from django.db import models

from core.enums import (
    PermissionChangeAction,
    PermissionChangeTargetType,
    PermissionDataScopeType,
    PermissionOverrideMode,
)
from core.models.base import TimeStampedModel, UUIDPrimaryKeyModel


class StaffRole(UUIDPrimaryKeyModel):
    staff = models.ForeignKey(
        "org.Staff",
        on_delete=models.CASCADE,
        related_name="staff_roles",
        verbose_name="所属员工",
        help_text="员工删除时级联删除角色关联",
    )
    role = models.ForeignKey(
        "fonrey_permission.Role",
        on_delete=models.PROTECT,
        related_name="staff_links",
        verbose_name="角色",
        help_text="角色被员工引用时禁止删除",
    )
    is_primary = models.BooleanField(
        default=False,
        verbose_name="是否主角色",
        help_text="每个员工有且仅有一个主角色",
    )
    assigned_at = models.DateTimeField(
        auto_now_add=True,
        verbose_name="分配时间",
    )
    assigned_by = models.ForeignKey(
        "org.Staff",
        null=True,
        blank=True,
        on_delete=models.SET_NULL,
        related_name="staff_role_assignments_made",
        verbose_name="分配操作人",
    )
    valid_from = models.DateField(
        null=True,
        blank=True,
        verbose_name="生效日",
        help_text='预留未来「定时生效」功能',
    )
    valid_until = models.DateField(
        null=True,
        blank=True,
        verbose_name="失效日",
    )

    class Meta:
        db_table = "staff_roles"
        verbose_name = "员工角色"
        verbose_name_plural = "员工角色"
        constraints = [
            models.UniqueConstraint(
                fields=["staff", "role"],
                name="uq_staff_roles",
            ),
            models.UniqueConstraint(
                fields=["staff"],
                condition=models.Q(is_primary=True),
                name="uq_staff_roles_primary",
            ),
        ]
        indexes = [
            models.Index(fields=["role"], name="idx_staff_roles_role"),
        ]

    def __str__(self) -> str:
        marker = " [primary]" if self.is_primary else ""
        return f"{self.staff_id} → {self.role_id}{marker}"


class StaffPermissionOverride(UUIDPrimaryKeyModel):
    staff = models.ForeignKey(
        "org.Staff",
        on_delete=models.CASCADE,
        related_name="permission_overrides",
        verbose_name="所属员工",
        help_text="员工删除时级联删除覆盖记录",
    )
    permission_def = models.ForeignKey(
        "fonrey_permission.PermissionDef",
        on_delete=models.PROTECT,
        related_name="staff_overrides",
        verbose_name="被覆盖权限项",
    )
    value = models.JSONField(
        verbose_name="个人权限值",
        help_text='统一格式 {"v": <value>}',
    )
    override_mode = models.CharField(
        max_length=10,
        choices=PermissionOverrideMode.choices,
        default=PermissionOverrideMode.REPLACE,
        verbose_name="覆盖模式",
        help_text="REPLACE=替换合并值 / RESTRICT=限制上限 / GRANT=仅扩展",
    )
    reason = models.TextField(
        blank=True,
        default="",
        verbose_name="备注",
        help_text="管理员备注，建议强制填写以便审计",
    )
    modified_by = models.ForeignKey(
        "org.Staff",
        null=True,
        blank=True,
        on_delete=models.SET_NULL,
        related_name="staff_overrides_modified",
        verbose_name="修改人",
    )
    modified_at = models.DateTimeField(
        auto_now=True,
        verbose_name="最近修改时间",
    )

    class Meta:
        db_table = "staff_permission_overrides"
        verbose_name = "个人权限覆盖"
        verbose_name_plural = "个人权限覆盖"
        constraints = [
            models.UniqueConstraint(
                fields=["staff", "permission_def"],
                name="uq_staff_overrides",
            ),
        ]
        indexes = [
            models.Index(fields=["staff"], name="idx_staff_overrides_staff"),
        ]


class StaffDataScope(UUIDPrimaryKeyModel):
    staff = models.ForeignKey(
        "org.Staff",
        on_delete=models.CASCADE,
        related_name="data_scopes",
        verbose_name="所属员工",
        help_text="员工删除时级联删除范围记录",
    )
    scope_type = models.CharField(
        max_length=20,
        choices=PermissionDataScopeType.choices,
        verbose_name="范围类型",
        help_text="self=本人 / group=本组 / store=本门店 / area=本区域 / region=本大区 / company=全公司 / custom_unit=指定节点",
    )
    org_unit = models.ForeignKey(
        "org.OrgUnit",
        null=True,
        blank=True,
        on_delete=models.PROTECT,
        related_name="data_scope_grants",
        verbose_name="组织节点",
        help_text="scope_type=custom_unit 时必填，其他类型为 NULL",
    )
    is_readable = models.BooleanField(
        default=True,
        verbose_name="可读",
    )
    is_writable = models.BooleanField(
        default=False,
        verbose_name="可写",
        help_text="默认只读",
    )
    granted_by = models.ForeignKey(
        "org.Staff",
        null=True,
        blank=True,
        on_delete=models.SET_NULL,
        related_name="data_scopes_granted",
        verbose_name="授权操作人",
    )
    granted_at = models.DateTimeField(
        auto_now_add=True,
        verbose_name="授权时间",
    )
    expires_at = models.DateTimeField(
        null=True,
        blank=True,
        verbose_name="临时授权失效时间",
    )
    reason = models.TextField(
        blank=True,
        default="",
        verbose_name="授予原因",
    )

    class Meta:
        db_table = "staff_data_scopes"
        verbose_name = "员工数据范围"
        verbose_name_plural = "员工数据范围"
        indexes = [
            models.Index(fields=["staff"], name="idx_data_scopes_staff"),
            models.Index(fields=["org_unit"], name="idx_data_scopes_org"),
            models.Index(
                fields=["expires_at"],
                name="idx_data_scopes_expires",
                condition=models.Q(expires_at__isnull=False),
            ),
        ]


class PermissionChangeLog(UUIDPrimaryKeyModel):
    target_type = models.CharField(
        max_length=30,
        choices=PermissionChangeTargetType.choices,
        verbose_name="变更对象类型",
        help_text="role / role_permission / staff_role / staff_override / staff_scope",
    )
    target_id = models.UUIDField(
        verbose_name="变更对象 ID",
    )
    staff = models.ForeignKey(
        "org.Staff",
        null=True,
        blank=True,
        on_delete=models.SET_NULL,
        related_name="permission_change_logs_affecting",
        verbose_name="被影响员工",
        help_text="target 是 staff_role/staff_override/staff_scope 时必填",
    )
    role = models.ForeignKey(
        "fonrey_permission.Role",
        null=True,
        blank=True,
        on_delete=models.SET_NULL,
        related_name="change_logs",
        verbose_name="被影响角色",
    )
    permission_code = models.CharField(
        max_length=150,
        blank=True,
        default="",
        verbose_name="权限编码",
        help_text="用 code 而非 FK，避免 PermissionDef 删除后日志丢失",
    )
    action = models.CharField(
        max_length=20,
        choices=PermissionChangeAction.choices,
        verbose_name="操作动作",
        help_text="create / update / delete / assign / revoke",
    )
    old_value = models.JSONField(
        null=True,
        blank=True,
        verbose_name="变更前快照",
    )
    new_value = models.JSONField(
        null=True,
        blank=True,
        verbose_name="变更后快照",
    )
    operator = models.ForeignKey(
        "org.Staff",
        on_delete=models.PROTECT,
        related_name="permission_changes_operated",
        verbose_name="操作人",
    )
    operator_ip = models.GenericIPAddressField(
        null=True,
        blank=True,
        verbose_name="操作来源 IP",
    )
    user_agent = models.TextField(
        blank=True,
        default="",
        verbose_name="操作终端 UA",
    )
    reason = models.TextField(
        blank=True,
        default="",
        verbose_name="操作原因",
        help_text="批量设置角色等场景强制填写",
    )
    operated_at = models.DateTimeField(
        auto_now_add=True,
        verbose_name="操作时间",
        help_text="append-only 流水，分区键",
    )

    class Meta:
        db_table = "permission_change_logs"
        verbose_name = "权限变更流水"
        verbose_name_plural = "权限变更流水"
        ordering = ["-operated_at"]
        indexes = [
            models.Index(
                fields=["staff", "-operated_at"],
                name="idx_perm_log_staff",
                condition=models.Q(staff__isnull=False),
            ),
            models.Index(
                fields=["role", "-operated_at"],
                name="idx_perm_log_role",
                condition=models.Q(role__isnull=False),
            ),
            models.Index(
                fields=["target_type", "target_id", "-operated_at"],
                name="idx_perm_log_target",
            ),
            models.Index(
                fields=["operator", "-operated_at"],
                name="idx_perm_log_operator",
            ),
            models.Index(fields=["-operated_at"], name="idx_perm_log_time"),
        ]

    def delete(self, *args, **kwargs):
        raise NotImplementedError("PermissionChangeLog is append-only and cannot be deleted.")