package audit

import (
	"context"
	"strconv"

	"gorm.io/gorm"

	employeecollection "github.com/break/junhong_cmp_fiber/internal/application/employeecollection"
	employeecollectiondomain "github.com/break/junhong_cmp_fiber/internal/domain/employeecollection"
	"github.com/break/junhong_cmp_fiber/internal/model"
	"github.com/break/junhong_cmp_fiber/pkg/constants"
	"github.com/break/junhong_cmp_fiber/pkg/errors"
)

// WriteEmployeeCollectionApplication 将核销申请、审批尝试记录与受影响账单写入统一 Audit Event。
// 申请与尝试的冻结快照含付款凭证对象键，审计只记录数量与外部流水号脱敏值，不复制敏感付款内容。
func (w *Writer) WriteEmployeeCollectionApplication(ctx context.Context, tx *gorm.DB, change employeecollection.ApplicationAudit) error {
	if change.Application == nil || change.Application.ID == 0 {
		return errors.New(errors.CodeInvalidParam, "核销申请审计资源不完整")
	}
	application := change.Application
	applicationID := strconv.FormatUint(uint64(application.ID), 10)
	resources := []ResourceInput{{
		Type: constants.AuditResourceEmployeeCollectionApplication, ID: &applicationID,
		Key: applicationID, DisplayName: "核销申请 " + applicationID,
		Relation: constants.AuditResourceRelationPrimary, Role: constants.AuditResourceRoleCollectionApplication,
		IdentitySnapshot: map[string]any{
			"id": application.ID, "applicant_account_id": application.ApplicantAccountID,
			"acting_operator_id": application.ActingOperatorID,
			"payment_method_id":  application.PaymentMethodID, "paid_amount": application.PaidAmount,
			"status":                      application.Status,
			"latest_approval_instance_id": application.LatestApprovalInstanceID,
		},
		BeforeData: change.BeforeData, AfterData: change.AfterData,
		SubjectVisibility: constants.AuditSubjectResult, SubjectSummary: change.Summary,
	}}
	if change.Attempt != nil && change.Attempt.ID != 0 {
		attempt := change.Attempt
		attemptID := strconv.FormatUint(uint64(attempt.ID), 10)
		instanceID := uint(0)
		if attempt.ApprovalInstanceID != nil {
			instanceID = *attempt.ApprovalInstanceID
		}
		resources = append(resources, ResourceInput{
			Type: constants.AuditResourceEmployeeCollectionAttempt, ID: &attemptID,
			Key: attemptID, DisplayName: "审批尝试 " + attemptID,
			Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleCollectionAttempt,
			IdentitySnapshot: map[string]any{
				"id": attempt.ID, "application_id": attempt.ApplicationID, "attempt_no": attempt.AttemptNo,
				"paid_amount": attempt.PaidAmount, "approval_instance_id": instanceID,
			},
			SubjectVisibility: constants.AuditSubjectResult, SubjectSummary: change.Summary,
		})
	}
	for _, bill := range change.Bills {
		if bill == nil || bill.ID == 0 {
			continue
		}
		billID := strconv.FormatUint(uint64(bill.ID), 10)
		resources = append(resources, ResourceInput{
			Type: constants.AuditResourceEmployeeCollectionBill, ID: &billID,
			Key: bill.SourceKey, DisplayName: bill.SourceNo,
			Relation: constants.AuditResourceRelationAffected, Role: constants.AuditResourceRoleCollectionBillAffected,
			IdentitySnapshot: map[string]any{
				"id": bill.ID, "source_type": bill.SourceType, "source_id": bill.SourceID,
				"source_key": bill.SourceKey, "debtor_account_id": bill.DebtorAccountID, "status": bill.Status,
			},
			SubjectVisibility: constants.AuditSubjectResult, SubjectSummary: change.Summary,
		})
	}
	return w.Append(ctx, tx, AppendInput{
		EventID: change.EventID, ActionCode: change.ActionCode, Summary: change.Summary,
		ScopeType: constants.AuditScopePlatform, Result: constants.AuditResultSuccess,
		CorrelationID: change.CorrelationID,
		Metadata: map[string]any{
			"payment_method_code": application.PaymentMethodCode,
			"payer_name":          application.PayerName,
			"external_transaction_no_masked": employeecollectiondomain.MaskExternalTransactionNo(
				application.ExternalTransactionNo),
			"voucher_count": len(application.PaymentVoucherKeys),
			"bill_count":    len(change.Bills),
		},
		Resources: resources,
	})
}

// WriteEmployeeCollectionRecovery 记录人工恢复原审批的脱敏审计事实。
func (w *Writer) WriteEmployeeCollectionRecovery(ctx context.Context, tx *gorm.DB, application *model.EmployeeCollectionApplication, attempt *model.EmployeeCollectionApplicationAttempt, instance *model.ApprovalInstance, actorID uint, beforeStatus, action, result string) error {
	if application == nil || application.ID == 0 || attempt == nil || attempt.ID == 0 || instance == nil || instance.ID == 0 || actorID == 0 {
		return errors.New(errors.CodeInvalidParam, "核销审批恢复审计资源不完整")
	}
	applicationID := strconv.FormatUint(uint64(application.ID), 10)
	attemptID := strconv.FormatUint(uint64(attempt.ID), 10)
	instanceID := strconv.FormatUint(uint64(instance.ID), 10)
	return w.Append(ctx, tx, AppendInput{
		EventID:    "employee_collection:application:" + applicationID + ":recover:" + action,
		ActionCode: constants.AuditActionApprovalSubmissionRecovered, Summary: "人工恢复员工核销原审批提交",
		Actor: ActorInput{Kind: constants.AuditActorAccount, ID: strconv.FormatUint(uint64(actorID), 10)}, Source: constants.AuditSourceAdminAPI,
		ScopeType: constants.AuditScopePlatform, Result: result,
		Metadata: map[string]any{"before_submission_status": beforeStatus, "action": action, "result": result},
		Resources: []ResourceInput{
			{Type: constants.AuditResourceEmployeeCollectionApplication, ID: &applicationID, Key: applicationID, DisplayName: "核销申请 " + applicationID, Relation: constants.AuditResourceRelationPrimary, Role: constants.AuditResourceRoleCollectionApplication, IdentitySnapshot: map[string]any{"id": application.ID, "applicant_account_id": application.ApplicantAccountID}},
			{Type: constants.AuditResourceEmployeeCollectionAttempt, ID: &attemptID, Key: attemptID, DisplayName: "审批尝试 " + attemptID, Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleCollectionAttempt, IdentitySnapshot: map[string]any{"id": attempt.ID, "application_id": attempt.ApplicationID}},
			{Type: constants.AuditResourceApprovalInstance, ID: &instanceID, Key: instanceID, DisplayName: "审批实例 " + instanceID, Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleApprovalTarget, IdentitySnapshot: map[string]any{"id": instance.ID, "business_type": instance.BusinessType, "business_id": instance.BusinessID}},
		},
	})
}