import argon2 from 'argon2';
import type { AppConfig } from './config.js';
import { getPool, withTransaction } from './db.js';
import { hashToken, randomToken, sameTokenHash } from './crypto.js';
import {
  BUSINESS_ROUTES,
  businessRouteById,
  type BusinessRouteId
} from './business-routes.js';
import {
  diagnosticMetadataKeys,
  noopDiagnosticLogger,
  type DiagnosticLogger
} from './diagnostics.js';

export type AuthRole = 'admin' | 'team_lead' | 'user';

export interface AuthUser {
  id: string;
  organizationId: string;
  username: string;
  role: AuthRole;
  erpAccount: string | null;
}

export interface PublicAccount {
  id: string;
  username: string;
  role: AuthRole;
  erp_account: string | null;
  is_active: boolean;
  authorized_business_route_ids: BusinessRouteId[];
  business_authorization_revision: number;
  last_login_at: string | null;
  created_at: string;
  updated_at: string;
}

export interface AuthSession {
  id: string;
  token: string;
  csrfToken: string;
  user: AuthUser;
}

export interface ActiveSession {
  id: string;
  user: AuthUser;
  csrfTokenHash: Buffer;
}

export class AuthError extends Error {
  constructor(
    public readonly code: string,
    message: string,
    public readonly statusCode = 401
  ) {
    super(message);
    this.name = 'AuthError';
  }
}

function normalizeUsername(value: string): string {
  return String(value || '').trim().toLowerCase();
}

function validateUsername(value: string): string {
  const normalized = normalizeUsername(value);
  if (!normalized || normalized.length > 160) {
    throw new AuthError('username_invalid', '账号必须为 1—160 个字符。', 400);
  }
  return normalized;
}

function validatePassword(value: string): string {
  const password = String(value || '');
  if (!password) {
    throw new AuthError('password_invalid', '密码不能为空。', 400);
  }
  return password;
}

function normalizeErpAccount(value: unknown): string | null {
  const normalized = String(value ?? '').trim();
  if (!normalized) return null;
  if (normalized.length > 200) {
    throw new AuthError('erp_account_invalid', 'ERP 账号必须为 1—200 个字符。', 400);
  }
  return normalized;
}

function validateAccountRouting(role: AuthRole, value: unknown): string | null {
  const erpAccount = normalizeErpAccount(value);
  if (role === 'admin') {
    if (erpAccount) throw new AuthError('admin_erp_account_forbidden', '管理员账号不能绑定员工 ERP 账号。', 409);
    return null;
  }
  if (!erpAccount) {
    throw new AuthError('erp_account_required', '普通用户或组长必须绑定 ERP 账号。', 400);
  }
  return erpAccount;
}

function normalizeRole(value: unknown): AuthRole {
  if (value === 'admin' || value === 'team_lead') return value;
  return 'user';
}

function isoOrNull(value: unknown): string | null {
  if (!value) return null;
  const date = new Date(String(value));
  return Number.isFinite(date.getTime()) ? date.toISOString() : null;
}

const ALL_BUSINESS_ROUTE_IDS = BUSINESS_ROUTES.map((route) => route.routeId);
const BUSINESS_ROUTE_DISPLAY_ORDER = new Map(
  ALL_BUSINESS_ROUTE_IDS.map((routeId, index) => [routeId, index])
);

function normalizeBusinessRouteIds(values: readonly unknown[] | undefined): BusinessRouteId[] {
  const normalized = [...new Set((values || []).map((value) => String(value || '').trim()).filter(Boolean))];
  const invalid = normalized.find((routeId) => !businessRouteById(routeId));
  if (invalid) throw new AuthError('business_route_invalid', `业务类型 ${invalid} 不存在。`, 400);
  return (normalized as BusinessRouteId[]).sort((left, right) => (
    (BUSINESS_ROUTE_DISPLAY_ORDER.get(left) ?? Number.MAX_SAFE_INTEGER)
    - (BUSINESS_ROUTE_DISPLAY_ORDER.get(right) ?? Number.MAX_SAFE_INTEGER)
  ));
}

function mapUser(row: Record<string, unknown>): AuthUser {
  return {
    id: String(row.id),
    organizationId: String(row.organization_id),
    username: String(row.username),
    role: normalizeRole(row.role),
    erpAccount: normalizeErpAccount(row.erp_account)
  };
}

function mapAccount(row: Record<string, unknown>): PublicAccount {
  const role = normalizeRole(row.role);
  const storedRouteIds = normalizeBusinessRouteIds(
    Array.isArray(row.authorized_business_route_ids) ? row.authorized_business_route_ids : []
  );
  return {
    id: String(row.id),
    username: String(row.username),
    role,
    erp_account: normalizeErpAccount(row.erp_account),
    is_active: row.is_active === true || String(row.is_active) === 'true',
    authorized_business_route_ids: role === 'admin' ? [...ALL_BUSINESS_ROUTE_IDS] : storedRouteIds,
    business_authorization_revision: Math.max(0, Number(row.business_authorization_revision || 0)),
    last_login_at: isoOrNull(row.last_login_at),
    created_at: isoOrNull(row.created_at) || new Date(0).toISOString(),
    updated_at: isoOrNull(row.updated_at) || new Date(0).toISOString()
  };
}

async function loadPublicAccount(
  client: import('pg').PoolClient,
  organizationId: string,
  userId: string
): Promise<PublicAccount | null> {
  const result = await client.query(
    `SELECT u.id, u.username, u.role, u.erp_account, u.is_active,
            u.business_authorization_revision,
            u.last_login_at, u.created_at, u.updated_at,
            COALESCE(ARRAY(
              SELECT route_grant.route_id
                FROM user_business_route_authorizations route_grant
               WHERE route_grant.organization_id = u.organization_id
                 AND route_grant.user_id = u.id
            ), ARRAY[]::text[]) AS authorized_business_route_ids
       FROM users u
      WHERE u.organization_id = $1 AND u.id = $2`,
    [organizationId, userId]
  );
  return result.rowCount ? mapAccount(result.rows[0] as Record<string, unknown>) : null;
}

export class AuthService {
  private readonly dummyHashPromise = argon2.hash('ltjt-dummy-password', {
    type: argon2.argon2id,
    memoryCost: 19_456,
    timeCost: 2,
    parallelism: 1
  });

  constructor(
    private readonly config: AppConfig,
    private readonly logger: DiagnosticLogger = noopDiagnosticLogger
  ) {}

  private log(metadata: Record<string, unknown>, message: string): void {
    try {
      this.logger.info(metadata, message);
    } catch {
      // Authentication state and audit persistence never depend on logging.
    }
  }

  async ensureOrganization(): Promise<{ id: string; slug: string; name: string }> {
    const result = await getPool(this.config).query(
      `INSERT INTO organizations (slug, name)
       VALUES ($1, $2)
       ON CONFLICT (slug) DO UPDATE SET name = EXCLUDED.name, updated_at = now()
       RETURNING id, slug, name`,
      [this.config.ORG_SLUG, this.config.ORG_NAME]
    );
    return result.rows[0] as { id: string; slug: string; name: string };
  }

  async getOrganization(): Promise<{ id: string; slug: string; name: string } | null> {
    const result = await getPool(this.config).query(
      'SELECT id, slug, name FROM organizations WHERE slug = $1',
      [this.config.ORG_SLUG]
    );
    return result.rowCount ? result.rows[0] as { id: string; slug: string; name: string } : null;
  }

  async bootstrapAdmin(username: string, password: string, { force = false } = {}): Promise<AuthUser> {
    const normalized = validateUsername(username);
    const validatedPassword = validatePassword(password);
    const organization = await this.ensureOrganization();
    const passwordHash = await argon2.hash(validatedPassword, { type: argon2.argon2id });
    return withTransaction(this.config, async (client) => {
      const existing = await client.query(
        'SELECT id FROM users WHERE organization_id = $1 AND username = $2 FOR UPDATE',
        [organization.id, normalized]
      );
      if (existing.rowCount && !force) {
        throw new Error(`administrator ${normalized} already exists; use --force to reset it.`);
      }
      const result = existing.rowCount
        ? await client.query(
          `UPDATE users
           SET password_hash = $1, role = 'admin', erp_account = NULL, is_active = true,
               must_change_password = false, password_changed_at = now(),
               failed_login_count = 0, locked_until = NULL, updated_at = now()
           WHERE id = $2
           RETURNING id, organization_id, username, role, erp_account`,
          [passwordHash, existing.rows[0].id]
        )
        : await client.query(
          `INSERT INTO users (organization_id, username, password_hash, role)
           VALUES ($1, $2, $3, 'admin')
           RETURNING id, organization_id, username, role, erp_account`,
          [organization.id, normalized, passwordHash]
        );
      const user = mapUser(result.rows[0]);
      if (existing.rowCount && force) {
        await client.query(
          `UPDATE user_channels
              SET owner_user_id = NULL, enabled = false, status = 'disabled',
                  last_error = '绑定账号已重置为管理员，渠道已解除绑定。', updated_at = now()
            WHERE organization_id = $1 AND owner_user_id = $2`,
          [organization.id, user.id]
        );
        await client.query(
          `UPDATE browser_connections
              SET status = 'superseded', erp_account_verified = false
            WHERE organization_id = $1 AND user_id = $2 AND status = 'connected'`,
          [organization.id, user.id]
        );
        await client.query(
          'UPDATE sessions SET revoked_at = now() WHERE user_id = $1 AND revoked_at IS NULL',
          [user.id]
        );
      }
      return user;
    });
  }

  async authenticate(username: string, password: string, ipAddress: string, userAgent: string): Promise<AuthSession> {
    const normalized = normalizeUsername(username);
    const pool = getPool(this.config);
    const lookup = await pool.query(
      `SELECT id, organization_id, username, password_hash, role, erp_account, is_active,
              failed_login_count, locked_until
       FROM users
       WHERE organization_id = (SELECT id FROM organizations WHERE slug = $1)
         AND username = $2`,
      [this.config.ORG_SLUG, normalized]
    );
    const row = lookup.rows[0] as Record<string, unknown> | undefined;
    const lockedUntil = row?.locked_until ? new Date(String(row.locked_until)) : null;
    if (lockedUntil && lockedUntil.getTime() > Date.now()) {
      throw new AuthError('account_locked', '账号暂时锁定，请稍后再试。', 429);
    }

    const hash = String(row?.password_hash || await this.dummyHashPromise);
    const valid = await argon2.verify(hash, password || '');
    if (!row || !valid || row.is_active === false) {
      if (row) {
        await pool.query(
          `UPDATE users
           SET failed_login_count = failed_login_count + 1,
               locked_until = CASE
                 WHEN failed_login_count + 1 >= 5 THEN now() + interval '15 minutes'
                 ELSE locked_until
               END,
               updated_at = now()
           WHERE id = $1`,
          [row.id]
        );
      }
      throw new AuthError('invalid_credentials', '账号或密码错误。');
    }

    const user = mapUser(row);
    await pool.query(
      `UPDATE users
       SET failed_login_count = 0, locked_until = NULL, last_login_at = now(), updated_at = now()
       WHERE id = $1`,
      [user.id]
    );
    return this.createSession(user, ipAddress, userAgent);
  }

  async resetPassword(username: string, password: string): Promise<void> {
    const normalized = validateUsername(username);
    const passwordHash = await argon2.hash(validatePassword(password), { type: argon2.argon2id });
    const result = await getPool(this.config).query(
      `UPDATE users
       SET password_hash = $1, must_change_password = false, password_changed_at = now(),
           failed_login_count = 0, locked_until = NULL, updated_at = now()
       WHERE organization_id = (SELECT id FROM organizations WHERE slug = $2)
         AND username = $3
       RETURNING id`,
      [passwordHash, this.config.ORG_SLUG, normalized]
    );
    if (!result.rowCount) throw new Error(`administrator ${normalized} was not found.`);
    await getPool(this.config).query(
      `UPDATE sessions SET revoked_at = now() WHERE user_id = $1 AND revoked_at IS NULL`,
      [result.rows[0].id]
    );
  }

  private requireAdmin(actor: AuthUser): void {
    if (actor.role !== 'admin') throw new AuthError('admin_required', '需要管理员权限。', 403);
  }

  private async accountAudit(
    client: import('pg').PoolClient,
    actor: AuthUser,
    eventType: string,
    targetUserId: string,
    requestId: string,
    metadata: Record<string, unknown> = {}
  ): Promise<void> {
    await client.query(
      `INSERT INTO audit_events
        (organization_id, actor_user_id, event_type, entity_type, entity_id, request_id, metadata)
       VALUES ($1, $2, $3, 'user', $4, $5, $6)`,
      [actor.organizationId, actor.id, eventType, targetUserId, requestId, metadata]
    );
    this.log({
      diagnostic_event: 'audit.event.staged',
      diagnostic_stage: 'account_audit',
      request_id: requestId,
      domain_event: eventType,
      entity_type: 'user',
      actor_present: true,
      metadata_keys: diagnosticMetadataKeys(metadata)
    }, 'account audit event persisted');
  }

  async listAccounts(actor: AuthUser): Promise<PublicAccount[]> {
    this.requireAdmin(actor);
    const result = await getPool(this.config).query(
      `SELECT u.id, u.username, u.role, u.erp_account, u.is_active,
              u.business_authorization_revision,
              u.last_login_at, u.created_at, u.updated_at,
              COALESCE(ARRAY(
                SELECT route_grant.route_id
                  FROM user_business_route_authorizations route_grant
                 WHERE route_grant.organization_id = u.organization_id
                   AND route_grant.user_id = u.id
              ), ARRAY[]::text[]) AS authorized_business_route_ids
         FROM users u
        WHERE u.organization_id = $1
        ORDER BY u.username ASC`,
      [actor.organizationId]
    );
    return (result.rows as Record<string, unknown>[]).map(mapAccount);
  }

  async createAccount(
    actor: AuthUser,
    input: {
      username: string;
      password: string;
      role: AuthRole;
      erpAccount?: string;
      businessRouteIds?: readonly string[];
    },
    requestId: string
  ): Promise<PublicAccount> {
    this.requireAdmin(actor);
    const username = validateUsername(input.username);
    const passwordHash = await argon2.hash(validatePassword(input.password), { type: argon2.argon2id });
    const role = normalizeRole(input.role);
    const erpAccount = validateAccountRouting(role, input.erpAccount);
    const businessRouteIds = role === 'admin' ? [] : normalizeBusinessRouteIds(input.businessRouteIds);
    try {
      return await withTransaction(this.config, async (client) => {
      await client.query(
        `SELECT pg_advisory_xact_lock(hashtextextended($1::text || ':' || $2::text, 0))`,
        [actor.organizationId, username]
      );
      const existing = await client.query(
        'SELECT id FROM users WHERE organization_id = $1 AND username = $2',
        [actor.organizationId, username]
      );
      if (existing.rowCount) throw new AuthError('account_exists', '该账号已存在。', 409);
      const created = await client.query(
        `INSERT INTO users
          (organization_id, username, password_hash, role, erp_account, password_changed_at)
         VALUES ($1, $2, $3, $4, $5, now())
         RETURNING id`,
        [actor.organizationId, username, passwordHash, role, erpAccount]
      );
      const accountId = String(created.rows[0].id);
      if (businessRouteIds.length) {
        await client.query(
          `INSERT INTO user_business_route_authorizations
            (organization_id, user_id, route_id, granted_by)
           SELECT $1, $2, route_id, $3
             FROM unnest($4::text[]) AS route_id`,
          [actor.organizationId, accountId, actor.id, businessRouteIds]
        );
      }
      const account = await loadPublicAccount(client, actor.organizationId, accountId);
      if (!account) throw new AuthError('account_not_found', '账号创建后未能读取。', 500);
      await this.accountAudit(client, actor, 'account.created', account.id, requestId, {
        role,
        erp_account_configured: Boolean(erpAccount),
        authorized_business_route_ids: account.authorized_business_route_ids
      });
        return account;
      });
    } catch (error) {
      if (error && typeof error === 'object' && String((error as { code?: unknown }).code || '') === '23505') {
        const constraint = String((error as { constraint?: unknown }).constraint || '');
        if (constraint.includes('erp_account')) {
          throw new AuthError('erp_account_conflict', '该 ERP 账号已经绑定另一个平台账号。', 409);
        }
      }
      throw error;
    }
  }

  async updateAccount(
    actor: AuthUser,
    targetUserId: string,
    input: { role?: AuthRole; isActive?: boolean; erpAccount?: string | null },
    requestId: string
  ): Promise<PublicAccount> {
    this.requireAdmin(actor);
    if (input.role === undefined && input.isActive === undefined && input.erpAccount === undefined) {
      throw new AuthError('account_update_empty', '没有需要更新的账号字段。', 400);
    }
    try {
      return await withTransaction(this.config, async (client) => {
      const target = await client.query(
        `SELECT id, username, role, erp_account, is_active,
                last_login_at, created_at, updated_at
           FROM users
          WHERE organization_id = $1 AND id = $2
          FOR UPDATE`,
        [actor.organizationId, targetUserId]
      );
      if (!target.rowCount) throw new AuthError('account_not_found', '账号不存在。', 404);
      const before = mapAccount(target.rows[0] as Record<string, unknown>);
      const role = input.role === undefined ? before.role : normalizeRole(input.role);
      const isActive = input.isActive === undefined ? before.is_active : input.isActive;
      const erpAccount = validateAccountRouting(
        role,
        role === 'admin'
          ? null
          : input.erpAccount === undefined ? before.erp_account : input.erpAccount
      );
      const removesActiveAdmin = before.role === 'admin' && before.is_active && (role !== 'admin' || !isActive);
      if (actor.id === before.id && (role !== 'admin' || !isActive)) {
        throw new AuthError('self_lockout_forbidden', '不能停用或降级当前登录的管理员账号。', 409);
      }
      if (removesActiveAdmin) {
        const activeAdmins = await client.query(
          `SELECT id FROM users
            WHERE organization_id = $1 AND role = 'admin' AND is_active = true
            FOR UPDATE`,
          [actor.organizationId]
        );
        if (activeAdmins.rows.filter((row: Record<string, unknown>) => String(row.id) !== before.id).length === 0) {
          throw new AuthError('last_admin_protected', '必须至少保留一个有效管理员账号。', 409);
        }
      }
      const updated = await client.query(
        `UPDATE users
            SET role = $1, is_active = $2, erp_account = $3, updated_at = now()
          WHERE organization_id = $4 AND id = $5
          RETURNING id`,
        [role, isActive, erpAccount, actor.organizationId, before.id]
      );
      const routingIdentityChanged = before.erp_account !== erpAccount;
      if (before.role !== role || before.is_active !== isActive || routingIdentityChanged) {
        await client.query(
          'UPDATE sessions SET revoked_at = now() WHERE user_id = $1 AND revoked_at IS NULL',
          [before.id]
        );
      }
      if (!isActive || role === 'admin') {
        await client.query(
          `UPDATE user_channels
              SET owner_user_id = NULL, enabled = false, status = 'disabled',
                  last_error = $1, updated_at = now()
            WHERE organization_id = $2 AND owner_user_id = $3`,
          [role === 'admin' ? '绑定账号已变更为管理员，渠道已解除绑定。' : '绑定账号已停用，渠道已解除绑定。', actor.organizationId, before.id]
        );
      }
      if (!isActive || routingIdentityChanged || before.role !== role) {
        await client.query(
          `UPDATE browser_connections
              SET status = 'superseded', erp_account_verified = false
            WHERE organization_id = $1 AND user_id = $2 AND status = 'connected'`,
          [actor.organizationId, before.id]
        );
      }
      await this.accountAudit(client, actor, 'account.updated', before.id, requestId, {
        previous_role: before.role,
        role,
        previous_active: before.is_active,
        active: isActive,
        erp_account_changed: routingIdentityChanged,
        sessions_revoked: before.role !== role || before.is_active !== isActive || routingIdentityChanged
      });
      const account = await loadPublicAccount(client, actor.organizationId, String(updated.rows[0].id));
      if (!account) throw new AuthError('account_not_found', '账号更新后未能读取。', 500);
        return account;
      });
    } catch (error) {
      if (error && typeof error === 'object' && String((error as { code?: unknown }).code || '') === '23505') {
        const constraint = String((error as { constraint?: unknown }).constraint || '');
        if (constraint.includes('erp_account')) {
          throw new AuthError('erp_account_conflict', '该 ERP 账号已经绑定另一个平台账号。', 409);
        }
      }
      throw error;
    }
  }

  async setBusinessRouteAuthorizations(
    actor: AuthUser,
    targetUserId: string,
    routeIds: readonly string[],
    expectedRevision: number,
    requestId: string
  ): Promise<PublicAccount> {
    this.requireAdmin(actor);
    const authorizedRouteIds = normalizeBusinessRouteIds(routeIds);
    return withTransaction(this.config, async (client) => {
      const target = await client.query(
        `SELECT id, role, business_authorization_revision
           FROM users
          WHERE organization_id = $1 AND id = $2
          FOR UPDATE`,
        [actor.organizationId, targetUserId]
      );
      if (!target.rowCount) throw new AuthError('account_not_found', '账号不存在。', 404);
      const row = target.rows[0] as Record<string, unknown>;
      if (normalizeRole(row.role) === 'admin') {
        throw new AuthError('admin_business_authorization_fixed', '管理员固定拥有全部业务权限，无需单独授权。', 409);
      }
      const currentRevision = Math.max(0, Number(row.business_authorization_revision || 0));
      if (currentRevision !== expectedRevision) {
        throw new AuthError('business_authorization_revision_conflict', '该账号的业务权限已被其他管理员修改，请刷新后重试。', 409);
      }
      const previous = await client.query(
        `SELECT route_id
           FROM user_business_route_authorizations
          WHERE organization_id = $1 AND user_id = $2`,
        [actor.organizationId, targetUserId]
      );
      const previousRouteIds = normalizeBusinessRouteIds(
        (previous.rows as Record<string, unknown>[]).map((item) => item.route_id)
      );
      await client.query(
        `DELETE FROM user_business_route_authorizations
          WHERE organization_id = $1 AND user_id = $2`,
        [actor.organizationId, targetUserId]
      );
      if (authorizedRouteIds.length) {
        await client.query(
          `INSERT INTO user_business_route_authorizations
            (organization_id, user_id, route_id, granted_by)
           SELECT $1, $2, route_id, $3
             FROM unnest($4::text[]) AS route_id`,
          [actor.organizationId, targetUserId, actor.id, authorizedRouteIds]
        );
      }
      await client.query(
        `UPDATE users
            SET business_authorization_revision = business_authorization_revision + 1,
                updated_at = now()
          WHERE organization_id = $1 AND id = $2`,
        [actor.organizationId, targetUserId]
      );
      await this.accountAudit(
        client,
        actor,
        'account.business_authorizations_updated',
        targetUserId,
        requestId,
        {
          previous_business_route_ids: previousRouteIds,
          business_route_ids: authorizedRouteIds,
          previous_revision: currentRevision,
          revision: currentRevision + 1
        }
      );
      const account = await loadPublicAccount(client, actor.organizationId, targetUserId);
      if (!account) throw new AuthError('account_not_found', '账号权限更新后未能读取。', 500);
      return account;
    });
  }

  async resetAccountPassword(
    actor: AuthUser,
    targetUserId: string,
    password: string,
    requestId: string
  ): Promise<void> {
    this.requireAdmin(actor);
    const passwordHash = await argon2.hash(validatePassword(password), { type: argon2.argon2id });
    await withTransaction(this.config, async (client) => {
      const target = await client.query(
        'SELECT id FROM users WHERE organization_id = $1 AND id = $2 FOR UPDATE',
        [actor.organizationId, targetUserId]
      );
      if (!target.rowCount) throw new AuthError('account_not_found', '账号不存在。', 404);
      await client.query(
        `UPDATE users
            SET password_hash = $1, must_change_password = false,
                password_changed_at = now(), failed_login_count = 0,
                locked_until = NULL, updated_at = now()
          WHERE id = $2`,
        [passwordHash, targetUserId]
      );
      const revoked = await client.query(
        'UPDATE sessions SET revoked_at = now() WHERE user_id = $1 AND revoked_at IS NULL',
        [targetUserId]
      );
      await this.accountAudit(client, actor, 'account.password_reset', targetUserId, requestId, {
        sessions_revoked: revoked.rowCount || 0
      });
    });
  }

  async revokeAccountSessions(actor: AuthUser, targetUserId: string, requestId: string): Promise<number> {
    this.requireAdmin(actor);
    return withTransaction(this.config, async (client) => {
      const target = await client.query(
        'SELECT id FROM users WHERE organization_id = $1 AND id = $2 FOR UPDATE',
        [actor.organizationId, targetUserId]
      );
      if (!target.rowCount) throw new AuthError('account_not_found', '账号不存在。', 404);
      const revoked = await client.query(
        'UPDATE sessions SET revoked_at = now() WHERE user_id = $1 AND revoked_at IS NULL',
        [targetUserId]
      );
      const count = revoked.rowCount || 0;
      await this.accountAudit(client, actor, 'account.sessions_revoked', targetUserId, requestId, {
        sessions_revoked: count
      });
      return count;
    });
  }

  async changeOwnPassword(
    session: ActiveSession,
    currentPassword: string,
    newPassword: string,
    requestId: string
  ): Promise<void> {
    const validatedNewPassword = validatePassword(newPassword);
    const newHash = await argon2.hash(validatedNewPassword, { type: argon2.argon2id });
    await withTransaction(this.config, async (client) => {
      const target = await client.query(
        `SELECT password_hash, is_active
           FROM users
          WHERE organization_id = $1 AND id = $2
          FOR UPDATE`,
        [session.user.organizationId, session.user.id]
      );
      const row = target.rows[0] as Record<string, unknown> | undefined;
      if (!row || row.is_active === false || !(await argon2.verify(String(row.password_hash), currentPassword || ''))) {
        throw new AuthError('current_password_invalid', '当前密码不正确。', 403);
      }
      if (await argon2.verify(String(row.password_hash), validatedNewPassword)) {
        throw new AuthError('password_unchanged', '新密码不能与当前密码相同。', 409);
      }
      await client.query(
        `UPDATE users
            SET password_hash = $1, must_change_password = false,
                password_changed_at = now(), failed_login_count = 0,
                locked_until = NULL, updated_at = now()
          WHERE id = $2`,
        [newHash, session.user.id]
      );
      const revoked = await client.query(
        `UPDATE sessions SET revoked_at = now()
          WHERE user_id = $1 AND id <> $2 AND revoked_at IS NULL`,
        [session.user.id, session.id]
      );
      await this.accountAudit(client, session.user, 'account.password_changed', session.user.id, requestId, {
        other_sessions_revoked: revoked.rowCount || 0
      });
    });
  }

  async createSession(user: AuthUser, ipAddress: string, userAgent: string): Promise<AuthSession> {
    const token = randomToken(32);
    const csrfToken = randomToken(24);
    const result = await getPool(this.config).query(
      `INSERT INTO sessions
        (user_id, token_hash, csrf_token_hash, expires_at, idle_expires_at, ip_address, user_agent)
       VALUES ($1, $2, $3, $4, $5, $6, $7)
       RETURNING id`,
      [user.id, hashToken(token), hashToken(csrfToken), null, null, ipAddress || null, userAgent || null]
    );
    return { id: String(result.rows[0].id), token, csrfToken, user };
  }

  async getActiveSession(token: string | undefined): Promise<ActiveSession | null> {
    if (!token) return null;
    const result = await getPool(this.config).query(
      `SELECT s.id AS session_id, s.csrf_token_hash, u.id, u.organization_id, u.username, u.role, u.erp_account
       FROM sessions s
       JOIN users u ON u.id = s.user_id
       WHERE s.token_hash = $1
         AND s.revoked_at IS NULL
         AND u.is_active = true`,
      [hashToken(token)]
    );
    if (!result.rowCount) return null;
    const row = result.rows[0] as Record<string, unknown>;
    await getPool(this.config).query(
      'UPDATE sessions SET last_seen_at = now() WHERE id = $1',
      [row.session_id]
    );
    return {
      id: String(row.session_id),
      csrfTokenHash: Buffer.isBuffer(row.csrf_token_hash)
        ? row.csrf_token_hash
        : Buffer.from(String(row.csrf_token_hash || ''), 'base64'),
      user: mapUser({
        id: row.id,
        organization_id: row.organization_id,
        username: row.username,
        role: row.role,
        erp_account: row.erp_account
      })
    };
  }

  async rotateCsrf(sessionId: string): Promise<string> {
    const token = randomToken(24);
    await getPool(this.config).query(
      'UPDATE sessions SET csrf_token_hash = $1 WHERE id = $2 AND revoked_at IS NULL',
      [hashToken(token), sessionId]
    );
    return token;
  }

  async verifyCsrf(session: ActiveSession, candidate: string | undefined): Promise<boolean> {
    if (!candidate) return false;
    return sameTokenHash(session.csrfTokenHash, hashToken(candidate));
  }

  async revokeSession(token: string | undefined): Promise<void> {
    if (!token) return;
    await getPool(this.config).query('UPDATE sessions SET revoked_at = now() WHERE token_hash = $1', [hashToken(token)]);
  }

  async revokeAllSessions(userId: string): Promise<void> {
    await getPool(this.config).query('UPDATE sessions SET revoked_at = now() WHERE user_id = $1 AND revoked_at IS NULL', [userId]);
  }

  async recordAudit(organizationId: string, userId: string | null, eventType: string, requestId: string, metadata: Record<string, unknown> = {}): Promise<void> {
    await getPool(this.config).query(
      `INSERT INTO audit_events
        (organization_id, actor_user_id, event_type, entity_type, entity_id, request_id, metadata)
       VALUES ($1, $2, 'auth.' || $3, 'session', $4, $5, $6)`,
      [organizationId, userId, eventType, userId || '', requestId, metadata]
    );
    this.log({
      diagnostic_event: 'audit.event.staged',
      diagnostic_stage: 'auth_audit',
      request_id: requestId,
      domain_event: `auth.${eventType}`,
      entity_type: 'session',
      actor_present: Boolean(userId),
      metadata_keys: diagnosticMetadataKeys(metadata)
    }, 'authentication audit event persisted');
  }
}