/**
 * 用户状态管理
 * 管理登录状态、用户信息、Token、权限
 */
import { defineStore } from 'pinia'
import { ref, computed } from 'vue'
import { login as loginApi, getUserPermissions, type UserPermissionVO, type LoginParams } from '../api/auth'
import router from '../router'

export const useUserStore = defineStore('user', () => {
  // 状态
  const token = ref(localStorage.getItem('token') || '')
  const username = ref(localStorage.getItem('username') || '')
  const nickname = ref(localStorage.getItem('nickname') || '')
  const role = ref(localStorage.getItem('role') || '')

  // RBAC权限
  const roles = ref<{ id: number; name: string; display_name: string }[]>([])
  const permissions = ref<string[]>([])

  /** 是否已登录 */
  const isLoggedIn = () => !!token.value

  /** 是否管理员(兼容旧逻辑) */
  const isAdmin = () => role.value === 'admin' || roles.value.some(r => r.name === 'admin')

  /**
   * 检查是否拥有指定权限
   * 管理员拥有所有权限
   */
  function hasPermission(code: string): boolean {
    if (isAdmin()) return true
    return permissions.value.includes(code) || permissions.value.includes('*')
  }

  /**
   * 登录
   */
  async function login(params: LoginParams) {
    const res = await loginApi(params)
    const data = res.data
    saveLoginResult(data)
    // 首次登录需改密码
    if ((data as any).must_change_pwd) {
      router.push('/?change_pwd=1')
    } else {
      router.push('/')
    }
  }

  /**
   * SSO登录(保存Token)
   */
  function ssoLogin(data: { token: string; username: string; nickname: string; role: string }) {
    saveLoginResult(data)
    router.push('/')
  }

  /**
   * 保存登录结果到本地
   */
  function saveLoginResult(data: { token: string; username: string; nickname: string; role: string }) {
    token.value = data.token
    username.value = data.username
    nickname.value = data.nickname
    role.value = data.role

    localStorage.setItem('token', data.token)
    localStorage.setItem('username', data.username)
    localStorage.setItem('nickname', data.nickname)
    localStorage.setItem('role', data.role)

    // 登录后加载权限
    loadPermissions()
  }

  /**
   * 加载用户权限
   */
  async function loadPermissions() {
    if (!token.value) return
    try {
      const res = await getUserPermissions()
      const data: UserPermissionVO = res.data
      roles.value = data.roles || []
      permissions.value = data.permissions || []
    } catch (error) {
      console.error('加载权限失败:', error)
    }
  }

  /**
   * 登出
   */
  function logout() {
    token.value = ''
    username.value = ''
    nickname.value = ''
    role.value = ''
    roles.value = []
    permissions.value = []

    localStorage.removeItem('token')
    localStorage.removeItem('username')
    localStorage.removeItem('nickname')
    localStorage.removeItem('role')

    router.push('/login')
  }

  return {
    token,
    username,
    nickname,
    role,
    roles,
    permissions,
    isLoggedIn,
    isAdmin,
    hasPermission,
    login,
    ssoLogin,
    loadPermissions,
    logout,
  }
})