<?php

declare(strict_types=1);

namespace App\Services\PermissionPosture;

use App\Models\AlertRule;
use App\Models\Finding;
use App\Models\OperationRun;
use App\Models\StoredReport;
use App\Models\Tenant;
use App\Services\Findings\FindingSlaPolicy;
use Carbon\CarbonImmutable;

/**
 * Generates, auto-resolves, and re-opens permission posture findings
 * based on the output of TenantPermissionService::compare().
 */
final class PermissionPostureFindingGenerator implements FindingGeneratorContract
{
    public function __construct(
        private readonly PostureScoreCalculator $scoreCalculator,
        private readonly FindingSlaPolicy $slaPolicy,
    ) {}

    /**
     * @param  array{overall_status: string, permissions: array<int, array{key: string, type: string, features: array<int, string>, status: string, ...}>, ...}  $permissionComparison
     */
    public function generate(Tenant $tenant, array $permissionComparison, ?OperationRun $operationRun = null): PostureResult
    {
        $permissions = $permissionComparison['permissions'] ?? [];
        $permissions = is_array($permissions) ? $permissions : [];

        $observedAt = $this->resolveObservedAt($permissionComparison, $operationRun);

        $created = 0;
        $resolved = 0;
        $reopened = 0;
        $unchanged = 0;
        $errors = 0;
        $alertEvents = [];
        $processedPermissionKeys = [];

        foreach ($permissions as $permission) {
            if (! is_array($permission)) {
                continue;
            }

            $key = $permission['key'] ?? '';
            $type = $permission['type'] ?? 'application';
            $status = $permission['status'] ?? 'granted';
            $features = is_array($permission['features'] ?? null) ? $permission['features'] : [];

            if ($key === '') {
                continue;
            }

            $processedPermissionKeys[] = $key;

            if ($status === 'error') {
                $this->handleErrorPermission($tenant, $key, $type, $features, $observedAt, $operationRun);
                $errors++;

                continue;
            }

            if ($status === 'missing') {
                $result = $this->handleMissingPermission($tenant, $key, $type, $features, $observedAt, $operationRun);

                if ($result === 'created') {
                    $created++;
                    $alertEvents[] = $this->buildAlertEvent($tenant, $key, $type, $features);
                } elseif ($result === 'reopened') {
                    $reopened++;
                    $alertEvents[] = $this->buildAlertEvent($tenant, $key, $type, $features);
                } else {
                    $unchanged++;
                }

                continue;
            }

            // status === 'granted'
            if ($this->resolveExistingFinding($tenant, $key, 'permission_granted', $observedAt)) {
                $resolved++;
            }
        }

        // Step 9: Resolve stale findings for permissions removed from registry
        $resolved += $this->resolveStaleFindings($tenant, $processedPermissionKeys, $observedAt);

        $postureScore = $this->scoreCalculator->calculate($permissionComparison);

        $report = $this->createStoredReport($tenant, $permissionComparison, $permissions, $postureScore);

        return new PostureResult(
            findingsCreated: $created,
            findingsResolved: $resolved,
            findingsReopened: $reopened,
            findingsUnchanged: $unchanged,
            errorsRecorded: $errors,
            postureScore: $postureScore,
            storedReportId: (int) $report->getKey(),
        );
    }

    /**
     * @return array<int, array<string, mixed>>
     */
    public function getAlertEvents(): array
    {
        return $this->alertEvents;
    }

    /** @var array<int, array<string, mixed>> */
    private array $alertEvents = [];

    private function handleMissingPermission(
        Tenant $tenant,
        string $key,
        string $type,
        array $features,
        CarbonImmutable $observedAt,
        ?OperationRun $operationRun,
    ): string {
        $fingerprint = $this->fingerprint($tenant, $key);
        $evidence = $this->buildEvidence($key, $type, 'missing', $features, $observedAt);
        $severity = $this->deriveSeverity(count($features));

        $finding = Finding::query()
            ->where('tenant_id', $tenant->getKey())
            ->where('finding_type', Finding::FINDING_TYPE_PERMISSION_POSTURE)
            ->where('fingerprint', $fingerprint)
            ->first();

        if ($finding instanceof Finding) {
            $this->observeFinding($finding, $observedAt);

            $finding->forceFill([
                'severity' => $severity,
                'evidence_jsonb' => $evidence,
                'current_operation_run_id' => $operationRun?->getKey(),
            ]);

            if ($finding->status === Finding::STATUS_RESOLVED) {
                $resolvedAt = $finding->resolved_at;

                if ($resolvedAt === null || $observedAt->greaterThan(CarbonImmutable::instance($resolvedAt))) {
                    $slaDays = $this->slaPolicy->daysForSeverity($severity, $tenant);

                    $finding->forceFill([
                        'status' => Finding::STATUS_REOPENED,
                        'reopened_at' => $observedAt,
                        'resolved_at' => null,
                        'resolved_reason' => null,
                        'closed_at' => null,
                        'closed_reason' => null,
                        'closed_by_user_id' => null,
                        'sla_days' => $slaDays,
                        'due_at' => $this->slaPolicy->dueAtForSeverity($severity, $tenant, $observedAt),
                    ]);

                    $finding->save();

                    return 'reopened';
                }
            }

            // Already open (new or acknowledged) — unchanged
            $finding->save();

            return 'unchanged';
        }

        $slaDays = $this->slaPolicy->daysForSeverity($severity, $tenant);

        Finding::create([
            'tenant_id' => (int) $tenant->getKey(),
            'finding_type' => Finding::FINDING_TYPE_PERMISSION_POSTURE,
            'source' => 'permission_check',
            'scope_key' => hash('sha256', 'permission_posture:'.$tenant->getKey()),
            'fingerprint' => $fingerprint,
            'subject_type' => 'permission',
            'subject_external_id' => $key,
            'severity' => $severity,
            'status' => Finding::STATUS_NEW,
            'evidence_jsonb' => $evidence,
            'current_operation_run_id' => $operationRun?->getKey(),
            'first_seen_at' => $observedAt,
            'last_seen_at' => $observedAt,
            'times_seen' => 1,
            'sla_days' => $slaDays,
            'due_at' => $this->slaPolicy->dueAtForSeverity($severity, $tenant, $observedAt),
        ]);

        return 'created';
    }

    private function handleErrorPermission(
        Tenant $tenant,
        string $key,
        string $type,
        array $features,
        CarbonImmutable $observedAt,
        ?OperationRun $operationRun,
    ): void {
        $fingerprint = $this->errorFingerprint($tenant, $key);

        $evidence = $this->buildEvidence($key, $type, 'error', $features, $observedAt);
        $evidence['check_error'] = true;
        $severity = Finding::SEVERITY_LOW;

        $existing = Finding::query()
            ->where('tenant_id', $tenant->getKey())
            ->where('finding_type', Finding::FINDING_TYPE_PERMISSION_POSTURE)
            ->where('fingerprint', $fingerprint)
            ->first();

        if ($existing instanceof Finding) {
            $this->observeFinding($existing, $observedAt);

            $existing->forceFill([
                'severity' => $severity,
                'evidence_jsonb' => $evidence,
                'current_operation_run_id' => $operationRun?->getKey(),
            ]);

            if ($existing->status === Finding::STATUS_RESOLVED) {
                $resolvedAt = $existing->resolved_at;

                if ($resolvedAt === null || $observedAt->greaterThan(CarbonImmutable::instance($resolvedAt))) {
                    $slaDays = $this->slaPolicy->daysForSeverity($severity, $tenant);

                    $existing->forceFill([
                        'status' => Finding::STATUS_REOPENED,
                        'reopened_at' => $observedAt,
                        'resolved_at' => null,
                        'resolved_reason' => null,
                        'closed_at' => null,
                        'closed_reason' => null,
                        'closed_by_user_id' => null,
                        'sla_days' => $slaDays,
                        'due_at' => $this->slaPolicy->dueAtForSeverity($severity, $tenant, $observedAt),
                    ]);
                }
            }

            $existing->save();

            return;
        }

        $slaDays = $this->slaPolicy->daysForSeverity($severity, $tenant);

        Finding::create([
            'tenant_id' => (int) $tenant->getKey(),
            'finding_type' => Finding::FINDING_TYPE_PERMISSION_POSTURE,
            'source' => 'permission_check',
            'scope_key' => hash('sha256', 'permission_posture_error:'.$tenant->getKey()),
            'fingerprint' => $fingerprint,
            'subject_type' => 'permission',
            'subject_external_id' => $key,
            'severity' => $severity,
            'status' => Finding::STATUS_NEW,
            'evidence_jsonb' => $evidence,
            'current_operation_run_id' => $operationRun?->getKey(),
            'first_seen_at' => $observedAt,
            'last_seen_at' => $observedAt,
            'times_seen' => 1,
            'sla_days' => $slaDays,
            'due_at' => $this->slaPolicy->dueAtForSeverity($severity, $tenant, $observedAt),
        ]);
    }

    private function resolveExistingFinding(Tenant $tenant, string $key, string $reason, CarbonImmutable $observedAt): bool
    {
        $fingerprint = $this->fingerprint($tenant, $key);

        $finding = Finding::query()
            ->where('tenant_id', $tenant->getKey())
            ->where('finding_type', Finding::FINDING_TYPE_PERMISSION_POSTURE)
            ->where('fingerprint', $fingerprint)
            ->whereIn('status', Finding::openStatusesForQuery())
            ->first();

        if (! $finding instanceof Finding) {
            return false;
        }

        $finding->forceFill([
            'status' => Finding::STATUS_RESOLVED,
            'resolved_at' => $observedAt,
            'resolved_reason' => $reason,
        ])->save();

        return true;
    }

    /**
     * Resolve any open permission_posture findings whose permission_key is not
     * in the current comparison (handles registry removals).
     */
    private function resolveStaleFindings(Tenant $tenant, array $processedPermissionKeys, CarbonImmutable $observedAt): int
    {
        $staleFindings = Finding::query()
            ->where('tenant_id', $tenant->getKey())
            ->where('finding_type', Finding::FINDING_TYPE_PERMISSION_POSTURE)
            ->whereIn('status', Finding::openStatusesForQuery())
            ->get();

        $resolved = 0;

        foreach ($staleFindings as $finding) {
            $evidence = is_array($finding->evidence_jsonb) ? $finding->evidence_jsonb : [];
            $permissionKey = $evidence['permission_key'] ?? null;

            // Skip error findings (they have check_error=true in evidence)
            if (($evidence['check_error'] ?? false) === true) {
                continue;
            }

            if ($permissionKey !== null && ! in_array($permissionKey, $processedPermissionKeys, true)) {
                $finding->forceFill([
                    'status' => Finding::STATUS_RESOLVED,
                    'resolved_at' => $observedAt,
                    'resolved_reason' => 'permission_removed_from_registry',
                ])->save();
                $resolved++;
            }
        }

        return $resolved;
    }

    private function resolveObservedAt(array $comparison, ?OperationRun $operationRun): CarbonImmutable
    {
        if ($operationRun?->completed_at !== null) {
            return CarbonImmutable::instance($operationRun->completed_at);
        }

        $refreshedAt = $comparison['last_refreshed_at'] ?? null;

        if (is_string($refreshedAt) && trim($refreshedAt) !== '') {
            try {
                return CarbonImmutable::parse($refreshedAt);
            } catch (\Throwable) {
                // Fall through.
            }
        }

        return CarbonImmutable::now();
    }

    private function observeFinding(Finding $finding, CarbonImmutable $observedAt): void
    {
        if ($finding->first_seen_at === null) {
            $finding->first_seen_at = $observedAt;
        }

        $lastSeenAt = $finding->last_seen_at;
        $timesSeen = is_numeric($finding->times_seen) ? (int) $finding->times_seen : 0;

        if ($lastSeenAt === null || $observedAt->greaterThan(CarbonImmutable::instance($lastSeenAt))) {
            $finding->last_seen_at = $observedAt;
            $finding->times_seen = max(0, $timesSeen) + 1;

            return;
        }

        if ($timesSeen < 1) {
            $finding->times_seen = 1;
        }
    }

    /**
     * @param  array<int, array<string, mixed>>  $permissions
     */
    private function createStoredReport(
        Tenant $tenant,
        array $permissionComparison,
        array $permissions,
        int $postureScore,
    ): StoredReport {
        $grantedCount = 0;

        foreach ($permissions as $permission) {
            if (is_array($permission) && ($permission['status'] ?? null) === 'granted') {
                $grantedCount++;
            }
        }

        return StoredReport::create([
            'tenant_id' => (int) $tenant->getKey(),
            'report_type' => StoredReport::REPORT_TYPE_PERMISSION_POSTURE,
            'payload' => [
                'posture_score' => $postureScore,
                'required_count' => count($permissions),
                'granted_count' => $grantedCount,
                'checked_at' => now()->toIso8601String(),
                'permissions' => array_map(
                    static fn (array $p): array => [
                        'key' => $p['key'] ?? '',
                        'type' => $p['type'] ?? 'application',
                        'status' => $p['status'] ?? 'unknown',
                        'features' => is_array($p['features'] ?? null) ? $p['features'] : [],
                    ],
                    array_filter($permissions, static fn (mixed $p): bool => is_array($p)),
                ),
            ],
        ]);
    }

    /**
     * @return array<string, mixed>
     */
    private function buildAlertEvent(Tenant $tenant, string $key, string $type, array $features): array
    {
        $event = [
            'event_type' => AlertRule::EVENT_PERMISSION_MISSING,
            'tenant_id' => (int) $tenant->getKey(),
            'severity' => $this->deriveSeverity(count($features)),
            'fingerprint_key' => 'permission_missing:'.$tenant->getKey().':'.$key,
            'title' => 'Missing permission: '.$key,
            'body' => sprintf(
                'Tenant %s is missing %s. Blocked features: %s.',
                $tenant->name ?? (string) $tenant->getKey(),
                $key,
                implode(', ', $features) ?: 'none',
            ),
            'metadata' => [
                'permission_key' => $key,
                'permission_type' => $type,
                'blocked_features' => $features,
            ],
        ];

        $this->alertEvents[] = $event;

        return $event;
    }

    /**
     * @return array<string, mixed>
     */
    private function buildEvidence(string $key, string $type, string $actualStatus, array $features, CarbonImmutable $observedAt): array
    {
        return [
            'permission_key' => $key,
            'permission_type' => $type,
            'expected_status' => 'granted',
            'actual_status' => $actualStatus,
            'blocked_features' => $features,
            'checked_at' => $observedAt->toIso8601String(),
        ];
    }

    private function deriveSeverity(int $featureCount): string
    {
        return match (true) {
            $featureCount >= 3 => Finding::SEVERITY_CRITICAL,
            $featureCount === 2 => Finding::SEVERITY_HIGH,
            $featureCount === 1 => Finding::SEVERITY_MEDIUM,
            default => Finding::SEVERITY_LOW,
        };
    }

    private function fingerprint(Tenant $tenant, string $permissionKey): string
    {
        return substr(hash('sha256', 'permission_posture:'.$tenant->getKey().':'.$permissionKey), 0, 64);
    }

    private function errorFingerprint(Tenant $tenant, string $permissionKey): string
    {
        return substr(hash('sha256', 'permission_posture:'.$tenant->getKey().':'.$permissionKey.':error'), 0, 64);
    }
}