        string     `json:"instance_id"`
	ProductKey        string     `json:"product_key"`
	Status            string     `json:"status"`
	AllocatedDeviceID *string    `json:"allocated_device_id,omitempty"`
	AllocatedAt       *time.Time `json:"allocated_at,omitempty"`
	ActivatedAt       *time.Time `json:"activated_at,omitempty"`
	ExpiresAt         time.Time  `json:"expires_at"`
	LastErrorCode     *string    `json:"last_error_code,omitempty"`
	CreatedAt         time.Time  `json:"created_at"`
	UpdatedAt         time.Time  `json:"updated_at"`
	Version           int64      `json:"version"`
}

type Delivery struct {
	LicenseRef string    `json:"license_ref"`
	License    string    `json:"license"`
	Digest     string    `json:"digest"`
	ExpiresAt  time.Time `json:"expires_at"`
	Status     string    `json:"status"`
}

type AcknowledgeInput struct {
	LicenseRef string
	Digest     string
	Result     string
	ErrorCode  string
}

func NewService(pool *pgxpool.Pool, auditRepository *audit.Repository, masterKey string) (*Service, error) {
	if pool == nil || auditRepository == nil {
		return nil, errors.New("hardware license service dependencies are required")
	}
	key, err := hex.DecodeString(strings.TrimSpace(masterKey))
	if err != nil || len(key) != 32 {
		return nil, errors.New("hardware license master key must be 32 bytes encoded as 64 hexadecimal characters")
	}
	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, fmt.Errorf("create hardware license cipher: %w", err)
	}
	aead, err := cipher.NewGCM(block)
	if err != nil {
		return nil, fmt.Errorf("create hardware license AEAD: %w", err)
	}
	return &Service{pool: pool, audit: auditRepository, aead: aead}, nil
}

func (s *Service) Import(ctx context.Context, principal identity.Principal, tenantPublicID, requestID string, input ImportInput) (Item, error) {
	input.LicenseRef = strings.TrimSpace(input.LicenseRef)
	input.Payload = strings.TrimSpace(input.Payload)
	input.InstanceID = strings.TrimSpace(input.InstanceID)
	input.ProductKey = strings.TrimSpace(input.ProductKey)
	if !referencePattern.MatchString(input.LicenseRef) || input.InstanceID == "" || len(input.InstanceID) > 200 || input.ProductKey == "" || len(input.ProductKey) > 200 ||
		len(input.Payload) < 8 || len(input.Payload) > 65536 || !input.ExpiresAt.After(time.Now().UTC()) {
		return Item{}, ErrInvalid
	}
	tx, err := s.pool.Begin(ctx)
	if err != nil {
		return Item{}, err
	}
	defer tx.Rollback(ctx)
	access, err := requireAccess(ctx, tx, principal, tenantPublicID, true)
	if err != nil {
		return Item{}, err
	}
	digestBytes := sha256.Sum256([]byte(input.Payload))
	digest := hex.EncodeToString(digestBytes[:])
	nonce := make([]byte, s.aead.NonceSize())
	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
		return Item{}, err
	}
	encrypted := s.aead.Seal(nil, nonce, []byte(input.Payload), licenseAAD(input.LicenseRef, input.InstanceID, input.ProductKey, input.ExpiresAt))
	var item Item
	err = tx.QueryRow(ctx, `INSERT INTO hardware_agent_license(
		tenant_id,provider,instance_id,product_key,license_ref,payload_digest,encrypted_payload,nonce,status,expires_at
	) VALUES($1::uuid,'volcengine',$2,$3,$4,$5,$6,$7,'AVAILABLE',$8)
	RETURNING public_id::text,license_ref,provider,instance_id,product_key,status,NULL::text,allocated_at,activated_at,expires_at,last_error_code,created_at,updated_at,version`,
		access.tenantID, input.InstanceID, input.ProductKey, input.LicenseRef, digest, encrypted, nonce, input.ExpiresAt).
		Scan(&item.ID, &item.LicenseRef, &item.Provider, &item.InstanceID, &item.ProductKey, &item.Status, &item.AllocatedDeviceID, &item.AllocatedAt, &item.ActivatedAt, &item.ExpiresAt, &item.LastErrorCode, &item.CreatedAt, &item.UpdatedAt, &item.Version)
	if err != nil {
		return Item{}, fmt.Errorf("import hardware license: %w", err)
	}
	if err := s.audit.Record(ctx, tx, audit.Event{TenantID: &access.tenantID, ActorType: "user", ActorPublicID: &access.userPublicID, Action: "ops.hardware_license.import", ResourceType: "hardware_agent_license", ResourceID: &item.ID, RequestID: requestID, Result: "success", Detail: map[string]any{"license_ref": item.LicenseRef, "product_key": item.ProductKey, "expires_at": item.ExpiresAt, "payload_digest": digest}}); err != nil {
		return Item{}, err
	}
	if err := tx.Commit(ctx); err != nil {
		return Item{}, err
	}
	return item, nil
}

func (s *Service) List(ctx context.Context, principal identity.Principal, tenantPublicID string) ([]Item, error) {
	access, err := requireAccess(ctx, s.pool, principal, tenantPublicID, false)
	if err != nil {
		return nil, err
	}
	_, _ = s.pool.Exec(ctx, `UPDATE hardware_agent_license SET status='EXPIRED',updated_at=now(),version=version+1 WHERE tenant_id=$1::uuid AND expires_at<=now() AND status IN ('AVAILABLE','ALLOCATED','ACTIVE','SUSPENDED')`, access.tenantID)
	rows, err := s.pool.Query(ctx, `SELECT l.public_id::text,l.license_ref,l.provider,l.instance_id,l.product_key,l.status,d.public_id::text,l.allocated_at,l.activated_at,l.expires_at,l.last_error_code,l.created_at,l.updated_at,l.version FROM hardware_agent_license l LEFT JOIN device d ON d.id=l.allocated_device_id WHERE l.tenant_id=$1::uuid ORDER BY l.created_at DESC`, access.tenantID)
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	items := make([]Item, 0)
	for rows.Next() {
		var item Item
		if err := rows.Scan(&item.ID, &item.LicenseRef, &item.Provider, &item.InstanceID, &item.ProductKey, &item.Status, &item.AllocatedDeviceID, &item.AllocatedAt, &item.ActivatedAt, &item.ExpiresAt, &item.LastErrorCode, &item.CreatedAt, &item.UpdatedAt, &item.Version); err != nil {
			return nil, err
		}
		items = append(items, item)
	}
	return items, rows.Err()
}

func (s *Service) Revoke(ctx context.Context, principal identity.Principal, tenantPublicID, licensePublicID, requestID string, expectedVersion int64) (Item, error) {
	return s.transitionInventory(ctx, principal, tenantPublicID, licensePublicID, requestID, expectedVersion, "REVOKED")
}

func (s *Service) Release(ctx context.Context, principal identity.Principal, tenantPublicID, licensePublicID, requestID string, expectedVersion int64) (Item, error) {
	return s.transitionInventory(ctx, principal, tenantPublicID, licensePublicID, requestID, expectedVersion, "AVAILABLE")
}

func (s *Service) transitionInventory(ctx context.Context, principal identity.Principal, tenantPublicID, licensePublicID, requestID string, expectedVersion int64, target string) (Item, error) {
	tx, err := s.pool.Begin(ctx)
	if err != nil {
		return Item{}, err
	}
	defer tx.Rollback(ctx)
	access, err := requireAccess(ctx, tx, principal, tenantPublicID, true)
	if err != nil {
		return Item{}, err
	}
	var internalID, status string
	var version int64
	var deviceID *string
	if err := tx.QueryRow(ctx, `SELECT id::text,status,version,allocated_device_id::text FROM hardware_agent_license WHERE public_id=$1::uuid AND tenant_id=$2::uuid FOR UPDATE`, licensePublicID, access.tenantID).Scan(&internalID, &status, &version, &deviceID); errors.Is(err, pgx.ErrNoRows) {
		return Item{}, ErrNotFound
	} else if err != nil {
		return Item{}, err
	}
	if version != expectedVersion {
		return Item{}, ErrVersionConflict
	}
	if target == "AVAILABLE" && (status != "SUSPENDED" || deviceID == nil) {
		return Item{}, ErrAssignment
	}
	if target == "AVAILABLE" && deviceID != nil {
		var bound bool
		if err := tx.QueryRow(ctx, `SELECT EXISTS(SELECT 1 FROM device_binding WHERE device_id=$1::uuid AND unbound_at IS NULL)`, *deviceID).Scan(&bound); err != nil {
			return Item{}, err
		}
		if bound {
			return Item{}, ErrAssignment
		}
	}
	if target == "REVOKED" && status == "REVOKED" {
		return Item{}, ErrAssignment
	}
	if target == "REVOKED" && deviceID != nil {
		var activationState string
		if err := tx.QueryRow(ctx, `SELECT activation_state FROM device WHERE id=$1::uuid AND tenant_id=$2::uuid FOR UPDATE`, *deviceID, access.tenantID).Scan(&activationState); err != nil {
			return Item{}, err
		}
		if activationState == string(deviceactivation.Active) {
			if _, err := deviceactivation.Apply(ctx, tx, deviceactivation.Input{DeviceID: *deviceID, TenantID: access.tenantID,
				Target: deviceactivation.Provisioning, Reason: "硬件智能体License已吊销", Source: "license-revoke", ActorType: "user",
				ActorPublicID: &access.userPublicID, RequestID: requestID}); err != nil {
				return Item{}, err
			}
		}
	}
	var item Item
	query := `UPDATE hardware_agent_license SET status=$3,
		allocated_device_id=CASE WHEN $3='AVAILABLE' THEN NULL ELSE allocated_device_id END,
		allocated_at=CASE WHEN $3='AVAILABLE' THEN NULL ELSE allocated_at END,
		activated_at=CASE WHEN $3='AVAILABLE' THEN NULL ELSE activated_at END,
		last_error_code=CASE WHEN $3='AVAILABLE' THEN NULL ELSE last_error_code END,
		released_at=CASE WHEN $3='AVAILABLE' THEN now() ELSE released_at END,
		revoked_at=CASE WHEN $3='REVOKED' THEN now() ELSE revoked_at END,
		updated_at=now(),version=version+1
		WHERE id=$1::uuid AND tenant_id=$2::uuid
		RETURNING public_id::text,license_ref,provider,instance_id,product_key,status,NULL::text,allocated_at,activated_at,expires_at,last_error_code,created_at,updated_at,version`
	if err := tx.QueryRow(ctx, query, internalID, access.tenantID, target).Scan(&item.ID, &item.LicenseRef, &item.Provider, &item.InstanceID, &item.ProductKey, &item.Status, &item.AllocatedDeviceID, &item.AllocatedAt, &item.ActivatedAt, &item.ExpiresAt, &item.LastErrorCode, &item.CreatedAt, &item.UpdatedAt, &item.Version); err != nil {
		return Item{}, err
	}
	if err := s.audit.Record(ctx, tx, audit.Event{TenantID: &access.tenantID, ActorType: "user", ActorPublicID: &access.userPublicID, Action: "ops.hardware_license." + strings.ToLower(target), ResourceType: "hardware_agent_license", ResourceID: &item.ID, RequestID: requestID, Result: "success", Detail: map[string]any{"license_ref": item.LicenseRef, "previous_status": status}}); err != nil {
		return Item{}, err
	}
	if err := tx.Commit(ctx); err != nil {
		return Item{}, err
	}
	return item, nil
}

func (s *Service) AcquireForDevice(ctx context.Context, tx pgx.Tx, tenantID, deviceID, instanceID, productKey string) (Delivery, error) {
	_, _ = tx.Exec(ctx, `UPDATE hardware_agent_license SET status='EXPIRED',updated_at=now(),version=version+1 WHERE tenant_id=$1::uuid AND expires_at<=now() AND status IN ('AVAILABLE','ALLOCATED','ACTIVE','SUSPENDED')`, tenantID)
	var internalID, ref, digest, status string
	var encrypted, nonce []byte
	var expires time.Time
	err := tx.QueryRow(ctx, `SELECT id::text,license_ref,payload_digest,status,encrypted_payload,nonce,expires_at FROM hardware_agent_license WHERE tenant_id=$1::uuid AND allocated_device_id=$2::uuid AND instance_id=$3 AND product_key=$4 AND status IN ('ALLOCATED','ACTIVE','SUSPENDED') FOR UPDATE`, tenantID, deviceID, instanceID, productKey).Scan(&internalID, &ref, &digest, &status, &encrypted, &nonce, &expires)
	if errors.Is(err, pgx.ErrNoRows) {
		err = tx.QueryRow(ctx, `SELECT id::text,license_ref,payload_digest,status,encrypted_payload,nonce,expires_at FROM hardware_agent_license WHERE tenant_id=$1::uuid AND allocated_device_id IS NULL AND instance_id=$2 AND product_key=$3 AND status='AVAILABLE' AND expires_at>now() ORDER BY expires_at,id FOR UPDATE SKIP LOCKED LIMIT 1`, tenantID, instanceID, productKey).Scan(&internalID, &ref, &digest, &status, &encrypted, &nonce, &expires)
	}
	if errors.Is(err, pgx.ErrNoRows) {
		return Delivery{}, ErrUnavailable
	}
	if err != nil {
		return Delivery{}, err
	}
	payload, err := s.aead.Open(nil, nonce, encrypted, licenseAAD(ref, instanceID, productKey, expires))
	if err != nil {
		return Delivery{}, errors.New("decrypt hardware license")
	}
	if status != "ACTIVE" {
		status = "ALLOCATED"
	}
	if _, err := tx.Exec(ctx, `UPDATE hardware_agent_license SET allocated_device_id=$2::uuid,status=$3,
		allocated_at=COALESCE(allocated_at,now()),released_at=NULL,last_error_code=NULL,updated_at=now(),version=version+1
		WHERE id=$1::uuid`, internalID, deviceID, status); err != nil {
		return Delivery{}, err
	}
	return Delivery{LicenseRef: ref, License: string(payload), Digest: digest, ExpiresAt: expires, Status: status}, nil
}

func (s *Service) Acknowledge(ctx context.Context, identity deviceauth.Identity, requestID string, input AcknowledgeInput) error {
	input.LicenseRef = strings.TrimSpace(input.LicenseRef)
	input.Digest = strings.ToLower(strings.TrimSpace(input.Digest))
	input.Result = strings.ToUpper(strings.TrimSpace(input.Result))
	input.ErrorCode = strings.TrimSpace(input.ErrorCode)
	if !referencePattern.MatchString(input.LicenseRef) || !regexp.MustCompile(`^[0-9a-f]{64}$`).MatchString(input.Digest) || (input.Result != "INSTALLED" && input.Result != "FAILED") || len(input.ErrorCode) > 100 {
		return ErrAcknowledgement
	}
	tx, err := s.pool.Begin(ctx)
	if err != nil {
		return err
	}
	defer tx.Rollback(ctx)
	var id, publicID, digest, status string
	var expires time.Time
	if err := tx.QueryRow(ctx, `SELECT id::text,public_id::text,payload_digest,status,expires_at FROM hardware_agent_license WHERE tenant_id=$1::uuid AND allocated_device_id=$2::uuid AND license_ref=$3 FOR UPDATE`, identity.TenantID, identity.ID, input.LicenseRef).Scan(&id, &publicID, &digest, &status, &expires); errors.Is(err, pgx.ErrNoRows) {
		return ErrAssignment
	} else if err != nil {
		return err
	}
	if !expires.After(time.Now().UTC()) {
		_, _ = tx.Exec(ctx, `UPDATE hardware_agent_license SET status='EXPIRED',updated_at=now(),version=version+1 WHERE id=$1::uuid`, id)
		if err := tx.Commit(ctx); err != nil {
			return err
		}
		return ErrExpired
	}
	if digest != input.Digest {
		return ErrAcknowledgement
	}
	if input.Result == "FAILED" {
		_, err = tx.Exec(ctx, `UPDATE hardware_agent_license SET status='SUSPENDED',last_error_code=NULLIF($2,''),updated_at=now(),version=version+1 WHERE id=$1::uuid`, id, input.ErrorCode)
		if err != nil {
			return err
		}
	} else {
		_, err = tx.Exec(ctx, `UPDATE hardware_agent_license SET status='ACTIVE',activated_at=COALESCE(activated_at,now()),last_error_code=NULL,updated_at=now(),version=version+1 WHERE id=$1::uuid`, id)
		if err != nil {
			return err
		}
		var providerReady, bindingReady bool
		var activationState string
		if err := tx.QueryRow(ctx, `SELECT d.activation_state,EXISTS(SELECT 1 FROM hardware_agent_provider_credential pc WHERE pc.device_id=d.id AND pc.status='ACTIVE'),EXISTS(SELECT 1 FROM device_binding b WHERE b.device_id=d.id AND b.unbound_at IS NULL) FROM device d WHERE d.id=$1::uuid AND d.tenant_id=$2::uuid FOR UPDATE`, identity.ID, identity.TenantID).Scan(&activationState, &providerReady, &bindingReady); err != nil {
			return err
		}
		if !providerReady || !bindingReady {
			return ErrAssignment
		}
		if activationState == string(deviceactivation.Provisioning) {
			if _, err := deviceactivation.Apply(ctx, tx, deviceactivation.Input{DeviceID: identity.ID, TenantID: identity.TenantID, Target: deviceactivation.Active, Reason: "设备已安全保存并确认有效License", Source: "license-ack", ActorType: "device", ActorPublicID: &identity.PublicID, RequestID: requestID}); err != nil {
				return err
			}
		}
	}
	if err := s.audit.Record(ctx, tx, audit.Event{TenantID: &identity.TenantID, ActorType: "device", ActorPublicID: &identity.PublicID, Action: "hardware_agent.license.ack", ResourceType: "hardware_agent_license", ResourceID: &publicID, RequestID: requestID, Result: "success", Detail: map[string]any{"license_ref": input.LicenseRef, "result": input.Result, "error_code": input.ErrorCode}}); err != nil {
		return err
	}
	return tx.Commit(ctx)
}

type access struct{ tenantID, userPublicID, role string }
type queryRow interface {
	QueryRow(context.Context, string, ...any) pgx.Row
}

func requireAccess(ctx context.Context, q queryRow, principal identity.Principal, tenantPublicID string, mutate bool) (access, error) {
	var a access
	err := q.QueryRow(ctx, `SELECT t.id::text,ua.public_id::text,ua.platform_role FROM tenant t JOIN user_account ua ON ua.tenant_id=t.id AND ua.status='active' AND ua.account_kind='operator' WHERE t.public_id=$1::uuid AND t.status='active' AND ua.oidc_issuer=$2 AND ua.oidc_subject=$3`, tenantPublicID, principal.Issuer, principal.Subject).Scan(&a.tenantID, &a.userPublicID, &a.role)
	if errors.Is(err, pgx.ErrNoRows) {
		return access{}, ErrAccessDenied
	}
	if err != nil {
		return access{}, err
	}
	if mutate && a.role != "ops_operator" && a.role != "ops_admin" {
		return access{}, ErrAccessDenied
	}
	return a, nil
}
func licenseAAD(ref, instanceID, productKey string, expires time.Time) []byte {
	return []byte(fmt.Sprintf("hardware-license-v1\n%s\n%s\n%s\n%d", ref, instanceID, productKey, expires.UTC().Unix()))
}