package app

import (
	"bufio"
	"bytes"
	"encoding/csv"
	"encoding/json"
	"fmt"
	"os"
	"path/filepath"
	"strconv"
	"strings"
	"time"

	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/helpers"

	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/audit"
	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/contract"
	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/output"
	"github.com/spf13/cobra"
)

var (
	auditCSVWrite = func(writer *csv.Writer, record []string) error { return writer.Write(record) }
	auditCSVFlush = func(writer *csv.Writer) { writer.Flush() }
	auditCSVError = func(writer *csv.Writer) error { return writer.Error() }
	auditExit     = os.Exit
	auditVerify   = audit.VerifyFile
)

func newAuditCommand() *cobra.Command {
	// Product-level Agent routing Decl (migrated from selection/audit.json
	// products.audit). Catalog assembly stamps provenance contract_final.
	contract.RegisterProductDecl(contract.ProductDecl{
		ID: "audit",
		Selection: contract.ProductSelectionDecl{
			AgentSummary: "查看、导出和校验本地操作审计日志",
			UseWhen: []string{
				"需要排查本机 CLI 操作审计记录，或验证审计文件完整性",
			},
			AvoidWhen: []string{
				"查钉钉业务数据或发消息请用对应产品命令，不要用 audit",
			},
		},
	})
	cmd := &cobra.Command{
		Use:   "audit",
		Short: "操作审计日志管理",
		Long:  "查看、导出和校验本地操作审计日志。",
	}
	cmd.AddCommand(
		newAuditTailCommand(),
		newAuditExportCommand(),
		newAuditVerifyCommand(),
	)
	return cmd
}

func newAuditTailCommand() *cobra.Command {
	var n int
	cmd := &cobra.Command{
		Use:   "tail",
		Short: "查看最近的审计记录",
		RunE: func(cmd *cobra.Command, args []string) error {
			if n < 1 {
				return fmt.Errorf("--lines 必须为正整数，收到 %d", n)
			}
			dir := auditDir()
			file, err := audit.LatestAuditFile(dir)
			if err != nil {
				return fmt.Errorf("无审计记录: %w", err)
			}
			lines, err := tailFile(file, n)
			if err != nil {
				return err
			}
			for _, line := range lines {
				fmt.Println(line)
			}
			return nil
		},
	}
	cmd.Flags().IntVarP(&n, "lines", "n", 20, "显示最近 N 条记录")
	helpers.DeclareLeafMetadata(cmd, helpers.LeafSpec{
		Safety: contract.SafetySpec{
			Effect: "read", Risk: "low",
			Confirmation: "not_required", Idempotency: "idempotent",
		},
		Contract: helpers.LeafContract{
			Identity: contract.ToolIdentitySpec{
				ProductID:      "audit",
				Name:           "tail",
				CanonicalPath:  "audit.tail",
				CLIPath:        "audit tail",
				PrimaryCLIPath: "audit tail",
			},
			Description: "查看本地操作审计日志最近 N 条记录",
			Interface: &contract.InterfaceSpec{
				Mode:         "local",
				Availability: "available",
				Reason:       "命令读取本地审计日志尾部，不绑定 pinned MCP RPC",
			},
			Selection: contract.SelectionSpec{
				AgentSummary: "查看本地操作审计日志最近 N 条记录",
				UseWhen:      []string{"需要快速查看最近写入的审计记录（默认最近 20 条）"},
				AvoidWhen: []string{
					"需要按日期范围整段导出用 audit export",
					"需要校验哈希链用 audit verify",
				},
				Examples: []string{
					"dws audit tail",
					"dws audit tail --lines 50",
				},
			},
		},
	})
	return cmd
}

func newAuditExportCommand() *cobra.Command {
	var since, until, format string
	cmd := &cobra.Command{
		Use:   "export",
		Short: "导出审计日志",
		RunE: func(cmd *cobra.Command, args []string) error {
			dir := auditDir()

			sinceDate := strings.ReplaceAll(since, "-", "")
			untilDate := strings.ReplaceAll(until, "-", "")

			files, err := audit.AuditFilesInRange(dir, sinceDate, untilDate)
			if err != nil {
				return fmt.Errorf("查找审计文件失败: %w", err)
			}
			if len(files) == 0 {
				return fmt.Errorf("指定范围内无审计文件")
			}

			switch format {
			case "jsonl":
				return exportJSONL(files)
			case "csv":
				return exportCSV(files)
			default:
				return fmt.Errorf("不支持的格式: %s（可选 jsonl, csv）", format)
			}
		},
	}
	cmd.Flags().StringVar(&since, "since", "", "起始日期 (YYYY-MM-DD)")
	cmd.Flags().StringVar(&until, "until", "", "截止日期 (YYYY-MM-DD)")
	cmd.Flags().StringVar(&format, "format", "jsonl", "输出格式: jsonl 或 csv")
	helpers.DeclareLeafMetadata(cmd, helpers.LeafSpec{
		Safety: contract.SafetySpec{
			Effect: "read", Risk: "low",
			Confirmation: "not_required", Idempotency: "idempotent",
		},
		Contract: helpers.LeafContract{
			Identity: contract.ToolIdentitySpec{
				ProductID:      "audit",
				Name:           "export",
				CanonicalPath:  "audit.export",
				CLIPath:        "audit export",
				PrimaryCLIPath: "audit export",
			},
			Description: "按日期范围导出本地操作审计日志（jsonl 或 csv）",
			Interface: &contract.InterfaceSpec{
				Mode:         "local",
				Availability: "available",
				Reason:       "命令读取并导出本地审计日志文件，不绑定 pinned MCP RPC",
			},
			Selection: contract.SelectionSpec{
				AgentSummary: "按日期范围导出本地操作审计日志（jsonl 或 csv）",
				UseWhen:      []string{"需要把本地审计日志导出为 jsonl/csv，或按 --since/--until 取一段时间"},
				AvoidWhen: []string{
					"只看最近几条用 audit tail",
					"只校验哈希链完整性用 audit verify",
				},
				Examples: []string{
					"dws audit export --format jsonl",
					"dws audit export --since 2026-07-01 --until 2026-07-14 --format csv",
				},
			},
		},
	})
	return cmd
}

func newAuditVerifyCommand() *cobra.Command {
	var file string
	cmd := &cobra.Command{
		Use:   "verify",
		Short: "校验审计日志哈希链完整性",
		RunE: func(cmd *cobra.Command, args []string) error {
			target := file
			if target == "" {
				dir := auditDir()
				var err error
				target, err = audit.LatestAuditFile(dir)
				if err != nil {
					return fmt.Errorf("无审计文件: %w", err)
				}
			}

			valid, brokenAt, verifyErr := auditVerify(target)
			if output.ResolveFormat(cmd, output.FormatTable) == output.FormatJSON {
				if verifyErr != nil && brokenAt == 0 {
					return fmt.Errorf("校验失败: %w", verifyErr)
				}
				payload := map[string]any{
					"valid":    valid,
					"file":     target,
					"brokenAt": brokenAt,
				}
				if verifyErr != nil {
					payload["reason"] = verifyErr.Error()
				}
				if err := output.WriteCommandPayload(cmd, payload, output.FormatTable); err != nil {
					return err
				}
				if !valid {
					auditExit(1)
				}
				return nil
			}
			if verifyErr != nil {
				return fmt.Errorf("校验失败: %w", verifyErr)
			}
			if valid {
				fmt.Printf("✓ %s 哈希链完整（全部通过）\n", filepath.Base(target))
			} else {
				fmt.Printf("✗ %s 哈希链在第 %d 行断裂\n", filepath.Base(target), brokenAt)
				auditExit(1)
			}
			return nil
		},
	}
	cmd.Flags().StringVar(&file, "file", "", "指定审计文件路径（默认最新文件）")
	helpers.DeclareLeafMetadata(cmd, helpers.LeafSpec{
		Safety: contract.SafetySpec{
			Effect: "read", Risk: "low",
			Confirmation: "not_required", Idempotency: "idempotent",
		},
		Contract: helpers.LeafContract{
			Identity: contract.ToolIdentitySpec{
				ProductID:      "audit",
				Name:           "verify",
				CanonicalPath:  "audit.verify",
				CLIPath:        "audit verify",
				PrimaryCLIPath: "audit verify",
			},
			Description: "校验本地审计日志文件的哈希链完整性",
			Interface: &contract.InterfaceSpec{
				Mode:         "local",
				Availability: "available",
				Reason:       "命令校验本地审计日志哈希链，不绑定 pinned MCP RPC",
			},
			Selection: contract.SelectionSpec{
				AgentSummary: "校验本地审计日志文件的哈希链完整性",
				UseWhen:      []string{"怀疑审计文件被篡改，或需要确认最新/指定文件哈希链是否完整"},
				AvoidWhen:    []string{"只浏览或导出日志内容时用 audit tail / audit export"},
				Examples: []string{
					"dws audit verify",
					"dws audit verify --file /path/to/audit.jsonl",
				},
			},
		},
	})
	return cmd
}

func auditDir() string {
	if dir := os.Getenv(audit.EnvAuditDir); dir != "" {
		return dir
	}
	return filepath.Join(defaultConfigDir(), "audit")
}

func tailFile(path string, n int) ([]string, error) {
	f, err := os.Open(path)
	if err != nil {
		return nil, err
	}
	defer f.Close()

	var lines []string
	scanner := bufio.NewScanner(f)
	scanner.Buffer(make([]byte, 1024*1024), 1024*1024)
	for scanner.Scan() {
		lines = append(lines, scanner.Text())
	}
	if err := scanner.Err(); err != nil {
		return nil, err
	}

	if len(lines) > n {
		lines = lines[len(lines)-n:]
	}
	return lines, nil
}

func exportJSONL(files []string) error {
	for _, file := range files {
		f, err := os.Open(file)
		if err != nil {
			return err
		}
		scanner := bufio.NewScanner(f)
		scanner.Buffer(make([]byte, 1024*1024), 1024*1024)
		for scanner.Scan() {
			fmt.Println(scanner.Text())
		}
		f.Close()
		if err := scanner.Err(); err != nil {
			return err
		}
	}
	return nil
}

func exportCSV(files []string) error {
	w := csv.NewWriter(os.Stdout)

	header := []string{"timestamp", "execution_id", "user_id", "corp_id", "product", "command", "result", "duration_ms", "error_category"}
	if err := auditCSVWrite(w, header); err != nil {
		return fmt.Errorf("写入 CSV 表头失败: %w", err)
	}

	for _, file := range files {
		f, err := os.Open(file)
		if err != nil {
			return err
		}
		scanner := bufio.NewScanner(f)
		scanner.Buffer(make([]byte, 1024*1024), 1024*1024)
		lineNum := 0
		for scanner.Scan() {
			lineNum++
			line := scanner.Bytes()
			if len(bytes.TrimSpace(line)) == 0 {
				continue
			}
			var evt audit.Event
			if err := json.Unmarshal(line, &evt); err != nil {
				f.Close()
				return fmt.Errorf("解析审计记录失败 %s:%d: %w", file, lineNum, err)
			}
			row := []string{
				evt.Timestamp.Format(time.RFC3339),
				evt.ExecutionID,
				evt.Actor.UserID,
				evt.Actor.CorpID,
				evt.Product,
				evt.Command,
				evt.Result,
				strconv.FormatInt(evt.DurationMs, 10),
				evt.ErrCategory,
			}
			if err := auditCSVWrite(w, row); err != nil {
				f.Close()
				return fmt.Errorf("写入 CSV 记录失败: %w", err)
			}
		}
		if err := scanner.Err(); err != nil {
			f.Close()
			return err
		}
		f.Close()
	}

	auditCSVFlush(w)
	if err := auditCSVError(w); err != nil {
		return fmt.Errorf("刷新 CSV 输出失败: %w", err)
	}
	return nil
}