import type { AuthUser } from "@/lib/auth/session";

const DEFAULT_ADMIN_AUTHORITIES = [
  "ROLE_ADMIN",
  "ROLE_1",
  "1",
  "ADMIN",
  "SUPER_ADMIN",
  "SYS_ADMIN",
  "ZHINIAN_ADMIN",
  "sys_user_view",
  "sys_user_add",
  "sys_user_edit",
  "sys_role_view",
  "sys_log_view",
  "sys_config_view",
  "sys_client_view"
];

const DEFAULT_ADMIN_USERS = [
  "ceshiop"
];

const ADMIN_PREFIXES = [
  "SYS_USER_",
  "SYS_ROLE_",
  "SYS_MENU_",
  "SYS_LOG_",
  "SYS_CONFIG_",
  "SYS_CLIENT_",
  "ADMIN:"
];

export function configuredAdminAuthorities(): string[] {
  const configured = process.env.ZHINIAN_ADMIN_AUTHORITIES;
  if (configured === undefined) return DEFAULT_ADMIN_AUTHORITIES;
  return splitConfiguredList(configured);
}

export function configuredAdminUsers(): string[] {
  const configured = process.env.ZHINIAN_ADMIN_USERS;
  if (configured === undefined) return DEFAULT_ADMIN_USERS;
  return splitConfiguredList(configured);
}

export function hasAdminAccess(
  user: AuthUser | null | undefined,
  adminAuthorities?: string[],
  adminUsers?: string[]
): boolean {
  if (!user) return false;
  const allowedUsers = new Set((adminUsers ?? configuredAdminUsers()).map(normalizeAccountName));
  const identities = [user.username, user.subject, user.displayName, user.id]
    .map((item) => item ? normalizeAccountName(item) : "")
    .filter(Boolean);
  if (identities.some((identity) => allowedUsers.has(identity))) return true;

  if (!shouldUseAuthorityGrants(adminAuthorities)) return false;
  const allowed = new Set((adminAuthorities ?? configuredAdminAuthorities()).map(normalizeAuthority));
  return user.authorities.some((authority) => {
    const normalized = normalizeAuthority(authority);
    return allowed.has(normalized) || ADMIN_PREFIXES.some((prefix) => normalized.startsWith(prefix));
  });
}

export function normalizeAuthority(value: string): string {
  return value.trim().replace(/[-\s]+/g, "_").toUpperCase();
}

function normalizeAccountName(value: string): string {
  return value.trim().toLowerCase();
}

function splitConfiguredList(value: string): string[] {
  return value
    .split(/[\n,]+/)
    .map((item) => item.trim())
    .filter(Boolean);
}

function shouldUseAuthorityGrants(explicitAuthorities?: string[]): boolean {
  if (explicitAuthorities !== undefined) return true;
  if (process.env.ZHINIAN_ADMIN_AUTHORITIES !== undefined) return true;
  return process.env.ZHINIAN_ADMIN_USERS === undefined;
}