"""
租戶管理 API
用於管理多租戶資訊（僅系統管理公司可存取）
"""
from typing import List
from datetime import datetime
import secrets
import string
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.orm import Session
from sqlalchemy.exc import IntegrityError

from app.api.deps import get_db, require_auth, get_current_tenant
from app.models import Tenant, Employee
from app.schemas.tenant import (
    TenantCreateRequest,
    TenantCreateResponse,
    TenantUpdateRequest,
    TenantUpdateResponse,
    TenantResponse,
    InitializationRequest,
    InitializationResponse
)
from app.services.keycloak_admin_client import get_keycloak_admin_client

router = APIRouter()


@router.get("/current", summary="取得當前租戶資訊")
def get_current_tenant_info(
    tenant: Tenant = Depends(get_current_tenant),
):
    """
    取得當前租戶資訊

    根據 JWT Token 的 Realm 自動識別租戶
    """
    return {
        "id": tenant.id,
        "code": tenant.code,
        "name": tenant.name,
        "name_eng": tenant.name_eng,
        "tax_id": tenant.tax_id,
        "prefix": tenant.prefix,
        "tel": tenant.tel,
        "add": tenant.add,
        "url": tenant.url,
        "keycloak_realm": tenant.keycloak_realm,
        "is_sysmana": tenant.is_sysmana,
        "plan_id": tenant.plan_id,
        "max_users": tenant.max_users,
        "storage_quota_gb": tenant.storage_quota_gb,
        "status": tenant.status,
        "is_active": tenant.is_active,
        "edit_by": tenant.edit_by,
        "created_at": tenant.created_at.isoformat() if tenant.created_at else None,
        "updated_at": tenant.updated_at.isoformat() if tenant.updated_at else None,
    }


@router.patch("/current", summary="更新當前租戶資訊")
def update_current_tenant_info(
    request: TenantUpdateRequest,
    db: Session = Depends(get_db),
    tenant: Tenant = Depends(get_current_tenant),
):
    """
    更新當前租戶的基本資料

    僅允許更新以下欄位:
    - name: 公司名稱
    - name_eng: 公司英文名稱
    - tax_id: 統一編號
    - tel: 公司電話
    - add: 公司地址
    - url: 公司網站

    注意: 租戶代碼 (code)、前綴 (prefix)、方案等核心欄位不可修改
    """
    try:
        # 更新欄位
        if request.name is not None:
            tenant.name = request.name
        if request.name_eng is not None:
            tenant.name_eng = request.name_eng
        if request.tax_id is not None:
            tenant.tax_id = request.tax_id
        if request.tel is not None:
            tenant.tel = request.tel
        if request.add is not None:
            tenant.add = request.add
        if request.url is not None:
            tenant.url = request.url

        # 更新編輯者
        tenant.edit_by = "current_user"  # TODO: 從 JWT Token 取得實際用戶名稱

        db.commit()
        db.refresh(tenant)

        return {
            "message": "公司資料已成功更新",
            "tenant": {
                "id": tenant.id,
                "code": tenant.code,
                "name": tenant.name,
                "name_eng": tenant.name_eng,
                "tax_id": tenant.tax_id,
                "tel": tenant.tel,
                "add": tenant.add,
                "url": tenant.url,
            }
        }

    except IntegrityError as e:
        db.rollback()
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail=f"更新失敗: {str(e)}"
        )
    except Exception as e:
        db.rollback()
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail=f"更新失敗: {str(e)}"
        )


@router.get("/", summary="列出所有租戶（僅系統管理公司）")
def list_tenants(
    db: Session = Depends(get_db),
    current_tenant: Tenant = Depends(get_current_tenant),
):
    """
    列出所有租戶

    權限要求: 必須為系統管理公司 (is_sysmana=True)
    """
    # 權限檢查
    if not current_tenant.is_sysmana:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Only system management company can access this resource"
        )

    tenants = db.query(Tenant).filter(Tenant.is_active == True).all()

    return {
        "total": len(tenants),
        "items": [
            {
                "id": t.id,
                "code": t.code,
                "name": t.name,
                "name_eng": t.name_eng,
                "keycloak_realm": t.keycloak_realm,
                "tax_id": t.tax_id,
                "prefix": t.prefix,
                "domain_set": t.domain_set,
                "tel": t.tel,
                "add": t.add,
                "url": t.url,
                "plan_id": t.plan_id,
                "max_users": t.max_users,
                "storage_quota_gb": t.storage_quota_gb,
                "status": t.status,
                "is_sysmana": t.is_sysmana,
                "is_active": t.is_active,
                "is_initialized": t.is_initialized,
                "initialized_at": t.initialized_at.isoformat() if t.initialized_at else None,
                "initialized_by": t.initialized_by,
                "edit_by": t.edit_by,
                "created_at": t.created_at.isoformat() if t.created_at else None,
                "updated_at": t.updated_at.isoformat() if t.updated_at else None,
            }
            for t in tenants
        ],
    }


@router.get("/{tenant_id}", summary="取得指定租戶資訊（僅系統管理公司）")
def get_tenant(
    tenant_id: int,
    db: Session = Depends(get_db),
    current_tenant: Tenant = Depends(get_current_tenant),
):
    """
    取得指定租戶詳細資訊

    權限要求: 必須為系統管理公司 (is_sysmana=True)
    """
    # 權限檢查
    if not current_tenant.is_sysmana:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Only system management company can access this resource"
        )

    tenant = db.query(Tenant).filter(Tenant.id == tenant_id).first()

    if not tenant:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND,
            detail=f"Tenant {tenant_id} not found"
        )

    return {
        "id": tenant.id,
        "code": tenant.code,
        "name": tenant.name,
        "name_eng": tenant.name_eng,
        "tax_id": tenant.tax_id,
        "prefix": tenant.prefix,
        "domain_set": tenant.domains,
        "tel": tenant.tel,
        "add": tenant.add,
        "url": tenant.url,
        "keycloak_realm": tenant.keycloak_realm,
        "is_sysmana": tenant.is_sysmana,
        "plan_id": tenant.plan_id,
        "max_users": tenant.max_users,
        "storage_quota_gb": tenant.storage_quota_gb,
        "status": tenant.status,
        "is_active": tenant.is_active,
        "is_initialized": tenant.is_initialized,
        "initialized_at": tenant.initialized_at,
        "initialized_by": tenant.initialized_by,
        "created_at": tenant.created_at,
        "updated_at": tenant.updated_at,
    }


def _generate_temp_password(length: int = 12) -> str:
    """產生臨時密碼"""
    chars = string.ascii_letters + string.digits + "!@#$%"
    return ''.join(secrets.choice(chars) for _ in range(length))


@router.post("/", response_model=TenantCreateResponse, summary="建立新租戶（僅 Superuser）")
def create_tenant(
    request: TenantCreateRequest,
    db: Session = Depends(get_db),
    current_tenant: Tenant = Depends(get_current_tenant),
):
    """
    建立新租戶（含 Keycloak Realm + Tenant Admin 帳號）

    權限要求: 必須為系統管理公司 (is_sysmana=True)

    流程:
    1. 驗證租戶代碼唯一性
    2. 建立 Keycloak Realm
    3. 在 Keycloak Realm 中建立 Tenant Admin 使用者
    4. 建立租戶記錄（tenants 表）
    5. 建立 Employee 記錄（employees 表）
    6. 返回租戶資訊與臨時密碼

    Returns:
        租戶資訊 + Tenant Admin 登入資訊
    """
    # ========== 權限檢查 ==========
    if not current_tenant.is_sysmana:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Only system management company can create tenants"
        )

    # ========== Step 1: 驗證租戶代碼唯一性 ==========
    existing_tenant = db.query(Tenant).filter(Tenant.code == request.code).first()
    if existing_tenant:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail=f"Tenant code '{request.code}' already exists"
        )

    # 產生 Keycloak Realm 名稱 (格式: porscheworld-pwd)
    realm_name = f"porscheworld-{request.code.lower()}"

    # ========== Step 2: 建立 Keycloak Realm ==========
    keycloak_client = get_keycloak_admin_client()
    realm_config = keycloak_client.create_realm(
        realm_name=realm_name,
        display_name=request.name
    )

    if not realm_config:
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail="Failed to create Keycloak Realm"
        )

    try:
        # ========== Step 3: 建立 Keycloak Realm Role (tenant-admin) ==========
        keycloak_client.create_realm_role(
            realm_name=realm_name,
            role_name="tenant-admin",
            description="租戶管理員 - 可管理公司內所有資源"
        )

        # ========== Step 4: 建立租戶記錄 ==========
        new_tenant = Tenant(
            code=request.code,
            name=request.name,
            name_eng=request.name_eng,
            tax_id=request.tax_id,
            prefix=request.prefix,
            tel=request.tel,
            add=request.add,
            url=request.url,
            keycloak_realm=realm_name,
            plan_id=request.plan_id,
            max_users=request.max_users,
            storage_quota_gb=request.storage_quota_gb,
            status="trial",
            is_sysmana=False,
            is_active=True,
            is_initialized=False,  # 尚未初始化
            edit_by="system"
        )

        db.add(new_tenant)
        db.flush()  # 取得 tenant.id

        # ========== Step 5: 在 Keycloak 建立 Tenant Admin 使用者 ==========
        # 使用提供的臨時密碼或產生新的
        temp_password = request.admin_temp_password

        # 分割姓名 (假設格式: "陳保時" → firstName="保時", lastName="陳")
        name_parts = request.admin_name.split()
        if len(name_parts) >= 2:
            first_name = " ".join(name_parts[1:])
            last_name = name_parts[0]
        else:
            first_name = request.admin_name
            last_name = ""

        keycloak_user_id = keycloak_client.create_user(
            username=request.admin_username,
            email=request.admin_email,
            first_name=first_name,
            last_name=last_name,
            enabled=True,
            email_verified=False
        )

        if not keycloak_user_id:
            raise HTTPException(
                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
                detail="Failed to create Keycloak user"
            )

        # 設定臨時密碼（首次登入必須變更）
        keycloak_client.reset_password(
            user_id=keycloak_user_id,
            password=temp_password,
            temporary=True  # 臨時密碼
        )

        # 將 tenant-admin 角色分配給使用者
        role_assigned = keycloak_client.assign_realm_role_to_user(
            realm_name=realm_name,
            user_id=keycloak_user_id,
            role_name="tenant-admin"
        )

        if not role_assigned:
            print(f"⚠️ Warning: Failed to assign tenant-admin role to user {keycloak_user_id}")
            # 不中斷流程,但記錄警告

        # ========== Step 6: 建立 Employee 記錄 ==========
        admin_employee = Employee(
            tenant_id=new_tenant.id,
            seq_no=1,  # 第一號員工
            tenant_emp_code=f"{request.prefix}0001",
            name=request.admin_name,
            name_eng=name_parts[0] if len(name_parts) >= 2 else request.admin_name,
            keycloak_username=request.admin_username,
            keycloak_user_id=keycloak_user_id,
            storage_quota_gb=100,  # Admin 預設配額
            email_quota_mb=10240,  # 10 GB
            employment_status="active",
            is_active=True,
            edit_by="system"
        )

        db.add(admin_employee)
        db.commit()

        # ========== Step 7: 返回結果 ==========
        return TenantCreateResponse(
            message="Tenant created successfully",
            tenant={
                "id": new_tenant.id,
                "code": new_tenant.code,
                "name": new_tenant.name,
                "keycloak_realm": realm_name,
                "status": new_tenant.status,
            },
            admin_user={
                "username": request.admin_username,
                "email": request.admin_email,
                "keycloak_user_id": keycloak_user_id,
            },
            keycloak_realm=realm_name,
            temporary_password=temp_password
        )

    except IntegrityError as e:
        db.rollback()
        # 嘗試清理已建立的 Realm
        keycloak_client.delete_realm(realm_name)
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail=f"Database integrity error: {str(e)}"
        )
    except Exception as e:
        db.rollback()
        # 嘗試清理已建立的 Realm
        keycloak_client.delete_realm(realm_name)
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail=f"Failed to create tenant: {str(e)}"
        )


@router.post("/{tenant_id}/initialize", response_model=InitializationResponse, summary="完成租戶初始化（僅 Tenant Admin）")
def initialize_tenant(
    tenant_id: int,
    request: InitializationRequest,
    db: Session = Depends(get_db),
    current_tenant: Tenant = Depends(get_current_tenant),
):
    """
    完成租戶初始化流程

    權限要求:
    - 必須為該租戶的成員
    - 必須擁有 tenant-admin 角色 (在 Keycloak 驗證)
    - 租戶必須尚未初始化 (is_initialized = false)

    流程:
    1. 驗證權限與初始化狀態
    2. 更新公司基本資料
    3. 建立部門結構
    4. 建立系統角色 (同步到 Keycloak)
    5. 儲存預設配額與服務設定
    6. 設定 is_initialized = true
    7. 記錄審計日誌

    Returns:
        初始化結果摘要
    """
    from app.models import Department, UserRole, AuditLog

    # ========== Step 1: 權限檢查 ==========
    # 驗證使用者屬於該租戶
    if current_tenant.id != tenant_id:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="You can only initialize your own tenant"
        )

    # 取得租戶記錄
    tenant = db.query(Tenant).filter(Tenant.id == tenant_id).first()
    if not tenant:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND,
            detail=f"Tenant {tenant_id} not found"
        )

    # 防止重複初始化
    if tenant.is_initialized:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Tenant has already been initialized. Initialization wizard is locked."
        )

    # TODO: 驗證使用者擁有 tenant-admin 角色 (從 JWT Token 或 Keycloak API)
    # 目前暫時跳過,後續實作 JWT Token 驗證

    try:
        # ========== Step 2: 更新公司基本資料 ==========
        company_info = request.company_info

        if "name" in company_info:
            tenant.name = company_info["name"]
        if "name_eng" in company_info:
            tenant.name_eng = company_info["name_eng"]
        if "tax_id" in company_info:
            tenant.tax_id = company_info["tax_id"]
        if "tel" in company_info:
            tenant.tel = company_info["tel"]
        if "add" in company_info:
            tenant.add = company_info["add"]
        if "url" in company_info:
            tenant.url = company_info["url"]

        # ========== Step 3: 建立部門結構 ==========
        departments_created = []

        for dept_data in request.departments:
            new_dept = Department(
                tenant_id=tenant_id,
                code=dept_data.get("code", dept_data["name"][:10]),
                name=dept_data["name"],
                name_eng=dept_data.get("name_eng"),
                parent_id=dept_data.get("parent_id"),
                is_active=True,
                edit_by="system"
            )
            db.add(new_dept)
            departments_created.append(dept_data["name"])

        db.flush()  # 取得部門 ID

        # ========== Step 4: 建立系統角色 ==========
        keycloak_client = get_keycloak_admin_client()
        roles_created = []

        for role_data in request.roles:
            # 在資料庫建立角色記錄
            new_role = UserRole(
                tenant_id=tenant_id,
                role_code=role_data["code"],
                role_name=role_data["name"],
                description=role_data.get("description", ""),
                is_active=True,
                edit_by="system"
            )
            db.add(new_role)

            # 在 Keycloak Realm 建立對應角色
            role_created = keycloak_client.create_realm_role(
                realm_name=tenant.keycloak_realm,
                role_name=role_data["code"],
                description=role_data.get("description", role_data["name"])
            )

            if role_created:
                roles_created.append(role_data["name"])
            else:
                print(f"⚠️ Warning: Failed to create role {role_data['code']} in Keycloak")

        # ========== Step 5: 儲存預設配額與服務設定 ==========
        # TODO: 實作預設配額儲存邏輯 (需要設計 tenant_settings 表)
        # 目前暫時儲存在 tenant 的 JSONB 欄位或獨立表

        default_settings = request.default_settings
        # 這裡可以儲存到 tenant metadata 或獨立的 settings 表

        # ========== Step 6: 設定初始化完成 ==========
        tenant.is_initialized = True
        tenant.initialized_at = datetime.utcnow()
        # TODO: 從 JWT Token 取得 current_user.username
        tenant.initialized_by = "admin"  # 暫時硬編碼

        # ========== Step 7: 記錄審計日誌 ==========
        audit_log = AuditLog(
            tenant_id=tenant_id,
            user_id=None,  # TODO: 從 current_user 取得
            action="tenant.initialized",
            resource_type="tenant",
            resource_id=str(tenant_id),
            details={
                "departments_created": len(departments_created),
                "roles_created": len(roles_created),
                "department_names": departments_created,
                "role_names": roles_created,
                "default_settings": default_settings,
            },
            ip_address=None,  # TODO: 從 request 取得
            user_agent=None,
        )
        db.add(audit_log)

        # 提交所有變更
        db.commit()

        # ========== Step 8: 返回結果 ==========
        return InitializationResponse(
            message="Tenant initialization completed successfully",
            summary={
                "tenant_id": tenant_id,
                "tenant_name": tenant.name,
                "departments_created": len(departments_created),
                "roles_created": len(roles_created),
                "initialized_at": tenant.initialized_at.isoformat(),
                "initialized_by": tenant.initialized_by,
            }
        )

    except IntegrityError as e:
        db.rollback()
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail=f"Database integrity error: {str(e)}"
        )
    except Exception as e:
        db.rollback()
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail=f"Initialization failed: {str(e)}"
        )
