package cc.mrbird.febs.firewall.service.impl;

import cc.mrbird.febs.common.entity.FebsResponse;
import cc.mrbird.febs.common.entity.QueryRequest;
import cc.mrbird.febs.common.utils.RedisUtils;
import cc.mrbird.febs.firewall.dto.CountryVo;
import cc.mrbird.febs.firewall.entity.FirewallCountryRule;
import cc.mrbird.febs.firewall.entity.FirewallIpWhite;
import cc.mrbird.febs.firewall.entity.FirewallSite;
import cc.mrbird.febs.firewall.mapper.FirewallCountryRuleMapper;
import cc.mrbird.febs.firewall.mapper.FirewallIpWhiteMapper;
import cc.mrbird.febs.firewall.mapper.FirewallSiteMapper;
import cc.mrbird.febs.firewall.nginx.IpWhitelistNginxConfigGenerator;
import cc.mrbird.febs.firewall.nginx.NginxConfigGenerator;
import cc.mrbird.febs.firewall.service.IFirewallRuleService;
import cn.hutool.core.util.StrUtil;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.metadata.IPage;
import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

import java.util.ArrayList;
import java.util.List;

/**
 * 防火墙规则 Service 实现
 *
 * @author auto-generated
 * @date 2026-07-31
 */
@Slf4j
@Service
@RequiredArgsConstructor
public class FirewallRuleServiceImpl implements IFirewallRuleService {

    private final FirewallCountryRuleMapper countryRuleMapper;
    private final FirewallIpWhiteMapper ipWhiteMapper;
    private final FirewallSiteMapper siteMapper;
    private final NginxConfigGenerator generator;
    private final IpWhitelistNginxConfigGenerator ipWhitelistGenerator;
    private final RedisUtils redisUtils;

    /** Redis 中 Nginx reload 任务队列 key */
    private static final String NGINX_RELOAD_QUEUE_KEY = "firewall:nginx_reload_queue";

    // ==================== 站点管理 ====================

    @Override
    public IPage<FirewallSite> siteList(FirewallSite site, QueryRequest request) {
        Page<FirewallSite> page = new Page<>(request.getPageNum(), request.getPageSize());
        LambdaQueryWrapper<FirewallSite> wrapper = new LambdaQueryWrapper<FirewallSite>()
                .like(StrUtil.isNotBlank(site.getSiteName()), FirewallSite::getSiteName, site.getSiteName())
                .like(StrUtil.isNotBlank(site.getDomain()), FirewallSite::getDomain, site.getDomain())
                .eq(site.getStatus() != null, FirewallSite::getStatus, site.getStatus())
                .orderByDesc(FirewallSite::getCreatedTime);
        return siteMapper.selectPage(page, wrapper);
    }

    @Override
    @Transactional(rollbackFor = Exception.class)
    public FebsResponse saveSite(FirewallSite site) {
        if (site.getId() != null) {
            // 更新
            FirewallSite exist = siteMapper.selectById(site.getId());
            if (exist == null) {
                return new FebsResponse().fail().message("站点不存在");
            }
            siteMapper.updateById(site);
            log.info("防火墙站点已更新: id={}, name={}", site.getId(), site.getSiteName());
        } else {
            // 新增
            siteMapper.insert(site);
            // 回填 nginxConf（如果没填则用默认值）
            if (StrUtil.isBlank(site.getNginxConf())) {
                site.setNginxConf("/etc/nginx/conf.d/firewall_country_" + site.getId() + ".conf");
                siteMapper.updateById(site);
            }
            log.info("防火墙站点已新增: id={}, name={}", site.getId(), site.getSiteName());
        }
        return new FebsResponse().success().message("保存成功");
    }

    @Override
    @Transactional(rollbackFor = Exception.class)
    public FebsResponse deleteSite(Long id) {
        FirewallSite site = siteMapper.selectById(id);
        if (site == null) {
            return new FebsResponse().fail().message("站点不存在");
        }
        // 删除站点关联的国家规则
        countryRuleMapper.delete(new LambdaQueryWrapper<FirewallCountryRule>()
                .eq(FirewallCountryRule::getSiteId, id));
        // 删除站点关联的IP白名单
        ipWhiteMapper.delete(new LambdaQueryWrapper<FirewallIpWhite>()
                .eq(FirewallIpWhite::getSiteId, id));
        // 删除Nginx配置文件（国家黑名单 + IP白名单）
        if (StrUtil.isNotBlank(site.getNginxConf())) {
            cn.hutool.core.io.FileUtil.del(site.getNginxConf());
        }
        cn.hutool.core.io.FileUtil.del(IpWhitelistNginxConfigGenerator.getConfPath(id));
        siteMapper.deleteById(id);
        log.info("防火墙站点已删除: id={}, name={}", id, site.getSiteName());
        return new FebsResponse().success().message("删除成功");
    }

    // ==================== 国家规则管理 ====================

    @Override
    public IPage<FirewallCountryRule> countryRuleList(FirewallCountryRule rule, QueryRequest request) {
        Page<FirewallCountryRule> page = new Page<>(request.getPageNum(), request.getPageSize());
        LambdaQueryWrapper<FirewallCountryRule> wrapper = new LambdaQueryWrapper<FirewallCountryRule>()
                .eq(rule.getSiteId() != null, FirewallCountryRule::getSiteId, rule.getSiteId())
                .eq(rule.getEnabled() != null, FirewallCountryRule::getEnabled, rule.getEnabled())
                .like(StrUtil.isNotBlank(rule.getCountryName()), FirewallCountryRule::getCountryName, rule.getCountryName())
                .orderByDesc(FirewallCountryRule::getCreatedTime);
        return countryRuleMapper.selectPage(page, wrapper);
    }

    @Override
    @Transactional(rollbackFor = Exception.class)
    public FebsResponse saveCountryRuleSingle(FirewallCountryRule rule) {
        if (rule.getSiteId() == null) {
            return new FebsResponse().fail().message("请选择站点");
        }
        if (StrUtil.isBlank(rule.getCountryCode())) {
            return new FebsResponse().fail().message("国家编码不能为空");
        }
        rule.setCountryCode(rule.getCountryCode().toUpperCase());

        if (rule.getId() != null) {
            countryRuleMapper.updateById(rule);
            log.info("防火墙国家规则已更新: id={}, siteId={}, country={}", rule.getId(), rule.getSiteId(), rule.getCountryCode());
        } else {
            // 检查同站点下是否已存在相同国家编码
            Integer count = countryRuleMapper.selectCount(new LambdaQueryWrapper<FirewallCountryRule>()
                    .eq(FirewallCountryRule::getSiteId, rule.getSiteId())
                    .eq(FirewallCountryRule::getCountryCode, rule.getCountryCode()));
            if (count > 0) {
                return new FebsResponse().fail().message("该站点下已存在相同国家编码: " + rule.getCountryCode());
            }
            countryRuleMapper.insert(rule);
            log.info("防火墙国家规则已新增: siteId={}, country={}", rule.getSiteId(), rule.getCountryCode());
        }

        // 保存后自动生成Nginx配置并发送reload信号
        regenerateNginxConfig(rule.getSiteId());
        return new FebsResponse().success().message("保存成功，Nginx 配置已更新");
    }

    @Override
    @Transactional(rollbackFor = Exception.class)
    public FebsResponse deleteCountryRule(Long id) {
        FirewallCountryRule rule = countryRuleMapper.selectById(id);
        if (rule == null) {
            return new FebsResponse().fail().message("规则不存在");
        }
        Long siteId = rule.getSiteId();
        countryRuleMapper.deleteById(id);
        log.info("防火墙国家规则已删除: id={}, siteId={}, country={}", id, siteId, rule.getCountryCode());

        // 删除后自动生成Nginx配置并发送reload信号
        regenerateNginxConfig(siteId);
        return new FebsResponse().success().message("删除成功，Nginx 配置已更新");
    }

    // ==================== 内部方法 ====================

    /** 重新生成Nginx配置并发送reload信号 */
    private void regenerateNginxConfig(Long siteId) {
        try {
            generator.generate(siteId);
            ipWhitelistGenerator.generate(siteId);
            redisUtils.lSet(NGINX_RELOAD_QUEUE_KEY, String.valueOf(siteId));
            log.info("Nginx reload 信号已入队: siteId={}", siteId);
        } catch (Exception e) {
            log.error("Nginx 配置生成失败: siteId={}", siteId, e);
        }
    }

    // ==================== 原有方法 ====================

    @Override
    public List<CountryVo> getCountries(Long siteId) {
        List<FirewallCountryRule> rules = countryRuleMapper.selectList(
                new LambdaQueryWrapper<FirewallCountryRule>()
                        .eq(FirewallCountryRule::getSiteId, siteId)
                        .eq(FirewallCountryRule::getEnabled, 1)
        );

        List<CountryVo> result = new ArrayList<>();
        for (FirewallCountryRule rule : rules) {
            CountryVo vo = new CountryVo();
            vo.setCode(rule.getCountryCode());
            vo.setName(rule.getCountryName());
            result.add(vo);
        }
        return result;
    }

    @Override
    @Transactional(rollbackFor = Exception.class)
    public void saveCountryRule(Long siteId, List<String> countries) {
        // 1. 删除旧规则
        countryRuleMapper.delete(new LambdaQueryWrapper<FirewallCountryRule>()
                .eq(FirewallCountryRule::getSiteId, siteId));

        // 2. 批量插入新规则
        for (String country : countries) {
            FirewallCountryRule rule = new FirewallCountryRule();
            rule.setSiteId(siteId);
            rule.setCountryCode(country.toUpperCase());
            rule.setCountryName(country);
            rule.setEnabled(1);
            countryRuleMapper.insert(rule);
        }

        log.info("防火墙国家规则已更新: siteId={}, countries={}", siteId, countries);

        // 3. 生成 Nginx 配置文件
        generator.generate(siteId);
        ipWhitelistGenerator.generate(siteId);

        // 4. 发送 reload 信号
        redisUtils.lSet(NGINX_RELOAD_QUEUE_KEY, String.valueOf(siteId));
        log.info("Nginx reload 信号已入队: siteId={}", siteId);
    }

    @Override
    public void triggerNginxReload(Long siteId) {
        generator.generate(siteId);
        ipWhitelistGenerator.generate(siteId);
        redisUtils.lSet(NGINX_RELOAD_QUEUE_KEY, String.valueOf(siteId));
        log.info("手动触发 Nginx reload: siteId={}", siteId);
    }

    // ==================== IP白名单管理 ====================

    @Override
    public IPage<FirewallIpWhite> ipWhiteList(FirewallIpWhite ipWhite, QueryRequest request) {
        Page<FirewallIpWhite> page = new Page<>(request.getPageNum(), request.getPageSize());
        LambdaQueryWrapper<FirewallIpWhite> wrapper = new LambdaQueryWrapper<FirewallIpWhite>()
                .eq(ipWhite.getSiteId() != null, FirewallIpWhite::getSiteId, ipWhite.getSiteId())
                .eq(ipWhite.getEnabled() != null, FirewallIpWhite::getEnabled, ipWhite.getEnabled())
                .like(StrUtil.isNotBlank(ipWhite.getIp()), FirewallIpWhite::getIp, ipWhite.getIp())
                .like(StrUtil.isNotBlank(ipWhite.getRemark()), FirewallIpWhite::getRemark, ipWhite.getRemark())
                .orderByDesc(FirewallIpWhite::getCreatedTime);
        return ipWhiteMapper.selectPage(page, wrapper);
    }

    @Override
    @Transactional(rollbackFor = Exception.class)
    public FebsResponse saveIpWhite(FirewallIpWhite ipWhite) {
        if (ipWhite.getSiteId() == null) {
            return new FebsResponse().fail().message("请选择站点");
        }
        if (StrUtil.isBlank(ipWhite.getIp())) {
            return new FebsResponse().fail().message("IP地址不能为空");
        }
        ipWhite.setIp(ipWhite.getIp().trim());

        if (ipWhite.getId() != null) {
            ipWhiteMapper.updateById(ipWhite);
            log.info("防火墙IP白名单已更新: id={}, siteId={}, ip={}", ipWhite.getId(), ipWhite.getSiteId(), ipWhite.getIp());
        } else {
            // 检查同站点下是否已存在相同IP
            Integer count = ipWhiteMapper.selectCount(new LambdaQueryWrapper<FirewallIpWhite>()
                    .eq(FirewallIpWhite::getSiteId, ipWhite.getSiteId())
                    .eq(FirewallIpWhite::getIp, ipWhite.getIp()));
            if (count > 0) {
                return new FebsResponse().fail().message("该站点下已存在相同IP: " + ipWhite.getIp());
            }
            ipWhiteMapper.insert(ipWhite);
            log.info("防火墙IP白名单已新增: siteId={}, ip={}", ipWhite.getSiteId(), ipWhite.getIp());
        }

        // 保存后自动生成Nginx配置并发送reload信号
        ipWhitelistGenerator.generate(ipWhite.getSiteId());
        redisUtils.lSet(NGINX_RELOAD_QUEUE_KEY, String.valueOf(ipWhite.getSiteId()));
        return new FebsResponse().success().message("保存成功，Nginx 配置已更新");
    }

    @Override
    @Transactional(rollbackFor = Exception.class)
    public FebsResponse deleteIpWhite(Long id) {
        FirewallIpWhite ipWhite = ipWhiteMapper.selectById(id);
        if (ipWhite == null) {
            return new FebsResponse().fail().message("IP白名单不存在");
        }
        Long siteId = ipWhite.getSiteId();
        ipWhiteMapper.deleteById(id);
        log.info("防火墙IP白名单已删除: id={}, siteId={}, ip={}", id, siteId, ipWhite.getIp());

        // 删除后自动生成Nginx配置并发送reload信号
        ipWhitelistGenerator.generate(siteId);
        redisUtils.lSet(NGINX_RELOAD_QUEUE_KEY, String.valueOf(siteId));
        return new FebsResponse().success().message("删除成功，Nginx 配置已更新");
    }
}