@Service
public class PermissionService {
    
    @Autowired
    private UserMapper userMapper;
    
    @Autowired
    private RoleMapper roleMapper;
    
    @Autowired
    private PermissionMapper permissionMapper;
    
    @Autowired
    private RedisTemplate<String, String> redisTemplate;
    
    /**
     * 获取用户权限列表
     */
    public Set<String> getUserPermissions(Long userId) {
        // 1. 查询缓存
        String cacheKey = "user:permissions:" + userId;
        String cached = redisTemplate.opsForValue().get(cacheKey);
        if (cached != null) {
            return JSON.parseObject(cached, new TypeReference<Set<String>>() {});
        }
        
        // 2. 查询数据库
        Set<String> permissions = new HashSet<>();
        
        // 2.1 获取用户角色
        List<Role> roles = roleMapper.selectByUserId(userId);
        
        // 2.2 获取角色权限
        for (Role role : roles) {
            List<Permission> rolePermissions = permissionMapper.selectByRoleId(role.getId());
            for (Permission permission : rolePermissions) {
                permissions.add(permission.getPermissionCode());
            }
            
            // 2.3 处理角色继承
            if (role.getParentId() != null) {
                addInheritedPermissions(role.getParentId(), permissions);
            }
        }
        
        // 3. 写入缓存
        redisTemplate.opsForValue().set(cacheKey, JSON.toJSONString(permissions), 
            1, TimeUnit.HOURS);
        
        return permissions;
    }
    
    /**
     * 添加继承的权限
     */
    private void addInheritedPermissions(Long parentRoleId, Set<String> permissions) {
        Role parentRole = roleMapper.selectById(parentRoleId);
        if (parentRole != null) {
            List<Permission> parentPermissions = permissionMapper.selectByRoleId(parentRoleId);
            for (Permission permission : parentPermissions) {
                permissions.add(permission.getPermissionCode());
            }
            
            // 递归处理父角色
            if (parentRole.getParentId() != null) {
                addInheritedPermissions(parentRole.getParentId(), permissions);
            }
        }
    }
    
    /**
     * 检查用户是否有权限
     */
    public boolean hasPermission(Long userId, String permissionCode) {
        Set<String> permissions = getUserPermissions(userId);
        return permissions.contains(permissionCode);
    }
}

@Component
public class PermissionInterceptor implements HandlerInterceptor {
    
    @Autowired
    private PermissionService permissionService;
    
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, 
                           Object handler) throws Exception {
        // 1. 获取当前用户
        Long userId = getCurrentUserId(request);
        if (userId == null) {
            response.setStatus(HttpStatus.UNAUTHORIZED.value());
            return false;
        }
        
        // 2. 获取请求的权限编码
        String permissionCode = getPermissionCode(request, handler);
        if (permissionCode == null) {
            // 无需权限验证
            return true;
        }
        
        // 3. 检查权限
        if (!permissionService.hasPermission(userId, permissionCode)) {
            response.setStatus(HttpStatus.FORBIDDEN.value());
            response.getWriter().write("无权限访问");
            return false;
        }
        
        return true;
    }
    
    private String getPermissionCode(HttpServletRequest request, Object handler) {
        if (handler instanceof HandlerMethod) {
            HandlerMethod handlerMethod = (HandlerMethod) handler;
            RequirePermission annotation = handlerMethod.getMethodAnnotation(RequirePermission.class);
            if (annotation != null) {
                return annotation.value();
            }
        }
        return null;
    }
}

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface RequirePermission {
    String value();  // 权限编码
}

@RestController
@RequestMapping("/api/user")
public class UserController {
    
    @RequirePermission("user:query")
    @GetMapping("/{id}")
    public Response<User> getUser(@PathVariable Long id) {
        // 查询用户
        return Response.success(userService.getUser(id));
    }
    
    @RequirePermission("user:create")
    @PostMapping
    public Response<String> createUser(@RequestBody User user) {
        // 创建用户
        return Response.success("创建成功");
    }
    
    @RequirePermission("user:update")
    @PutMapping("/{id}")
    public Response<String> updateUser(@PathVariable Long id, @RequestBody User user) {
        // 更新用户
        return Response.success("更新成功");
    }
    
    @RequirePermission("user:delete")
    @DeleteMapping("/{id}")
    public Response<String> deleteUser(@PathVariable Long id) {
        // 删除用户
        return Response.success("删除成功");
    }
}

@Service
public class PolicyEngine {
    
    @Autowired
    private PolicyMapper policyMapper;
    
    /**
     * 评估访问请求
     */
    public AccessDecision evaluate(AccessRequest request) {
        // 1. 获取所有策略
        List<Policy> policies = policyMapper.selectActivePolicies();
        
        // 2. 按优先级排序
        policies.sort(Comparator.comparing(Policy::getPriority).reversed());
        
        // 3. 评估策略
        for (Policy policy : policies) {
            if (evaluatePolicy(policy, request)) {
                return new AccessDecision(policy.getEffect(), policy.getId());
            }
        }
        
        // 4. 默认拒绝
        return new AccessDecision("Deny", null);
    }
    
    /**
     * 评估单个策略
     */
    private boolean evaluatePolicy(Policy policy, AccessRequest request) {
        // 解析条件
        JSONObject conditions = JSON.parseObject(policy.getConditions());
        
        // 评估每个条件
        for (String key : conditions.keySet()) {
            Object condition = conditions.get(key);
            if (!evaluateCondition(key, condition, request)) {
                return false;
            }
        }
        
        return true;
    }
    
    /**
     * 评估单个条件
     */
    private boolean evaluateCondition(String attribute, Object condition, AccessRequest request) {
        // 获取属性值
        Object attributeValue = getAttributeValue(attribute, request);
        
        // 评估条件
        if (condition instanceof Map) {
            Map<String, Object> conditionMap = (Map<String, Object>) condition;
            String operator = (String) conditionMap.get("operator");
            Object expectedValue = conditionMap.get("value");
            
            return evaluateOperator(operator, attributeValue, expectedValue);
        }
        
        return false;
    }
    
    /**
     * 获取属性值
     */
    private Object getAttributeValue(String attribute, AccessRequest request) {
        // 从请求中获取属性值
        if (attribute.startsWith("subject.")) {
            return request.getSubject().getAttribute(attribute.substring(8));
        } else if (attribute.startsWith("resource.")) {
            return request.getResource().getAttribute(attribute.substring(9));
        } else if (attribute.startsWith("action.")) {
            return request.getAction().getAttribute(attribute.substring(7));
        } else if (attribute.startsWith("environment.")) {
            return request.getEnvironment().getAttribute(attribute.substring(12));
        }
        return null;
    }
    
    /**
     * 评估操作符
     */
    private boolean evaluateOperator(String operator, Object actual, Object expected) {
        switch (operator) {
            case "equals":
                return Objects.equals(actual, expected);
            case "not_equals":
                return !Objects.equals(actual, expected);
            case "in":
                if (expected instanceof List) {
                    return ((List<?>) expected).contains(actual);
                }
                return false;
            case "not_in":
                if (expected instanceof List) {
                    return !((List<?>) expected).contains(actual);
                }
                return false;
            case "greater_than":
                return compareNumbers(actual, expected) > 0;
            case "less_than":
                return compareNumbers(actual, expected) < 0;
            case "contains":
                if (actual instanceof String && expected instanceof String) {
                    return ((String) actual).contains((String) expected);
                }
                return false;
            default:
                return false;
        }
    }
}

public class AccessRequest {
    private Subject subject;        // 主体
    private Resource resource;      // 资源
    private Action action;          // 操作
    private Environment environment; // 环境
    
    // getters and setters
}

public class Subject {
    private Long userId;
    private String username;
    private String deptId;
    private String role;
    private Map<String, Object> attributes;
    
    public Object getAttribute(String key) {
        return attributes.get(key);
    }
}

public class Resource {
    private String resourceType;
    private String resourceId;
    private String ownerId;
    private Map<String, Object> attributes;
    
    public Object getAttribute(String key) {
        return attributes.get(key);
    }
}

public class Action {
    private String actionType;
    private Map<String, Object> attributes;
    
    public Object getAttribute(String key) {
        return attributes.get(key);
    }
}

public class Environment {
    private String ip;
    private String time;
    private Map<String, Object> attributes;
    
    public Object getAttribute(String key) {
        return attributes.get(key);
    }
}

@Component
public class AbacInterceptor implements HandlerInterceptor {
    
    @Autowired
    private PolicyEngine policyEngine;
    
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, 
                           Object handler) throws Exception {
        // 1. 构建访问请求
        AccessRequest accessRequest = buildAccessRequest(request, handler);
        
        // 2. 评估访问请求
        AccessDecision decision = policyEngine.evaluate(accessRequest);
        
        // 3. 根据决策处理
        if ("Deny".equals(decision.getEffect())) {
            response.setStatus(HttpStatus.FORBIDDEN.value());
            response.getWriter().write("无权限访问");
            return false;
        }
        
        return true;
    }
    
    private AccessRequest buildAccessRequest(HttpServletRequest request, Object handler) {
        AccessRequest accessRequest = new AccessRequest();
        
        // 构建Subject
        Subject subject = new Subject();
        Long userId = getCurrentUserId(request);
        User user = userService.getUser(userId);
        subject.setUserId(userId);
        subject.setUsername(user.getUsername());
        subject.setDeptId(user.getDeptId());
        subject.setRole(user.getRole());
        accessRequest.setSubject(subject);
        
        // 构建Resource
        Resource resource = new Resource();
        resource.setResourceType(getResourceType(handler));
        resource.setResourceId(getResourceId(request));
        accessRequest.setResource(resource);
        
        // 构建Action
        Action action = new Action();
        action.setActionType(getActionType(request));
        accessRequest.setAction(action);
        
        // 构建Environment
        Environment environment = new Environment();
        environment.setIp(getClientIp(request));
        environment.setTime(String.valueOf(System.currentTimeMillis()));
        accessRequest.setEnvironment(environment);
        
        return accessRequest;
    }
}

@Service
public class DataPermissionService {
    
    @Autowired
    private DataPermissionMapper dataPermissionMapper;
    
    @Autowired
    private DeptService deptService;
    
    /**
     * 获取用户数据范围
     */
    public DataScope getUserDataScope(Long userId, String resourceType) {
        // 1. 查询用户数据权限
        DataPermission userPermission = dataPermissionMapper.selectByUserId(userId, resourceType);
        if (userPermission != null) {
            return buildDataScope(userPermission);
        }
        
        // 2. 查询角色数据权限
        List<Role> roles = roleMapper.selectByUserId(userId);
        for (Role role : roles) {
            DataPermission rolePermission = dataPermissionMapper.selectByRoleId(role.getId(), resourceType);
            if (rolePermission != null) {
                return buildDataScope(rolePermission);
            }
        }
        
        // 3. 默认：只能看自己的数据
        return new DataScope("self", null);
    }
    
    /**
     * 构建数据范围
     */
    private DataScope buildDataScope(DataPermission permission) {
        DataScope scope = new DataScope();
        scope.setDataScope(permission.getDataScope());
        
        if ("custom".equals(permission.getDataScope())) {
            List<Long> deptIds = JSON.parseArray(permission.getDeptIds(), Long.class);
            scope.setDeptIds(deptIds);
        }
        
        return scope;
    }
    
    /**
     * 构建SQL WHERE条件
     */
    public String buildWhereClause(Long userId, String resourceType, String tableAlias) {
        DataScope dataScope = getUserDataScope(userId, resourceType);
        
        switch (dataScope.getDataScope()) {
            case "all":
                return "";  // 无限制
            case "dept":
                User user = userService.getUser(userId);
                return String.format("%s.dept_id = %d", tableAlias, user.getDeptId());
            case "dept_and_children":
                User user2 = userService.getUser(userId);
                List<Long> deptIds = deptService.getDeptAndChildrenIds(user2.getDeptId());
                return String.format("%s.dept_id IN (%s)", tableAlias, 
                    deptIds.stream().map(String::valueOf).collect(Collectors.joining(",")));
            case "self":
                return String.format("%s.user_id = %d", tableAlias, userId);
            case "custom":
                List<Long> customDeptIds = dataScope.getDeptIds();
                return String.format("%s.dept_id IN (%s)", tableAlias, 
                    customDeptIds.stream().map(String::valueOf).collect(Collectors.joining(",")));
            default:
                return String.format("%s.user_id = %d", tableAlias, userId);
        }
    }
}

@Intercepts({
    @Signature(type = Executor.class, method = "update", args = {MappedStatement.class, Object.class}),
    @Signature(type = Executor.class, method = "query", args = {MappedStatement.class, Object.class, RowBounds.class, ResultHandler.class})
})
@Component
public class DataPermissionInterceptor implements Interceptor {
    
    @Autowired
    private DataPermissionService dataPermissionService;
    
    @Override
    public Object intercept(Invocation invocation) throws Throwable {
        // 1. 获取MappedStatement
        MappedStatement mappedStatement = (MappedStatement) invocation.getArgs()[0];
        
        // 2. 检查是否需要数据权限过滤
        if (needDataPermission(mappedStatement)) {
            // 3. 获取当前用户
            Long userId = getCurrentUserId();
            
            // 4. 获取资源类型
            String resourceType = getResourceType(mappedStatement);
            
            // 5. 构建WHERE条件
            String whereClause = dataPermissionService.buildWhereClause(userId, resourceType, "t");
            
            // 6. 修改SQL
            if (StringUtils.isNotBlank(whereClause)) {
                BoundSql boundSql = mappedStatement.getBoundSql(invocation.getArgs()[1]);
                String sql = boundSql.getSql();
                sql = addWhereClause(sql, whereClause);
                
                // 创建新的BoundSql
                BoundSql newBoundSql = new BoundSql(mappedStatement.getConfiguration(), sql, 
                    boundSql.getParameterMappings(), boundSql.getParameterObject());
                
                // 创建新的MappedStatement
                MappedStatement newMappedStatement = copyFromMappedStatement(mappedStatement, 
                    new BoundSqlSqlSource(newBoundSql));
                invocation.getArgs()[0] = newMappedStatement;
            }
        }
        
        return invocation.proceed();
    }
    
    private String addWhereClause(String sql, String whereClause) {
        // 在SQL中添加WHERE条件
        if (sql.toUpperCase().contains("WHERE")) {
            return sql + " AND " + whereClause;
        } else {
            return sql + " WHERE " + whereClause;
        }
    }
}

public interface PermissionService {
    /**
     * 检查权限
     */
    boolean hasPermission(Long userId, String permissionCode);
    
    /**
     * 检查数据权限
     */
    boolean hasDataPermission(Long userId, String resourceType, String resourceId);
    
    /**
     * 获取用户权限列表
     */
    Set<String> getUserPermissions(Long userId);
}

@Service
public class UnifiedPermissionService implements PermissionService {
    
    @Autowired
    private RbacPermissionService rbacPermissionService;
    
    @Autowired
    private AbacPermissionService abacPermissionService;
    
    @Autowired
    private DataPermissionService dataPermissionService;
    
    @Override
    public boolean hasPermission(Long userId, String permissionCode) {
        // 1. 先检查RBAC权限
        if (rbacPermissionService.hasPermission(userId, permissionCode)) {
            return true;
        }
        
        // 2. 再检查ABAC权限
        // 需要构建AccessRequest
        return false;
    }
    
    @Override
    public boolean hasDataPermission(Long userId, String resourceType, String resourceId) {
        return dataPermissionService.hasDataPermission(userId, resourceType, resourceId);
    }
    
    @Override
    public Set<String> getUserPermissions(Long userId) {
        return rbacPermissionService.getUserPermissions(userId);
    }
}

@Service
public class TenantPermissionService {
    
    public Set<String> getUserPermissions(Long tenantId, Long userId) {
        String cacheKey = "tenant:permissions:" + tenantId + ":" + userId;
        // 查询权限（包含租户ID）
        return permissionService.getUserPermissions(tenantId, userId);
    }
}

@Service
public class DynamicPermissionService {
    
    @Autowired
    private PolicyEngine policyEngine;
    
    public boolean checkPermission(Long userId, String resource, String action) {
        // 构建AccessRequest
        AccessRequest request = buildAccessRequest(userId, resource, action);
        
        // 评估策略
        AccessDecision decision = policyEngine.evaluate(request);
        
        return "Allow".equals(decision.getEffect());
    }
}