using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Http;
using RainOpsMini.Services;
using RainOpsMini.Models;
using RainOpsMini;
using RainOpsMini.Helpers;

namespace RainOpsMini.Apis
{
    public static class UserApi
    {
        public static void MapUserApis(this IEndpointRouteBuilder app)
        {
            // API: 获取用户列表
            // 仅管理员可用
            app.MapGet("/api/users", (HttpContext ctx) =>
            {
                if (!ctx.User.HasClaim("Permission", "users.view") && !ctx.User.HasClaim("Permission", "all") && ctx.User.FindFirst("IsSuperAdmin")?.Value != "true") return Results.Unauthorized();
                return Results.Json(UserStorage.GetAll().Select(u => new { u.Id, u.Username, u.IsEnabled, u.Permissions, u.CreatedAt }));
            });

            // API: 创建新用户
            // 添加新的子账号
            app.MapPost("/api/users", (UserAccount user, HttpContext ctx) =>
            {
                if (!ctx.User.HasClaim("Permission", "users.add") && !ctx.User.HasClaim("Permission", "all") && ctx.User.FindFirst("IsSuperAdmin")?.Value != "true") return Results.Unauthorized();
                if (string.IsNullOrWhiteSpace(user.Username) || string.IsNullOrWhiteSpace(user.Password)) return Results.BadRequest(new { error = "用户名和密码不能为空" });

                if (UserStorage.GetByUsername(user.Username) != null || user.Username == Program.Config.WebUser)
                {
                    return Results.BadRequest(new { error = "用户名已存在" });
                }

                UserStorage.Add(user);
                return Results.Ok();
            });

            // API: 更新用户信息
            // 修改用户的权限或状态
            app.MapPut("/api/users/{id}", (string id, UserAccount user, HttpContext ctx) =>
            {
                if (!ctx.User.HasClaim("Permission", "users.edit") && !ctx.User.HasClaim("Permission", "all") && ctx.User.FindFirst("IsSuperAdmin")?.Value != "true") return Results.Unauthorized();
                var existing = UserStorage.GetById(id);
                if (existing == null) return Results.NotFound();

                // 仅更新允许的字段
                existing.Permissions = user.Permissions;
                existing.IsEnabled = user.IsEnabled;

                UserStorage.Update(existing);
                return Results.Ok();
            });

            // API: 重置用户密码
            // 强制修改指定用户的密码
            app.MapPost("/api/users/{id}/reset-password", (string id, PasswordResetRequest req, HttpContext ctx) =>
            {
                if (!ctx.User.HasClaim("Permission", "users.edit") && !ctx.User.HasClaim("Permission", "all") && ctx.User.FindFirst("IsSuperAdmin")?.Value != "true") return Results.Unauthorized();
                var existing = UserStorage.GetById(id);
                if (existing == null) return Results.NotFound();

                if (string.IsNullOrWhiteSpace(req.NewPassword)) return Results.BadRequest(new { error = "新密码不能为空" });

                existing.Password = req.NewPassword;
                UserStorage.Update(existing);
                return Results.Ok();
            });

            // API: 删除用户
            // 移除子账号
            app.MapDelete("/api/users/{id}", (string id, HttpContext ctx) =>
            {
                if (!ctx.User.HasClaim("Permission", "users.delete") && !ctx.User.HasClaim("Permission", "all") && ctx.User.FindFirst("IsSuperAdmin")?.Value != "true") return Results.Unauthorized();
                var existing = UserStorage.GetById(id);
                if (existing == null) return Results.NotFound();

                UserStorage.Delete(id);
                return Results.Ok();
            });

            // API: 获取角色列表
            // 返回系统预定义的角色
            app.MapGet("/api/roles", (HttpContext ctx) =>
            {
                if (!ctx.User.HasClaim("Permission", "users.view") && !ctx.User.HasClaim("Permission", "all") && ctx.User.FindFirst("IsSuperAdmin")?.Value != "true") return Results.Unauthorized();
                return Results.Json(RoleStorage.GetAll());
            });

            // API: 创建角色
            app.MapPost("/api/roles", (Role role, HttpContext ctx) =>
            {
                if (!ctx.User.HasClaim("Permission", "users.add") && !ctx.User.HasClaim("Permission", "all") && ctx.User.FindFirst("IsSuperAdmin")?.Value != "true") return Results.Unauthorized();
                
                if (string.IsNullOrWhiteSpace(role.Name)) return Results.BadRequest(new { error = "角色名称不能为空" });
                
                RoleStorage.Add(role);
                return Results.Ok();
            });

            // API: 更新角色
            app.MapPut("/api/roles/{id}", (string id, Role role, HttpContext ctx) =>
            {
                if (!ctx.User.HasClaim("Permission", "users.edit") && !ctx.User.HasClaim("Permission", "all") && ctx.User.FindFirst("IsSuperAdmin")?.Value != "true") return Results.Unauthorized();
                
                var existing = RoleStorage.GetById(id);
                if (existing == null) return Results.NotFound();
                
                role.Id = id; // Ensure ID matches
                RoleStorage.Update(role);
                return Results.Ok();
            });

            // API: 删除角色
            app.MapDelete("/api/roles/{id}", (string id, HttpContext ctx) =>
            {
                if (!ctx.User.HasClaim("Permission", "users.delete") && !ctx.User.HasClaim("Permission", "all") && ctx.User.FindFirst("IsSuperAdmin")?.Value != "true") return Results.Unauthorized();
                
                var existing = RoleStorage.GetById(id);
                if (existing == null) return Results.NotFound();
                
                RoleStorage.Delete(id);
                return Results.Ok();
            });
        }
    }
}