package auth

import (
	"errors"
	"fmt"
	"os"
	"strings"

	_ "github.com/mattn/go-sqlite3"
	"github.com/segmentio/ksuid"
	"github.com/xormplus/xorm"
)

var authdb *xorm.Engine

//资源列表
type Source struct {
	Id          string `xorm:"pk notnull unique 'id'"`
	Name        string
	Permissions []Permission
	Description string
}

//权限列表
type Permission struct {
	Id       string `xorm:"pk notnull unique"`
	Name     string
	SourceId string
	Method   string
	Relation string
	//	Roles    []Role
	Roles []string
	Users []string
}

//初始化
func InitAuth(dbpath string) error {
	pathstr := strings.Split(dbpath, "/")
	dirarr := pathstr[:len(pathstr)-1]
	var dir string
	if len(dirarr) > 0 {
		dir = strings.Join(dirarr, "/")
		_, err := os.Stat(dir)
		if err != nil {
			if os.MkdirAll(dir, 0644) != nil {
				fmt.Println(dir)
				return err
			}
		}
	}

	var err error
	authdb, err = xorm.NewEngine("sqlite3", dbpath)
	if err != nil {
		return err
	}
	err = authdb.Sync(new(Source), new(Permission))
	if err != nil {
		return err
	}
	return err
}

//添加资源
func AddSource(name, routepath string) (string, error) {
	a := Source{}
	a.Description = routepath
	a.Name = name

	exist, err := authdb.Exist(&a)
	if err != nil {
		return "", err
	}
	if exist {
		return "", errors.New("exist")
	}
	a.Id = ksuid.New().String()
	_, err = authdb.Omit("permissions").Insert(&a)
	if err != nil {
		return "", err
	}
	return a.Id, err
}

//修改资源
func UpdateSource(id, name, routepath string) error {
	a := Source{}
	a.Name = name
	a.Description = routepath
	a.Id = id
	_, err := authdb.ID(id).Update(&a)
	if err != nil {
		return err
	}
	return err
}

//删除资源
func DeleteSrouce(id string) error {
	a := Source{}
	_, err := authdb.Id(id).Delete(&a)
	if err != nil {
		return err
	}
	return err
}

//查看资源对应权限
func SelectSrouce() ([]Source, error) {
	a := []Source{}
	err := authdb.Find(&a)
	if err != nil {
		return a, err
	}
	return a, err
}

//查看资源
func GetPermission(sourceid, method, relation string) ([]Permission, error) {
	a := []Permission{}
	sql := ""
	strs := []string{}
	if sourceid != "" {
		sql = "source_id = ?"
		strs = append(strs, sourceid)
	}
	if method != "" {
		and := ""
		if sql != "" {
			and = " and "
		}
		sql = sql + and + "method = ?"
		strs = append(strs, method)
	}
	if relation != "" {
		and := ""
		if sql != "" {
			and = " and "
		}
		sql = sql + and + "relation = ?"
		strs = append(strs, relation)
	}
	var err error
	if len(strs) > 0 {
		s := make([]interface{}, len(strs)+1)
		for i, v := range strs {
			s[i] = v
		}
		err = authdb.Where(sql, s...).Find(&a)
	} else {
		err = authdb.Find(&a)
	}

	if err != nil {
		return a, err
	}
	return a, err
}

//添加权限
func AddPermission(souceid, name, method, relation string, rolesid ...string) (string, error) {
	a := Permission{}
	a.Method = method
	a.SourceId = souceid
	a.Relation = relation
	exist, err := authdb.Exist(&a)
	if err != nil {
		return "", err
	}
	if exist {
		return "", errors.New("exist")
	}
	a.Name = name
	a.Id = ksuid.New().String()
	_, err = authdb.InsertOne(&a)
	if err != nil {
		return "", err
	}
	if len(rolesid) > 0 {
		err := AddRole(a.Id, rolesid...)
		if err != nil {
			return "", err
		}
	}

	return a.Id, err
}

// id 对应权限
func GetIdPermission(id string) (Permission, error) {
	var permission Permission
	_, err := authdb.Where("id=?", id).Get(&permission)
	if err != nil {
		return permission, err
	}
	return permission, err
}

//查看角色对应权限
func GetPermissionRole(RoleID string) ([]Permission, error) {
	a := []Permission{}
	err := authdb.Where("roles like ?", "%"+RoleID+"%").Find(&a)
	if err != nil {
		return a, err
	}
	return a, err
}

//查询全部权限
func SelectPermission() ([]Permission, error) {
	a := []Permission{}
	err := authdb.Find(&a)
	if err != nil {
		return a, err
	}
	return a, err
}

//修改权限属性
func UpdatePermission(id, souceid, name, method, relation string, rolesid ...string) error {
	a := Permission{}
	a.Relation = relation
	a.SourceId = souceid
	a.Method = method
	a.Id = id
	a.Name = name
	if len(rolesid) > 0 {
		a.Roles = rolesid
	}
	_, err := authdb.ID(id).Update(&a)
	if err != nil {
		return err
	}
	return err
}

//删除权限
func DeletePermission(id string) error {
	a := Permission{}
	_, err := authdb.Id(id).Delete(&a)
	if err != nil {
		return err
	}
	return err
}

//添加角色
func AddRole(permissionid string, rolesid ...string) error {
	a := Permission{}

	bo, err := authdb.Id(permissionid).Get(&a)
	if err != nil {
		return err
	}
	if !bo {
		return errors.New("not found permission :" + permissionid)
	}
	for _, roleid := range rolesid {
		exist := true
		for _, v := range a.Roles {
			roleNow := Permission{}
			exist2, err := authdb.Where("id != ? and source_id=? and method=? and roles like ?", permissionid, a.SourceId, a.Method, "%"+roleid+"%").Get(&roleNow)
			if err != nil {
				fmt.Println(err)
			}
			if exist2 {
				var index int
				for k, vr := range roleNow.Roles {
					if vr == roleid {
						index = k
					}
				}
				roleNow.Roles = append(a.Roles[:index], a.Roles[index+1:]...)
				_, err := authdb.Id(roleNow.Id).Update(roleNow)
				if err != nil {
					fmt.Println(err)
				}
			}
			if v == roleid {
				exist = false
			}
		}
		if exist {
			a.Roles = append(a.Roles, roleid)
		}
	}
	_, err = authdb.Id(permissionid).Update(&a)
	if err != nil {
		return err
	}
	return err
}

//删除角色权限
func DeleteRole(permissionid string, rolesid ...string) error {
	a := Permission{}

	bo, err := authdb.Id(permissionid).Get(&a)
	if err != nil {
		return err
	}
	if !bo {
		return nil
	}
	for _, roleid := range rolesid {
		for k, v := range a.Roles {
			if v == roleid {
				a.Roles = append(a.Roles[:k], a.Roles[k+1:]...)
				continue
			}
		}
	}

	_, err = authdb.Id(permissionid).Update(&a)
	if err != nil {
		return err
	}
	return err
}

//验证权限
func Verification(routepath, roleid, method string) (string, error) {
	var a string
	_, err := authdb.Table("source").Cols("permission.relation").Join("INNER", "permission", "source.id = permission.source_id").Where("source.description = ? AND permission.method = ? AND permission.roles LIKE ?", routepath, method, "%\""+roleid+"\"%").Get(&a)
	if err != nil {
		return "", err
	}
	return a, err
}

// 条件搜索的Activat
func ActivatPermission(query string, args ...interface{}) ([]Permission, error) {
	permission := []Permission{}
	err := authdb.Where(query, args...).Desc("created").Find(&permission)
	return permission, err
}

// 条件搜索的InPermission
func InPermission(tablename, column string, datas []interface{}, args ...interface{}) ([]interface{}, error) {
	err := authdb.Table(tablename).In(column, args).Find(&datas)
	return datas, err
}