package data

import (
	"context"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"net/url"
	"strconv"
	"strings"

	"kra/internal/biz"
	datapayment "kra/internal/data/payment"

	"gorm.io/gorm"
)

type paymentRepo struct{ data *Data }

func NewPaymentRepo(data *Data) biz.PaymentRepo { return &paymentRepo{data: data} }

func ensurePaymentIntegrationConfigs(db *gorm.DB) error {
	for _, provider := range biz.SupportedPaymentProviders {
		var count int64
		if err := db.Model(&integrationConfigPO{}).Where("kind = ? AND provider = ?", integrationKindPayment, provider).Count(&count).Error; err != nil {
			return err
		}
		if count == 0 {
			if err := db.Create(&integrationConfigPO{Kind: integrationKindPayment, Provider: provider, Enabled: false, Config: "{}"}).Error; err != nil {
				return err
			}
		}
	}
	return nil
}

func (r *paymentRepo) row(ctx context.Context, provider string) (*integrationConfigPO, map[string]any, error) {
	var row integrationConfigPO
	if err := r.data.gormDB.WithContext(ctx).Where("kind = ? AND provider = ?", integrationKindPayment, provider).First(&row).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return nil, nil, biz.ErrPaymentProviderNotFound
		}
		return nil, nil, err
	}
	if !row.Enabled {
		return nil, nil, fmt.Errorf("支付渠道 %s 未启用", provider)
	}
	values := map[string]any{}
	if err := json.Unmarshal([]byte(row.Config), &values); err != nil {
		return nil, nil, fmt.Errorf("支付配置格式错误: %w", err)
	}
	return &row, values, nil
}

func (r *paymentRepo) ListConfigs(ctx context.Context) ([]*biz.PaymentConfig, error) {
	var rows []integrationConfigPO
	if err := r.data.gormDB.WithContext(ctx).Where("kind = ?", integrationKindPayment).Order("provider ASC").Find(&rows).Error; err != nil {
		return nil, err
	}
	out := make([]*biz.PaymentConfig, 0, len(rows))
	for _, row := range rows {
		values := map[string]any{}
		if json.Unmarshal([]byte(row.Config), &values) == nil {
			maskPaymentSecrets(values)
			masked, _ := json.Marshal(values)
			out = append(out, &biz.PaymentConfig{Provider: row.Provider, Enabled: row.Enabled, Values: masked})
			continue
		}
		out = append(out, &biz.PaymentConfig{Provider: row.Provider, Enabled: row.Enabled, Values: json.RawMessage("{}")})
	}
	return out, nil
}

func (r *paymentRepo) SaveConfig(ctx context.Context, config *biz.PaymentConfig) error {
	if config == nil || !contains(biz.SupportedPaymentProviders, config.Provider) {
		return errors.New("不支持的支付渠道")
	}
	if !json.Valid(config.Values) {
		return errors.New("支付配置必须是 JSON")
	}
	values := map[string]any{}
	if err := json.Unmarshal(config.Values, &values); err != nil {
		return errors.New("支付配置必须是 JSON 对象")
	}
	db := r.data.gormDB.WithContext(ctx)
	var row integrationConfigPO
	err := db.Where("kind = ? AND provider = ?", integrationKindPayment, config.Provider).First(&row).Error
	if errors.Is(err, gorm.ErrRecordNotFound) {
		if config.Enabled {
			if err = validatePaymentConfig(config.Provider, values); err != nil {
				return err
			}
		}
		encoded, _ := json.Marshal(values)
		return db.Create(&integrationConfigPO{Kind: integrationKindPayment, Provider: config.Provider, Enabled: config.Enabled, Config: string(encoded)}).Error
	}
	if err != nil {
		return err
	}
	old := map[string]any{}
	_ = json.Unmarshal([]byte(row.Config), &old)
	mergePaymentSecrets(values, old)
	if config.Enabled {
		if err = validatePaymentConfig(config.Provider, values); err != nil {
			return err
		}
	}
	encoded, _ := json.Marshal(values)
	return db.Model(&row).Updates(map[string]any{"enabled": config.Enabled, "config": string(encoded)}).Error
}

func (r *paymentRepo) adapter(ctx context.Context, provider string) (datapayment.Adapter, map[string]any, error) {
	_, values, err := r.row(ctx, provider)
	if err != nil {
		return nil, nil, err
	}
	adapter, err := datapayment.New(provider)
	return adapter, values, err
}

func (r *paymentRepo) Create(ctx context.Context, req *biz.PaymentRequest) (*biz.PaymentResult, error) {
	a, c, err := r.adapter(ctx, req.Provider)
	if err != nil {
		return nil, err
	}
	effective := *req
	effective.NotifyURL = strings.TrimSpace(text(c, "notify_url"))
	effective.ReturnURL = strings.TrimSpace(text(c, "return_url"))
	if req.Provider != biz.PaymentApple && effective.NotifyURL == "" {
		return nil, fmt.Errorf("支付渠道 %s 未配置服务端 notify_url", req.Provider)
	}
	return a.Create(ctx, &effective, c)
}
func (r *paymentRepo) Query(ctx context.Context, provider, tradeNo string) (*biz.PaymentResult, error) {
	a, c, err := r.adapter(ctx, provider)
	if err != nil {
		return nil, err
	}
	return a.Query(ctx, tradeNo, c)
}
func (r *paymentRepo) Refund(ctx context.Context, req *biz.PaymentRefundRequest) (*biz.PaymentResult, error) {
	if req == nil {
		return nil, errors.New("支付退款请求为空")
	}
	a, c, err := r.adapter(ctx, req.Provider)
	if err != nil {
		return nil, err
	}
	return a.Refund(ctx, req, c)
}
func (r *paymentRepo) HandleCallback(ctx context.Context, callback *biz.PaymentCallback) (*biz.PaymentResult, error) {
	if callback == nil {
		return nil, errors.New("支付回调为空")
	}
	a, c, err := r.adapter(ctx, callback.Provider)
	if err != nil {
		return nil, err
	}
	result, err := a.Callback(ctx, callback, c)
	if err != nil {
		return nil, &biz.PaymentCallbackError{Cause: err, Ack: paymentCallbackAck(callback.Provider, c, false)}
	}
	if result == nil {
		err = errors.New("支付回调解析结果为空")
		return nil, &biz.PaymentCallbackError{Cause: err, Ack: paymentCallbackAck(callback.Provider, c, false)}
	}
	result.SuccessAck = paymentCallbackAck(callback.Provider, c, true)
	result.FailureAck = paymentCallbackAck(callback.Provider, c, false)
	if result.Provider != callback.Provider {
		err = errors.New("支付回调渠道不匹配")
		return nil, &biz.PaymentCallbackError{Cause: err, Ack: result.FailureAck}
	}
	fields := callbackFields(callback)
	eventID := first(fields, "event_id", "notify_id", "notificationUUID", "id")
	if eventID == "" {
		hash := sha256.Sum256(append([]byte(callback.Provider+"\x00"), callback.Body...))
		eventID = hex.EncodeToString(hash[:])
	}
	result.EventID = eventID
	return result, nil
}

func paymentCallbackAck(provider string, values map[string]any, success bool) biz.PaymentCallbackAck {
	ack := biz.DefaultPaymentCallbackAck(provider, success)
	prefix := "callback_success_"
	if !success {
		prefix = "callback_failure_"
	}
	if configured := strings.TrimSpace(text(values, prefix+"status")); configured != "" {
		if status, err := strconv.Atoi(configured); err == nil && status >= 200 && status <= 599 {
			ack.StatusCode = status
		}
	}
	if contentType := strings.TrimSpace(text(values, prefix+"content_type")); contentType != "" {
		ack.ContentType = contentType
	}
	if body, exists := values[prefix+"body"]; exists {
		ack.Body = []byte(fmt.Sprint(body))
	}
	return ack
}

func callbackFields(callback *biz.PaymentCallback) map[string]string {
	fields := map[string]string{}
	for key, value := range callback.Query {
		fields[key] = value
	}
	contentType := strings.ToLower(callback.Headers["Content-Type"])
	if strings.Contains(contentType, "application/x-www-form-urlencoded") {
		if values, err := url.ParseQuery(string(callback.Body)); err == nil {
			for key, value := range values {
				if len(value) > 0 {
					fields[key] = value[0]
				}
			}
		}
	}
	var object map[string]any
	if json.Unmarshal(callback.Body, &object) == nil {
		for key, value := range object {
			if text, ok := value.(string); ok {
				fields[key] = text
			}
		}
	}
	return fields
}

func first(values map[string]string, keys ...string) string {
	for _, key := range keys {
		if values[key] != "" {
			return values[key]
		}
	}
	return ""
}

var paymentSecretKeys = map[string]bool{
	"key": true, "secret": true, "secret_key": true, "private_key": true, "privatekey": true,
	"client_key": true, "client_secret": true, "api_key": true, "api_v3_key": true,
	"mch_key": true, "merchant_key": true, "signing_secret": true, "certificate": true,
	"cert": true, "root_cert": true, "platform_cert": true, "public_cert": true,
	"public_key": true, "client_cert": true, "app_secret": true, "appsecret": true,
	"access_token": true, "app_auth_token": true, "credential_code": true, "cus_id": true, "p12": true,
	"pkcs12": true, "merchant_private_key": true, "platform_key": true,
}

func maskPaymentSecrets(values map[string]any) {
	for key, value := range values {
		normalized := strings.ToLower(strings.ReplaceAll(key, "-", "_"))
		if paymentSecretKeys[normalized] || strings.Contains(normalized, "private") || strings.Contains(normalized, "secret") {
			if text, ok := value.(string); ok && text != "" {
				values[key] = "******"
			}
			continue
		}
		if nested, ok := value.(map[string]any); ok {
			maskPaymentSecrets(nested)
		}
	}
}
func mergePaymentSecrets(values, old map[string]any) {
	for key, value := range values {
		normalized := strings.ToLower(strings.ReplaceAll(key, "-", "_"))
		if paymentSecretKeys[normalized] || strings.Contains(normalized, "private") || strings.Contains(normalized, "secret") {
			if text, ok := value.(string); ok && text == "******" {
				if prior, exists := old[key]; exists {
					values[key] = prior
				}
			}
			continue
		}
		if nested, ok := value.(map[string]any); ok {
			if prior, ok := old[key].(map[string]any); ok {
				mergePaymentSecrets(nested, prior)
			}
		}
	}
}
func contains(values []string, value string) bool {
	for _, item := range values {
		if item == value {
			return true
		}
	}
	return false
}

func validatePaymentConfig(provider string, values map[string]any) error {
	required := []string{}
	switch provider {
	case biz.PaymentAlipay:
		required = []string{"app_id", "private_key", "public_key"}
	case biz.PaymentWechatV2:
		required = []string{"app_id", "merchant_id", "mch_key"}
	case biz.PaymentWechatV3:
		required = []string{"app_id", "merchant_id", "serial_no", "private_key", "api_v3_key", "platform_cert"}
	case biz.PaymentApple:
		required = []string{"issuer_id", "key_id", "bundle_id", "private_key"}
		if configuredInt64(values, "price_divisor", 0) <= 0 {
			if _, ok := values["price_divisors"].(map[string]any); !ok {
				return fmt.Errorf("%s 缺少配置字段 price_divisor 或 price_divisors", provider)
			}
		}
	case biz.PaymentDouyin:
		required = []string{"merchant_id", "serial_no", "api_key", "private_key", "platform_cert", "platform_serial_no"}
	case biz.PaymentQQ:
		if firstAny(values, "mch_id", "merchant_id") == "" {
			return fmt.Errorf("%s 缺少配置字段 mch_id", provider)
		}
		required = []string{"api_key"}
	case biz.PaymentAllinPay:
		required = []string{"cus_id", "app_id", "private_key", "public_key"}
	case biz.PaymentLakala:
		required = []string{"partner_code", "credential_code"}
	case biz.PaymentPayPal:
		required = []string{"client_id", "client_secret"}
	case biz.PaymentSaobei:
		required = []string{"inst_no", "key", "merchant_no", "terminal_id", "access_token"}
	default:
		required = []string{
			"protocol_version", "create_url", "query_url", "query_status_field", "query_success_values",
			"query_trade_no_field", "query_provider_trade_no_field", "query_amount_field",
			"query_currency_field", "query_amount_scale", "callback_status_field",
			"callback_success_values", "callback_trade_no_field", "callback_provider_trade_no_field",
		}
		if firstAny(values, "app_key", "merchant_key", "signing_secret", "token") == "" {
			return fmt.Errorf("%s 缺少签名密钥", provider)
		}
		if err := validateConfiguredBreakdownFields(values); err != nil {
			return fmt.Errorf("%s 金额拆分配置无效: %w", provider, err)
		}
	}
	for _, key := range required {
		if text(values, key) == "" {
			return fmt.Errorf("%s 缺少配置字段 %s", provider, key)
		}
	}
	if provider == biz.PaymentDouyin && firstAny(values, "platform_serial_no", "platform_cert_serial") == "" {
		return fmt.Errorf("%s 缺少配置字段 platform_serial_no", provider)
	}
	if environment := strings.ToLower(strings.TrimSpace(text(values, "environment"))); environment != "" {
		switch provider {
		case biz.PaymentQQ, biz.PaymentDouyin, biz.PaymentLakala:
			if environment != "production" && environment != "prod" {
				return fmt.Errorf("%s 仅支持 production 环境", provider)
			}
		case biz.PaymentPayPal:
			if environment != "production" && environment != "prod" && environment != "sandbox" {
				return fmt.Errorf("%s environment 必须是 production 或 sandbox", provider)
			}
		default:
			if environment != "production" && environment != "prod" && environment != "sandbox" {
				return fmt.Errorf("%s environment 配置无效", provider)
			}
		}
	}
	if provider == biz.PaymentQQ {
		signType := strings.ToUpper(strings.TrimSpace(text(values, "sign_type")))
		if signType != "" && signType != "MD5" && signType != "HMAC-SHA256" {
			return fmt.Errorf("%s sign_type 必须是 MD5 或 HMAC-SHA256", provider)
		}
	}
	if err := validatePaymentCallbackAckConfig(values); err != nil {
		return fmt.Errorf("%s 回调响应配置无效: %w", provider, err)
	}
	return nil
}

func validateConfiguredBreakdownFields(values map[string]any) error {
	for _, key := range []string{
		"query_payer_paid_amount_scale", "query_cash_paid_amount_scale", "query_point_paid_amount_scale",
		"query_discount_amount_scale", "query_provider_discount_amount_scale", "query_merchant_discount_amount_scale",
		"query_settlement_amount_scale",
	} {
		if _, exists := values[key]; exists && configuredInt64(values, key, 0) <= 0 {
			return fmt.Errorf("%s 必须是正整数", key)
		}
	}
	for _, key := range []string{
		"query_payer_paid_amount_field", "query_cash_paid_amount_field", "query_point_paid_amount_field",
		"query_discount_amount_field", "query_provider_discount_amount_field", "query_merchant_discount_amount_field",
		"query_settlement_amount_field", "query_payer_currency_field",
	} {
		if value, exists := values[key]; exists && strings.TrimSpace(fmt.Sprint(value)) == "" {
			return fmt.Errorf("%s 不能为空", key)
		}
	}
	return nil
}

func validatePaymentCallbackAckConfig(values map[string]any) error {
	for _, prefix := range []string{"callback_success_", "callback_failure_"} {
		if value := strings.TrimSpace(text(values, prefix+"status")); value != "" {
			status, err := strconv.Atoi(value)
			if err != nil || status < 200 || status > 599 {
				return fmt.Errorf("%sstatus 必须是 200-599", prefix)
			}
		}
		if contentType := text(values, prefix+"content_type"); strings.ContainsAny(contentType, "\r\n") || len(contentType) > 200 {
			return fmt.Errorf("%scontent_type 非法", prefix)
		}
		if body, exists := values[prefix+"body"]; exists && len(fmt.Sprint(body)) > 64<<10 {
			return fmt.Errorf("%sbody 超过 64KiB", prefix)
		}
	}
	return nil
}