package com.njcn.rdms.module.project.framework.security.service;

import com.njcn.rdms.framework.security.core.util.SecurityFrameworkUtils;
import com.njcn.rdms.module.project.dal.dataobject.member.UserObjectRoleDO;
import com.njcn.rdms.module.project.dal.mysql.member.UserObjectRoleMapper;
import com.njcn.rdms.module.project.enums.ErrorCodeConstants;
import com.njcn.rdms.module.system.api.permission.ObjectPermissionApi;
import com.njcn.rdms.module.system.enums.permission.PermissionScopeTypeEnum;
import jakarta.annotation.Resource;
import org.springframework.stereotype.Service;
import org.springframework.util.StringUtils;

import java.util.Collections;
import java.util.LinkedHashSet;
import java.util.Set;
import java.util.stream.Collectors;

import static com.njcn.rdms.framework.common.exception.util.ServiceExceptionUtil.exception;
import static com.njcn.rdms.framework.common.exception.util.ServiceExceptionUtil.invalidParamException;

/**
 * 产品对象权限服务。
 */
@Service
public class ProductObjectPermissionService implements ObjectPermissionService {

    private static final String PRODUCT_OBJECT_TYPE = "product";
    private static final String ROLE_SCOPE_OBJECT = PermissionScopeTypeEnum.OBJECT.getScopeType();

    @Resource
    private UserObjectRoleMapper userObjectRoleMapper;
    @Resource
    private ObjectPermissionApi objectPermissionApi;

    @Override
    public String getObjectType() {
        return PRODUCT_OBJECT_TYPE;
    }

    @Override
    public void checkPermission(Long objectId, String permission, boolean memberOnly) {
        if (objectId == null) {
            throw invalidParamException("对象编号不能为空");
        }
        Long loginUserId = SecurityFrameworkUtils.getLoginUserId();
        UserObjectRoleDO currentMember = userObjectRoleMapper
                .selectActiveByObjectAndUserId(PRODUCT_OBJECT_TYPE, objectId, loginUserId);
        if (currentMember == null) {
            throw exception(ErrorCodeConstants.PRODUCT_OBJECT_PERMISSION_DENIED,
                    buildDeniedPermission(permission, memberOnly));
        }
        if (memberOnly) {
            return;
        }
        String normalizedPermission = normalizePermission(permission);
        if (!getRolePermissions(currentMember.getRoleId()).contains(normalizedPermission)) {
            throw exception(ErrorCodeConstants.PRODUCT_OBJECT_PERMISSION_DENIED, normalizedPermission);
        }
    }

    private Set<String> getRolePermissions(Long roleId) {
        Set<String> permissions = objectPermissionApi
                .getObjectRolePermissions(roleId, ROLE_SCOPE_OBJECT, PRODUCT_OBJECT_TYPE)
                .getCheckedData();
        if (permissions == null || permissions.isEmpty()) {
            return Collections.emptySet();
        }
        return permissions.stream()
                .filter(StringUtils::hasText)
                .map(String::trim)
                .collect(Collectors.toCollection(LinkedHashSet::new));
    }

    private String normalizePermission(String permission) {
        if (!StringUtils.hasText(permission)) {
            throw invalidParamException("对象权限码不能为空");
        }
        return permission.trim();
    }

    private String buildDeniedPermission(String permission, boolean memberOnly) {
        return memberOnly ? "member" : normalizePermission(permission);
    }

}
