<?php

namespace App\Http\Controllers\SystemSettings;

use App\Models\Auth\User;
use App\Models\Auth\UserAccessGroup;
use App\Utilities\BusinessNavigation;
use App\Utilities\SidebarPermissions;
use App\Utilities\SystemAccess;
use Illuminate\Http\Request;
use Illuminate\Routing\Controller;
use Illuminate\Validation\Rule;

class Sidebar extends Controller
{
    public function __construct()
    {
        $this->middleware(function ($request, $next) {
            abort_unless(SystemAccess::canOpenSettings(), 403);

            return $next($request);
        });
    }

    public function index()
    {
        return view('system_settings.sidebar.index');
    }

    public function edit(Request $request)
    {
        $subjects = $this->subjects();
        $subject = $request->string('subject')->toString() ?: array_key_first($subjects);

        abort_unless(isset($subjects[$subject]), 404);

        $settings = SidebarPermissions::settings();
        $configured = in_array($subject, $settings['configured'] ?? [], true);
        $selected = $configured
            ? SidebarPermissions::normalizeAllowedKeys((array) ($settings['subjects'][$subject] ?? []))
            : SidebarPermissions::allKeys();
        $source = $configured ? '当前使用单独配置。' : '未单独配置，使用系统默认完整页面。';
        $canInherit = str_starts_with($subject, 'user_');
        if (str_starts_with($subject, 'group_')) {
            $group = UserAccessGroup::forCompany()->findOrFail(substr($subject, 6));
            $selected = SidebarPermissions::normalizeAllowedKeys($group->page_permissions ?? []);
            $configured = true;
            $source = '分组权限与用户的其他分组权限合并；用户例外配置优先。新分组默认没有页面权限。';
        } elseif ($canInherit && ! $configured) {
            $target = User::findOrFail(substr($subject, 5));
            $selected = SidebarPermissions::allowedKeys($target) ?? SidebarPermissions::allKeys();
            $groups = UserAccessGroup::forUser($target);
            $source = $groups->isNotEmpty() ? '正在继承分组：' . $groups->pluck('name')->implode('、') : '正在继承角色或系统默认权限。';
        }

        return view('system_settings.sidebar.edit', [
            'navigation' => BusinessNavigation::all(),
            'subjects' => $subjects,
            'subject' => $subject,
            'configured' => $configured,
            'selected' => $selected,
            'source' => $source,
            'canInherit' => $canInherit,
        ]);
    }

    public function update(Request $request)
    {
        $subjects = $this->subjects();
        $subject = $request->input('subject');

        $request->validate([
            'subject' => ['required', Rule::in(array_keys($subjects))],
            'permissions' => ['nullable', 'array'],
            'permissions.*' => ['string', Rule::in(SidebarPermissions::allKeys())],
            'mode' => ['nullable', Rule::in(['custom', 'inherit'])],
        ]);

        if ($request->input('mode') === 'inherit' && ! str_starts_with($subject, 'user_')) {
            return back()->withErrors(['mode' => '只有用户例外配置可以恢复继承。']);
        }
        if (str_starts_with($subject, 'group_')) {
            UserAccessGroup::forCompany()->findOrFail(substr($subject, 6))->update([
                'page_permissions' => array_values(array_unique((array) $request->input('permissions', []))),
            ]);
            flash('分组页面权限已更新，成员将在下次访问时使用新权限。')->success();
            return redirect()->route('system-settings.sidebar.edit', ['subject' => $subject]);
        }

        $settings = SidebarPermissions::settings();
        $settings['configured'] = array_values(array_unique(array_merge(
            (array) ($settings['configured'] ?? []),
            [$subject]
        )));
        $settings['subjects'][$subject] = array_values(array_unique((array) $request->input('permissions', [])));
        if ($request->input('mode') === 'inherit') {
            $settings['configured'] = array_values(array_diff($settings['configured'], [$subject]));
            unset($settings['subjects'][$subject]);
        }

        setting()->set('system.sidebar_permissions', json_encode($settings, JSON_UNESCAPED_UNICODE));
        setting()->save();

        flash('保存成功，侧边栏权限已更新。')->success();

        return redirect()->route('system-settings.sidebar.edit', ['subject' => $subject]);
    }

    private function subjects(): array
    {
        $labels = SystemAccess::roleLabels();

        if (SystemAccess::isSuperAdmin()) {
            $subjects = [
                'role_admin' => '用户类型：' . $labels[SystemAccess::ADMIN],
                'role_user' => '用户类型：' . $labels[SystemAccess::USER],
            ];

            $users = User::query()
                ->whereHas('companies', fn ($company) => $company->where('companies.id', company_id()))
                ->whereHas('roles', fn ($roles) => $roles->whereIn('roles.name', [SystemAccess::SUPER_ADMIN, SystemAccess::ADMIN, SystemAccess::USER]))
                ->with('roles')
                ->orderBy('name')
                ->get();
        } else {
            $subjects = ['role_user' => '用户类型：' . $labels[SystemAccess::USER]];
            $users = User::query()
                ->whereHas('companies', fn ($company) => $company->where('companies.id', company_id()))
                ->whereHas('roles', fn ($roles) => $roles->where('roles.name', SystemAccess::USER))
                ->orderBy('name')
                ->get();
        }

        foreach ($users as $managedUser) {
            $role = SystemAccess::roleName($managedUser);
            if ($role === SystemAccess::SUPER_ADMIN) {
                continue;
            }
            $subjects['user_' . $managedUser->id] = '指定用户：' . $managedUser->name . ' - ' . ($labels[$role] ?? $role);
        }

        if (SystemAccess::isSuperAdmin()) {
            foreach (UserAccessGroup::forCompany()->orderBy('name')->get() as $group) {
                $subjects['group_' . $group->id] = '分组：' . $group->name;
            }
        }

        return $subjects;
    }
}