package deviceprovisioning

import (
	"io"

	"github.com/gin-gonic/gin"
	"wails-app/internal/model/common/response"
	"wails-app/internal/modules/deviceprovisioning/model/request"
	provisionService "wails-app/internal/modules/deviceprovisioning/service"
	utils "wails-app/internal/pkg"
)

var svc = provisionService.New()

func requireAdmin(c *gin.Context) bool {
	if utils.GetUserAuthorityId(c) != 888 {
		response.FailWithMessage("仅管理员可以执行设备接入配置", c)
		c.Abort()
		return false
	}
	return true
}

// ReadManualIdentity 读取管理员输入 IP 设备的公开身份。
func ReadManualIdentity(c *gin.Context) {
	if !requireAdmin(c) {
		return
	}
	var req request.ManualIdentityRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		response.FailWithMessage(err.Error(), c)
		return
	}
	identity, err := svc.ReadIdentity(req)
	if err != nil {
		response.FailWithMessage(err.Error(), c)
		return
	}
	response.OkWithData(identity, c)
}

// DiscoverDevices broadcasts a bounded UDP discovery request and returns candidates.
func DiscoverDevices(c *gin.Context) {
	if !requireAdmin(c) {
		return
	}
	var req request.DiscoverRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		if err != io.EOF {
			response.FailWithMessage(err.Error(), c)
			return
		}
	}
	items, err := svc.Discover(req)
	if err != nil {
		response.FailWithMessage(err.Error(), c)
		return
	}
	response.OkWithData(items, c)
}

// ListDiscoveries returns unexpired UDP candidates for the discovery dialog.
func ListDiscoveries(c *gin.Context) {
	if !requireAdmin(c) {
		return
	}
	items, err := svc.Discoveries()
	if err != nil {
		response.FailWithMessage(err.Error(), c)
		return
	}
	response.OkWithData(items, c)
}

// ReadDiscoveredIdentity upgrades a UDP candidate to an HTTPS identity record.
func ReadDiscoveredIdentity(c *gin.Context) {
	if !requireAdmin(c) {
		return
	}
	identity, err := svc.ReadDiscoveredIdentity(c.Param("device_id"))
	if err != nil {
		response.FailWithMessage(err.Error(), c)
		return
	}
	response.OkWithData(identity, c)
}

// VerifyIdentity 确认证书指纹和设备配对码。
func VerifyIdentity(c *gin.Context) {
	if !requireAdmin(c) {
		return
	}
	var req request.VerifyRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		response.FailWithMessage(err.Error(), c)
		return
	}
	identity, err := svc.VerifyIdentity(c.Param("device_id"), req)
	if err != nil {
		response.FailWithMessage(err.Error(), c)
		return
	}
	response.OkWithData(identity, c)
}

// ProvisionDevice 绑定业务坐标并下发 MQTT 配置。
func ProvisionDevice(c *gin.Context) {
	if !requireAdmin(c) {
		return
	}
	var req request.ProvisionRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		response.FailWithMessage(err.Error(), c)
		return
	}
	status, err := svc.Provision(c.Param("device_id"), req)
	if err != nil {
		response.FailWithMessage(err.Error(), c)
		return
	}
	response.OkWithData(status, c)
}

// GetStatus 查询接入状态和 MQTT 在线状态。
func GetStatus(c *gin.Context) {
	if !requireAdmin(c) {
		return
	}
	status, err := svc.Status(c.Param("device_id"))
	if err != nil {
		response.FailWithMessage(err.Error(), c)
		return
	}
	response.OkWithData(status, c)
}

// SetupRouter 注册手工 IP 接入 API。路由挂在 PrivateGroup，仍受 JWT/Casbin/操作审计保护。
func SetupRouter(router *gin.RouterGroup) {
	group := router.Group("/device-provisioning")
	group.POST("/discover", DiscoverDevices)
	group.GET("/discoveries", ListDiscoveries)
	group.POST("/manual/identity", ReadManualIdentity)
	group.POST("/:device_id/identity", ReadDiscoveredIdentity)
	group.POST("/:device_id/verify", VerifyIdentity)
	group.POST("/:device_id/provision", ProvisionDevice)
	group.GET("/:device_id/status", GetStatus)
}