<?php

namespace App\Utilities;

use Illuminate\Contracts\Encryption\DecryptException;
use Illuminate\Support\Facades\Artisan;
use PDO;
use PDOException;
use RuntimeException;
use Symfony\Component\Process\Process;
use Throwable;

class SystemDatabaseConfiguration
{
    private string $environmentPath;

    public function __construct(?string $environmentPath = null)
    {
        $this->environmentPath = $environmentPath ?: base_path('.env');
    }

    public function current(): array
    {
        $connectionName = (string) config('database.default', 'mysql');
        $connection = (array) config('database.connections.' . $connectionName, []);
        $options = (array) ($connection['options'] ?? []);

        $host = (string) (
            data_get($connection, 'write.host.0')
            ?? data_get($connection, 'read.host.0')
            ?? ($connection['host'] ?? '')
        );
        $tlsRequired = isset($options[PDO::MYSQL_ATTR_SSL_CA])
            || isset($options[PDO::MYSQL_ATTR_SSL_CIPHER]);
        $verifyServerCertificate = defined('PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT')
            ? (bool) ($options[constant('PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT')] ?? false)
            : false;

        return [
            'connection' => $connectionName,
            'driver' => (string) ($connection['driver'] ?? $connectionName),
            'host' => $host,
            'port' => (int) ($connection['port'] ?? 3306),
            'database' => (string) ($connection['database'] ?? ''),
            'username' => (string) ($connection['username'] ?? ''),
            'password' => (string) ($connection['password'] ?? ''),
            'prefix' => (string) ($connection['prefix'] ?? ''),
            'mode' => $this->databaseMode($host, (string) ($connection['database'] ?? '')),
            'tls_required' => $tlsRequired,
            'tls_verify_server_cert' => $tlsRequired && $verifyServerCertificate,
            'tls_ca' => (string) ($options[PDO::MYSQL_ATTR_SSL_CA] ?? ''),
        ];
    }

    /**
     * @return array{cipher:string,user_count:int,admin_count:int,source_count:int,prefix:string}
     */
    public function probe(array $settings): array
    {
        if (($settings['driver'] ?? 'mysql') !== 'mysql') {
            throw new RuntimeException('系统数据库目前只支持 MariaDB/MySQL。');
        }

        $this->assertHostResolves((string) $settings['host']);
        $this->assertTcpReachable((string) $settings['host'], (int) $settings['port']);

        $options = [
            PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
            PDO::ATTR_TIMEOUT => 8,
        ];

        if (! empty($settings['tls_required'])) {
            $options[PDO::MYSQL_ATTR_SSL_CIPHER] = 'DEFAULT';

            if (! empty($settings['tls_ca'])) {
                $options[PDO::MYSQL_ATTR_SSL_CA] = (string) $settings['tls_ca'];
            }

            if (defined('PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT')) {
                $options[constant('PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT')] =
                    ! empty($settings['tls_verify_server_cert']);
            }
        }

        try {
            $pdo = new PDO(
                sprintf(
                    'mysql:host=%s;port=%d;dbname=%s;charset=utf8mb4',
                    $settings['host'],
                    $settings['port'],
                    $settings['database']
                ),
                $settings['username'],
                $settings['password'],
                $options
            );

            $cipher = (string) ($pdo
                ->query("SHOW SESSION STATUS LIKE 'Ssl_cipher'")
                ->fetch(PDO::FETCH_NUM)[1] ?? '');

            if (! empty($settings['tls_required']) && $cipher === '') {
                throw new RuntimeException('数据库连接没有启用 TLS 加密。');
            }

            $tableNames = $pdo->query(
                'SELECT table_name FROM information_schema.tables '
                . 'WHERE table_schema = DATABASE()'
            )->fetchAll(PDO::FETCH_COLUMN);
            $prefix = $this->detectTablePrefix(
                array_map('strval', $tableNames),
                $this->current()['prefix']
            );
            $this->assertRequiredSchema($pdo, $prefix);
            $this->assertCurrentMigrations($pdo, $prefix);

            $userCount = (int) $pdo->query(
                'SELECT COUNT(*) FROM ' . $this->quoteIdentifier($prefix . 'users')
            )->fetchColumn();

            if ($userCount < 1) {
                throw new RuntimeException('目标库没有任何用户，已拒绝切换。');
            }

            $adminCount = $this->administratorCount($pdo, $prefix);

            if ($adminCount < 1) {
                throw new RuntimeException('目标库没有具备公司和后台权限的可登录管理员，已拒绝切换。');
            }

            $sourceCount = $this->assertSharedSources(
                $pdo,
                $prefix,
                (string) $settings['password']
            );

            return [
                'cipher' => $cipher,
                'user_count' => $userCount,
                'admin_count' => $adminCount,
                'source_count' => $sourceCount,
                'prefix' => $prefix,
            ];
        } catch (PDOException $exception) {
            throw new RuntimeException($this->safeConnectionError($exception), 0, $exception);
        } catch (RuntimeException $exception) {
            throw $exception;
        } catch (Throwable $exception) {
            throw new RuntimeException($this->safeConnectionError($exception), 0, $exception);
        }
    }

    public function persist(array $settings): string
    {
        if (! is_file($this->environmentPath) || ! is_writable($this->environmentPath)) {
            throw new RuntimeException('服务器私有启动配置不可写，未执行切换。');
        }

        $current = file_get_contents($this->environmentPath);

        if ($current === false) {
            throw new RuntimeException('无法读取服务器私有启动配置。');
        }

        $backupDirectory = storage_path('app/system-database-config-backups');

        if (! is_dir($backupDirectory) && ! mkdir($backupDirectory, 0700, true) && ! is_dir($backupDirectory)) {
            throw new RuntimeException('无法创建系统数据库配置备份目录。');
        }

        $backupPath = $backupDirectory . DIRECTORY_SEPARATOR . 'runtime-env-' . now()->format('Ymd-His-u') . '.backup';

        if (file_put_contents($backupPath, $current, LOCK_EX) === false) {
            throw new RuntimeException('系统数据库配置备份失败，未执行切换。');
        }

        chmod($backupPath, 0600);

        $prefix = array_key_exists('prefix', $settings)
            ? (string) $settings['prefix']
            : $this->current()['prefix'];
        $this->assertValidPrefix($prefix);

        $updated = $this->replaceEnvironmentValues($current, [
            'DB_CONNECTION' => 'mysql',
            'DB_HOST' => (string) $settings['host'],
            'DB_PORT' => (string) $settings['port'],
            'DB_DATABASE' => (string) $settings['database'],
            'DB_USERNAME' => (string) $settings['username'],
            'DB_PASSWORD' => (string) $settings['password'],
            'DB_PREFIX' => $prefix,
            'MYSQL_ATTR_SSL_CIPHER' => ! empty($settings['tls_required']) ? 'DEFAULT' : '',
            'MYSQL_ATTR_SSL_CA' => ! empty($settings['tls_required'])
                ? (string) ($settings['tls_ca'] ?? '')
                : '',
            'MYSQL_ATTR_SSL_VERIFY_SERVER_CERT' => ! empty($settings['tls_required'])
                && ! empty($settings['tls_verify_server_cert'])
                    ? 'true'
                    : 'false',
            'SYSTEM_DATABASE_MODE' => 'shared',
            // 系统数据库保存后统一读取共享云数据库配置，不再要求开发机
            // 另外维护完整的 DB_<SOURCE>_* 连接参数。
            'UPSTREAM_STORED_CONFIG_ENABLED' => 'true',
            'UPSTREAM_LOCAL_CONFIG_ENABLED' => 'false',
        ]);

        try {
            if (file_put_contents($this->environmentPath, $updated, LOCK_EX) === false) {
                throw new RuntimeException('系统数据库配置写入失败。');
            }

            Artisan::call('config:clear');
            $this->runFreshVerification('system-database:verify');
        } catch (Throwable $exception) {
            $restored = file_put_contents($this->environmentPath, $current, LOCK_EX) !== false;
            Artisan::call('config:clear');

            if (! $restored) {
                throw new RuntimeException(
                    '新配置未通过应用级验证，且旧配置自动恢复失败。请立即使用私有备份恢复。',
                    0,
                    $exception
                );
            }

            try {
                $this->runFreshVerification('app:ready');
            } catch (Throwable $rollbackException) {
                throw new RuntimeException(
                    '新配置未通过应用级验证，旧配置文件已经恢复，但旧连接复核失败。',
                    0,
                    $rollbackException
                );
            }

            throw new RuntimeException('新配置未通过应用级验证，已自动恢复原系统数据库。', 0, $exception);
        }

        return $backupPath;
    }

    /**
     * 根据一组完整的系统必需表自动识别目标库表前缀。
     *
     * @param array<int,string> $tableNames
     */
    public function detectTablePrefix(array $tableNames, string $preferredPrefix = ''): string
    {
        $requiredTables = [
            'migrations',
            'users',
            'companies',
            'roles',
            'permissions',
            'role_permissions',
            'user_roles',
            'user_companies',
            'settings',
            'system_database_connections',
        ];
        $candidates = null;

        foreach ($requiredTables as $requiredTable) {
            $matchingPrefixes = [];

            foreach ($tableNames as $tableName) {
                if ($tableName !== $requiredTable && ! str_ends_with($tableName, '_' . $requiredTable)) {
                    continue;
                }

                $prefix = substr($tableName, 0, strlen($tableName) - strlen($requiredTable));

                try {
                    $this->assertValidPrefix($prefix);
                    $matchingPrefixes[] = $prefix;
                } catch (RuntimeException) {
                    continue;
                }
            }

            $matchingPrefixes = array_values(array_unique($matchingPrefixes));
            $candidates = $candidates === null
                ? $matchingPrefixes
                : array_values(array_intersect($candidates, $matchingPrefixes));
        }

        if ($candidates === null || $candidates === []) {
            throw new RuntimeException('目标库缺少系统必需表，已拒绝切换。');
        }

        if (in_array($preferredPrefix, $candidates, true)) {
            return $preferredPrefix;
        }

        if (count($candidates) !== 1) {
            throw new RuntimeException('目标库存在多套系统表，无法自动确定表前缀。');
        }

        return $candidates[0];
    }

    private function databaseMode(string $host, string $database): string
    {
        $configured = strtolower(trim((string) config('system_database.mode', '')));

        if (in_array($configured, ['bootstrap', 'shared'], true)) {
            return $configured;
        }

        return app()->environment(['local', 'development'])
            && $host === 'mysql'
            && $database === 'akaunting'
                ? 'bootstrap'
                : 'shared';
    }

    private function assertHostResolves(string $host): void
    {
        if (
            filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)
            || filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)
        ) {
            return;
        }

        if ($host === '' || gethostbynamel($host) === false) {
            throw new RuntimeException('连接失败阶段：DNS 解析。请检查主机名称。');
        }
    }

    private function assertTcpReachable(string $host, int $port): void
    {
        $address = filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)
            ? sprintf('tcp://[%s]:%d', $host, $port)
            : sprintf('tcp://%s:%d', $host, $port);
        $socket = @stream_socket_client($address, $errorCode, $errorMessage, 4);

        if (! is_resource($socket)) {
            throw new RuntimeException('连接失败阶段：TCP 端口。请检查端口、网络和访问白名单。');
        }

        fclose($socket);
    }

    private function assertRequiredSchema(PDO $pdo, string $prefix): void
    {
        $requiredColumns = [
            'users' => ['id', 'email', 'password', 'enabled'],
            'companies' => ['id', 'enabled'],
            'roles' => ['id', 'name'],
            'permissions' => ['id', 'name'],
            'role_permissions' => ['role_id', 'permission_id'],
            'user_roles' => ['user_id', 'role_id'],
            'user_companies' => ['user_id', 'company_id'],
            'system_database_connections' => [
                'company_id',
                'source_key',
                'password',
                'shared_password',
                'allowed_scopes',
            ],
        ];
        $statement = $pdo->prepare(
            'SELECT column_name FROM information_schema.columns '
            . 'WHERE table_schema = DATABASE() AND table_name = ?'
        );

        foreach ($requiredColumns as $table => $columns) {
            $statement->execute([$prefix . $table]);
            $available = array_map('strval', $statement->fetchAll(PDO::FETCH_COLUMN));
            $missing = array_diff($columns, $available);

            if ($missing !== []) {
                throw new RuntimeException(sprintf(
                    '目标库表结构不完整：%s 缺少 %d 个必要字段。',
                    $table,
                    count($missing)
                ));
            }
        }
    }

    private function assertCurrentMigrations(PDO $pdo, string $prefix): void
    {
        $files = glob(database_path('migrations/*.php')) ?: [];
        $required = array_map(
            static fn (string $path): string => pathinfo($path, PATHINFO_FILENAME),
            $files
        );
        $applied = array_map(
            'strval',
            $pdo->query(
                'SELECT migration FROM ' . $this->quoteIdentifier($prefix . 'migrations')
            )->fetchAll(PDO::FETCH_COLUMN)
        );
        $missing = array_diff($required, $applied);

        if ($missing !== []) {
            throw new RuntimeException(sprintf(
                '目标库缺少当前代码要求的 %d 个数据库迁移，已拒绝切换。',
                count($missing)
            ));
        }
    }

    private function administratorCount(PDO $pdo, string $prefix): int
    {
        $users = $this->quoteIdentifier($prefix . 'users');
        $roles = $this->quoteIdentifier($prefix . 'roles');
        $permissions = $this->quoteIdentifier($prefix . 'permissions');
        $userRoles = $this->quoteIdentifier($prefix . 'user_roles');
        $userCompanies = $this->quoteIdentifier($prefix . 'user_companies');
        $rolePermissions = $this->quoteIdentifier($prefix . 'role_permissions');

        return (int) $pdo->query(
            "SELECT COUNT(DISTINCT u.id) FROM {$users} u "
            . "INNER JOIN {$userRoles} ur ON ur.user_id = u.id "
            . "INNER JOIN {$roles} r ON r.id = ur.role_id "
            . "INNER JOIN {$userCompanies} uc ON uc.user_id = u.id "
            . "INNER JOIN {$rolePermissions} rp ON rp.role_id = r.id "
            . "INNER JOIN {$permissions} p ON p.id = rp.permission_id "
            . "WHERE u.enabled = 1 "
            . "AND r.name IN ('super_admin', 'admin') "
            . "AND p.name = 'read-admin-panel'"
        )->fetchColumn();
    }

    private function assertSharedSources(PDO $pdo, string $prefix, string $systemDatabasePassword): int
    {
        $requiredSources = array_keys((array) config('upstreams.sources', []));

        if ($requiredSources === []) {
            return 0;
        }

        $table = $this->quoteIdentifier($prefix . 'system_database_connections');
        $statement = $pdo->query(
            "SELECT source_key, shared_password FROM {$table} WHERE company_id = 0"
        );
        $records = [];

        foreach ($statement->fetchAll(PDO::FETCH_ASSOC) as $record) {
            $source = (string) ($record['source_key'] ?? '');

            if ($source !== '') {
                $records[$source] = (string) ($record['shared_password'] ?? '');
            }
        }

        foreach ($requiredSources as $source) {
            if (! array_key_exists($source, $records)) {
                throw new RuntimeException('目标库缺少已登记的共享云数据库来源：' . $source . '。');
            }

            if ($records[$source] === '') {
                throw new RuntimeException('共享云数据库密码尚未迁移：' . $source . '。');
            }

            try {
                app(UpstreamCredentialCipher::class)->decryptWithSecret(
                    $records[$source],
                    $systemDatabasePassword
                );
            } catch (DecryptException|RuntimeException) {
                throw new RuntimeException('系统数据库密码无法解锁共享云数据库配置：' . $source . '。');
            }
        }

        return count($requiredSources);
    }

    private function safeConnectionError(Throwable $exception): string
    {
        $driverCode = $exception instanceof PDOException
            ? (int) ($exception->errorInfo[1] ?? 0)
            : 0;
        $message = strtolower($exception->getMessage());

        if ($driverCode === 1045 || str_contains($message, 'access denied')) {
            return '连接失败阶段：账号认证。请检查数据库账号和密码。';
        }

        if ($driverCode === 1049 || str_contains($message, 'unknown database')) {
            return '连接失败阶段：选择数据库。请检查数据库名称和账号权限。';
        }

        if (
            $driverCode === 2026
            || str_contains($message, 'ssl')
            || str_contains($message, 'certificate')
            || str_contains($message, 'tls')
        ) {
            return '连接失败阶段：TLS 协商或证书验证。请检查 TLS 和 CA 配置。';
        }

        if ($driverCode === 2002 || str_contains($message, 'timed out')) {
            return '连接失败阶段：数据库握手。请检查网络、端口和访问白名单。';
        }

        return '连接失败阶段：数据库登录或初始化。请检查库名、账号权限和 TLS 配置。';
    }

    protected function runFreshVerification(string $command): void
    {
        $process = new Process(
            [PHP_BINARY, base_path('artisan'), $command, '--no-ansi', '--quiet'],
            base_path()
        );
        $process->setTimeout(60);
        $process->run();

        if (! $process->isSuccessful()) {
            throw new RuntimeException('新的 Laravel 进程未通过应用级数据库验证。');
        }
    }

    private function quoteIdentifier(string $identifier): string
    {
        return '`' . str_replace('`', '``', $identifier) . '`';
    }

    private function assertValidPrefix(string $prefix): void
    {
        if (strlen($prefix) > 50 || preg_match('/^[A-Za-z0-9_]*$/D', $prefix) !== 1) {
            throw new RuntimeException('目标库系统表前缀不安全，已拒绝切换。');
        }
    }

    private function replaceEnvironmentValues(string $environment, array $values): string
    {
        $lines = preg_split('/\r\n|\r|\n/', $environment) ?: [];

        foreach ($values as $key => $value) {
            $replacement = $key . '=' . $this->encodeEnvironmentValue((string) $value);
            $found = false;

            foreach ($lines as $index => $line) {
                if (preg_match('/^' . preg_quote($key, '/') . '=/', $line) === 1) {
                    $lines[$index] = $replacement;
                    $found = true;
                    break;
                }
            }

            if (! $found) {
                $lines[] = $replacement;
            }
        }

        return rtrim(implode("\n", $lines), "\n") . "\n";
    }

    private function encodeEnvironmentValue(string $value): string
    {
        return '"' . str_replace(
            ['\\', '"', '$', "\r", "\n"],
            ['\\\\', '\\"', '\\$', '', '\\n'],
            $value
        ) . '"';
    }
}