import type { AuthSession, AuthUser } from "@/lib/auth/session";

const DEFAULT_ADMIN_AUTHORITIES = [
  "ROLE_ADMIN",
  "ADMIN",
  "SUPER_ADMIN",
  "SYS_ADMIN",
  "ZHINIAN_ADMIN"
];

const DEFAULT_ADMIN_USERS = [
  "ceshiop"
];

export function configuredAdminAuthorities(): string[] {
  const configured = process.env.ZHINIAN_ADMIN_AUTHORITIES;
  if (configured === undefined || !configured.trim()) return DEFAULT_ADMIN_AUTHORITIES;
  return splitConfiguredList(configured);
}

export function configuredAdminUsers(): string[] {
  const configured = process.env.ZHINIAN_ADMIN_USERS;
  if (configured === undefined || !configured.trim()) return DEFAULT_ADMIN_USERS;
  return splitConfiguredList(configured);
}

export function hasAdminAccess(
  user: AuthUser | null | undefined,
  adminAuthorities?: string[],
  adminUsers?: string[]
): boolean {
  if (!user) return false;
  if (user.role) return user.role === "super_admin" || user.role === "organization_admin";
  const allowedUsers = new Set((adminUsers ?? configuredAdminUsers()).map(normalizeAccountName));
  const identities = [user.username, user.subject]
    .map((item) => item ? normalizeAccountName(item) : "")
    .filter(Boolean);
  if (identities.some((identity) => allowedUsers.has(identity))) return true;

  const allowed = new Set((adminAuthorities ?? configuredAdminAuthorities()).map(normalizeAuthority));
  return user.authorities.some((authority) => allowed.has(normalizeAuthority(authority)));
}

export function hasSuperAdminAccess(user: AuthUser | null | undefined): boolean {
  if (!user) return false;
  if (user.role) return user.role === "super_admin";
  const allowedAuthorities = new Set(configuredAdminAuthorities().map(normalizeAuthority));
  return user.authorities.some((authority) => {
    const normalized = normalizeAuthority(authority);
    return normalized === "SUPER_ADMIN" || normalized === "ROLE_SUPER_ADMIN";
  }) || (user.username ? configuredAdminUsers().some((item) => normalizeAccountName(item) === normalizeAccountName(user.username || "")) : false) ||
    user.authorities.some((authority) => allowedAuthorities.has(normalizeAuthority(authority)) && normalizeAuthority(authority) === "SUPER_ADMIN");
}

export function hasOrganizationAdminAccess(user: AuthUser | null | undefined): boolean {
  if (!user) return false;
  return user.role === "organization_admin";
}

export function hasAdminSessionAccess(session: AuthSession | null | undefined): boolean {
  return session?.authMode === "admin" && hasAdminAccess(session.user);
}

export function normalizeAuthority(value: string): string {
  return value.trim().replace(/[-\s]+/g, "_").toUpperCase();
}

function normalizeAccountName(value: string): string {
  return value.trim().toLowerCase();
}

function splitConfiguredList(value: string): string[] {
  return value
    .split(/[\n,]+/)
    .map((item) => item.trim())
    .filter(Boolean);
}