/*
 * Copyright 2025 Apollo Authors
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 */
package com.ctrip.framework.apollo.openapi.v1.controller;

import com.ctrip.framework.apollo.audit.annotation.ApolloAuditLog;
import com.ctrip.framework.apollo.audit.annotation.OpType;
import com.ctrip.framework.apollo.common.exception.BadRequestException;
import com.ctrip.framework.apollo.common.utils.InputValidator;
import com.ctrip.framework.apollo.common.utils.RequestPrecondition;
import com.ctrip.framework.apollo.core.utils.StringUtils;
import com.ctrip.framework.apollo.openapi.api.ClusterManagementApi;
import com.ctrip.framework.apollo.openapi.model.OpenClusterDTO;
import com.ctrip.framework.apollo.openapi.server.service.ClusterOpenApiService;
import com.ctrip.framework.apollo.portal.component.UnifiedPermissionValidator;
import com.ctrip.framework.apollo.portal.component.UserIdentityContextHolder;
import com.ctrip.framework.apollo.portal.constant.UserIdentityConstants;
import com.ctrip.framework.apollo.portal.entity.bo.UserInfo;
import com.ctrip.framework.apollo.portal.spi.UserInfoHolder;
import com.ctrip.framework.apollo.portal.spi.UserService;
import java.util.Objects;
import org.springframework.http.ResponseEntity;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.RestController;

@RestController("openapiClusterController")
public class ClusterController implements ClusterManagementApi {

  private final UserService userService;
  private final ClusterOpenApiService clusterOpenApiService;
  private final UserInfoHolder userInfoHolder;
  private final UnifiedPermissionValidator unifiedPermissionValidator;

  public ClusterController(UserService userService, ClusterOpenApiService clusterOpenApiService,
      UserInfoHolder userInfoHolder, UnifiedPermissionValidator unifiedPermissionValidator) {
    this.userService = userService;
    this.clusterOpenApiService = clusterOpenApiService;
    this.userInfoHolder = userInfoHolder;
    this.unifiedPermissionValidator = unifiedPermissionValidator;
  }

  @Override
  public ResponseEntity<OpenClusterDTO> getCluster(String appId, String clusterName, String env) {
    requireReadApplicationPermissionForUserToken(appId);
    return ResponseEntity.ok(this.clusterOpenApiService.getCluster(appId, env, clusterName));
  }

  @PreAuthorize(value = "@unifiedPermissionValidator.hasCreateClusterPermission(#appId)")
  @ApolloAuditLog(type = OpType.CREATE, name = "Cluster.create")
  @Override
  public ResponseEntity<OpenClusterDTO> createCluster(String appId, String env,
      OpenClusterDTO cluster) {

    if (!Objects.equals(appId, cluster.getAppId())) {
      throw new BadRequestException("AppId not equal. AppId in path = %s, AppId in payload = %s",
          appId, cluster.getAppId());
    }

    String clusterName = cluster.getName();
    requireCreateClusterPermissionForUserToken(appId, env, clusterName);
    String operator = resolveOperator(cluster.getDataChangeCreatedBy());
    cluster.setDataChangeLastModifiedBy(operator);
    cluster.setDataChangeCreatedBy(operator);

    RequestPrecondition.checkArguments(!StringUtils.isContainEmpty(clusterName, operator),
        "name and dataChangeCreatedBy should not be null or empty");

    if (!InputValidator.isValidClusterNamespace(clusterName)) {
      throw BadRequestException
          .invalidClusterNameFormat(InputValidator.INVALID_CLUSTER_NAMESPACE_MESSAGE);
    }

    return ResponseEntity.ok(this.clusterOpenApiService.createCluster(env, cluster, operator));
  }

  /**
   * Delete Clusters
   */
  @ApolloAuditLog(type = OpType.DELETE, name = "Cluster.delete")
  @Override
  public ResponseEntity<Void> deleteCluster(String env, String appId, String clusterName,
      String operator) {
    requireDeleteClusterPermission(appId);
    String resolvedOperator = resolveOperator(operator);

    clusterOpenApiService.deleteCluster(env, appId, clusterName, resolvedOperator);
    return ResponseEntity.ok().build();
  }

  private void requireDeleteClusterPermission(String appId) {
    String authType = UserIdentityContextHolder.getAuthType();
    if (UserIdentityConstants.USER.equals(authType)) {
      // Keep Portal UI behavior aligned with the legacy WebAPI delete path, which required
      // super-admin permission for cluster deletion.
      if (unifiedPermissionValidator.isSuperAdmin()) {
        return;
      }
      throw new AccessDeniedException("Super admin permission is required");
    }
    if (UserIdentityConstants.CONSUMER.equals(authType)) {
      // Existing OpenAPI consumers use app-scoped authorization here. Preserve that public
      // token boundary while keeping the Portal USER path compatible with the legacy WebAPI.
      if (unifiedPermissionValidator.isAppAdmin(appId)) {
        return;
      }
      throw new AccessDeniedException("App admin permission is required");
    }
    if (UserIdentityConstants.USER_TOKEN.equals(authType)) {
      if (unifiedPermissionValidator.isSuperAdmin()) {
        return;
      }
      throw new AccessDeniedException("Super admin permission is required");
    }
    throw new AccessDeniedException("Access is denied");
  }

  private void requireReadApplicationPermissionForUserToken(String appId) {
    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())
        && !unifiedPermissionValidator.hasReadApplicationPermission(appId)) {
      throw new AccessDeniedException("Access is denied");
    }
  }

  private void requireCreateClusterPermissionForUserToken(String appId, String env,
      String clusterName) {
    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())
        && !unifiedPermissionValidator.hasCreateClusterPermission(appId, env, clusterName)) {
      throw new AccessDeniedException("Create cluster permission is required");
    }
  }

  private String resolveOperator(String operator) {
    String authType = UserIdentityContextHolder.getAuthType();
    if (UserIdentityConstants.USER.equals(authType)
        || UserIdentityConstants.USER_TOKEN.equals(authType)) {
      UserInfo loginUser = userInfoHolder.getUser();
      if (loginUser == null || StringUtils.isBlank(loginUser.getUserId())) {
        throw new BadRequestException("Current user not found");
      }
      return loginUser.getUserId();
    }

    RequestPrecondition.checkArguments(!StringUtils.isContainEmpty(operator),
        "operator should not be null or empty");

    if (userService.findByUserId(operator) == null) {
      throw BadRequestException.userNotExists(operator);
    }
    return operator;
  }

}
