using System.Globalization;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Text.RegularExpressions;

namespace Lskj.AgentPet.Host.Core.Configuration;

public sealed class ErpSessionScopeBinding
{
    private const string TokenDomain = "lserp-pet-session-scope-v3\n";
    private static readonly Regex DatabaseFingerprint = new(
        "^[a-f0-9]{64}$",
        RegexOptions.Compiled | RegexOptions.CultureInvariant);
    private static readonly Regex ScopeToken = new(
        "^[a-f0-9]{32}$",
        RegexOptions.Compiled | RegexOptions.CultureInvariant);
    private static readonly ISet<string> ContextFields = new HashSet<string>(
        new[]
        {
            "userId", "userName", "accountBook", "subSystemId",
            "databaseScopeFingerprint", "subSystemName", "isAdministrator",
            "activeModule", "openModuleCount", "openModulesTruncated", "openModules"
        },
        StringComparer.Ordinal);
    private static readonly ISet<string> ModuleFields = new HashSet<string>(
        new[] { "moduleCode", "navigationCode", "moduleName" },
        StringComparer.Ordinal);

    private ErpSessionScopeBinding(
        string databaseScopeFingerprint,
        string userId,
        string userName,
        string accountBook,
        string subSystemId,
        bool isAdministrator,
        string token)
    {
        DatabaseScopeFingerprint = databaseScopeFingerprint;
        UserId = userId;
        UserName = userName;
        AccountBook = accountBook;
        SubSystemId = subSystemId;
        IsAdministrator = isAdministrator;
        Token = token;
    }

    public string DatabaseScopeFingerprint { get; }
    public string UserId { get; }
    public string UserName { get; }
    public string AccountBook { get; }
    public string SubSystemId { get; }
    public bool IsAdministrator { get; }
    public string Token { get; }

    public static ErpSessionScopeBinding Create(
        string databaseScopeFingerprint,
        string userId,
        string userName,
        string accountBook,
        string subSystemId,
        bool isAdministrator)
    {
        string database = ValidateDatabaseFingerprint(databaseScopeFingerprint);
        string user = ValidateScopeText(userId, "expected_erp_user_invalid");
        string name = ValidateScopeText(userName, "expected_erp_user_name_invalid");
        string account = ValidateScopeText(accountBook, "expected_erp_account_book_invalid");
        string subsystem = ValidateScopeText(subSystemId, "expected_erp_subsystem_invalid");
        return new ErpSessionScopeBinding(
            database,
            user,
            name,
            account,
            subsystem,
            isAdministrator,
            ComputeToken(
                database,
                user,
                name,
                account,
                subsystem,
                isAdministrator));
    }

    public static string ValidateToken(string value)
    {
        if (string.IsNullOrWhiteSpace(value)
            || !string.Equals(value, value.Trim(), StringComparison.Ordinal)
            || !ScopeToken.IsMatch(value))
        {
            throw new HostError(
                "bridge_session_scope_token_invalid",
                "ERP 会话作用域令牌格式无效。");
        }
        return value;
    }

    public static bool TokenEquals(string left, string right)
    {
        string leftValue = left ?? string.Empty;
        string rightValue = right ?? string.Empty;
        if (!ScopeToken.IsMatch(leftValue)
            || !ScopeToken.IsMatch(rightValue)) return false;
        return CryptographicOperations.FixedTimeEquals(
            Encoding.ASCII.GetBytes(leftValue),
            Encoding.ASCII.GetBytes(rightValue));
    }

    public ErpSessionScopeSnapshot VerifyContextResponse(JsonElement response)
    {
        if (response.ValueKind != JsonValueKind.Object
            || !response.TryGetProperty("success", out JsonElement success)
            || success.ValueKind != JsonValueKind.True
            || !response.TryGetProperty("code", out JsonElement code)
            || code.ValueKind != JsonValueKind.String
            || !string.Equals(code.GetString(), "ok", StringComparison.Ordinal)
            || !response.TryGetProperty("data", out JsonElement data))
        {
            throw ProtocolError();
        }

        EnsureExactProperties(data, ContextFields, "ERP 上下文");
        string user = ContextText(data, "userId", 256);
        string userName = ContextText(data, "userName", 500);
        string account = ContextText(data, "accountBook", 256);
        string subsystem = ContextText(data, "subSystemId", 256);
        string database = ContextText(data, "databaseScopeFingerprint", 64);
        if (!DatabaseFingerprint.IsMatch(database)) throw ProtocolError();
        string subSystemName = ContextText(data, "subSystemName", 500);
        if (!data.TryGetProperty("isAdministrator", out JsonElement administrator)
            || (administrator.ValueKind != JsonValueKind.True
                && administrator.ValueKind != JsonValueKind.False))
            throw ProtocolError();

        string uiStateFingerprint = ProjectModuleState(data, subSystemName);
        ErpSessionScopeSnapshot snapshot = new(
            database,
            user,
            userName,
            account,
            subsystem,
            administrator.GetBoolean(),
            uiStateFingerprint);
        if (!string.Equals(DatabaseScopeFingerprint, snapshot.DatabaseScopeFingerprint, StringComparison.Ordinal)
            || !string.Equals(UserId, snapshot.UserId, StringComparison.Ordinal)
            || !string.Equals(UserName, snapshot.UserName, StringComparison.Ordinal)
            || !string.Equals(AccountBook, snapshot.AccountBook, StringComparison.Ordinal)
            || !string.Equals(SubSystemId, snapshot.SubSystemId, StringComparison.Ordinal)
            || IsAdministrator != snapshot.IsAdministrator
            || !TokenEquals(Token, ComputeToken(
                snapshot.DatabaseScopeFingerprint,
                snapshot.UserId,
                snapshot.UserName,
                snapshot.AccountBook,
                snapshot.SubSystemId,
                snapshot.IsAdministrator)))
        {
            throw new HostError(
                "erp_session_scope_mismatch",
                "当前 ERP 用户、权限、账套、子系统或数据库已不属于本次批准的桌宠会话。");
        }
        return snapshot;
    }

    private static string ComputeToken(
        string databaseScopeFingerprint,
        string userId,
        string userName,
        string accountBook,
        string subSystemId,
        bool isAdministrator)
    {
        StringBuilder canonical = new(TokenDomain);
        AppendPart(canonical, "databaseScopeFingerprint", databaseScopeFingerprint);
        AppendPart(canonical, "userId", userId);
        AppendPart(canonical, "userName", userName);
        AppendPart(canonical, "accountBook", accountBook);
        AppendPart(canonical, "subSystemId", subSystemId);
        AppendPart(
            canonical,
            "isAdministrator",
            isAdministrator ? "true" : "false");
        byte[] digest = SHA256.HashData(Encoding.UTF8.GetBytes(canonical.ToString()));
        return Convert.ToHexString(digest.AsSpan(0, 16)).ToLowerInvariant();
    }

    private static void AppendPart(StringBuilder target, string name, string value)
    {
        target.Append(name)
            .Append('=')
            .Append(Encoding.UTF8.GetByteCount(value).ToString(CultureInfo.InvariantCulture))
            .Append(':')
            .Append(value)
            .Append('\n');
    }

    private static string ValidateDatabaseFingerprint(string value)
    {
        string normalized = (value ?? string.Empty).ToLowerInvariant();
        if (!string.Equals(value, value?.Trim(), StringComparison.Ordinal)
            || !DatabaseFingerprint.IsMatch(normalized))
        {
            throw new HostError(
                "expected_database_scope_invalid",
                "预期数据库作用域指纹格式无效。");
        }
        return normalized;
    }

    private static string ValidateScopeText(string value, string code)
    {
        if (string.IsNullOrWhiteSpace(value)
            || value.Length > 256
            || !string.Equals(value, value.Trim(), StringComparison.Ordinal)
            || value.Any(char.IsControl))
        {
            throw new HostError(code, "预期 ERP 会话字段格式无效。");
        }
        return value;
    }

    private static string ContextText(JsonElement source, string name, int maximumLength)
    {
        if (!source.TryGetProperty(name, out JsonElement value)
            || value.ValueKind != JsonValueKind.String)
            throw ProtocolError();
        string result = value.GetString() ?? string.Empty;
        if (string.IsNullOrWhiteSpace(result)
            || result.Length > maximumLength
            || !string.Equals(result, result.Trim(), StringComparison.Ordinal)
            || result.Any(char.IsControl))
            throw ProtocolError();
        return result;
    }

    private static string ProjectModuleState(
        JsonElement data,
        string subSystemName)
    {
        if (!data.TryGetProperty("activeModule", out JsonElement active)
            || !data.TryGetProperty("openModuleCount", out JsonElement countElement)
            || countElement.ValueKind != JsonValueKind.Number
            || !countElement.TryGetInt32(out int count)
            || count < 0
            || !data.TryGetProperty("openModulesTruncated", out JsonElement truncatedElement)
            || (truncatedElement.ValueKind != JsonValueKind.True
                && truncatedElement.ValueKind != JsonValueKind.False)
            || !data.TryGetProperty("openModules", out JsonElement modules)
            || modules.ValueKind != JsonValueKind.Array
            || modules.GetArrayLength() > 50
            || count < modules.GetArrayLength()
            || truncatedElement.GetBoolean() != (count > modules.GetArrayLength()))
            throw ProtocolError();
        if (active.ValueKind != JsonValueKind.Null)
            ValidateModule(active);
        foreach (JsonElement module in modules.EnumerateArray()) ValidateModule(module);
        StringBuilder canonical = new();
        AppendCanonical(canonical, subSystemName);
        AppendModule(canonical, active);
        canonical.Append(count.ToString(CultureInfo.InvariantCulture))
            .Append(':')
            .Append(truncatedElement.GetBoolean() ? '1' : '0')
            .Append('|');
        foreach (JsonElement module in modules.EnumerateArray())
            AppendModule(canonical, module);
        return canonical.ToString();
    }

    private static void AppendModule(StringBuilder target, JsonElement module)
    {
        if (module.ValueKind == JsonValueKind.Null)
        {
            target.Append("null|");
            return;
        }
        AppendCanonical(target, ContextText(module, "moduleCode", 128));
        AppendCanonical(target, ContextText(module, "navigationCode", 128));
        AppendCanonical(target, ContextText(module, "moduleName", 500));
    }

    private static void AppendCanonical(StringBuilder target, string value)
    {
        target.Append(value.Length.ToString(CultureInfo.InvariantCulture))
            .Append(':')
            .Append(value)
            .Append('|');
    }

    private static void ValidateModule(JsonElement module)
    {
        EnsureExactProperties(module, ModuleFields, "ERP 模块上下文");
        ContextText(module, "moduleCode", 128);
        ContextText(module, "navigationCode", 128);
        ContextText(module, "moduleName", 500);
    }

    private static void EnsureExactProperties(
        JsonElement source,
        ISet<string> expected,
        string label)
    {
        if (source.ValueKind != JsonValueKind.Object) throw ProtocolError();
        HashSet<string> found = new(StringComparer.Ordinal);
        foreach (JsonProperty property in source.EnumerateObject())
        {
            if (!found.Add(property.Name) || !expected.Contains(property.Name))
                throw new HostError("bridge_protocol_error", label + "字段无效。");
        }
        if (!found.SetEquals(expected)) throw ProtocolError();
    }

    private static HostError ProtocolError() => new(
        "bridge_protocol_error",
        "ERP 桥返回了无效的会话上下文。");
}

public sealed class ErpSessionScopeSnapshot : IEquatable<ErpSessionScopeSnapshot>
{
    public ErpSessionScopeSnapshot(
        string databaseScopeFingerprint,
        string userId,
        string userName,
        string accountBook,
        string subSystemId)
        : this(
            databaseScopeFingerprint,
            userId,
            userName,
            accountBook,
            subSystemId,
            false,
            string.Empty)
    {
    }

    internal ErpSessionScopeSnapshot(
        string databaseScopeFingerprint,
        string userId,
        string userName,
        string accountBook,
        string subSystemId,
        bool isAdministrator,
        string uiStateFingerprint)
    {
        DatabaseScopeFingerprint = databaseScopeFingerprint;
        UserId = userId;
        UserName = userName;
        AccountBook = accountBook;
        SubSystemId = subSystemId;
        IsAdministrator = isAdministrator;
        UiStateFingerprint = uiStateFingerprint ?? string.Empty;
    }

    public string DatabaseScopeFingerprint { get; }
    public string UserId { get; }
    public string UserName { get; }
    public string AccountBook { get; }
    public string SubSystemId { get; }
    public bool IsAdministrator { get; }
    internal string UiStateFingerprint { get; }

    internal bool SameSessionIdentity(ErpSessionScopeSnapshot? other) =>
        other is not null
        && string.Equals(DatabaseScopeFingerprint, other.DatabaseScopeFingerprint, StringComparison.Ordinal)
        && string.Equals(UserId, other.UserId, StringComparison.Ordinal)
        && string.Equals(UserName, other.UserName, StringComparison.Ordinal)
        && string.Equals(AccountBook, other.AccountBook, StringComparison.Ordinal)
        && string.Equals(SubSystemId, other.SubSystemId, StringComparison.Ordinal)
        && IsAdministrator == other.IsAdministrator;

    internal bool SameUiState(ErpSessionScopeSnapshot? other) =>
        other is not null
        && string.Equals(UiStateFingerprint, other.UiStateFingerprint, StringComparison.Ordinal);

    public bool Equals(ErpSessionScopeSnapshot? other)
    {
        return SameSessionIdentity(other) && SameUiState(other);
    }

    public override bool Equals(object? obj) => Equals(obj as ErpSessionScopeSnapshot);

    public override int GetHashCode() => HashCode.Combine(
        DatabaseScopeFingerprint,
        UserId,
        UserName,
        AccountBook,
        SubSystemId,
        IsAdministrator,
        UiStateFingerprint);
}