import logging
import time
import random
from typing import Dict, Optional
from datetime import datetime, timedelta

from fastapi import APIRouter, HTTPException
import requests

from models.dida_auth import (
    DidaOAuthRequest,
    DidaRefreshTokenRequest,
    DidaBindingStatusResponse,
    DidaOAuthResponse,
)
from database import query, update, insert, get_db_type

logger = logging.getLogger(__name__)
router = APIRouter()

# 滴答清单OAuth配置
DIDA_OAUTH_BASE_URL = "https://dida365.com/oauth"
DIDA_API_BASE_URL = "https://api.dida365.com/open/v1"


class DidaOAuthClient:
    """滴答清单OAuth客户端"""

    def __init__(self, client_id: str, client_secret: str):
        self.client_id = client_id
        self.client_secret = client_secret

    def exchange_code_for_token(self, authorization_code: str, redirect_uri: str) -> Dict:
        """
        用授权码换取访问令牌

        Args:
            authorization_code: OAuth授权码
            redirect_uri: 重定向URI（必须与OAuth申请时一致）

        Returns:
            包含access_token、refresh_token等的字典
        """
        url = f"{DIDA_OAUTH_BASE_URL}/token"
        data = {
            "client_id": self.client_id,
            "client_secret": self.client_secret,
            "code": authorization_code,
            "grant_type": "authorization_code",
            "redirect_uri": redirect_uri,
        }

        try:
            logger.info(f"🔄 开始交换OAuth令牌")
            logger.info(f"   URL: {url}")
            logger.info(f"   client_id: {self.client_id}")
            logger.info(f"   client_secret: {self.client_secret[:10]}..." if self.client_secret else "   client_secret: None")
            logger.info(f"   code: {authorization_code}")
            logger.info(f"   redirect_uri: {redirect_uri}")
            
            response = requests.post(url, data=data, timeout=10)
            
            logger.info(f"📡 响应状态码: {response.status_code}")
            logger.info(f"📡 响应头: {dict(response.headers)}")
            
            # 记录详细的错误信息
            if response.status_code != 200:
                error_detail = response.text[:500]  # 只记录前500字符
                logger.error(f"❌ OAuth令牌交换失败 [{response.status_code}]")
                logger.error(f"   错误详情: {error_detail}")
                
                # 尝试解析JSON错误
                try:
                    error_json = response.json()
                    error_msg = error_json.get('error_description') or error_json.get('error') or error_detail
                except:
                    error_msg = error_detail
                
                raise HTTPException(
                    status_code=400, 
                    detail=f"OAuth令牌交换失败: {error_msg}"
                )
            
            result = response.json()
            logger.info(f"✅ OAuth令牌交换成功")

            if "access_token" not in result:
                raise ValueError(f"OAuth响应中缺少access_token: {result}")

            return result
        except HTTPException:
            raise
        except requests.exceptions.RequestException as e:
            logger.error(f"❌ OAuth令牌交换网络错误: {e}")
            raise HTTPException(status_code=400, detail=f"OAuth令牌交换失败: {str(e)}")

    def refresh_access_token(self, refresh_token: str) -> Dict:
        """
        刷新访问令牌

        Args:
            refresh_token: 刷新令牌

        Returns:
            包含新access_token的字典
        """
        url = f"{DIDA_OAUTH_BASE_URL}/token"
        data = {
            "client_id": self.client_id,
            "client_secret": self.client_secret,
            "refresh_token": refresh_token,
            "grant_type": "refresh_token",
        }

        try:
            response = requests.post(url, data=data, timeout=10)
            response.raise_for_status()
            result = response.json()

            if "access_token" not in result:
                raise ValueError(f"刷新令牌响应中缺少access_token: {result}")

            return result
        except requests.exceptions.RequestException as e:
            logger.error(f"刷新令牌失败: {e}")
            raise HTTPException(status_code=400, detail=f"刷新令牌失败: {str(e)}")

    def get_user_info(self, access_token: str) -> Dict:
        """
        获取用户信息
        注意：滴答清单Open API可能不提供用户详情接口，我们可以跳过这一步

        Args:
            access_token: 访问令牌

        Returns:
            用户信息字典（如果API不支持，返回空字典）
        """
        # 滴答清单Open API可能不提供标准的用户信息接口
        # 我们可以尝试获取项目列表来验证token有效性
        url = f"{DIDA_API_BASE_URL}/project"
        headers = {"Authorization": f"Bearer {access_token}"}

        try:
            response = requests.get(url, headers=headers, timeout=10)
            response.raise_for_status()
            # 如果能成功获取项目列表，说明token有效
            # 返回一个包含基本信息的字典
            projects = response.json()
            logger.info(f"Token验证成功，用户有 {len(projects) if isinstance(projects, list) else 0} 个项目")
            return {"verified": True, "project_count": len(projects) if isinstance(projects, list) else 0}
        except requests.exceptions.RequestException as e:
            logger.error(f"验证access_token失败: {e}")
            raise HTTPException(status_code=400, detail=f"验证access_token失败: {str(e)}")


@router.post("/oauth/callback", response_model=DidaOAuthResponse)
async def handle_oauth_callback(request: DidaOAuthRequest):
    """
    处理OAuth回调，交换授权码为访问令牌并保存

    Args:
        request: OAuth请求，包含授权码、Client凭证和redirect_uri

    Returns:
        OAuth响应
    """
    try:
        # 创建OAuth客户端
        oauth_client = DidaOAuthClient(request.client_id, request.client_secret)

        # 交换授权码为令牌（必须传递redirect_uri）
        logger.info(f"用户 {request.system_user_id} 正在交换OAuth授权码...")
        logger.info(f"redirect_uri: {request.redirect_uri}")
        token_result = oauth_client.exchange_code_for_token(
            authorization_code=request.authorization_code,
            redirect_uri=request.redirect_uri
        )

        logger.info(f"Token响应: {token_result}")
        
        access_token = token_result["access_token"]
        # refresh_token可能不存在，使用access_token作为备用
        refresh_token = token_result.get("refresh_token", access_token)
        expires_in = token_result.get("expires_in", 7200)  # 默认2小时
        
        if not token_result.get("refresh_token"):
            logger.warning("OAuth响应中未包含refresh_token，使用access_token作为备用")

        # 验证token并获取基本信息
        user_info = oauth_client.get_user_info(access_token)
        # 滴答清单可能不返回用户名，使用一个默认值
        dida_username = user_info.get("username") or user_info.get("email") or f"dida_user_{request.system_user_id}"
        logger.info(f"使用滴答清单账号名: {dida_username}")

        # 计算令牌过期时间
        token_expires_at = datetime.now() + timedelta(seconds=expires_in)

        # 保存到数据库
        await save_dida_credentials(
            system_user_id=request.system_user_id,
            dida_username=dida_username,
            client_id=request.client_id,
            client_secret=request.client_secret,
            access_token=access_token,
            refresh_token=refresh_token,
            token_expires_at=token_expires_at,
        )

        return DidaOAuthResponse(
            status="success",
            message="滴答清单账号绑定成功！",
            data={
                "username": dida_username,
                "expires_at": token_expires_at.isoformat(),
            },
        )

    except HTTPException:
        raise
    except Exception as e:
        logger.error(f"OAuth回调处理失败: {e}", exc_info=True)
        raise HTTPException(status_code=500, detail=f"服务器错误: {str(e)}")


@router.post("/refresh", response_model=DidaOAuthResponse)
async def refresh_dida_token(request: DidaRefreshTokenRequest):
    """
    刷新滴答清单访问令牌

    Args:
        request: 包含system_user_id的请求

    Returns:
        OAuth响应
    """
    try:
        # 查询当前凭证
        credentials = await get_dida_credentials(request.system_user_id)
        if not credentials:
            raise HTTPException(status_code=404, detail="未找到滴答清单绑定信息，请先绑定账号")

        # 创建OAuth客户端
        oauth_client = DidaOAuthClient(
            credentials["client_id"], credentials["client_secret"]
        )

        # 刷新令牌
        logger.info(f"用户 {request.system_user_id} 正在刷新滴答清单令牌...")
        token_result = oauth_client.refresh_access_token(credentials["refresh_token"])

        access_token = token_result["access_token"]
        refresh_token = token_result.get("refresh_token", credentials["refresh_token"])
        expires_in = token_result.get("expires_in", 7200)

        # 计算新的过期时间
        token_expires_at = datetime.now() + timedelta(seconds=expires_in)

        # 更新数据库
        await update_dida_credentials(
            system_user_id=request.system_user_id,
            access_token=access_token,
            refresh_token=refresh_token,
            token_expires_at=token_expires_at,
        )

        return DidaOAuthResponse(
            status="success",
            message="令牌刷新成功",
            data={
                "expires_at": token_expires_at.isoformat(),
            },
        )

    except HTTPException:
        raise
    except Exception as e:
        logger.error(f"刷新令牌失败: {e}", exc_info=True)
        raise HTTPException(status_code=500, detail=f"服务器错误: {str(e)}")


@router.get("/binding/status", response_model=DidaBindingStatusResponse)
async def check_binding_status(system_user_id: int):
    """
    检查滴答清单账号绑定状态

    Args:
        system_user_id: 系统用户ID

    Returns:
        绑定状态响应
    """
    try:
        logger.info(f"🔍 检查用户 {system_user_id} 的滴答清单绑定状态")

        credentials = await get_dida_credentials(system_user_id)

        if credentials:
            logger.info(f"✅ 找到绑定账号: {credentials['dida_username']}")
            return DidaBindingStatusResponse(
                is_bound=True,
                username=credentials["dida_username"],
                bound_at=str(credentials["created_at"]),
                token_expires_at=str(credentials.get("token_expires_at")),
            )

        logger.info(f"❌ 未找到绑定账号，system_user_id={system_user_id}")
        return DidaBindingStatusResponse(is_bound=False)

    except Exception as e:
        logger.error(f"❌ check_binding_status error: {e}", exc_info=True)
        return DidaBindingStatusResponse(is_bound=False)


@router.delete("/unbind")
async def unbind_dida_account(system_user_id: int):
    """
    解绑滴答清单账号

    Args:
        system_user_id: 系统用户ID

    Returns:
        操作结果
    """
    try:
        db_type = get_db_type()

        if db_type == "mysql":
            # MySQL: 软删除（设置is_active=0）
            update_sql = """
                UPDATE dida_credentials 
                SET is_active = 0 
                WHERE system_user_id = %s
            """
            update(update_sql, (system_user_id,))
        else:
            # StarRocks: 由于是DUPLICATE KEY表，不支持DELETE，插入一条标记删除的记录
            # 这里简单起见，我们不真正删除，只是在查询时忽略
            logger.warning("StarRocks不支持DELETE，请手动处理或在查询时过滤")

        return {"status": "success", "message": "滴答清单账号已解绑"}

    except Exception as e:
        logger.error(f"解绑账号失败: {e}", exc_info=True)
        raise HTTPException(status_code=500, detail=f"解绑失败: {str(e)}")


# ==================== 数据库操作辅助函数 ====================


async def save_dida_credentials(
    system_user_id: int,
    dida_username: str,
    client_id: str,
    client_secret: str,
    access_token: str,
    refresh_token: str,
    token_expires_at: datetime,
):
    """
    保存滴答清单凭证到数据库

    Args:
        system_user_id: 系统用户ID
        dida_username: 滴答清单用户名
        client_id: 应用Client ID
        client_secret: 应用Client Secret
        access_token: 访问令牌
        refresh_token: 刷新令牌
        token_expires_at: 令牌过期时间
    """
    try:
        db_type = get_db_type()

        if db_type == "mysql":
            # MySQL: 先禁用旧凭证，再插入新凭证
            update_sql = """
                UPDATE dida_credentials 
                SET is_active = 0 
                WHERE system_user_id = %s
            """
            update(update_sql, (system_user_id,))

            insert_sql = """
                INSERT INTO dida_credentials 
                (system_user_id, dida_username, client_id, client_secret, 
                 access_token, refresh_token, token_expires_at, is_active, created_at, updated_at)
                VALUES (%s, %s, %s, %s, %s, %s, %s, 1, NOW(), NOW())
            """
            insert(
                insert_sql,
                (
                    system_user_id,
                    dida_username,
                    client_id,
                    client_secret,
                    access_token,
                    refresh_token,
                    token_expires_at,
                ),
            )
            logger.info(f"[MySQL] 用户 {system_user_id} 成功绑定滴答清单账号: {dida_username}")

        else:  # StarRocks
            # StarRocks: 直接插入新记录
            credential_id = int(time.time() * 1000) + random.randint(1000, 9999)
            insert_sql = """
                INSERT INTO dida_credentials 
                (id, system_user_id, dida_username, client_id, client_secret, 
                 access_token, refresh_token, token_expires_at, created_at, updated_at)
                VALUES (%s, %s, %s, %s, %s, %s, %s, %s, NOW(), NOW())
            """
            insert(
                insert_sql,
                (
                    credential_id,
                    system_user_id,
                    dida_username,
                    client_id,
                    client_secret,
                    access_token,
                    refresh_token,
                    token_expires_at,
                ),
            )
            logger.info(f"[StarRocks] 用户 {system_user_id} 成功绑定滴答清单账号: {dida_username}")

    except Exception as e:
        logger.error(f"save_dida_credentials error: {e}")
        raise


async def update_dida_credentials(
    system_user_id: int,
    access_token: str,
    refresh_token: str,
    token_expires_at: datetime,
):
    """
    更新滴答清单凭证（主要用于刷新令牌）

    Args:
        system_user_id: 系统用户ID
        access_token: 新的访问令牌
        refresh_token: 新的刷新令牌
        token_expires_at: 新的过期时间
    """
    try:
        db_type = get_db_type()

        if db_type == "mysql":
            update_sql = """
                UPDATE dida_credentials 
                SET access_token = %s, 
                    refresh_token = %s,
                    token_expires_at = %s,
                    updated_at = NOW()
                WHERE system_user_id = %s AND is_active = 1
            """
            update(update_sql, (access_token, refresh_token, token_expires_at, system_user_id))
            logger.info(f"[MySQL] 用户 {system_user_id} 的滴答清单令牌已更新")
        else:
            # StarRocks: 插入新记录
            credentials = await get_dida_credentials(system_user_id)
            if credentials:
                await save_dida_credentials(
                    system_user_id=system_user_id,
                    dida_username=credentials["dida_username"],
                    client_id=credentials["client_id"],
                    client_secret=credentials["client_secret"],
                    access_token=access_token,
                    refresh_token=refresh_token,
                    token_expires_at=token_expires_at,
                )

    except Exception as e:
        logger.error(f"update_dida_credentials error: {e}")
        raise


async def get_dida_credentials(system_user_id: int) -> Optional[Dict]:
    """
    获取用户的滴答清单凭证

    Args:
        system_user_id: 系统用户ID

    Returns:
        凭证字典，如果不存在则返回None
    """
    try:
        db_type = get_db_type()

        if db_type == "mysql":
            sql = """
                SELECT dida_username, client_id, client_secret, access_token, 
                       refresh_token, token_expires_at, created_at, updated_at
                FROM dida_credentials 
                WHERE system_user_id = %s AND is_active = 1
                ORDER BY updated_at DESC 
                LIMIT 1
            """
        else:
            # StarRocks: 取最新记录
            sql = """
                SELECT dida_username, client_id, client_secret, access_token, 
                       refresh_token, token_expires_at, created_at, updated_at
                FROM dida_credentials 
                WHERE system_user_id = %s
                ORDER BY updated_at DESC 
                LIMIT 1
            """

        result = query(sql, (system_user_id,))

        if result and len(result) > 0:
            return result[0]

        return None

    except Exception as e:
        logger.error(f"get_dida_credentials error: {e}")
        return None