package mysql

import (
	"context"
	"crypto/sha256"
	"database/sql"
	"encoding/binary"
	"encoding/hex"
	"errors"
	"fmt"
	"hash"
	"strings"

	"hyapp/pkg/appcode"
	"hyapp/pkg/xerr"
)

const (
	walletOutboxPurgeAuthorizationState = "RESTORE_VERIFIED"
	walletOutboxPurgeReceiptState       = "PURGED"
	walletOutboxPurgePolicyFinancialV1  = "financial-v1"
)

// financial-v1 是显式正向安全集合：只覆盖已经确认不被正常在线查询回读的账务事实。
// 未知新事件、礼物/资源目录事件和低频资源/VIP 控制事件默认永久留热，新增清理类型必须发布新 policy version。
var walletOutboxPurgeFinancialV1EventTypes = []string{
	"AgencyPointCredited",
	"HostPeriodDiamondCredited",
	"HostPointCredited",
	"WalletAgencyOpeningRewardCredited",
	"WalletBalanceChanged",
	"WalletCoinSellerCoinCompensated",
	"WalletCoinSellerStockPurchased",
	"WalletCoinSellerSubTransferred",
	"WalletCoinSellerTransferred",
	"WalletGiftDebited",
	"WalletGiftIncomeCredited",
	"WalletGooglePaymentCredited",
	"WalletInviteActivityRewardCredited",
	"WalletLuckyGiftRewardCredited",
	"WalletRechargeRecorded",
	"WalletRedPacketClaimed",
	"WalletRedPacketCreated",
	"WalletRedPacketRefunded",
	"WalletRoomTurnoverRewardCredited",
	"WalletTaskRewardCredited",
	"WalletWheelRewardCredited",
}

// WalletOutboxPurgeReceipt 是一个已经提交的精确 PK 清理批次。
// DeletedCount 为零时表示本轮没有成熟候选，此时 PurgeID 为空且数据库不会写空审计行。
type WalletOutboxPurgeReceipt struct {
	AppCode                 string
	PurgeID                 string
	State                   string
	PolicyVersion           string
	CutoffMS                int64
	ReceiptVerifiedBeforeMS int64
	CandidateSHA256         string
	CandidateCount          int
	DeletedCount            int
	FirstCursor             WalletOutboxArchiveCursor
	LastCursor              WalletOutboxArchiveCursor
	PurgedAtMS              int64
}

type walletOutboxPurgeCandidate struct {
	EventID     string
	UpdatedAtMS int64
}

// RequireWalletOutboxPurgeAuthorization 要求生产 wallet DB 已手工固化一条与隔离库
// RESTORE_VERIFIED 回执精确匹配的授权证据。迁移不会自动插入该表，因此仅部署人员
// 明确核验过的 (App, archive batch, manifest hash) 能打开自动清理总闸。
func (r *Repository) RequireWalletOutboxPurgeAuthorization(ctx context.Context, appCode, batchID, manifestSHA string) error {
	if r == nil || r.db == nil {
		return xerr.New(xerr.Unavailable, "mysql repository is not configured")
	}
	ctx, normalizedAppCode, err := walletOutboxPurgeContext(ctx, appCode)
	if err != nil {
		return err
	}
	batchID, err = normalizeWalletOutboxPurgeSHA256("archive_batch_id", batchID)
	if err != nil {
		return err
	}
	manifestSHA, err = normalizeWalletOutboxPurgeSHA256("manifest_sha256", manifestSHA)
	if err != nil {
		return err
	}

	var marker int
	err = r.db.QueryRowContext(ctx, `
		SELECT 1
		FROM wallet_outbox_archive_purge_authorizations auth FORCE INDEX (PRIMARY)
		JOIN wallet_outbox_archive_receipts receipt FORCE INDEX (PRIMARY)
		  ON receipt.app_code = auth.app_code AND receipt.batch_id = auth.archive_batch_id
		 AND receipt.manifest_sha256 = auth.manifest_sha256
		 AND receipt.schema_version = auth.schema_version AND receipt.row_count = auth.row_count
		 AND receipt.data_crc64 = auth.data_crc64 AND receipt.manifest_crc64 = auth.manifest_crc64
		 AND receipt.success_crc64 = auth.success_crc64
		WHERE auth.app_code = ? AND auth.archive_batch_id = ? AND auth.manifest_sha256 = ?
		  AND auth.state = ? AND receipt.state = ?
		LIMIT 1`,
		normalizedAppCode, batchID, manifestSHA, walletOutboxPurgeAuthorizationState, walletOutboxArchiveStateVerified,
	).Scan(&marker)
	if errors.Is(err, sql.ErrNoRows) {
		return xerr.New(xerr.Conflict, "wallet outbox purge restore rehearsal is not authorized")
	}
	return err
}

// PurgeDeliveredWalletOutboxBatch 在单个 READ COMMITTED 事务内锁定、删除并审计至多 limit 条旧事实。
// 调用方必须已经持有 AcquireWalletOutboxArchiveAppLock 返回的 App 级 GET_LOCK。候选只能从
// exact member 表产生；每一行都重新连接当前 outbox 和 VERIFIED receipt，杜绝用批次首尾游标
// 推断中间行、迟到写入或旧 receipt 自动获得删除资格。
func (r *Repository) PurgeDeliveredWalletOutboxBatch(ctx context.Context, appCode, policyVersion string, cutoffMS, receiptVerifiedBeforeMS int64, limit int, nowMS int64) (WalletOutboxPurgeReceipt, error) {
	if r == nil || r.db == nil {
		return WalletOutboxPurgeReceipt{}, xerr.New(xerr.Unavailable, "mysql repository is not configured")
	}
	ctx, normalizedAppCode, err := walletOutboxPurgeContext(ctx, appCode)
	if err != nil {
		return WalletOutboxPurgeReceipt{}, err
	}
	eventTypes, err := walletOutboxPurgeEventTypes(policyVersion)
	if err != nil {
		return WalletOutboxPurgeReceipt{}, err
	}
	if cutoffMS <= 0 || receiptVerifiedBeforeMS <= 0 || nowMS <= 0 || cutoffMS >= nowMS || receiptVerifiedBeforeMS >= nowMS {
		return WalletOutboxPurgeReceipt{}, xerr.New(xerr.InvalidArgument, "wallet outbox purge cutoff, receipt grace, and now are invalid")
	}
	if limit <= 0 || limit > 500 {
		return WalletOutboxPurgeReceipt{}, xerr.New(xerr.InvalidArgument, "wallet outbox purge limit must be within [1,500]")
	}

	tx, err := r.db.BeginTx(ctx, &sql.TxOptions{Isolation: sql.LevelReadCommitted})
	if err != nil {
		return WalletOutboxPurgeReceipt{}, err
	}
	defer func() { _ = tx.Rollback() }()
	receipt := WalletOutboxPurgeReceipt{
		AppCode:                 normalizedAppCode,
		State:                   walletOutboxPurgeReceiptState,
		PolicyVersion:           policyVersion,
		CutoffMS:                cutoffMS,
		ReceiptVerifiedBeforeMS: receiptVerifiedBeforeMS,
		PurgedAtMS:              nowMS,
	}
	candidates, err := selectWalletOutboxPurgeCandidates(ctx, tx, normalizedAppCode, cutoffMS, receiptVerifiedBeforeMS, eventTypes, limit)
	if err != nil {
		return WalletOutboxPurgeReceipt{}, err
	}
	if len(candidates) == 0 {
		return receipt, nil
	}

	receipt.CandidateSHA256 = hashWalletOutboxPurgeCandidates(normalizedAppCode, candidates)
	receipt.CandidateCount = len(candidates)
	receipt.FirstCursor = WalletOutboxArchiveCursor{UpdatedAtMS: candidates[0].UpdatedAtMS, EventID: candidates[0].EventID}
	last := candidates[len(candidates)-1]
	receipt.LastCursor = WalletOutboxArchiveCursor{UpdatedAtMS: last.UpdatedAtMS, EventID: last.EventID}
	receipt.PurgeID = hashWalletOutboxPurgeReceipt(receipt)

	deleted, err := deleteWalletOutboxPurgeCandidates(ctx, tx, normalizedAppCode, cutoffMS, eventTypes, candidates)
	if err != nil {
		return WalletOutboxPurgeReceipt{}, err
	}
	if deleted != int64(len(candidates)) {
		return WalletOutboxPurgeReceipt{}, fmt.Errorf("wallet outbox purge candidate/delete mismatch: candidates=%d deleted=%d", len(candidates), deleted)
	}
	deletedMembers, err := deleteWalletOutboxArchiveMembers(ctx, tx, normalizedAppCode, candidates)
	if err != nil {
		return WalletOutboxPurgeReceipt{}, err
	}
	if deletedMembers != int64(len(candidates)) {
		// outbox 与 member 删除必须共同提交；member 数不一致时回滚 outbox 删除，避免留下无法审计的半完成批次。
		return WalletOutboxPurgeReceipt{}, fmt.Errorf("wallet outbox purge member/delete mismatch: candidates=%d deleted_members=%d", len(candidates), deletedMembers)
	}
	receipt.DeletedCount = int(deleted)
	if err := insertWalletOutboxPurgeReceipt(ctx, tx, receipt); err != nil {
		return WalletOutboxPurgeReceipt{}, err
	}
	if err := tx.Commit(); err != nil {
		return WalletOutboxPurgeReceipt{}, err
	}
	return receipt, nil
}

func selectWalletOutboxPurgeCandidates(ctx context.Context, tx *sql.Tx, appCode string, cutoffMS, receiptVerifiedBeforeMS int64, eventTypes []string, limit int) ([]walletOutboxPurgeCandidate, error) {
	placeholders := walletOutboxPurgePlaceholders(len(eventTypes))
	args := make([]any, 0, len(eventTypes)+6)
	args = append(args, appCode, cutoffMS, walletOutboxArchiveStateVerified, receiptVerifiedBeforeMS, outboxStatusDelivered)
	for _, eventType := range eventTypes {
		args = append(args, eventType)
	}
	args = append(args, limit)
	rows, err := tx.QueryContext(ctx, `
		SELECT STRAIGHT_JOIN m.event_id, m.updated_at_ms
		FROM wallet_outbox_archive_members m FORCE INDEX (idx_wallet_outbox_archive_member_purge)
		JOIN wallet_outbox_archive_receipts ar FORCE INDEX (PRIMARY)
		  ON ar.app_code = m.app_code AND ar.batch_id = m.batch_id
		 AND ar.manifest_sha256 = m.manifest_sha256 AND ar.verified_at_ms = m.receipt_verified_at_ms
		JOIN wallet_outbox wo FORCE INDEX (PRIMARY)
		  ON wo.app_code = m.app_code AND wo.event_id = m.event_id AND wo.updated_at_ms = m.updated_at_ms
		WHERE m.app_code = ? AND m.updated_at_ms < ?
		  AND ar.state = ? AND ar.verified_at_ms < ?
		  AND wo.status = ? AND wo.event_type IN (`+placeholders+`)
		ORDER BY m.updated_at_ms ASC, m.event_id ASC
		LIMIT ?
		FOR UPDATE SKIP LOCKED`, args...)
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	candidates := make([]walletOutboxPurgeCandidate, 0, limit)
	for rows.Next() {
		var candidate walletOutboxPurgeCandidate
		if err := rows.Scan(&candidate.EventID, &candidate.UpdatedAtMS); err != nil {
			return nil, err
		}
		candidates = append(candidates, candidate)
	}
	return candidates, rows.Err()
}

func deleteWalletOutboxPurgeCandidates(ctx context.Context, tx *sql.Tx, appCode string, cutoffMS int64, eventTypes []string, candidates []walletOutboxPurgeCandidate) (int64, error) {
	primaryKeys, args, err := walletOutboxPurgeExactKeys(appCode, candidates)
	if err != nil {
		return 0, err
	}
	args = append(args, appCode, outboxStatusDelivered, cutoffMS)
	for _, eventType := range eventTypes {
		args = append(args, eventType)
	}
	// 候选 SELECT 已锁住这些行；删除仍逐键复核 app/event/updated、delivered、cutoff 和正向 policy，
	// 即使未来有人修改候选 JOIN，也不能把未授权类型或时间发生变化的行带入删除。
	result, err := tx.ExecContext(ctx, `
		DELETE wo
		FROM wallet_outbox wo FORCE INDEX (PRIMARY)
		WHERE (wo.app_code, wo.event_id, wo.updated_at_ms) IN (`+primaryKeys+`)
		  AND wo.app_code = ? AND wo.status = ? AND wo.updated_at_ms < ?
		  AND wo.event_type IN (`+walletOutboxPurgePlaceholders(len(eventTypes))+`)`, args...)
	if err != nil {
		return 0, err
	}
	return result.RowsAffected()
}

func deleteWalletOutboxArchiveMembers(ctx context.Context, tx *sql.Tx, appCode string, candidates []walletOutboxPurgeCandidate) (int64, error) {
	primaryKeys, args, err := walletOutboxPurgeExactKeys(appCode, candidates)
	if err != nil {
		return 0, err
	}
	result, err := tx.ExecContext(ctx, `
		DELETE m
		FROM wallet_outbox_archive_members m FORCE INDEX (PRIMARY)
		WHERE (m.app_code, m.event_id, m.updated_at_ms) IN (`+primaryKeys+`)`, args...)
	if err != nil {
		return 0, err
	}
	return result.RowsAffected()
}

func walletOutboxPurgeExactKeys(appCode string, candidates []walletOutboxPurgeCandidate) (string, []any, error) {
	if len(candidates) == 0 || len(candidates) > 500 {
		return "", nil, xerr.New(xerr.InvalidArgument, "wallet outbox purge candidate count must be within [1,500]")
	}
	keys := make([]string, 0, len(candidates))
	args := make([]any, 0, len(candidates)*3)
	for _, candidate := range candidates {
		keys = append(keys, "(?, ?, ?)")
		args = append(args, appCode, candidate.EventID, candidate.UpdatedAtMS)
	}
	return strings.Join(keys, ","), args, nil
}

func insertWalletOutboxPurgeReceipt(ctx context.Context, tx *sql.Tx, receipt WalletOutboxPurgeReceipt) error {
	result, err := tx.ExecContext(ctx, `
		INSERT INTO wallet_outbox_archive_purge_receipts (
		  app_code, purge_id, state, policy_version, cutoff_ms, receipt_verified_before_ms,
		  candidate_sha256, candidate_count, deleted_count,
		  first_updated_at_ms, first_event_id, last_updated_at_ms, last_event_id,
		  purged_at_ms, created_at_ms, updated_at_ms
		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
		receipt.AppCode, receipt.PurgeID, receipt.State, receipt.PolicyVersion, receipt.CutoffMS, receipt.ReceiptVerifiedBeforeMS,
		receipt.CandidateSHA256, receipt.CandidateCount, receipt.DeletedCount,
		receipt.FirstCursor.UpdatedAtMS, receipt.FirstCursor.EventID, receipt.LastCursor.UpdatedAtMS, receipt.LastCursor.EventID,
		receipt.PurgedAtMS, receipt.PurgedAtMS, receipt.PurgedAtMS,
	)
	if err != nil {
		return err
	}
	affected, err := result.RowsAffected()
	if err != nil {
		return err
	}
	if affected != 1 {
		return fmt.Errorf("wallet outbox purge receipt insert affected %d rows", affected)
	}
	return nil
}

func walletOutboxPurgeContext(ctx context.Context, appCode string) (context.Context, string, error) {
	if strings.TrimSpace(appCode) == "" {
		return ctx, "", xerr.New(xerr.InvalidArgument, "wallet outbox purge app_code is required")
	}
	ctx = contextWithCommandApp(ctx, appCode)
	normalized := appcode.FromContext(ctx)
	// 本轮容量治理边界只有 Lalu/Fami；其他租户即使误配也必须在进入事务前失败。
	if normalized != "lalu" && normalized != "fami" {
		return ctx, "", xerr.New(xerr.InvalidArgument, "wallet outbox purge app_code is not allowed")
	}
	return ctx, normalized, nil
}

func walletOutboxPurgeEventTypes(policyVersion string) ([]string, error) {
	policyVersion = strings.TrimSpace(policyVersion)
	if policyVersion != walletOutboxPurgePolicyFinancialV1 {
		return nil, xerr.New(xerr.InvalidArgument, "wallet outbox purge policy_version is unsupported")
	}
	return walletOutboxPurgeFinancialV1EventTypes, nil
}

func normalizeWalletOutboxPurgeSHA256(field string, value string) (string, error) {
	value = strings.ToLower(strings.TrimSpace(value))
	if len(value) != sha256.Size*2 {
		return "", xerr.New(xerr.InvalidArgument, field+" must be a SHA-256 hex digest")
	}
	if _, err := hex.DecodeString(value); err != nil {
		return "", xerr.New(xerr.InvalidArgument, field+" must be a SHA-256 hex digest")
	}
	return value, nil
}

func walletOutboxPurgePlaceholders(count int) string {
	values := make([]string, count)
	for index := range values {
		values[index] = "?"
	}
	return strings.Join(values, ",")
}

func hashWalletOutboxPurgeCandidates(appCode string, candidates []walletOutboxPurgeCandidate) string {
	digest := sha256.New()
	writeWalletOutboxPurgeHashString(digest, appCode)
	writeWalletOutboxPurgeHashUint64(digest, uint64(len(candidates)))
	for _, candidate := range candidates {
		// 候选已按 (updated_at_ms,event_id) 排序；哈希内容采用精确 PK 和归档时 updated_at 快照。
		writeWalletOutboxPurgeHashString(digest, candidate.EventID)
		writeWalletOutboxPurgeHashUint64(digest, uint64(candidate.UpdatedAtMS))
	}
	return hex.EncodeToString(digest.Sum(nil))
}

func hashWalletOutboxPurgeReceipt(receipt WalletOutboxPurgeReceipt) string {
	digest := sha256.New()
	writeWalletOutboxPurgeHashString(digest, receipt.AppCode)
	writeWalletOutboxPurgeHashString(digest, receipt.PolicyVersion)
	writeWalletOutboxPurgeHashString(digest, receipt.CandidateSHA256)
	writeWalletOutboxPurgeHashUint64(digest, uint64(receipt.CutoffMS))
	writeWalletOutboxPurgeHashUint64(digest, uint64(receipt.ReceiptVerifiedBeforeMS))
	writeWalletOutboxPurgeHashUint64(digest, uint64(receipt.PurgedAtMS))
	return hex.EncodeToString(digest.Sum(nil))
}

func writeWalletOutboxPurgeHashString(digest hash.Hash, value string) {
	// 长度前缀消除字段拼接歧义，使相同候选在不同进程上得到完全一致的审计指纹。
	var size [4]byte
	binary.BigEndian.PutUint32(size[:], uint32(len(value)))
	_, _ = digest.Write(size[:])
	_, _ = digest.Write([]byte(value))
}

func writeWalletOutboxPurgeHashUint64(digest hash.Hash, value uint64) {
	var encoded [8]byte
	binary.BigEndian.PutUint64(encoded[:], value)
	_, _ = digest.Write(encoded[:])
}