package com.yimeng.okr.service;

import com.yimeng.okr.entity.OkrObjective;
import com.yimeng.okr.entity.SysDepartment;
import com.yimeng.okr.entity.SysUser;
import com.yimeng.okr.enums.UserRole;
import com.yimeng.okr.exception.BusinessException;
import com.yimeng.okr.mapper.SysDepartmentMapper;
import com.yimeng.okr.mapper.SysUserMapper;
import lombok.RequiredArgsConstructor;
import org.springframework.stereotype.Service;

import java.util.Objects;

@Service
@RequiredArgsConstructor
public class AuthorizationService {

    private final SysUserMapper userMapper;
    private final SysDepartmentMapper departmentMapper;

    public void requireCanViewUserData(Long actorId, Long targetUserId) {
        if (canViewUserData(actorId, targetUserId)) return;
        throw new BusinessException(403, "无权查看该员工数据");
    }

    public void requireCanManageUserData(Long actorId, Long targetUserId) {
        if (canManageUserData(actorId, targetUserId)) return;
        throw new BusinessException(403, "无权管理该员工数据");
    }

    public void requireCanViewDepartment(Long actorId, Long deptId) {
        SysUser actor = requireUser(actorId);
        if (isHrOrAbove(actor) || isDepartmentLeader(actorId, deptId)) return;
        throw new BusinessException(403, "无权查看该部门数据");
    }

    public void requireCanViewOkr(Long actorId, OkrObjective objective) {
        if (objective == null) throw new BusinessException(404, "OKR不存在");
        if (canViewOkr(actorId, objective)) return;
        throw new BusinessException(403, "无权查看该OKR");
    }

    public boolean canViewOkr(Long actorId, OkrObjective objective) {
        if (objective == null) return false;
        if (objective.getUserId() == null) return isHrOrAbove(requireUser(actorId));
        if (canViewUserData(actorId, objective.getUserId())) return true;
        return "APPROVED".equals(objective.getStatus())
                && ("COMPANY".equals(objective.getLevel()) || "DEPARTMENT".equals(objective.getLevel()));
    }

    public boolean canViewUserData(Long actorId, Long targetUserId) {
        if (actorId == null || targetUserId == null) return false;
        if (Objects.equals(actorId, targetUserId)) return true;
        SysUser actor = requireUser(actorId);
        SysUser target = requireUser(targetUserId);
        return isHrOrAbove(actor)
                || Objects.equals(actorId, target.getSuperiorId())
                || isDepartmentLeader(actorId, target.getDepartmentId());
    }

    public boolean canManageUserData(Long actorId, Long targetUserId) {
        if (actorId == null || targetUserId == null || Objects.equals(actorId, targetUserId)) return false;
        SysUser actor = requireUser(actorId);
        SysUser target = requireUser(targetUserId);
        return isHrOrAbove(actor)
                || Objects.equals(actorId, target.getSuperiorId())
                || isDepartmentLeader(actorId, target.getDepartmentId());
    }

    public boolean isHrOrAbove(Long actorId) {
        return isHrOrAbove(requireUser(actorId));
    }

    private boolean isHrOrAbove(SysUser user) {
        return user.getRole() == UserRole.HR_ADMIN || user.getRole() == UserRole.SUPER_ADMIN;
    }

    private boolean isDepartmentLeader(Long actorId, Long deptId) {
        if (actorId == null || deptId == null) return false;
        SysDepartment dept = departmentMapper.selectById(deptId);
        return dept != null && Objects.equals(actorId, dept.getLeaderId());
    }

    private SysUser requireUser(Long userId) {
        SysUser user = userMapper.selectById(userId);
        if (user == null) throw new BusinessException(404, "用户不存在");
        return user;
    }
}
