using System.Security.Cryptography;
using System.Text.Json;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Options;
using Npgsql;
using Tiku.Application.Security;
using Tiku.Domain.Identity;
using Tiku.Domain.Operations;
using Tiku.Domain.Platform;
using Tiku.Domain.Growth;
using Tiku.Domain.Tenancy;
using Tiku.Infrastructure.Persistence;

namespace Tiku.Infrastructure.Bootstrap;

public static class DevelopmentPlatformAdminSeeder
{
    public const string Email = "admin@tiku.local";
    public const string RoleCode = PlatformAdminBootstrapper.SuperAdminRoleCode;

    public static void Configure(DbContextOptionsBuilder optionsBuilder)
    {
        optionsBuilder
            .UseSeeding((context, _) => Seed((TikuDbContext)context))
            .UseAsyncSeeding((context, _, cancellationToken) =>
                SeedAsync((TikuDbContext)context, cancellationToken));
    }

    public static bool Seed(TikuDbContext dbContext)
    {
        ReloadPostgresTypes(dbContext);

        if (dbContext.PlatformBackendUserRoles.Any())
        {
            EnsurePlatformPermissionCatalog(dbContext);
            SeedDemoTenantCapabilities(dbContext);
            dbContext.SaveChanges();
            return false;
        }

        var temporaryPassword = GenerateTemporaryPassword();
        EnsureEmailIsAvailable(dbContext.Users.Any(user =>
            user.NormalizedEmail == Email.ToUpperInvariant() ||
            user.NormalizedUserName == Email.ToUpperInvariant()));
        var permissionCodes = BackendPermissions.Platform.ToArray();
        var existingPermissionCodes = dbContext.BackendPermissions
            .Where(permission => permissionCodes.Contains(permission.Code))
            .Select(permission => permission.Code)
            .ToHashSet(StringComparer.Ordinal);
        AddSeedGraph(dbContext, temporaryPassword, permissionCodes, existingPermissionCodes);
        SeedDemoTenantCapabilities(dbContext);
        dbContext.SaveChanges();
        WriteFirstLoginInstructions(temporaryPassword);
        return true;
    }

    public static async Task<bool> SeedAsync(
        TikuDbContext dbContext,
        CancellationToken cancellationToken = default)
    {
        await ReloadPostgresTypesAsync(dbContext, cancellationToken);

        if (await dbContext.PlatformBackendUserRoles.AnyAsync(cancellationToken))
        {
            EnsurePlatformPermissionCatalog(dbContext);
            SeedDemoTenantCapabilities(dbContext);
            await dbContext.SaveChangesAsync(cancellationToken);
            return false;
        }

        var temporaryPassword = GenerateTemporaryPassword();
        var normalizedEmail = Email.ToUpperInvariant();
        EnsureEmailIsAvailable(await dbContext.Users.AnyAsync(user =>
            user.NormalizedEmail == normalizedEmail ||
            user.NormalizedUserName == normalizedEmail, cancellationToken));
        var permissionCodes = BackendPermissions.Platform.ToArray();
        var existingPermissionCodes = (await dbContext.BackendPermissions
                .Where(permission => permissionCodes.Contains(permission.Code))
                .Select(permission => permission.Code)
                .ToArrayAsync(cancellationToken))
            .ToHashSet(StringComparer.Ordinal);
        AddSeedGraph(dbContext, temporaryPassword, permissionCodes, existingPermissionCodes);
        SeedDemoTenantCapabilities(dbContext);
        await dbContext.SaveChangesAsync(cancellationToken);
        WriteFirstLoginInstructions(temporaryPassword);
        return true;
    }

    private static void AddSeedGraph(
        TikuDbContext dbContext,
        string temporaryPassword,
        IReadOnlyCollection<string> permissionCodes,
        IReadOnlySet<string> existingPermissionCodes)
    {
        var normalizedEmail = Email.ToUpperInvariant();
        var user = new User
        {
            Email = Email,
            NormalizedEmail = normalizedEmail,
            UserName = Email,
            NormalizedUserName = normalizedEmail,
            Name = "Local Platform Administrator",
            EmailConfirmed = true,
            Status = UserStatus.Active,
            ForcePasswordChange = true
        };
        var passwordHasher = new PasswordHasher<User>(Options.Create(new PasswordHasherOptions
        {
            IterationCount = 210_000
        }));
        user.PasswordHash = passwordHasher.HashPassword(user, temporaryPassword);

        var role = new PlatformBackendRole
        {
            Code = RoleCode,
            Name = "Platform Super Administrator",
            Description = "Built-in Development administrator created by EF Core data seeding.",
            Status = BackendRoleStatus.Active,
            IsSystem = true
        };
        dbContext.Users.Add(user);
        dbContext.PlatformBackendRoles.Add(role);
        var platformModuleCodes = permissionCodes
            .Select(PermissionModuleCatalog.ResolvePermissionModuleCode)
            .Distinct(StringComparer.Ordinal)
            .ToArray();
        var existingModuleCodes = dbContext.PermissionModules
            .Where(module => platformModuleCodes.Contains(module.Code))
            .Select(module => module.Code)
            .ToArray();
        dbContext.PermissionModules.AddRange(platformModuleCodes
            .Except(existingModuleCodes, StringComparer.Ordinal)
            .Select(code => new PermissionModule
            {
                Code = code,
                Name = code,
                Area = BackendPermissionArea.Platform
            }));
        dbContext.BackendPermissions.AddRange(
            permissionCodes
                .Where(code => !existingPermissionCodes.Contains(code))
                .Select(code => new BackendPermission
                {
                    Code = code,
                    Name = code,
                    Area = BackendPermissionArea.Platform,
                    PermissionModuleCode = PermissionModuleCatalog.ResolvePermissionModuleCode(code),
                    Description = "Built-in platform permission.",
                    IsSystem = true
                }));
        dbContext.PlatformBackendRolePermissions.AddRange(
            permissionCodes.Select(code => new PlatformBackendRolePermission
            {
                RoleId = role.Id,
                PermissionCode = code
            }));
        dbContext.PlatformBackendUserRoles.Add(new PlatformBackendUserRole
        {
            UserId = user.Id,
            RoleId = role.Id
        });
        dbContext.AuditLogs.Add(new AuditLog
        {
            ActorUserId = user.Id,
            Action = "platform.bootstrap_admin.created",
            TargetType = "users",
            TargetId = user.Id.ToString(),
            Details = JsonSerializer.SerializeToElement(new
            {
                user.Email,
                RoleCode,
                ForcePasswordChange = true,
                Source = "ef_core_use_seeding"
            })
        });
    }

    private static void EnsurePlatformPermissionCatalog(TikuDbContext dbContext)
    {
        var permissionCodes = BackendPermissions.Platform.ToArray();
        var moduleCodes = permissionCodes
            .Select(PermissionModuleCatalog.ResolvePermissionModuleCode)
            .Distinct(StringComparer.Ordinal)
            .ToArray();
        var existingModuleCodes = dbContext.PermissionModules
            .Where(module => moduleCodes.Contains(module.Code))
            .Select(module => module.Code)
            .ToHashSet(StringComparer.Ordinal);
        foreach (var code in moduleCodes.Where(code => !existingModuleCodes.Contains(code)))
        {
            dbContext.PermissionModules.Add(new PermissionModule
            {
                Code = code,
                Name = code,
                Area = BackendPermissionArea.Platform,
                RequiredFeatureCode = PermissionModuleCatalog.RequiredFeatures[code]
            });
        }

        var existingPermissionCodes = dbContext.BackendPermissions
            .Where(permission => permissionCodes.Contains(permission.Code))
            .Select(permission => permission.Code)
            .ToHashSet(StringComparer.Ordinal);
        foreach (var code in permissionCodes.Where(code => !existingPermissionCodes.Contains(code)))
        {
            dbContext.BackendPermissions.Add(new BackendPermission
            {
                Code = code,
                Name = code,
                Area = BackendPermissionArea.Platform,
                PermissionModuleCode = PermissionModuleCatalog.ResolvePermissionModuleCode(code),
                Description = "Built-in platform permission.",
                IsSystem = true
            });
        }

        var superAdminRoleId = dbContext.PlatformBackendRoles
            .Where(role => role.Code == RoleCode)
            .Select(role => (Guid?)role.Id)
            .FirstOrDefault();
        if (superAdminRoleId is null)
        {
            return;
        }

        var boundPermissionCodes = dbContext.PlatformBackendRolePermissions
            .Where(binding => binding.RoleId == superAdminRoleId.Value)
            .Select(binding => binding.PermissionCode)
            .ToHashSet(StringComparer.Ordinal);
        dbContext.PlatformBackendRolePermissions.AddRange(permissionCodes
            .Where(code => !boundPermissionCodes.Contains(code))
            .Select(code => new PlatformBackendRolePermission
            {
                RoleId = superAdminRoleId.Value,
                PermissionCode = code
            }));
    }

    private static void SeedDemoTenantCapabilities(TikuDbContext dbContext)
    {
        var tenantA = EnsureTenant(dbContext, "demo-crm-school", "演示题库机构 A");
        var tenantB = EnsureTenant(dbContext, "demo-sms-campus", "演示题库机构 B");
        EnsureCrmDemo(dbContext, tenantA);
        EnsureSmsDemo(dbContext, tenantA, "aliyun", "登录验证码");
        EnsureSmsDemo(dbContext, tenantB, "tencent", "营销通知");
        EnsurePlatformPaymentDemo(dbContext, tenantA);
        EnsureTenantPaymentDemo(dbContext, tenantA);
    }

    private static Tenant EnsureTenant(TikuDbContext dbContext, string slug, string name)
    {
        var tenant = dbContext.Tenants.SingleOrDefault(value => value.Slug == slug);
        if (tenant is not null)
        {
            return tenant;
        }

        tenant = new Tenant
        {
            Slug = slug,
            Name = name,
            LegalName = $"{name}有限公司",
            Status = TenantStatus.Active,
            BillingStatus = BillingStatus.Active,
            Metadata = JsonSerializer.SerializeToElement(new { demo = true })
        };
        dbContext.Tenants.Add(tenant);
        return tenant;
    }

    private static void EnsureCrmDemo(TikuDbContext dbContext, Tenant tenant)
    {
        if (!dbContext.CrmConfigs.Any(value => value.TenantId == tenant.Id))
        {
            dbContext.CrmConfigs.Add(new CrmConfig
            {
                TenantId = tenant.Id,
                Enabled = true,
                Url = "https://crm.example.test/webhook/tiku",
                SecretRef = "tenant_secret:crm:demo:redacted",
                FormName = "学生留资表单",
                ExamType = "ielts",
                TimeoutSeconds = 10,
                DelaySeconds = 0,
                AssignmentMode = ReferralAssignmentMode.RoundRobin,
                AssignmentPool = JsonSerializer.SerializeToElement(new[] { "顾问一", "顾问二" }),
                AssignmentConfig = JsonSerializer.SerializeToElement(new { retry = 3, source = "development_seed" })
            });
        }

        if (!dbContext.CrmWebhookQueue.Any(value => value.TenantId == tenant.Id && value.IdempotencyKey == "demo-crm-failed-lead"))
        {
            dbContext.CrmWebhookQueue.Add(new CrmWebhookQueueItem
            {
                TenantId = tenant.Id,
                RecordId = "CRM-DEMO-LEAD-001",
                LeadId = "LEAD-001",
                Source = "tenant.student.crm_push",
                Provider = "generic",
                Status = CrmWebhookQueueStatus.Failed,
                Attempts = 2,
                LastError = "demo timeout",
                LastHttpCode = 504,
                TargetUrl = "https://crm.example.test/webhook/tiku",
                IdempotencyKey = "demo-crm-failed-lead",
                Payload = JsonSerializer.SerializeToElement(new { student = "王同学", phoneMasked = "138****0001" })
            });
        }
    }

    private static void EnsureSmsDemo(TikuDbContext dbContext, Tenant tenant, string provider, string templateName)
    {
        var scene = templateName.Contains("登录", StringComparison.Ordinal) ? "login" : "marketing";
        var channel = dbContext.SmsChannels.SingleOrDefault(value => value.TenantId == tenant.Id && value.Provider == provider && value.Scene == scene);
        if (channel is null)
        {
            channel = new SmsChannel
            {
                TenantId = tenant.Id,
                Provider = provider,
                Name = $"{tenant.Name} {provider} 短信渠道",
                Signature = "题库演示",
                Scene = scene,
                Status = TenantExternalProviderStatus.Active,
                SecretRef = $"tenant_secret:sms:{provider}:redacted",
                MonthlyQuota = 10000,
                ConfigPublic = JsonSerializer.SerializeToElement(new { region = "cn", redacted = true }),
                Metadata = JsonSerializer.SerializeToElement(new { demo = true })
            };
            dbContext.SmsChannels.Add(channel);
        }

        var templateCode = $"demo_{provider}_{scene}";
        var template = dbContext.SmsTemplates.SingleOrDefault(value => value.TenantId == tenant.Id && value.Code == templateCode);
        if (template is null)
        {
            template = new SmsTemplate
            {
                TenantId = tenant.Id,
                ChannelId = channel.Id,
                Code = templateCode,
                Name = templateName,
                Type = scene == "login" ? SmsTemplateType.VerificationCode : SmsTemplateType.Marketing,
                AuditStatus = SmsTemplateAuditStatus.Approved,
                Status = SmsTemplateStatus.Active,
                ProviderTemplateCode = $"TPL_{provider.ToUpperInvariant()}_DEMO",
                Content = "您的验证码为 ${code}，请勿泄露。",
                ApprovedAt = DateTimeOffset.UtcNow,
                Metadata = JsonSerializer.SerializeToElement(new { demo = true })
            };
            dbContext.SmsTemplates.Add(template);
        }

        if (!dbContext.SmsSendLogs.Any(value => value.TenantId == tenant.Id && value.ProviderMessageId == $"demo-{provider}-{scene}-001"))
        {
            dbContext.SmsSendLogs.Add(new SmsSendLog
            {
                TenantId = tenant.Id,
                ChannelId = channel.Id,
                TemplateId = template.Id,
                Provider = provider,
                Scene = scene,
                PhoneMasked = "138****0001",
                Status = SmsSendLogStatus.Sent,
                ProviderMessageId = $"demo-{provider}-{scene}-001",
                SentAt = DateTimeOffset.UtcNow,
                Metadata = JsonSerializer.SerializeToElement(new { demo = true })
            });
        }
    }

    private static void EnsurePlatformPaymentDemo(TikuDbContext dbContext, Tenant tenant)
    {
        var app = dbContext.PlatformPaymentApps.SingleOrDefault(value => value.AppCode == "platform_saas_collect");
        if (app is null)
        {
            app = new PlatformPaymentApp
            {
                AppCode = "platform_saas_collect",
                AppName = "平台 SaaS 收款",
                Status = PlatformPaymentAppStatus.Active,
                SettlementMode = "PlatformCollect",
                Description = "Development demo platform payment app.",
                Metadata = JsonSerializer.SerializeToElement(new { demo = true })
            };
            dbContext.PlatformPaymentApps.Add(app);
        }

        if (!dbContext.PlatformPaymentChannels.Any(value => value.AppId == app.Id && value.Provider == "manual"))
        {
            dbContext.PlatformPaymentChannels.Add(new PlatformPaymentChannel
            {
                AppId = app.Id,
                Provider = "manual",
                Mode = "PlatformCollect",
                Status = PlatformPaymentChannelStatus.Active,
                DisplayName = "线下人工确认",
                SecretRef = "platform_payment:manual:redacted",
                CallbackPath = "/api/platform-billing/payments/notify/manual",
                ConfigPublic = JsonSerializer.SerializeToElement(new { manual = true })
            });
        }

        if (!dbContext.PlatformBillingPayments.Any(value => value.PaymentNo == "PB-DEMO-MANUAL-001"))
        {
            var quote = new PlatformBillingQuote
            {
                TenantId = tenant.Id,
                QuoteNo = "BQ-DEMO-001",
                IdempotencyKey = "demo-platform-payment-quote",
                Status = PlatformBillingQuoteStatus.Converted,
                Purpose = PlatformBillingOrderPurpose.NewSubscription,
                TotalAmountCents = 19900,
                ExpiresAt = DateTimeOffset.UtcNow.AddDays(7)
            };
            var order = new PlatformBillingOrder
            {
                TenantId = tenant.Id,
                QuoteId = quote.Id,
                OrderNo = "BO-DEMO-001",
                IdempotencyKey = "demo-platform-payment-order",
                Purpose = PlatformBillingOrderPurpose.NewSubscription,
                Status = PlatformBillingOrderStatus.PendingPayment,
                TotalAmountCents = 19900,
                ExpiresAt = DateTimeOffset.UtcNow.AddDays(7)
            };
            var payment = new PlatformBillingPayment
            {
                TenantId = tenant.Id,
                OrderId = order.Id,
                PaymentNo = "PB-DEMO-MANUAL-001",
                IdempotencyKey = "demo-platform-payment-payment",
                Provider = "manual",
                Method = "bank_transfer",
                Status = PlatformBillingPaymentStatus.Pending,
                AmountCents = 19900
            };
            dbContext.PlatformBillingQuotes.Add(quote);
            dbContext.PlatformBillingOrders.Add(order);
            dbContext.PlatformBillingPayments.Add(payment);
            dbContext.PlatformBillingPaymentEvents.Add(new PlatformBillingPaymentEvent
            {
                TenantId = tenant.Id,
                PaymentId = payment.Id,
                Provider = "manual",
                ProviderEventId = "demo-platform-payment-created",
                EventType = "payment_created",
                Payload = JsonSerializer.SerializeToElement(new { demo = true, amountCents = 19900 })
            });
        }
    }

    private static void EnsureTenantPaymentDemo(TikuDbContext dbContext, Tenant tenant)
    {
        if (!dbContext.TenantExternalProviders.Any(value => value.TenantId == tenant.Id && value.Capability == TenantExternalProviderCapability.Payment && value.Provider == "manual"))
        {
            dbContext.TenantExternalProviders.Add(new TenantExternalProvider
            {
                TenantId = tenant.Id,
                Capability = TenantExternalProviderCapability.Payment,
                Provider = "manual",
                Status = TenantExternalProviderStatus.Active,
                DisplayName = "租户线下收款",
                SecretRef = "tenant_payment:manual:redacted",
                ConfigPublic = JsonSerializer.SerializeToElement(new { manual = true }),
                Metadata = JsonSerializer.SerializeToElement(new { demo = true })
            });
        }
    }

    private static string GenerateTemporaryPassword() =>
        $"Tiku!{Convert.ToHexString(RandomNumberGenerator.GetBytes(16))}9a";

    private static void ReloadPostgresTypes(TikuDbContext dbContext)
    {
        if (dbContext.Database.IsNpgsql())
        {
            ((NpgsqlConnection)dbContext.Database.GetDbConnection()).ReloadTypes();
        }
    }

    private static async Task ReloadPostgresTypesAsync(
        TikuDbContext dbContext,
        CancellationToken cancellationToken)
    {
        if (dbContext.Database.IsNpgsql())
        {
            await ((NpgsqlConnection)dbContext.Database.GetDbConnection())
                .ReloadTypesAsync(cancellationToken);
        }
    }

    private static void EnsureEmailIsAvailable(bool isAssigned)
    {
        if (isAssigned)
        {
            throw new InvalidOperationException(
                $"Cannot create the Development platform administrator because '{Email}' is already assigned.");
        }
    }

    private static void WriteFirstLoginInstructions(string temporaryPassword)
    {
        Console.WriteLine("Development platform administrator created by EF Core data seeding.");
        Console.WriteLine($"  Account: {Email}");
        Console.WriteLine($"  Temporary password: {temporaryPassword}");
        Console.WriteLine("  Change the temporary password at first sign-in. This password is shown only once.");
    }
}