import { existsSync, readFileSync } from "node:fs";
import { mkdir, readFile, writeFile } from "node:fs/promises";
import { join } from "node:path";
import { randomBytes, scryptSync } from "node:crypto";
import { closePostgresPool, createPostgresPool, getScriptDataBackend } from "./postgres-client.mjs";

loadEnvFile(".env");
loadEnvFile(".env.local");

let pool;
try {
  await main();
} catch (error) {
  console.error(`初始化失败：${error instanceof Error ? error.message : String(error)}`);
  process.exitCode = 1;
} finally {
  await closePostgresPool(pool);
}

async function main() {
  const args = parseArgs(process.argv.slice(2));
  const phone = normalizePhone(args.phone || process.env.ZHINIAN_BOOTSTRAP_ADMIN_PHONE || "");
  const password = args.password || process.env.ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD || "";
  const displayName = args.name || process.env.ZHINIAN_BOOTSTRAP_ADMIN_NAME || "平台超级管理员";
  if (!/^\+?[0-9]{6,20}$/.test(phone)) throw new Error("请通过 --phone 或 ZHINIAN_BOOTSTRAP_ADMIN_PHONE 提供有效手机号。");
  if (password.length < 8) throw new Error("请通过 --password 或 ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD 提供至少 8 位密码。");

  const credential = hashPassword(password);
  const now = new Date().toISOString();
  if (getScriptDataBackend() === "postgres") {
    pool = createPostgresPool({ applicationName: "zhinian-bootstrap-admin" });
    const client = await pool.connect();
    try {
      await client.query("BEGIN");
      await client.query("SELECT pg_advisory_xact_lock($1)", ["7308731946202609"]);
      const existing = (await client.query("SELECT id, password_hash FROM platform_users WHERE role = $1 ORDER BY created_at ASC LIMIT 1 FOR UPDATE", ["super_admin"])).rows[0];
      const phoneOwner = (await client.query("SELECT id FROM platform_users WHERE phone = $1 LIMIT 1", [phone])).rows[0];
      if (phoneOwner && phoneOwner.id !== existing?.id) throw new Error("该手机号已经绑定其他账号，不能初始化为超级管理员。");
      if (existing?.password_hash) throw new Error("平台已经存在超级管理员，初始化已停止。");
      const userId = existing?.id || `user_${randomBytes(8).toString("hex")}`;
      if (existing) {
        await client.query("UPDATE platform_users SET phone=$2, display_name=$3, password_hash=$4, password_salt=$5, status=$6, failed_login_count=0, locked_until=NULL, session_version=1, updated_at=$7 WHERE id=$1 RETURNING id", [userId, phone, displayName, credential.hash, credential.salt, "active", now]);
      } else {
        await client.query("INSERT INTO platform_users (id, phone, display_name, role, organization_id, status, password_hash, password_salt, failed_login_count, locked_until, session_version, created_at, updated_at) VALUES ($1,$2,$3,$4,NULL,$5,$6,$7,0,NULL,1,$8,$8) RETURNING id", [userId, phone, displayName, "super_admin", "active", credential.hash, credential.salt, now]);
      }
      await client.query("COMMIT");
      console.log(`已初始化超级管理员：${phone}（${userId}）`);
    } catch (error) {
      await client.query("ROLLBACK");
      throw error;
    } finally {
      client.release();
    }
    return;
  }

  const dataDirectory = process.env.ZHINIAN_DATA_DIR || join(process.cwd(), ".runtime", "data");
  await mkdir(dataDirectory, { recursive: true });
  const path = join(dataDirectory, "platform-accounts.json");
  const state = await readState(path);
  const existing = state.users.find((user) => user.role === "super_admin");
  const phoneOwner = state.users.find((user) => user.phone === phone && user.id !== existing?.id);
  if (phoneOwner) throw new Error("该手机号已经绑定其他账号，不能初始化为超级管理员。");
  if (existing?.passwordHash) throw new Error("平台已经存在超级管理员，初始化已停止。");
  const user = existing || { id: `user_${randomBytes(8).toString("hex")}`, phone, displayName, role: "super_admin", status: "active", failedLoginCount: 0, sessionVersion: 1, createdAt: now, updatedAt: now };
  Object.assign(user, { phone, displayName, passwordHash: credential.hash, passwordSalt: credential.salt, organizationId: undefined, failedLoginCount: 0, lockedUntil: undefined, sessionVersion: 1, updatedAt: now });
  if (!existing) state.users.push(user);
  await writeFile(path, JSON.stringify(state, null, 2));
  console.log(`已初始化超级管理员：${phone}（${user.id}）`);
}

function hashPassword(value) {
  const salt = randomBytes(16).toString("hex");
  return { salt, hash: scryptSync(value, salt, 64).toString("hex") };
}

function normalizePhone(value) { return value.trim().replace(/[\s()-]/g, ""); }

function parseArgs(values) {
  const result = {};
  for (let index = 0; index < values.length; index += 1) {
    const value = values[index];
    if (!value.startsWith("--")) continue;
    result[value.slice(2)] = values[index + 1] && !values[index + 1].startsWith("--") ? values[++index] : "true";
  }
  return result;
}

async function readState(path) {
  if (!existsSync(path)) return { users: [], organizations: [], migrations: [] };
  try { return JSON.parse(await readFile(path, "utf8")); } catch { return { users: [], organizations: [], migrations: [] }; }
}

function loadEnvFile(path) {
  if (!existsSync(path)) return;
  for (const line of readFileSync(path, "utf8").split(/\r?\n/)) {
    const match = line.match(/^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)\s*$/);
    if (!match || process.env[match[1]]) continue;
    process.env[match[1]] = match[2].replace(/^['"]|['"]$/g, "");
  }
}