package financewithdrawal

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"log/slog"
	"math/big"
	"strconv"
	"strings"
	"time"

	"hyapp-admin-server/internal/appctx"
	"hyapp-admin-server/internal/integration/activityclient"
	"hyapp-admin-server/internal/integration/walletclient"
	"hyapp-admin-server/internal/integration/withdrawalsource"
	"hyapp-admin-server/internal/model"
	"hyapp-admin-server/internal/modules/shared"
	"hyapp-admin-server/internal/repository"
	activityv1 "hyapp.local/api/proto/activity/v1"
	walletv1 "hyapp.local/api/proto/wallet/v1"
)

const (
	permissionViewWithdrawalApplications  = "finance-withdrawal:view"
	permissionAuditWithdrawalApplications = "finance-withdrawal:audit"
	permissionViewOperationsWithdrawals   = "operations-withdrawal:view"
	permissionAuditOperationsWithdrawals  = "operations-withdrawal:audit"

	pointWithdrawalDefaultPointsPerUSD = int64(100000)
	pointWithdrawalDefaultFeeBPS       = int32(500)
)

var errWithdrawalMoneyScopeForbidden = errors.New("没有该 App 的财务范围")

type Service struct {
	store    *repository.Store
	wallet   walletclient.Client
	activity activityclient.Client
	sources  *withdrawalsource.Registry
	notifier ReviewPendingNotifier
	now      func() time.Time
}

type externalWithdrawalApplicationInput struct {
	AppCode             string
	SourceSystem        string
	SourceApplicationID string
	UserID              string
	SalaryAssetType     string
	WithdrawAmount      string
	WithdrawAmountMinor int64
	BalanceBefore       string
	ServiceChargeRatio  string
	ServiceCharge       string
	ActualAmount        string
	ActualAmountMinor   *int64
	WithdrawMethod      string
	WithdrawAddress     string
	CreatedAtMS         int64
}

type pointWithdrawalWallet interface {
	SettlePointWithdrawal(ctx context.Context, req *walletv1.SettlePointWithdrawalRequest) (*walletv1.SettlePointWithdrawalResponse, error)
	ReleasePointWithdrawal(ctx context.Context, req *walletv1.ReleasePointWithdrawalRequest) (*walletv1.ReleasePointWithdrawalResponse, error)
}

func NewService(store *repository.Store, wallet walletclient.Client, activity activityclient.Client) *Service {
	return &Service{store: store, wallet: wallet, activity: activity, now: func() time.Time { return time.Now().UTC() }}
}

func NewServiceWithSources(store *repository.Store, wallet walletclient.Client, activity activityclient.Client, sources *withdrawalsource.Registry) *Service {
	service := NewService(store, wallet, activity)
	service.sources = sources
	return service
}

func (s *Service) BindReviewPendingNotifier(notifier ReviewPendingNotifier) *Service {
	if s != nil {
		s.notifier = notifier
	}
	return s
}

func (s *Service) CreateExternalApplication(ctx context.Context, input externalWithdrawalApplicationInput) (*withdrawalApplicationDTO, error) {
	if s == nil || s.store == nil || s.sources == nil {
		return nil, errors.New("external withdrawal intake is not configured")
	}
	input.AppCode = appctx.Normalize(input.AppCode)
	input.SourceSystem = strings.ToLower(strings.TrimSpace(input.SourceSystem))
	input.SourceApplicationID = strings.TrimSpace(input.SourceApplicationID)
	input.UserID = strings.TrimSpace(input.UserID)
	input.SalaryAssetType = strings.TrimSpace(input.SalaryAssetType)
	input.WithdrawAmount = strings.TrimSpace(input.WithdrawAmount)
	input.BalanceBefore = strings.TrimSpace(input.BalanceBefore)
	input.ServiceChargeRatio = strings.TrimSpace(input.ServiceChargeRatio)
	input.ServiceCharge = strings.TrimSpace(input.ServiceCharge)
	input.ActualAmount = strings.TrimSpace(input.ActualAmount)
	input.WithdrawMethod = strings.TrimSpace(input.WithdrawMethod)
	input.WithdrawAddress = strings.TrimSpace(input.WithdrawAddress)
	if !s.sources.HasSource(input.AppCode, input.SourceSystem) {
		return nil, errors.New("withdrawal source is not configured")
	}
	if input.SourceApplicationID == "" || len(input.SourceApplicationID) > 128 || input.UserID == "" || len(input.UserID) > 64 {
		return nil, errors.New("来源申请号或用户 ID 不正确")
	}
	if input.SalaryAssetType == "" || len(input.SalaryAssetType) > 64 || input.WithdrawMethod == "" || len(input.WithdrawMethod) > 64 || input.WithdrawAddress == "" || len(input.WithdrawAddress) > 255 {
		return nil, errors.New("提现资产或收款信息不完整")
	}
	if err := validateExternalWithdrawalAmount(input.WithdrawAmount, input.WithdrawAmountMinor); err != nil {
		return nil, err
	}
	if err := validateExternalWithdrawalBalanceBefore(input.BalanceBefore, input.WithdrawAmount); err != nil {
		return nil, err
	}
	if err := validateExternalWithdrawalPayoutSnapshot(input); err != nil {
		return nil, err
	}
	createdAtMS := input.CreatedAtMS
	if createdAtMS <= 0 {
		createdAtMS = s.now().UnixMilli()
	}
	application, created, err := s.store.CreateExternalWithdrawalApplication(model.UserWithdrawalApplication{
		AppCode:             input.AppCode,
		SourceSystem:        input.SourceSystem,
		SourceApplicationID: input.SourceApplicationID,
		UserID:              input.UserID,
		SalaryAssetType:     input.SalaryAssetType,
		WithdrawAmount:      input.WithdrawAmount,
		WithdrawAmountMinor: input.WithdrawAmountMinor,
		BalanceBefore:       optionalDecimalString(input.BalanceBefore),
		ServiceChargeRatio:  optionalDecimalString(input.ServiceChargeRatio),
		ServiceCharge:       optionalDecimalString(input.ServiceCharge),
		ActualAmount:        optionalDecimalString(input.ActualAmount),
		ActualAmountMinor:   input.ActualAmountMinor,
		WithdrawMethod:      input.WithdrawMethod,
		WithdrawAddress:     input.WithdrawAddress,
		// 外部来源在提交前已经完成扣款；这两个字段保留来源事实，真正终态由 callback adapter 执行，绝不误调用 HY wallet。
		FreezeCommandID:     "external:" + input.SourceSystem + ":" + input.SourceApplicationID,
		FreezeTransactionID: "external:" + input.SourceApplicationID,
		Status:              model.WithdrawalApplicationStatusPending,
		OperationsStatus:    model.WithdrawalOperationsStatusPending,
		CreatedAtMS:         createdAtMS,
		UpdatedAtMS:         createdAtMS,
	})
	if err != nil {
		return nil, err
	}
	// 来源采用持久重试；只有首次成功落库才提醒运营，HTTP 响应丢失后的幂等重放不能反复轰炸审核群。
	if created {
		s.notifyReviewPending(ctx, *application, repository.WithdrawalApplicationReviewStageOperations)
	}
	dto := withdrawalApplicationDTOFromModel(*application)
	return &dto, nil
}

func validateExternalWithdrawalAmount(amount string, amountMinor int64) error {
	parsed, ok := new(big.Rat).SetString(strings.TrimSpace(amount))
	if !ok || parsed.Sign() <= 0 || amountMinor <= 0 {
		return errors.New("提现金额不正确")
	}
	minor := new(big.Rat).Mul(parsed, big.NewRat(100, 1))
	if !minor.IsInt() || !minor.Num().IsInt64() || minor.Num().Int64() != amountMinor {
		return errors.New("提现金额与最小单位金额不一致")
	}
	return nil
}

func validateExternalWithdrawalBalanceBefore(balanceBefore string, withdrawAmount string) error {
	if balanceBefore == "" {
		// 兼容字段上线前已经进入 Likei 持久重试队列的申请；这些历史单在审核页明确显示“-”。
		return nil
	}
	balance, ok := new(big.Rat).SetString(balanceBefore)
	if !ok || balance.Sign() < 0 {
		return errors.New("提现前余额不正确")
	}
	amount, ok := new(big.Rat).SetString(withdrawAmount)
	if !ok || balance.Cmp(amount) < 0 {
		return errors.New("提现前余额不能小于提现金额")
	}
	return nil
}

func validateExternalWithdrawalPayoutSnapshot(input externalWithdrawalApplicationInput) error {
	ratioText := strings.TrimSpace(input.ServiceChargeRatio)
	chargeText := strings.TrimSpace(input.ServiceCharge)
	actualText := strings.TrimSpace(input.ActualAmount)
	presentCount := 0
	for _, present := range []bool{ratioText != "", chargeText != "", actualText != "", input.ActualAmountMinor != nil} {
		if present {
			presentCount++
		}
	}
	if presentCount == 0 {
		// ChatApp3 的历史字段同时包含费率和已向上取整的手续费结果；缺快照时 Admin 无法安全推导实际打款额。
		if strings.EqualFold(strings.TrimSpace(input.SourceSystem), "chatapp3") {
			return errors.New("ChatApp3 提现缺少手续费与实际打款快照")
		}
		return nil
	}
	if presentCount != 4 {
		return errors.New("提现手续费与实际打款快照不完整")
	}

	ratio, _, ok := parseExternalFixedDecimal(ratioText, 9, 4)
	if !ok || ratio.Sign() < 0 || ratio.Cmp(big.NewRat(100, 1)) > 0 {
		return errors.New("提现手续费率不正确")
	}
	charge, chargeMinor, ok := parseExternalFixedDecimal(chargeText, 18, 2)
	if !ok || charge.Sign() < 0 {
		return errors.New("提现手续费不正确")
	}
	actual, actualMinor, ok := parseExternalFixedDecimal(actualText, 18, 2)
	if !ok || actual.Sign() <= 0 {
		return errors.New("实际打款金额不正确")
	}
	if !actualMinor.IsInt64() || actualMinor.Int64() != *input.ActualAmountMinor {
		return errors.New("实际打款金额与最小单位金额不一致")
	}
	gross, _, ok := parseExternalFixedDecimal(input.WithdrawAmount, 18, 2)
	if !ok || new(big.Rat).Add(charge, actual).Cmp(gross) != 0 {
		return errors.New("申请金额、手续费与实际打款金额不一致")
	}
	// 同时校验最小单位表示，防止 decimal 展示正确但上游分值被截断或溢出。
	payoutMinor := new(big.Int).Add(chargeMinor, big.NewInt(*input.ActualAmountMinor))
	if !payoutMinor.IsInt64() || payoutMinor.Int64() != input.WithdrawAmountMinor {
		return errors.New("手续费、实际打款与申请金额的最小单位不一致")
	}
	return nil
}

func parseExternalFixedDecimal(value string, precision int, scale int) (*big.Rat, *big.Int, bool) {
	value = strings.TrimSpace(value)
	if value == "" || len(value) > 64 || precision <= 0 || scale < 0 || scale > precision {
		return nil, nil, false
	}
	negative := false
	if value[0] == '+' || value[0] == '-' {
		negative = value[0] == '-'
		value = value[1:]
	}
	parts := strings.Split(value, ".")
	if len(parts) > 2 || parts[0] == "" || !isExternalDecimalDigits(parts[0]) {
		return nil, nil, false
	}
	fraction := ""
	if len(parts) == 2 {
		fraction = parts[1]
		if fraction == "" || !isExternalDecimalDigits(fraction) {
			return nil, nil, false
		}
	}
	if len(fraction) > scale {
		// 文本小数位超出列 scale 时即使多出的是 0 也拒绝，避免契约精度在入库时被隐式改写。
		return nil, nil, false
	}
	scaleFactor := new(big.Int).Exp(big.NewInt(10), big.NewInt(int64(scale)), nil)
	scaledDigits := parts[0] + fraction + strings.Repeat("0", scale-len(fraction))
	scaled, ok := new(big.Int).SetString(scaledDigits, 10)
	if !ok {
		return nil, nil, false
	}
	if negative {
		scaled.Neg(scaled)
	}
	maxScaled := new(big.Int).Sub(new(big.Int).Exp(big.NewInt(10), big.NewInt(int64(precision)), nil), big.NewInt(1))
	if new(big.Int).Abs(new(big.Int).Set(scaled)).Cmp(maxScaled) > 0 {
		return nil, nil, false
	}
	// 先按存储 scale 构造精确有理数，后续所有金额恒等式都不经过 float64 或四舍五入。
	return new(big.Rat).SetFrac(new(big.Int).Set(scaled), scaleFactor), scaled, true
}

func isExternalDecimalDigits(value string) bool {
	for i := 0; i < len(value); i++ {
		if value[i] < '0' || value[i] > '9' {
			return false
		}
	}
	return value != ""
}

func optionalDecimalString(value string) *string {
	if value == "" {
		return nil
	}
	return &value
}

func (s *Service) ListApplications(actor shared.Actor, options repository.WithdrawalApplicationListOptions) ([]withdrawalApplicationDTO, int64, error) {
	if s == nil || s.store == nil {
		return nil, 0, errors.New("admin store is not configured")
	}
	var err error
	options, err = s.scopeWithdrawalList(actor, options)
	if err != nil {
		return nil, 0, err
	}
	options.Stage = repository.WithdrawalApplicationReviewStageFinance
	items, total, err := s.store.ListWithdrawalApplications(options)
	if err != nil {
		return nil, 0, err
	}
	return withdrawalApplicationDTOsFromModel(items), total, nil
}

func (s *Service) ListOperationsApplications(actor shared.Actor, options repository.WithdrawalApplicationListOptions) ([]withdrawalApplicationDTO, int64, error) {
	if s == nil || s.store == nil {
		return nil, 0, errors.New("admin store is not configured")
	}
	var err error
	options, err = s.scopeWithdrawalList(actor, options)
	if err != nil {
		return nil, 0, err
	}
	options.Stage = repository.WithdrawalApplicationReviewStageOperations
	items, total, err := s.store.ListWithdrawalApplications(options)
	if err != nil {
		return nil, 0, err
	}
	return withdrawalApplicationDTOsFromModel(items), total, nil
}

func (s *Service) scopeWithdrawalList(actor shared.Actor, options repository.WithdrawalApplicationListOptions) (repository.WithdrawalApplicationListOptions, error) {
	access, err := s.store.MoneyAccessForUser(actor.UserID)
	if err != nil {
		return options, err
	}
	if requestedApp := strings.TrimSpace(options.AppCode); requestedApp != "" {
		options.AppCode = appctx.Normalize(requestedApp)
		if !access.AllowsApp(options.AppCode) {
			return options, errWithdrawalMoneyScopeForbidden
		}
		return options, nil
	}
	options.AppCode = ""
	if !access.All {
		// 空 app 查询不代表全局；非全量财务用户只能在 admin_user_money_scopes 授权的 App 集合中分页。
		options.RestrictAppCodes = true
		options.AllowedAppCodes = access.AppCodes()
	}
	return options, nil
}

func (s *Service) ApproveApplication(ctx context.Context, actor shared.Actor, id uint, remark string, auditImageURL string, requestID string) (*withdrawalApplicationDTO, error) {
	return s.auditApplication(ctx, actor, id, repository.WithdrawalApplicationReviewStageFinance, model.WithdrawalApplicationStatusApproved, remark, auditImageURL, requestID)
}

func (s *Service) RejectApplication(ctx context.Context, actor shared.Actor, id uint, remark string, requestID string) (*withdrawalApplicationDTO, error) {
	return s.auditApplication(ctx, actor, id, repository.WithdrawalApplicationReviewStageFinance, model.WithdrawalApplicationStatusRejected, remark, "", requestID)
}

func (s *Service) ApproveOperationsApplication(ctx context.Context, actor shared.Actor, id uint, remark string, requestID string) (*withdrawalApplicationDTO, error) {
	return s.auditApplication(ctx, actor, id, repository.WithdrawalApplicationReviewStageOperations, model.WithdrawalApplicationStatusApproved, remark, "", requestID)
}

func (s *Service) RejectOperationsApplication(ctx context.Context, actor shared.Actor, id uint, remark string, requestID string) (*withdrawalApplicationDTO, error) {
	return s.auditApplication(ctx, actor, id, repository.WithdrawalApplicationReviewStageOperations, model.WithdrawalApplicationStatusRejected, remark, "", requestID)
}

func (s *Service) auditApplication(ctx context.Context, actor shared.Actor, id uint, stage repository.WithdrawalApplicationReviewStage, decision string, remark string, auditImageURL string, requestID string) (*withdrawalApplicationDTO, error) {
	if s == nil || s.store == nil || s.wallet == nil || s.activity == nil {
		return nil, errors.New("admin finance withdrawal service is not configured")
	}
	if id == 0 || actor.UserID == 0 || !canAuditWithdrawalStage(stage, actor.Permissions) {
		return nil, errors.New("没有操作权限")
	}
	remark = strings.TrimSpace(remark)
	auditImageURL = strings.TrimSpace(auditImageURL)
	if stage == repository.WithdrawalApplicationReviewStageFinance && decision == model.WithdrawalApplicationStatusApproved && auditImageURL == "" {
		return nil, errors.New("提现通过凭证图片不能为空")
	}
	if decision == model.WithdrawalApplicationStatusRejected && remark == "" {
		return nil, errors.New("拒绝原因不能为空")
	}
	appCode := appctx.FromContext(ctx)
	access, err := s.store.MoneyAccessForUser(actor.UserID)
	if err != nil {
		return nil, err
	}
	if !access.AllowsApp(appCode) {
		// 审核以目标行的 App header 为数据域；即使 JWT 含按钮权限，也不能跨 admin_user_money_scopes 触发钱包动作。
		return nil, errWithdrawalMoneyScopeForbidden
	}
	nowMS := s.now().UnixMilli()
	commandID := withdrawalAuditCommandID(id, stage)
	if stage == repository.WithdrawalApplicationReviewStageFinance {
		current, err := s.store.GetWithdrawalApplicationForApp(appCode, id)
		if err != nil {
			return nil, err
		}
		if isExternalWithdrawal(*current) {
			// 外部钱包回调和 Admin 终态不可能共享一个数据库事务；先持久首次财务 claim 才能安全调用回调。
			return s.executeExternalFinanceDecision(ctx, actor, id, appCode, decision, remark, auditImageURL, commandID, nowMS)
		}
	}
	if stage == repository.WithdrawalApplicationReviewStageOperations && decision == model.WithdrawalApplicationStatusRejected {
		return s.executeOperationsRejection(ctx, actor, id, appCode, remark, requestID, commandID, nowMS)
	}
	updated, err := s.store.ReviewWithdrawalApplicationForApp(appCode, id, repository.WithdrawalApplicationAuditInput{
		Stage:          stage,
		Decision:       decision,
		ApproverUserID: actor.UserID,
		ApproverName:   actor.Username,
		AuditRemark:    remark,
		AuditImageURL:  auditImageURL,
		ApprovedAtMS:   nowMS,
	}, func(item model.UserWithdrawalApplication) (repository.WithdrawalApplicationAuditEffect, error) {
		if stage == repository.WithdrawalApplicationReviewStageOperations && decision == model.WithdrawalApplicationStatusApproved {
			// 运营通过只确认业务资料并转交财务；申请金额继续保留在 frozen，且不能提前向用户发送最终通过通知。
			return repository.WithdrawalApplicationAuditEffect{}, nil
		}
		transactionID, userID, walletErr := s.applyWithdrawalDecision(ctx, item, decision, commandID, appCode, actor, remark, auditImageURL, id)
		if walletErr != nil {
			return repository.WithdrawalApplicationAuditEffect{}, walletErr
		}
		if !isExternalWithdrawal(item) {
			noticeErr := s.sendWithdrawalAuditNotice(ctx, auditNoticeInput{
				ApplicationID:      id,
				AppCode:            appCode,
				UserID:             userID,
				Stage:              stage,
				Decision:           decision,
				Remark:             remark,
				AuditImageURL:      auditImageURL,
				AuditTransactionID: transactionID,
				WithdrawAmount:     item.WithdrawAmount,
				WithdrawMethod:     item.WithdrawMethod,
				RequestID:          requestID,
				SentAtMS:           nowMS,
			})
			if noticeErr != nil {
				// 钱包扣冻/释放使用阶段固定 command id，通知使用阶段+结果事件 id；回调失败会回滚 admin 状态，重试不会重复资金动作或消息。
				return repository.WithdrawalApplicationAuditEffect{}, noticeErr
			}
		}
		return repository.WithdrawalApplicationAuditEffect{CommandID: commandID, TransactionID: transactionID}, nil
	})
	if err != nil {
		return nil, err
	}
	if stage == repository.WithdrawalApplicationReviewStageOperations && decision == model.WithdrawalApplicationStatusApproved {
		// 运营通过已经提交到数据库，随后独立提醒财务；机器人异常不能把已转交的申请回滚到运营队列。
		s.notifyReviewPending(ctx, *updated, repository.WithdrawalApplicationReviewStageFinance)
	}
	dto := withdrawalApplicationDTOFromModel(*updated)
	return &dto, nil
}

func (s *Service) notifyReviewPending(ctx context.Context, application model.UserWithdrawalApplication, stage repository.WithdrawalApplicationReviewStage) {
	if s == nil || s.notifier == nil {
		return
	}
	if err := s.notifier.NotifyReviewPending(ctx, application, stage); err != nil {
		slog.Warn("withdrawal_review_dingtalk_notify_failed",
			"application_id", application.ID,
			"app_code", application.AppCode,
			"review_stage", stage,
			"error", err,
		)
	}
}

// executeOperationsRejection 把拒绝拆成 claim -> 外部幂等动作 -> finalize 三段。
// claim 是独立短事务，因此 wallet 已释放后即使 notice 或最终 admin 提交失败，申请仍停在 rejecting，不能被改点通过或进入财务。
func (s *Service) executeOperationsRejection(ctx context.Context, actor shared.Actor, id uint, appCode string, remark string, requestID string, commandID string, nowMS int64) (*withdrawalApplicationDTO, error) {
	claimed, err := s.store.ClaimWithdrawalOperationsRejectionForApp(appCode, id, repository.WithdrawalApplicationAuditInput{
		Stage:          repository.WithdrawalApplicationReviewStageOperations,
		Decision:       model.WithdrawalApplicationStatusRejected,
		ApproverUserID: actor.UserID,
		ApproverName:   actor.Username,
		AuditRemark:    remark,
		AuditCommandID: commandID,
		ApprovedAtMS:   nowMS,
	}, func(item model.UserWithdrawalApplication) error {
		return validateWithdrawalDecisionTarget(item)
	})
	if err != nil {
		return nil, err
	}
	if claimed.Status == model.WithdrawalApplicationStatusRejected && claimed.OperationsStatus == model.WithdrawalOperationsStatusRejected {
		// 已完成的重复请求直接返回终态，避免再次调用 wallet/inbox；前端重试是安全的。
		dto := withdrawalApplicationDTOFromModel(*claimed)
		return &dto, nil
	}

	if claimed.OperationsReviewerUserID == nil || *claimed.OperationsReviewerUserID == 0 || strings.TrimSpace(claimed.OperationsAuditRemark) == "" {
		return nil, errors.New("提现单运营拒绝 claim 不完整")
	}
	// 重试沿用第一次 claim 的审核人和拒绝原因，不能让资金 metadata、用户通知和后台审计快照随重试人改变。
	claimedActor := shared.Actor{UserID: *claimed.OperationsReviewerUserID, Username: claimed.OperationsReviewerName}
	claimedRemark := strings.TrimSpace(claimed.OperationsAuditRemark)
	transactionID, userID, err := s.applyWithdrawalDecision(ctx, *claimed, model.WithdrawalApplicationStatusRejected, commandID, appCode, claimedActor, claimedRemark, "", id)
	if err != nil {
		return nil, err
	}
	sentAtMS := nowMS
	if claimed.OperationsReviewedAtMS != nil && *claimed.OperationsReviewedAtMS > 0 {
		sentAtMS = *claimed.OperationsReviewedAtMS
	}
	if !isExternalWithdrawal(*claimed) {
		err = s.sendWithdrawalAuditNotice(ctx, auditNoticeInput{
			ApplicationID:      id,
			AppCode:            appCode,
			UserID:             userID,
			Stage:              repository.WithdrawalApplicationReviewStageOperations,
			Decision:           model.WithdrawalApplicationStatusRejected,
			Remark:             claimedRemark,
			AuditTransactionID: transactionID,
			WithdrawAmount:     claimed.WithdrawAmount,
			WithdrawMethod:     claimed.WithdrawMethod,
			RequestID:          requestID,
			SentAtMS:           sentAtMS,
		})
		if err != nil {
			// rejecting 已在前一事务提交；返回错误让运营页展示“重试拒绝”，绝不能回退成 pending。
			return nil, err
		}
	}
	updated, err := s.store.FinalizeWithdrawalOperationsRejectionForApp(appCode, id, commandID, transactionID, s.now().UnixMilli())
	if err != nil {
		return nil, err
	}
	dto := withdrawalApplicationDTOFromModel(*updated)
	return &dto, nil
}

// executeExternalFinanceDecision 把外部财务终审拆成 claim -> 来源幂等回调 -> finalize。
// claim 一旦提交，后续任何审核人的同决策重试都只能沿用第一次审计快照，相反决策在回调前被拒绝。
func (s *Service) executeExternalFinanceDecision(ctx context.Context, actor shared.Actor, id uint, appCode string, decision string, remark string, auditImageURL string, commandID string, nowMS int64) (*withdrawalApplicationDTO, error) {
	claimed, err := s.store.ClaimExternalWithdrawalFinanceDecisionForApp(appCode, id, repository.WithdrawalApplicationAuditInput{
		Stage:          repository.WithdrawalApplicationReviewStageFinance,
		Decision:       decision,
		ApproverUserID: actor.UserID,
		ApproverName:   actor.Username,
		AuditRemark:    remark,
		AuditImageURL:  auditImageURL,
		AuditCommandID: commandID,
		ApprovedAtMS:   nowMS,
	}, func(item model.UserWithdrawalApplication) error {
		return validateWithdrawalDecisionTarget(item)
	})
	if err != nil {
		return nil, err
	}
	claimStatus := ""
	if claimed.ExternalFinanceClaimStatus != nil {
		claimStatus = strings.TrimSpace(*claimed.ExternalFinanceClaimStatus)
	}
	if claimStatus == model.WithdrawalExternalFinanceClaimStatusFinalized {
		// 上次 finalize 可能已提交但返回链路中断；终态幂等返回不再重复回调。
		dto := withdrawalApplicationDTOFromModel(*claimed)
		return &dto, nil
	}
	if claimStatus != model.WithdrawalExternalFinanceClaimStatusClaimed || claimed.ExternalFinanceClaimDecision == nil ||
		claimed.ApproverUserID == nil || *claimed.ApproverUserID == 0 || claimed.ApprovedAtMS == nil || *claimed.ApprovedAtMS <= 0 || strings.TrimSpace(claimed.AuditCommandID) == "" {
		return nil, errors.New("外部提现财务 claim 不完整")
	}
	claimedDecision := strings.TrimSpace(*claimed.ExternalFinanceClaimDecision)
	claimedRemark := strings.TrimSpace(claimed.AuditRemark)
	claimedImageURL := strings.TrimSpace(claimed.AuditImageURL)
	claimedActor := shared.Actor{UserID: *claimed.ApproverUserID, Username: claimed.ApproverName}
	transactionID, _, err := s.applyWithdrawalDecision(ctx, *claimed, claimedDecision, claimed.AuditCommandID, appCode, claimedActor, claimedRemark, claimedImageURL, id)
	if err != nil {
		// claim 已在独立事务持久，回调失败只返错误供财务按相同决策重试，不得回退或改写 claim。
		return nil, err
	}
	updated, err := s.store.FinalizeExternalWithdrawalFinanceDecisionForApp(appCode, id, claimedDecision, claimed.AuditCommandID, transactionID, s.now().UnixMilli())
	if err != nil {
		return nil, err
	}
	dto := withdrawalApplicationDTOFromModel(*updated)
	return &dto, nil
}

func withdrawalWalletUserID(item model.UserWithdrawalApplication) (int64, error) {
	userID, err := strconv.ParseInt(strings.TrimSpace(item.UserID), 10, 64)
	if err != nil || userID <= 0 || strings.TrimSpace(item.SalaryAssetType) == "" || item.WithdrawAmountMinor <= 0 || strings.TrimSpace(item.FreezeTransactionID) == "" {
		return 0, errors.New("提现单冻结信息不完整")
	}
	return userID, nil
}

func validateWithdrawalDecisionTarget(item model.UserWithdrawalApplication) error {
	if isExternalWithdrawal(item) {
		if strings.TrimSpace(item.SourceApplicationID) == "" || strings.TrimSpace(item.UserID) == "" || item.WithdrawAmountMinor <= 0 {
			return errors.New("外部提现单来源信息不完整")
		}
		return nil
	}
	_, err := withdrawalWalletUserID(item)
	return err
}

func isExternalWithdrawal(item model.UserWithdrawalApplication) bool {
	sourceSystem := strings.ToLower(strings.TrimSpace(item.SourceSystem))
	return sourceSystem != "" && sourceSystem != "hyapp_wallet"
}

func (s *Service) applyWithdrawalDecision(ctx context.Context, item model.UserWithdrawalApplication, decision string, commandID string, appCode string, actor shared.Actor, remark string, auditImageURL string, applicationID uint) (string, int64, error) {
	if isExternalWithdrawal(item) {
		if s.sources == nil {
			return "", 0, errors.New("withdrawal source callback is not configured")
		}
		sourceDecision := "NOT_PASS"
		credentials := []string(nil)
		if decision == model.WithdrawalApplicationStatusApproved {
			sourceDecision = "PASS"
			credentials = []string{strings.TrimSpace(auditImageURL)}
		}
		transactionID, err := s.sources.ApplyDecision(ctx, appCode, item.SourceSystem, withdrawalsource.DecisionRequest{
			SourceApplicationID: item.SourceApplicationID,
			Decision:            sourceDecision,
			CredentialURLs:      credentials,
			Remark:              strings.TrimSpace(remark),
			ReviewerUserID:      actor.UserID,
			ReviewerName:        actor.Username,
			CommandID:           commandID,
		})
		return transactionID, 0, err
	}
	userID, err := withdrawalWalletUserID(item)
	if err != nil {
		return "", 0, err
	}
	transactionID, err := s.applyWalletDecision(ctx, decision, commandID, appCode, userID, item.SalaryAssetType, item.WithdrawAmountMinor, item.PointFeeAmount, item.PointNetAmount, item.PointsPerUSD, item.PointFeeBPS, item.FreezeTransactionID, actor, strings.TrimSpace(remark), applicationID)
	return transactionID, userID, err
}

func (s *Service) applyWalletDecision(ctx context.Context, decision string, commandID string, appCode string, userID int64, assetType string, amountMinor int64, storedFeePoints int64, storedNetPoints int64, storedPointsPerUSD int64, storedFeeBPS int32, freezeTransactionID string, actor shared.Actor, remark string, applicationID uint) (string, error) {
	reason := strings.TrimSpace(remark)
	if reason == "" {
		reason = "salary withdrawal " + decision
	}
	applicationIDText := strconv.FormatUint(uint64(applicationID), 10)
	if isPointWithdrawalAssetType(assetType) {
		pointWallet, ok := s.wallet.(pointWithdrawalWallet)
		if !ok {
			return "", errors.New("point withdrawal wallet executor is not configured")
		}
		feePoints, netPoints, pointsPerUSD, feeBPS := pointWithdrawalSnapshot(model.UserWithdrawalApplication{
			WithdrawAmountMinor: amountMinor, PointFeeAmount: storedFeePoints, PointNetAmount: storedNetPoints,
			PointsPerUSD: storedPointsPerUSD, PointFeeBPS: storedFeeBPS,
		})
		switch decision {
		case model.WithdrawalApplicationStatusApproved:
			resp, err := pointWallet.SettlePointWithdrawal(ctx, &walletv1.SettlePointWithdrawalRequest{
				CommandId:               commandID,
				UserId:                  userID,
				AssetType:               assetType,
				GrossPointAmount:        amountMinor,
				FeePointAmount:          feePoints,
				NetPointAmount:          netPoints,
				PointsPerUsd:            pointsPerUSD,
				FeeBps:                  feeBPS,
				OperatorUserId:          int64(actor.UserID),
				Reason:                  reason,
				AppCode:                 appCode,
				WithdrawalApplicationId: applicationIDText,
				FreezeTransactionId:     strings.TrimSpace(freezeTransactionID),
			})
			if err != nil {
				return "", err
			}
			return resp.GetTransactionId(), nil
		case model.WithdrawalApplicationStatusRejected:
			resp, err := pointWallet.ReleasePointWithdrawal(ctx, &walletv1.ReleasePointWithdrawalRequest{
				CommandId:               commandID,
				UserId:                  userID,
				AssetType:               assetType,
				GrossPointAmount:        amountMinor,
				FeePointAmount:          feePoints,
				NetPointAmount:          netPoints,
				PointsPerUsd:            pointsPerUSD,
				FeeBps:                  feeBPS,
				OperatorUserId:          int64(actor.UserID),
				Reason:                  reason,
				AppCode:                 appCode,
				WithdrawalApplicationId: applicationIDText,
				FreezeTransactionId:     strings.TrimSpace(freezeTransactionID),
			})
			if err != nil {
				return "", err
			}
			return resp.GetTransactionId(), nil
		default:
			return "", errors.New("审核结果不正确")
		}
	}
	switch decision {
	case model.WithdrawalApplicationStatusApproved:
		resp, err := s.wallet.SettleSalaryWithdrawal(ctx, &walletv1.SettleSalaryWithdrawalRequest{
			CommandId:               commandID,
			UserId:                  userID,
			SalaryAssetType:         assetType,
			SalaryUsdMinor:          amountMinor,
			OperatorUserId:          int64(actor.UserID),
			Reason:                  reason,
			AppCode:                 appCode,
			WithdrawalApplicationId: applicationIDText,
		})
		if err != nil {
			return "", err
		}
		return resp.GetTransactionId(), nil
	case model.WithdrawalApplicationStatusRejected:
		resp, err := s.wallet.ReleaseSalaryWithdrawal(ctx, &walletv1.ReleaseSalaryWithdrawalRequest{
			CommandId:               commandID,
			UserId:                  userID,
			SalaryAssetType:         assetType,
			SalaryUsdMinor:          amountMinor,
			OperatorUserId:          int64(actor.UserID),
			Reason:                  reason,
			AppCode:                 appCode,
			WithdrawalApplicationId: applicationIDText,
		})
		if err != nil {
			return "", err
		}
		return resp.GetTransactionId(), nil
	default:
		return "", errors.New("审核结果不正确")
	}
}

func withdrawalAuditCommandID(id uint, stage repository.WithdrawalApplicationReviewStage) string {
	// 同一阶段的通过和拒绝复用 command id；内部 wallet 用请求哈希防相反决策，外部回调则由持久 finance claim 先锁定决策和审计上下文。
	return fmt.Sprintf("salary-withdrawal:%d:%s", id, stage)
}

func isPointWithdrawalAssetType(assetType string) bool {
	switch strings.ToUpper(strings.TrimSpace(assetType)) {
	case "POINT", "POINT_DIAMOND", "COIN_SELLER_POINT":
		return true
	default:
		return false
	}
}

type auditNoticeInput struct {
	ApplicationID      uint
	AppCode            string
	UserID             int64
	Stage              repository.WithdrawalApplicationReviewStage
	Decision           string
	Remark             string
	AuditImageURL      string
	AuditTransactionID string
	WithdrawAmount     string
	WithdrawMethod     string
	RequestID          string
	SentAtMS           int64
}

func (s *Service) sendWithdrawalAuditNotice(ctx context.Context, input auditNoticeInput) error {
	body := "Your withdrawal request has been approved."
	title := "Withdrawal request approved"
	imageURL := ""
	eventType := "finance_withdrawal_approved"
	if input.Decision == model.WithdrawalApplicationStatusRejected {
		body = "Your withdrawal request has been rejected. Reason: " + strings.TrimSpace(input.Remark)
		title = "Withdrawal request rejected"
		eventType = "finance_withdrawal_rejected"
		if input.Stage == repository.WithdrawalApplicationReviewStageOperations {
			eventType = "operations_withdrawal_rejected"
		}
	} else {
		imageURL = strings.TrimSpace(input.AuditImageURL)
	}
	metadata, err := json.Marshal(map[string]any{
		"application_id":       input.ApplicationID,
		"app_code":             strings.TrimSpace(input.AppCode),
		"audit_transaction_id": strings.TrimSpace(input.AuditTransactionID),
		"decision":             strings.TrimSpace(input.Decision),
		"review_stage":         string(input.Stage),
		"withdraw_amount":      strings.TrimSpace(input.WithdrawAmount),
		"withdraw_method":      strings.TrimSpace(input.WithdrawMethod),
	})
	if err != nil {
		return err
	}
	_, err = s.activity.CreateInboxMessage(ctx, &activityv1.CreateInboxMessageRequest{
		Meta: &activityv1.RequestMeta{
			RequestId: strings.TrimSpace(input.RequestID),
			Caller:    "admin-server",
			AppCode:   strings.TrimSpace(input.AppCode),
			SentAtMs:  input.SentAtMS,
		},
		TargetUserId:      input.UserID,
		Producer:          "admin-server",
		ProducerEventId:   withdrawalAuditNotificationEventID(input.ApplicationID, input.Stage, input.Decision),
		ProducerEventType: eventType,
		MessageType:       "system",
		AggregateType:     "user_withdrawal_application",
		AggregateId:       strconv.FormatUint(uint64(input.ApplicationID), 10),
		Title:             title,
		Summary:           body,
		Body:              body,
		ImageUrl:          imageURL,
		SentAtMs:          input.SentAtMS,
		MetadataJson:      string(metadata),
	})
	if err != nil {
		return fmt.Errorf("发送提现审核通知失败: %w", err)
	}
	return nil
}

func withdrawalAuditNotificationEventID(id uint, stage repository.WithdrawalApplicationReviewStage, decision string) string {
	if stage == repository.WithdrawalApplicationReviewStageFinance {
		// 旧财务通知可能已成功而 admin 申请仍 pending；继续使用原 event id，部署后重试才不会重复发用户通知。
		return fmt.Sprintf("finance-withdrawal:%d:%s", id, strings.TrimSpace(decision))
	}
	return fmt.Sprintf("operations-withdrawal:%d:%s", id, strings.TrimSpace(decision))
}

func canAuditWithdrawal(permissions []string) bool {
	return hasWithdrawalPermission(permissions, permissionAuditWithdrawalApplications)
}

func canAuditOperationsWithdrawal(permissions []string) bool {
	return hasWithdrawalPermission(permissions, permissionAuditOperationsWithdrawals)
}

func canAuditWithdrawalStage(stage repository.WithdrawalApplicationReviewStage, permissions []string) bool {
	if stage == repository.WithdrawalApplicationReviewStageOperations {
		return canAuditOperationsWithdrawal(permissions)
	}
	return canAuditWithdrawal(permissions)
}

func hasWithdrawalPermission(permissions []string, expected string) bool {
	for _, permission := range permissions {
		if strings.TrimSpace(permission) == expected {
			return true
		}
	}
	return false
}
