package app

import (
	"context"
	"crypto/rand"
	"crypto/sha256"
	"database/sql"
	"encoding/base64"
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"net"
	"net/http"
	"regexp"
	"sort"
	"strconv"
	"strings"
	"sync"
	"time"

	"golang.org/x/crypto/bcrypt"

	"lingniu/vehicle-data-platform/apps/api/internal/config"
	"lingniu/vehicle-data-platform/apps/api/internal/httpx"
	"lingniu/vehicle-data-platform/apps/api/internal/platform"
)

const (
	localSessionCacheTTL = 30 * time.Second
	loginLockDuration    = 15 * time.Minute
	maxLoginFailures     = 5
)

var usernamePattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{2,63}$`)

var customerMenuSet = map[string]bool{
	"monitor": true, "vehicles": true, "tracks": true, "statistics": true,
}

var adminMenus = []string{"monitor", "vehicles", "tracks", "history", "statistics", "alerts", "access", "operations", "users"}

type authUser struct {
	ID              uint64                    `json:"id"`
	Username        string                    `json:"username"`
	DisplayName     string                    `json:"displayName"`
	UserType        string                    `json:"userType"`
	Status          string                    `json:"status"`
	CustomerRef     string                    `json:"customerRef"`
	TenantRef       string                    `json:"tenantRef"`
	AuthProvider    string                    `json:"authProvider"`
	ExternalSubject string                    `json:"externalSubject,omitempty"`
	MenuKeys        []string                  `json:"menuKeys"`
	VehicleVINs     []string                  `json:"vehicleVins"`
	Vehicles        []authVehicleGrant        `json:"vehicles"`
	GrantHistory    []authVehicleGrantHistory `json:"grantHistory"`
	LastLoginAt     *time.Time                `json:"lastLoginAt,omitempty"`
	CreatedAt       time.Time                 `json:"createdAt"`
	UpdatedAt       time.Time                 `json:"updatedAt"`
}

type authVehicleGrant struct {
	VIN          string     `json:"vin"`
	Plate        string     `json:"plate"`
	ValidFrom    time.Time  `json:"validFrom"`
	ValidTo      *time.Time `json:"validTo,omitempty"`
	SourceSystem string     `json:"sourceSystem"`
	GrantedBy    string     `json:"grantedBy"`
}

type authVehicleGrantHistory struct {
	ID           uint64     `json:"id"`
	VIN          string     `json:"vin"`
	Plate        string     `json:"plate"`
	ValidFrom    time.Time  `json:"validFrom"`
	ValidTo      *time.Time `json:"validTo,omitempty"`
	SourceSystem string     `json:"sourceSystem"`
	GrantedBy    string     `json:"grantedBy"`
	RevokedBy    string     `json:"revokedBy"`
	CreatedAt    time.Time  `json:"createdAt"`
	UpdatedAt    time.Time  `json:"updatedAt"`
}

type userVehicleGrantInput struct {
	VIN       string `json:"vin"`
	ValidFrom string `json:"validFrom"`
	ValidTo   string `json:"validTo"`
}

type vehicleGrantMutation struct {
	VIN       string
	ValidFrom *time.Time
	ValidTo   *time.Time
}

type vehicleGrantAuditSnapshot struct {
	ValidFrom time.Time  `json:"validFrom"`
	ValidTo   *time.Time `json:"validTo,omitempty"`
}

type vehicleGrantAuditChange struct {
	VIN    string                     `json:"vin"`
	Before *vehicleGrantAuditSnapshot `json:"before,omitempty"`
	After  *vehicleGrantAuditSnapshot `json:"after,omitempty"`
}

type localCredential struct {
	authUser
	PasswordHash     string
	FailedLoginCount int
	LockedUntil      sql.NullTime
}

type userMutation struct {
	Username      string                  `json:"username"`
	DisplayName   string                  `json:"displayName"`
	Password      string                  `json:"password"`
	Status        string                  `json:"status"`
	CustomerRef   string                  `json:"customerRef"`
	TenantRef     string                  `json:"tenantRef"`
	MenuKeys      []string                `json:"menuKeys"`
	VehicleVINs   []string                `json:"vehicleVins"`
	VehicleGrants []userVehicleGrantInput `json:"vehicleGrants"`
}

const maxUserBatchItems = 50

type userBatchRequest struct {
	Mode  string          `json:"mode"`
	Items []userBatchItem `json:"items"`
}

type userBatchItem struct {
	Row   int          `json:"row"`
	Input userMutation `json:"input"`
}

type userBatchResultItem struct {
	Row         int    `json:"row"`
	Username    string `json:"username"`
	DisplayName string `json:"displayName"`
	Status      string `json:"status"`
	Code        string `json:"code,omitempty"`
	Message     string `json:"message"`
	ID          int64  `json:"id,omitempty"`
}

type userBatchSummary struct {
	Received int `json:"received"`
	Ready    int `json:"ready"`
	Created  int `json:"created"`
	Failed   int `json:"failed"`
}

type userBatchResult struct {
	Mode    string                `json:"mode"`
	Summary userBatchSummary      `json:"summary"`
	Items   []userBatchResultItem `json:"items"`
}

type loginRequest struct {
	Username string `json:"username"`
	Password string `json:"password"`
}

type passwordChangeRequest struct {
	CurrentPassword string `json:"currentPassword"`
	NewPassword     string `json:"newPassword"`
}

type loginResponse struct {
	AccessToken string             `json:"accessToken"`
	ExpiresAt   time.Time          `json:"expiresAt"`
	Session     platform.Principal `json:"session"`
}

type oneOSTicketExchangeRequest struct {
	Ticket string `json:"ticket"`
}

type oneOSTicketExchangeResponse struct {
	AccessToken string             `json:"accessToken"`
	ExpiresAt   time.Time          `json:"expiresAt"`
	Session     platform.Principal `json:"session"`
	ReturnTo    string             `json:"returnTo"`
}

type cachedSession struct {
	principal platform.Principal
	expiresAt time.Time
	cachedAt  time.Time
}

type authStore struct {
	db              *sql.DB
	sessionTTL      time.Duration
	oneOSSessionTTL time.Duration
	cacheMu         sync.RWMutex
	cache           map[string]cachedSession
}

func newAuthStore(db *sql.DB, cfg config.Config) (*authStore, error) {
	if db == nil {
		return nil, nil
	}
	ttl := cfg.SessionTTL
	if ttl <= 0 {
		ttl = 12 * time.Hour
	}
	oneOSTTL := cfg.OneOSSessionTTL
	if oneOSTTL <= 0 {
		oneOSTTL = 30 * time.Minute
	}
	store := &authStore{db: db, sessionTTL: ttl, oneOSSessionTTL: oneOSTTL, cache: map[string]cachedSession{}}
	if err := store.ensureBootstrapAdmin(context.Background(), cfg.BootstrapAdminUsername, cfg.BootstrapAdminPassword); err != nil {
		return nil, err
	}
	return store, nil
}

func (s *authStore) ensureBootstrapAdmin(ctx context.Context, username, password string) error {
	username = strings.TrimSpace(username)
	if username == "" && password == "" {
		return nil
	}
	if !usernamePattern.MatchString(username) {
		return fmt.Errorf("BOOTSTRAP_ADMIN_USERNAME is invalid")
	}
	if err := validatePassword(password); err != nil {
		return fmt.Errorf("BOOTSTRAP_ADMIN_PASSWORD: %w", err)
	}
	var exists int
	if err := s.db.QueryRowContext(ctx, `SELECT COUNT(*) FROM platform_user WHERE user_type='admin'`).Scan(&exists); err != nil {
		return fmt.Errorf("check bootstrap admin: %w", err)
	}
	if exists > 0 {
		return nil
	}
	hash, err := bcrypt.GenerateFromPassword([]byte(password), 12)
	if err != nil {
		return fmt.Errorf("hash bootstrap password: %w", err)
	}
	_, err = s.db.ExecContext(ctx, `INSERT INTO platform_user(username,display_name,password_hash,user_type,status,auth_provider,created_by,updated_by) VALUES(?,?,?,'admin','enabled','local','bootstrap','bootstrap')`, username, "平台管理员", string(hash))
	if err != nil {
		return fmt.Errorf("create bootstrap admin: %w", err)
	}
	return nil
}

func (s *authStore) login(w http.ResponseWriter, r *http.Request) {
	var input loginRequest
	if !decodeAuthJSON(w, r, &input) {
		return
	}
	input.Username = strings.TrimSpace(input.Username)
	if !usernamePattern.MatchString(input.Username) || len(input.Password) > 128 {
		s.audit(r.Context(), input.Username, "login", "user", input.Username, "denied", map[string]any{"reason": "invalid_credentials"}, remoteAddress(r))
		httpx.WriteError(w, http.StatusUnauthorized, "LOGIN_FAILED", "用户名或密码错误", "", requestTraceID(r))
		return
	}
	credential, err := s.localCredential(r.Context(), input.Username)
	if err != nil {
		if !errors.Is(err, sql.ErrNoRows) {
			httpx.WriteError(w, http.StatusInternalServerError, "AUTH_STORE_FAILED", "登录服务暂时不可用", "", requestTraceID(r))
			return
		}
		s.audit(r.Context(), input.Username, "login", "user", input.Username, "denied", map[string]any{"reason": "invalid_credentials"}, remoteAddress(r))
		httpx.WriteError(w, http.StatusUnauthorized, "LOGIN_FAILED", "用户名或密码错误", "", requestTraceID(r))
		return
	}
	now := time.Now()
	if credential.Status != "enabled" {
		s.audit(r.Context(), input.Username, "login", "user", strconv.FormatUint(credential.ID, 10), "denied", map[string]any{"reason": "disabled"}, remoteAddress(r))
		httpx.WriteError(w, http.StatusForbidden, "ACCOUNT_DISABLED", "账号已停用，请联系管理员", "", requestTraceID(r))
		return
	}
	if credential.LockedUntil.Valid && credential.LockedUntil.Time.After(now) {
		httpx.WriteError(w, http.StatusTooManyRequests, "ACCOUNT_LOCKED", "登录失败次数过多，请稍后再试", credential.LockedUntil.Time.Format(time.RFC3339), requestTraceID(r))
		return
	}
	if bcrypt.CompareHashAndPassword([]byte(credential.PasswordHash), []byte(input.Password)) != nil {
		failures := credential.FailedLoginCount + 1
		var locked any
		if failures >= maxLoginFailures {
			locked = now.Add(loginLockDuration)
		}
		_, _ = s.db.ExecContext(r.Context(), `UPDATE platform_user SET failed_login_count=?,locked_until=? WHERE id=?`, failures, locked, credential.ID)
		s.audit(r.Context(), input.Username, "login", "user", strconv.FormatUint(credential.ID, 10), "denied", map[string]any{"reason": "invalid_credentials", "failures": failures}, remoteAddress(r))
		httpx.WriteError(w, http.StatusUnauthorized, "LOGIN_FAILED", "用户名或密码错误", "", requestTraceID(r))
		return
	}
	principal, err := s.principalForUser(r.Context(), credential.authUser)
	if err != nil {
		httpx.WriteError(w, http.StatusInternalServerError, "AUTH_STORE_FAILED", "登录服务暂时不可用", "", requestTraceID(r))
		return
	}
	response, err := s.issueSession(r, credential.ID, principal, s.sessionTTL)
	if err != nil {
		httpx.WriteError(w, http.StatusInternalServerError, "SESSION_CREATE_FAILED", "无法创建登录会话", "", requestTraceID(r))
		return
	}
	_, _ = s.db.ExecContext(r.Context(), `UPDATE platform_user SET failed_login_count=0,locked_until=NULL,last_login_at=? WHERE id=?`, now, credential.ID)
	s.audit(r.Context(), principal.Name, "login", "user", strconv.FormatUint(credential.ID, 10), "success", nil, remoteAddress(r))
	w.Header().Set("Cache-Control", "no-store")
	httpx.WriteOK(w, requestTraceID(r), response)
}

func (s *authStore) exchangeOneOSTicket(w http.ResponseWriter, r *http.Request, adapter *oneOSIdentityAdapter) {
	var input oneOSTicketExchangeRequest
	if !decodeAuthJSON(w, r, &input) {
		return
	}
	identity, err := adapter.ExchangeTicket(r.Context(), input.Ticket)
	if err != nil {
		s.audit(r.Context(), "oneos", "sso.exchange", "ticket", "", "denied", map[string]any{"reason": err.Error()}, remoteAddress(r))
		httpx.WriteError(w, http.StatusUnauthorized, "ONEOS_TICKET_REJECTED", "OneOS 登录票据无效、已过期或已使用", "", requestTraceID(r))
		return
	}
	user, err := s.syncOneOSIdentity(r.Context(), identity, adapter.defaultMenus)
	if err != nil {
		s.audit(r.Context(), identity.Username, "sso.exchange", "user", identity.Subject, "failed", map[string]any{"reason": err.Error()}, remoteAddress(r))
		httpx.WriteError(w, http.StatusInternalServerError, "ONEOS_IDENTITY_SYNC_FAILED", "无法同步 OneOS 用户权限", "", requestTraceID(r))
		return
	}
	principal, err := s.principalForUser(r.Context(), user)
	if err != nil {
		httpx.WriteError(w, http.StatusInternalServerError, "ONEOS_IDENTITY_SYNC_FAILED", "无法加载 OneOS 用户权限", "", requestTraceID(r))
		return
	}
	response, err := s.issueSession(r, user.ID, principal, s.oneOSSessionTTL)
	if err != nil {
		httpx.WriteError(w, http.StatusInternalServerError, "SESSION_CREATE_FAILED", "无法创建登录会话", "", requestTraceID(r))
		return
	}
	_, _ = s.db.ExecContext(r.Context(), `UPDATE platform_user SET last_login_at=NOW(3),failed_login_count=0,locked_until=NULL WHERE id=?`, user.ID)
	s.audit(r.Context(), principal.Name, "sso.exchange", "user", identity.Subject, "success", map[string]any{
		"scopeLevel": identity.ScopeLevel, "departmentIds": identity.DepartmentIDs,
	}, remoteAddress(r))
	w.Header().Set("Cache-Control", "no-store")
	httpx.WriteOK(w, requestTraceID(r), oneOSTicketExchangeResponse{
		AccessToken: response.AccessToken,
		ExpiresAt:   response.ExpiresAt,
		Session:     response.Session,
		ReturnTo:    identity.ReturnTo,
	})
}

func (s *authStore) syncOneOSIdentity(ctx context.Context, identity oneOSIdentity, menus []string) (authUser, error) {
	tx, err := s.db.BeginTx(ctx, nil)
	if err != nil {
		return authUser{}, err
	}
	defer tx.Rollback()
	var userID uint64
	err = tx.QueryRowContext(ctx, `SELECT id FROM platform_user WHERE auth_provider='oneos' AND external_subject=? FOR UPDATE`, identity.Subject).Scan(&userID)
	switch {
	case errors.Is(err, sql.ErrNoRows):
		result, insertErr := tx.ExecContext(ctx, `INSERT INTO platform_user(
username,display_name,password_hash,user_type,status,customer_ref,tenant_ref,auth_provider,external_subject,created_by,updated_by
) VALUES(?,?,?,'customer','enabled','',?,'oneos',?,'oneos-sso','oneos-sso')`,
			oneOSPlatformUsername(identity.Subject), oneOSDisplayName(identity), "", identity.TenantID, identity.Subject,
		)
		if insertErr != nil {
			return authUser{}, insertErr
		}
		insertedID, insertErr := result.LastInsertId()
		if insertErr != nil {
			return authUser{}, insertErr
		}
		userID = uint64(insertedID)
	case err != nil:
		return authUser{}, err
	default:
		if _, err = tx.ExecContext(ctx, `UPDATE platform_user SET display_name=?,tenant_ref=?,status='enabled',updated_by='oneos-sso' WHERE id=?`,
			oneOSDisplayName(identity), identity.TenantID, userID); err != nil {
			return authUser{}, err
		}
	}
	if _, err = tx.ExecContext(ctx, `DELETE FROM platform_user_menu WHERE user_id=?`, userID); err != nil {
		return authUser{}, err
	}
	for _, menu := range menus {
		if !customerMenuSet[menu] {
			continue
		}
		if _, err = tx.ExecContext(ctx, `INSERT INTO platform_user_menu(user_id,menu_key,granted_by) VALUES(?,?, 'oneos-sso')`, userID, menu); err != nil {
			return authUser{}, err
		}
	}
	departmentIDs := strings.Join(normalizeStringList(identity.DepartmentIDs, 100), ",")
	if _, err = tx.ExecContext(ctx, `INSERT INTO platform_user_business_scope(
user_id,scope_level,department_ids,responsible_user_id,enabled,source_system,source_updated_at
) VALUES(?,?,?,?,1,'oneos',?)
ON DUPLICATE KEY UPDATE scope_level=VALUES(scope_level),department_ids=VALUES(department_ids),
responsible_user_id=VALUES(responsible_user_id),enabled=1,source_system='oneos',
source_updated_at=VALUES(source_updated_at)`,
		userID, identity.ScopeLevel, departmentIDs, strings.TrimSpace(identity.ResponsibleUserID), identity.IssuedAt); err != nil {
		return authUser{}, err
	}
	if err = tx.Commit(); err != nil {
		return authUser{}, err
	}
	s.invalidateUser(userID)
	return authUser{
		ID: userID, Username: oneOSPlatformUsername(identity.Subject), DisplayName: oneOSDisplayName(identity),
		UserType: "customer", Status: "enabled", TenantRef: identity.TenantID,
		AuthProvider: "oneos", ExternalSubject: identity.Subject,
	}, nil
}

func (s *authStore) issueSession(r *http.Request, userID uint64, principal platform.Principal, ttl time.Duration) (loginResponse, error) {
	accessToken, tokenHash, err := randomSessionToken()
	if err != nil {
		return loginResponse{}, err
	}
	sessionID, err := randomHex(16)
	if err != nil {
		return loginResponse{}, err
	}
	now := time.Now()
	if ttl <= 0 {
		ttl = 30 * time.Minute
	}
	expiresAt := now.Add(ttl)
	if _, err = s.db.ExecContext(r.Context(), `INSERT INTO platform_user_session(id,user_id,token_hash,issued_at,expires_at,last_seen_at,remote_addr,user_agent) VALUES(?,?,?,?,?,?,?,?)`,
		sessionID, userID, tokenHash[:], now, expiresAt, now, remoteAddress(r), truncateUTF8(r.UserAgent(), 255)); err != nil {
		return loginResponse{}, err
	}
	principal.SessionID = sessionID
	s.cachePut(hex.EncodeToString(tokenHash[:]), principal, expiresAt)
	return loginResponse{AccessToken: accessToken, ExpiresAt: expiresAt, Session: principal}, nil
}

func oneOSPlatformUsername(subject string) string {
	normalized := strings.Map(func(r rune) rune {
		if (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') || r == '.' || r == '_' || r == '-' {
			return r
		}
		return '-'
	}, strings.TrimSpace(subject))
	normalized = strings.Trim(normalized, "-")
	if normalized == "" {
		sum := sha256.Sum256([]byte(subject))
		normalized = hex.EncodeToString(sum[:8])
	}
	value := "oneos-" + normalized
	if len(value) > 64 {
		sum := sha256.Sum256([]byte(subject))
		value = "oneos-" + hex.EncodeToString(sum[:16])
	}
	return value
}

func oneOSDisplayName(identity oneOSIdentity) string {
	if value := strings.TrimSpace(identity.DisplayName); value != "" {
		return truncateUTF8(value, 96)
	}
	return truncateUTF8(identity.Username, 96)
}

func (s *authStore) authenticate(ctx context.Context, token string) (platform.Principal, bool) {
	hash := sha256.Sum256([]byte(token))
	key := hex.EncodeToString(hash[:])
	if principal, ok := s.cacheGet(key); ok {
		return principal, true
	}
	var user authUser
	var sessionID string
	var expiresAt time.Time
	var external sql.NullString
	err := s.db.QueryRowContext(ctx, `SELECT u.id,u.username,u.display_name,u.user_type,u.status,u.customer_ref,u.tenant_ref,u.auth_provider,u.external_subject,u.last_login_at,u.created_at,u.updated_at,s.id,s.expires_at FROM platform_user_session s JOIN platform_user u ON u.id=s.user_id WHERE s.token_hash=? AND s.revoked_at IS NULL AND s.expires_at>NOW(3) AND u.status='enabled'`, hash[:]).Scan(
		&user.ID, &user.Username, &user.DisplayName, &user.UserType, &user.Status, &user.CustomerRef, &user.TenantRef, &user.AuthProvider, &external, &user.LastLoginAt, &user.CreatedAt, &user.UpdatedAt, &sessionID, &expiresAt,
	)
	if err != nil {
		return platform.Principal{}, false
	}
	user.ExternalSubject = external.String
	principal, err := s.principalForUser(ctx, user)
	if err != nil {
		return platform.Principal{}, false
	}
	principal.SessionID = sessionID
	s.cachePut(key, principal, expiresAt)
	return principal, true
}

func (s *authStore) logout(ctx context.Context, token string) {
	hash := sha256.Sum256([]byte(token))
	_, _ = s.db.ExecContext(ctx, `UPDATE platform_user_session SET revoked_at=NOW(3) WHERE token_hash=? AND revoked_at IS NULL`, hash[:])
	s.cacheMu.Lock()
	delete(s.cache, hex.EncodeToString(hash[:]))
	s.cacheMu.Unlock()
}

func (s *authStore) changePassword(w http.ResponseWriter, r *http.Request, principal platform.Principal) {
	if principal.AuthProvider != "local" || principal.SubjectID == "" {
		httpx.WriteError(w, http.StatusBadRequest, "PASSWORD_CHANGE_UNAVAILABLE", "当前登录方式不支持修改密码", "", requestTraceID(r))
		return
	}
	var input passwordChangeRequest
	if !decodeAuthJSON(w, r, &input) {
		return
	}
	if err := validatePassword(input.NewPassword); err != nil {
		httpx.WriteError(w, http.StatusBadRequest, "PASSWORD_INVALID", err.Error(), "", requestTraceID(r))
		return
	}
	id, _ := strconv.ParseUint(principal.SubjectID, 10, 64)
	var currentHash string
	if err := s.db.QueryRowContext(r.Context(), `SELECT password_hash FROM platform_user WHERE id=? AND status='enabled'`, id).Scan(&currentHash); err != nil || bcrypt.CompareHashAndPassword([]byte(currentHash), []byte(input.CurrentPassword)) != nil {
		s.audit(r.Context(), principal.Name, "password.change", "user", principal.SubjectID, "denied", map[string]any{"reason": "current_password_invalid"}, remoteAddress(r))
		httpx.WriteError(w, http.StatusUnauthorized, "CURRENT_PASSWORD_INVALID", "当前密码不正确", "", requestTraceID(r))
		return
	}
	if bcrypt.CompareHashAndPassword([]byte(currentHash), []byte(input.NewPassword)) == nil {
		httpx.WriteError(w, http.StatusBadRequest, "PASSWORD_UNCHANGED", "新密码不能与当前密码相同", "", requestTraceID(r))
		return
	}
	hash, _ := bcrypt.GenerateFromPassword([]byte(input.NewPassword), 12)
	tx, err := s.db.BeginTx(r.Context(), nil)
	if err != nil {
		httpx.WriteError(w, http.StatusInternalServerError, "PASSWORD_CHANGE_FAILED", "无法修改密码", "", requestTraceID(r))
		return
	}
	defer tx.Rollback()
	if _, err := tx.ExecContext(r.Context(), `UPDATE platform_user SET password_hash=?,password_changed_at=NOW(3),failed_login_count=0,locked_until=NULL,updated_by=? WHERE id=?`, string(hash), principal.Name, id); err != nil {
		httpx.WriteError(w, http.StatusInternalServerError, "PASSWORD_CHANGE_FAILED", "无法修改密码", "", requestTraceID(r))
		return
	}
	if _, err := tx.ExecContext(r.Context(), `UPDATE platform_user_session SET revoked_at=NOW(3) WHERE user_id=? AND revoked_at IS NULL`, id); err != nil {
		httpx.WriteError(w, http.StatusInternalServerError, "PASSWORD_CHANGE_FAILED", "无法撤销旧会话", "", requestTraceID(r))
		return
	}
	if err := tx.Commit(); err != nil {
		httpx.WriteError(w, http.StatusInternalServerError, "PASSWORD_CHANGE_FAILED", "无法修改密码", "", requestTraceID(r))
		return
	}
	s.invalidateUser(id)
	s.audit(r.Context(), principal.Name, "password.change", "user", principal.SubjectID, "success", nil, remoteAddress(r))
	httpx.WriteOK(w, requestTraceID(r), map[string]bool{"changed": true})
}

func (s *authStore) localCredential(ctx context.Context, username string) (localCredential, error) {
	var credential localCredential
	var external sql.NullString
	err := s.db.QueryRowContext(ctx, `SELECT id,username,display_name,password_hash,user_type,status,customer_ref,tenant_ref,auth_provider,external_subject,failed_login_count,locked_until,last_login_at,created_at,updated_at FROM platform_user WHERE username=? AND auth_provider='local'`, username).Scan(
		&credential.ID, &credential.Username, &credential.DisplayName, &credential.PasswordHash, &credential.UserType, &credential.Status, &credential.CustomerRef, &credential.TenantRef, &credential.AuthProvider, &external, &credential.FailedLoginCount, &credential.LockedUntil, &credential.LastLoginAt, &credential.CreatedAt, &credential.UpdatedAt,
	)
	credential.ExternalSubject = external.String
	return credential, err
}

func (s *authStore) principalForUser(ctx context.Context, user authUser) (platform.Principal, error) {
	menus := append([]string(nil), adminMenus...)
	vehicles := []string{}
	vehicleGrants := []platform.VehicleGrant{}
	businessScopeLevel := ""
	departmentIDs := []string{}
	responsibleUserID := ""
	if user.UserType == "customer" {
		menus = []string{}
		rows, err := s.db.QueryContext(ctx, `SELECT menu_key FROM platform_user_menu WHERE user_id=? ORDER BY menu_key`, user.ID)
		if err != nil {
			return platform.Principal{}, err
		}
		for rows.Next() {
			var value string
			if err := rows.Scan(&value); err != nil {
				rows.Close()
				return platform.Principal{}, err
			}
			if customerMenuSet[value] {
				menus = append(menus, value)
			}
		}
		if err := rows.Close(); err != nil {
			return platform.Principal{}, err
		}
		rows, err = s.db.QueryContext(ctx, `SELECT vin,COALESCE(valid_from,granted_at),valid_to FROM platform_user_vehicle WHERE user_id=? AND (valid_from IS NULL OR valid_from<=NOW(3)) AND (valid_to IS NULL OR valid_to>NOW(3)) ORDER BY vin`, user.ID)
		if err != nil {
			return platform.Principal{}, err
		}
		for rows.Next() {
			var vin string
			var validFrom time.Time
			var validTo sql.NullTime
			if err := rows.Scan(&vin, &validFrom, &validTo); err != nil {
				rows.Close()
				return platform.Principal{}, err
			}
			vehicles = append(vehicles, vin)
			grant := platform.VehicleGrant{VIN: vin, ValidFrom: validFrom}
			if validTo.Valid {
				grant.ValidTo = &validTo.Time
			}
			vehicleGrants = append(vehicleGrants, grant)
		}
		if err := rows.Close(); err != nil {
			return platform.Principal{}, err
		}
		if strings.EqualFold(strings.TrimSpace(user.AuthProvider), "oneos") {
			var rawDepartmentIDs string
			err := s.db.QueryRowContext(ctx, `SELECT scope_level,department_ids,responsible_user_id
FROM platform_user_business_scope WHERE user_id=? AND enabled=1`, user.ID).Scan(
				&businessScopeLevel, &rawDepartmentIDs, &responsibleUserID,
			)
			if err != nil && !errors.Is(err, sql.ErrNoRows) {
				return platform.Principal{}, err
			}
			if err == nil {
				departmentIDs = normalizeScopeValues(rawDepartmentIDs)
				businessVINs, err := s.loadOneOSBusinessVINs(ctx, businessScopeLevel, departmentIDs, responsibleUserID)
				if err != nil {
					return platform.Principal{}, err
				}
				vehicles = businessVINs
				vehicleGrants = make([]platform.VehicleGrant, 0, len(businessVINs))
				for _, vin := range businessVINs {
					vehicleGrants = append(vehicleGrants, platform.VehicleGrant{VIN: vin})
				}
			}
		}
	}
	return platform.Principal{
		SubjectID: strconv.FormatUint(user.ID, 10), Name: user.DisplayName, Username: user.Username,
		Role: user.UserType, UserType: user.UserType, CustomerRef: user.CustomerRef, TenantRef: user.TenantRef,
		AuthProvider: user.AuthProvider, MenuKeys: menus, VehicleVINs: vehicles, VehicleGrants: vehicleGrants,
		BusinessScopeLevel: businessScopeLevel, DepartmentIDs: departmentIDs, ResponsibleUserID: strings.TrimSpace(responsibleUserID),
	}, nil
}

func normalizeScopeValues(raw string) []string {
	seen := map[string]bool{}
	result := []string{}
	for _, value := range strings.Split(raw, ",") {
		value = strings.TrimSpace(value)
		if value == "" || seen[value] || len(result) >= 100 {
			continue
		}
		seen[value] = true
		result = append(result, value)
	}
	sort.Strings(result)
	return result
}

func (s *authStore) loadOneOSBusinessVINs(ctx context.Context, level string, departmentIDs []string, responsibleUserID string) ([]string, error) {
	where := []string{"st.id=1"}
	args := []any{}
	switch strings.ToLower(strings.TrimSpace(level)) {
	case "department":
		if len(departmentIDs) == 0 {
			return []string{}, nil
		}
		placeholders := strings.TrimSuffix(strings.Repeat("?,", len(departmentIDs)), ",")
		where = append(where, "scope.department_id IN ("+placeholders+")")
		for _, id := range departmentIDs {
			args = append(args, id)
		}
	case "responsible":
		responsibleUserID = strings.TrimSpace(responsibleUserID)
		if responsibleUserID == "" {
			return []string{}, nil
		}
		where = append(where, "scope.responsible_user_id=?")
		args = append(args, responsibleUserID)
	default:
		return []string{}, nil
	}
	rows, err := s.db.QueryContext(ctx, `SELECT DISTINCT UPPER(TRIM(scope.vin))
FROM business_scope_state st
JOIN business_customer_vehicle_scope scope ON BINARY scope.source_version=BINARY st.active_version
WHERE `+strings.Join(where, " AND ")+` AND scope.vin<>'' ORDER BY UPPER(TRIM(scope.vin))`, args...)
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	result := []string{}
	for rows.Next() {
		var vin string
		if err := rows.Scan(&vin); err != nil {
			return nil, err
		}
		if vin = strings.TrimSpace(vin); vin != "" {
			result = append(result, vin)
		}
	}
	return result, rows.Err()
}

func (s *authStore) handleAdmin(w http.ResponseWriter, r *http.Request, principal platform.Principal) bool {
	if r.URL.Path != "/api/v2/admin/users" && !strings.HasPrefix(r.URL.Path, "/api/v2/admin/users/") {
		return false
	}
	if principal.UserType != "admin" && principal.Role != "admin" {
		httpx.WriteError(w, http.StatusForbidden, "PERMISSION_DENIED", "仅管理员可以管理账号与权限", "", requestTraceID(r))
		return true
	}
	switch {
	case r.Method == http.MethodGet && r.URL.Path == "/api/v2/admin/users":
		s.listUsers(w, r)
	case r.Method == http.MethodPost && r.URL.Path == "/api/v2/admin/users/batch":
		s.batchCustomers(w, r, principal)
	case r.Method == http.MethodPost && r.URL.Path == "/api/v2/admin/users":
		s.createCustomer(w, r, principal)
	case r.Method == http.MethodPut && strings.HasPrefix(r.URL.Path, "/api/v2/admin/users/"):
		s.updateCustomer(w, r, principal)
	default:
		httpx.WriteError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "不支持的账号管理操作", "", requestTraceID(r))
	}
	return true
}

func (s *authStore) listUsers(w http.ResponseWriter, r *http.Request) {
	rows, err := s.db.QueryContext(r.Context(), `SELECT id,username,display_name,user_type,status,customer_ref,tenant_ref,auth_provider,external_subject,last_login_at,created_at,updated_at FROM platform_user ORDER BY user_type ASC,created_at DESC`)
	if err != nil {
		httpx.WriteError(w, http.StatusInternalServerError, "USER_LIST_FAILED", "无法读取账号列表", "", requestTraceID(r))
		return
	}
	defer rows.Close()
	users := []authUser{}
	allVINs := []string{}
	for rows.Next() {
		var user authUser
		var external sql.NullString
		if err := rows.Scan(&user.ID, &user.Username, &user.DisplayName, &user.UserType, &user.Status, &user.CustomerRef, &user.TenantRef, &user.AuthProvider, &external, &user.LastLoginAt, &user.CreatedAt, &user.UpdatedAt); err != nil {
			httpx.WriteError(w, http.StatusInternalServerError, "USER_LIST_FAILED", "无法读取账号列表", "", requestTraceID(r))
			return
		}
		user.ExternalSubject = external.String
		principal, err := s.principalForUser(r.Context(), user)
		if err != nil {
			httpx.WriteError(w, http.StatusInternalServerError, "USER_LIST_FAILED", "无法读取账号权限", "", requestTraceID(r))
			return
		}
		user.MenuKeys = principal.MenuKeys
		if user.UserType == "customer" {
			user.Vehicles, user.GrantHistory, err = loadUserVehicleAuthorization(r.Context(), s.db, user.ID)
			if err != nil {
				httpx.WriteError(w, http.StatusInternalServerError, "USER_LIST_FAILED", "无法读取车辆授权履历", "", requestTraceID(r))
				return
			}
			user.VehicleVINs = make([]string, 0, len(user.Vehicles))
			for _, vehicle := range user.Vehicles {
				user.VehicleVINs = append(user.VehicleVINs, vehicle.VIN)
				allVINs = append(allVINs, vehicle.VIN)
			}
			for _, history := range user.GrantHistory {
				allVINs = append(allVINs, history.VIN)
			}
		}
		users = append(users, user)
	}
	if err := rows.Err(); err != nil {
		httpx.WriteError(w, http.StatusInternalServerError, "USER_LIST_FAILED", "无法读取账号列表", "", requestTraceID(r))
		return
	}
	vehicleLabels, err := loadAuthVehicleGrants(r.Context(), s.db, normalizeVINs(allVINs))
	if err != nil {
		httpx.WriteError(w, http.StatusInternalServerError, "USER_LIST_FAILED", "无法读取车辆权限信息", "", requestTraceID(r))
		return
	}
	for index := range users {
		for vehicleIndex := range users[index].Vehicles {
			users[index].Vehicles[vehicleIndex].Plate = vehicleLabels[users[index].Vehicles[vehicleIndex].VIN].Plate
		}
		for historyIndex := range users[index].GrantHistory {
			users[index].GrantHistory[historyIndex].Plate = vehicleLabels[users[index].GrantHistory[historyIndex].VIN].Plate
		}
	}
	httpx.WriteOK(w, requestTraceID(r), users)
}

func loadUserVehicleAuthorization(ctx context.Context, db *sql.DB, userID uint64) ([]authVehicleGrant, []authVehicleGrantHistory, error) {
	rows, err := db.QueryContext(ctx, `SELECT vin,COALESCE(valid_from,granted_at),valid_to,source_system,granted_by
FROM platform_user_vehicle WHERE user_id=? ORDER BY vin`, userID)
	if err != nil {
		return nil, nil, err
	}
	grants := []authVehicleGrant{}
	for rows.Next() {
		var grant authVehicleGrant
		var validTo sql.NullTime
		if err := rows.Scan(&grant.VIN, &grant.ValidFrom, &validTo, &grant.SourceSystem, &grant.GrantedBy); err != nil {
			rows.Close()
			return nil, nil, err
		}
		grant.VIN = strings.ToUpper(strings.TrimSpace(grant.VIN))
		if validTo.Valid {
			value := validTo.Time
			grant.ValidTo = &value
		}
		grants = append(grants, grant)
	}
	if err := rows.Close(); err != nil {
		return nil, nil, err
	}
	historyRows, err := db.QueryContext(ctx, `SELECT id,vin,valid_from,valid_to,source_system,granted_by,revoked_by,created_at,updated_at
FROM platform_user_vehicle_grant_history WHERE user_id=? ORDER BY valid_from DESC,id DESC`, userID)
	if err != nil {
		return nil, nil, err
	}
	history := []authVehicleGrantHistory{}
	for historyRows.Next() {
		var item authVehicleGrantHistory
		var validTo sql.NullTime
		if err := historyRows.Scan(&item.ID, &item.VIN, &item.ValidFrom, &validTo, &item.SourceSystem, &item.GrantedBy, &item.RevokedBy, &item.CreatedAt, &item.UpdatedAt); err != nil {
			historyRows.Close()
			return nil, nil, err
		}
		item.VIN = strings.ToUpper(strings.TrimSpace(item.VIN))
		if validTo.Valid {
			value := validTo.Time
			item.ValidTo = &value
		}
		history = append(history, item)
	}
	if err := historyRows.Close(); err != nil {
		return nil, nil, err
	}
	return grants, history, nil
}

func loadAuthVehicleGrants(ctx context.Context, db *sql.DB, vins []string) (map[string]authVehicleGrant, error) {
	result := make(map[string]authVehicleGrant, len(vins))
	for start := 0; start < len(vins); start += 250 {
		end := start + 250
		if end > len(vins) {
			end = len(vins)
		}
		part := vins[start:end]
		placeholders := strings.TrimSuffix(strings.Repeat("?,", len(part)), ",")
		args := make([]any, 0, len(part)*2)
		for range 2 {
			for _, vin := range part {
				args = append(args, vin)
			}
		}
		query := `SELECT vin, COALESCE(` +
			`MAX(CASE WHEN source_priority=0 THEN NULLIF(plate,'') END),` +
			`MAX(CASE WHEN source_priority=1 THEN NULLIF(plate,'') END),'') ` +
			`FROM (` +
			`SELECT UPPER(TRIM(vin)) AS vin,plate,0 AS source_priority FROM vehicle_identity_binding WHERE vin IN (` + placeholders + `) ` +
			`UNION ALL ` +
			`SELECT UPPER(TRIM(vin)) AS vin,plate,1 AS source_priority FROM vehicle_realtime_snapshot WHERE vin IN (` + placeholders + `)` +
			`) vehicle_grants GROUP BY vin`
		rows, err := db.QueryContext(ctx, query, args...)
		if err != nil {
			return nil, err
		}
		for rows.Next() {
			var vehicle authVehicleGrant
			if err := rows.Scan(&vehicle.VIN, &vehicle.Plate); err != nil {
				rows.Close()
				return nil, err
			}
			vehicle.VIN = strings.ToUpper(strings.TrimSpace(vehicle.VIN))
			vehicle.Plate = strings.TrimSpace(vehicle.Plate)
			result[vehicle.VIN] = vehicle
		}
		if err := rows.Close(); err != nil {
			return nil, err
		}
	}
	return result, nil
}

func (s *authStore) createCustomer(w http.ResponseWriter, r *http.Request, actor platform.Principal) {
	var input userMutation
	if !decodeAuthJSON(w, r, &input) {
		return
	}
	input.Status = firstNonEmpty(strings.TrimSpace(input.Status), "enabled")
	menus, grants, err := s.validateMutation(r.Context(), input, true)
	if err != nil {
		httpx.WriteError(w, http.StatusBadRequest, "USER_INPUT_INVALID", err.Error(), "", requestTraceID(r))
		return
	}
	id, grantChanges, err := s.createCustomerRecord(r.Context(), input, menus, grants, actor.Name)
	if err != nil {
		if strings.Contains(strings.ToLower(err.Error()), "duplicate") {
			writeUserMutationError(w, r, err, "创建")
		} else {
			httpx.WriteError(w, http.StatusInternalServerError, "USER_CREATE_FAILED", "无法创建客户账号", "", requestTraceID(r))
		}
		return
	}
	s.audit(r.Context(), actor.Name, "user.create", "user", strconv.FormatInt(id, 10), "success", map[string]any{"menus": menus, "vehicleGrantChanges": grantChanges}, remoteAddress(r))
	httpx.WriteOK(w, requestTraceID(r), map[string]any{"id": id})
}

func (s *authStore) batchCustomers(w http.ResponseWriter, r *http.Request, actor platform.Principal) {
	var input userBatchRequest
	if !decodeAuthJSON(w, r, &input) {
		return
	}
	input.Mode = strings.ToLower(strings.TrimSpace(input.Mode))
	if input.Mode != "preview" && input.Mode != "create" {
		httpx.WriteError(w, http.StatusBadRequest, "USER_BATCH_MODE_INVALID", "批量操作模式必须为 preview 或 create", "", requestTraceID(r))
		return
	}
	if len(input.Items) == 0 || len(input.Items) > maxUserBatchItems {
		httpx.WriteError(w, http.StatusBadRequest, "USER_BATCH_SIZE_INVALID", fmt.Sprintf("每次需导入 1-%d 个客户账号", maxUserBatchItems), "", requestTraceID(r))
		return
	}

	result := userBatchResult{Mode: input.Mode, Summary: userBatchSummary{Received: len(input.Items)}, Items: make([]userBatchResultItem, 0, len(input.Items))}
	seen := map[string]bool{}
	for index, item := range input.Items {
		row := item.Row
		if row <= 1 {
			row = index + 2
		}
		item.Input.Username = strings.TrimSpace(item.Input.Username)
		item.Input.DisplayName = strings.TrimSpace(item.Input.DisplayName)
		item.Input.Status = firstNonEmpty(strings.TrimSpace(item.Input.Status), "enabled")
		entry := userBatchResultItem{Row: row, Username: item.Input.Username, DisplayName: item.Input.DisplayName}
		usernameKey := strings.ToLower(item.Input.Username)
		if seen[usernameKey] {
			entry.Status, entry.Code, entry.Message = "invalid", "DUPLICATE_IN_FILE", "文件内用户名重复"
			result.Summary.Failed++
			result.Items = append(result.Items, entry)
			continue
		}
		seen[usernameKey] = true
		menus, grants, err := s.validateMutation(r.Context(), item.Input, true)
		if err != nil {
			entry.Status, entry.Code, entry.Message = "invalid", "USER_INPUT_INVALID", err.Error()
			result.Summary.Failed++
			result.Items = append(result.Items, entry)
			continue
		}
		var existingID uint64
		err = s.db.QueryRowContext(r.Context(), `SELECT id FROM platform_user WHERE LOWER(username)=LOWER(?) LIMIT 1`, item.Input.Username).Scan(&existingID)
		if err == nil {
			entry.Status, entry.Code, entry.Message = "conflict", "USERNAME_EXISTS", "用户名已存在"
			result.Summary.Failed++
			result.Items = append(result.Items, entry)
			continue
		}
		if !errors.Is(err, sql.ErrNoRows) {
			entry.Status, entry.Code, entry.Message = "failed", "USER_CHECK_FAILED", "暂时无法校验用户名"
			result.Summary.Failed++
			result.Items = append(result.Items, entry)
			continue
		}
		if input.Mode == "preview" {
			entry.Status, entry.Message = "ready", "校验通过，可以创建"
			result.Summary.Ready++
			result.Items = append(result.Items, entry)
			continue
		}
		id, grantChanges, err := s.createCustomerRecord(r.Context(), item.Input, menus, grants, actor.Name)
		if err != nil {
			entry.Status, entry.Code, entry.Message = "failed", "USER_CREATE_FAILED", "创建失败，请重试"
			if strings.Contains(strings.ToLower(err.Error()), "duplicate") {
				entry.Status, entry.Code, entry.Message = "conflict", "USERNAME_EXISTS", "用户名已存在"
			}
			result.Summary.Failed++
			result.Items = append(result.Items, entry)
			continue
		}
		entry.Status, entry.Message, entry.ID = "created", "账号与权限已创建", id
		result.Summary.Created++
		result.Items = append(result.Items, entry)
		s.audit(r.Context(), actor.Name, "user.create", "user", strconv.FormatInt(id, 10), "success", map[string]any{"batch": true, "row": row, "menus": menus, "vehicleGrantChanges": grantChanges}, remoteAddress(r))
	}
	s.audit(r.Context(), actor.Name, "user.batch."+input.Mode, "user_batch", strconv.Itoa(len(input.Items)), "success", map[string]any{"received": result.Summary.Received, "ready": result.Summary.Ready, "created": result.Summary.Created, "failed": result.Summary.Failed}, remoteAddress(r))
	httpx.WriteOK(w, requestTraceID(r), result)
}

func (s *authStore) createCustomerRecord(ctx context.Context, input userMutation, menus []string, grants []vehicleGrantMutation, actor string) (int64, []vehicleGrantAuditChange, error) {
	hash, err := bcrypt.GenerateFromPassword([]byte(input.Password), 12)
	if err != nil {
		return 0, nil, err
	}
	tx, err := s.db.BeginTx(ctx, nil)
	if err != nil {
		return 0, nil, err
	}
	defer tx.Rollback()
	created, err := tx.ExecContext(ctx, `INSERT INTO platform_user(username,display_name,password_hash,user_type,status,customer_ref,tenant_ref,auth_provider,created_by,updated_by) VALUES(?,?,?,'customer',?,?,?,'local',?,?)`, strings.TrimSpace(input.Username), strings.TrimSpace(input.DisplayName), string(hash), input.Status, strings.TrimSpace(input.CustomerRef), strings.TrimSpace(input.TenantRef), actor, actor)
	if err != nil {
		return 0, nil, err
	}
	id, err := created.LastInsertId()
	if err != nil {
		return 0, nil, err
	}
	grantChanges := []vehicleGrantAuditChange{}
	if err := replaceGrants(ctx, tx, uint64(id), menus, grants, actor, &grantChanges); err != nil {
		return 0, nil, err
	}
	if err := tx.Commit(); err != nil {
		return 0, nil, err
	}
	return id, grantChanges, nil
}

func (s *authStore) updateCustomer(w http.ResponseWriter, r *http.Request, actor platform.Principal) {
	idText := strings.TrimPrefix(r.URL.Path, "/api/v2/admin/users/")
	id, err := strconv.ParseUint(idText, 10, 64)
	if err != nil || id == 0 {
		httpx.WriteError(w, http.StatusBadRequest, "USER_ID_INVALID", "账号编号无效", "", requestTraceID(r))
		return
	}
	var input userMutation
	if !decodeAuthJSON(w, r, &input) {
		return
	}
	input.Status = firstNonEmpty(strings.TrimSpace(input.Status), "enabled")
	menus, grants, err := s.validateMutation(r.Context(), input, false)
	if err != nil {
		httpx.WriteError(w, http.StatusBadRequest, "USER_INPUT_INVALID", err.Error(), "", requestTraceID(r))
		return
	}
	tx, err := s.db.BeginTx(r.Context(), nil)
	if err != nil {
		httpx.WriteError(w, http.StatusInternalServerError, "USER_UPDATE_FAILED", "无法更新客户账号", "", requestTraceID(r))
		return
	}
	defer tx.Rollback()
	var userType, authProvider string
	if err := tx.QueryRowContext(r.Context(), `SELECT user_type,auth_provider FROM platform_user WHERE id=? FOR UPDATE`, id).Scan(&userType, &authProvider); err != nil || userType != "customer" {
		httpx.WriteError(w, http.StatusBadRequest, "CUSTOMER_USER_REQUIRED", "只能通过此功能维护客户账号", "", requestTraceID(r))
		return
	}
	if authProvider = strings.TrimSpace(authProvider); authProvider != "" && !strings.EqualFold(authProvider, "local") && input.Password != "" {
		httpx.WriteError(w, http.StatusBadRequest, "EXTERNAL_IDENTITY_PASSWORD_READ_ONLY", "外部身份的登录凭据必须在身份源中维护", authProvider, requestTraceID(r))
		return
	}
	args := []any{strings.TrimSpace(input.DisplayName), input.Status, strings.TrimSpace(input.CustomerRef), strings.TrimSpace(input.TenantRef), actor.Name}
	query := `UPDATE platform_user SET display_name=?,status=?,customer_ref=?,tenant_ref=?,updated_by=?`
	if input.Password != "" {
		hash, _ := bcrypt.GenerateFromPassword([]byte(input.Password), 12)
		query += `,password_hash=?,password_changed_at=NOW(3),failed_login_count=0,locked_until=NULL`
		args = append(args, string(hash))
	}
	query += ` WHERE id=?`
	args = append(args, id)
	if _, err := tx.ExecContext(r.Context(), query, args...); err != nil {
		writeUserMutationError(w, r, err, "更新")
		return
	}
	grantChanges := []vehicleGrantAuditChange{}
	if err := replaceGrants(r.Context(), tx, id, menus, grants, actor.Name, &grantChanges); err != nil {
		httpx.WriteError(w, http.StatusInternalServerError, "USER_UPDATE_FAILED", "无法保存客户权限", "", requestTraceID(r))
		return
	}
	if input.Status == "disabled" || input.Password != "" {
		if _, err := tx.ExecContext(r.Context(), `UPDATE platform_user_session SET revoked_at=NOW(3) WHERE user_id=? AND revoked_at IS NULL`, id); err != nil {
			httpx.WriteError(w, http.StatusInternalServerError, "USER_UPDATE_FAILED", "无法撤销旧会话", "", requestTraceID(r))
			return
		}
	}
	if err := tx.Commit(); err != nil {
		httpx.WriteError(w, http.StatusInternalServerError, "USER_UPDATE_FAILED", "无法更新客户账号", "", requestTraceID(r))
		return
	}
	s.invalidateUser(id)
	s.audit(r.Context(), actor.Name, "user.update", "user", idText, "success", map[string]any{"status": input.Status, "menus": menus, "vehicleGrantChanges": grantChanges, "passwordReset": input.Password != ""}, remoteAddress(r))
	httpx.WriteOK(w, requestTraceID(r), map[string]any{"id": id})
}

func (s *authStore) validateMutation(ctx context.Context, input userMutation, requirePassword bool) ([]string, []vehicleGrantMutation, error) {
	if requirePassword && !usernamePattern.MatchString(strings.TrimSpace(input.Username)) {
		return nil, nil, fmt.Errorf("用户名需为 3-64 位字母、数字、点、下划线或短横线")
	}
	if strings.TrimSpace(input.DisplayName) == "" || len([]rune(strings.TrimSpace(input.DisplayName))) > 48 {
		return nil, nil, fmt.Errorf("客户名称不能为空且不能超过 48 个字符")
	}
	if input.Status != "enabled" && input.Status != "disabled" {
		return nil, nil, fmt.Errorf("账号状态无效")
	}
	if requirePassword || input.Password != "" {
		if err := validatePassword(input.Password); err != nil {
			return nil, nil, err
		}
	}
	menus := normalizeMenus(input.MenuKeys)
	if len(menus) == 0 {
		return nil, nil, fmt.Errorf("至少分配一个客户菜单")
	}
	grants, err := normalizeVehicleGrantMutations(input)
	if err != nil {
		return nil, nil, err
	}
	if len(grants) == 0 {
		return nil, nil, fmt.Errorf("至少分配一辆可查看车辆")
	}
	if len(grants) > 5000 {
		return nil, nil, fmt.Errorf("单个客户最多分配 5000 辆车")
	}
	vins := grantVINs(grants)
	found, err := existingVINs(ctx, s.db, vins)
	if err != nil {
		return nil, nil, fmt.Errorf("校验车辆失败")
	}
	if len(found) != len(vins) {
		missing := []string{}
		for _, vin := range vins {
			if !found[vin] {
				missing = append(missing, vin)
			}
			if len(missing) == 5 {
				break
			}
		}
		return nil, nil, fmt.Errorf("存在未接入的 VIN：%s", strings.Join(missing, "、"))
	}
	return menus, grants, nil
}

type currentVehicleGrant struct {
	ValidFrom        time.Time
	ValidTo          *time.Time
	HistoryID        uint64
	HistoryValidFrom *time.Time
	HistoryValidTo   *time.Time
}

func replaceGrants(ctx context.Context, tx *sql.Tx, userID uint64, menus []string, grants []vehicleGrantMutation, actor string, changes *[]vehicleGrantAuditChange) error {
	if _, err := tx.ExecContext(ctx, `DELETE FROM platform_user_menu WHERE user_id=?`, userID); err != nil {
		return err
	}
	for _, menu := range menus {
		if _, err := tx.ExecContext(ctx, `INSERT INTO platform_user_menu(user_id,menu_key,granted_by) VALUES(?,?,?)`, userID, menu, actor); err != nil {
			return err
		}
	}
	current := map[string]currentVehicleGrant{}
	rows, err := tx.QueryContext(ctx, `SELECT p.vin,COALESCE(p.valid_from,p.granted_at),p.valid_to,
COALESCE(h.id,0),h.valid_from,h.valid_to
FROM platform_user_vehicle p
LEFT JOIN platform_user_vehicle_grant_history h
  ON h.id=(SELECT MAX(latest.id) FROM platform_user_vehicle_grant_history latest WHERE latest.user_id=p.user_id AND latest.vin=p.vin)
WHERE p.user_id=? FOR UPDATE`, userID)
	if err != nil {
		return err
	}
	for rows.Next() {
		var vin string
		var validFrom time.Time
		var validTo sql.NullTime
		var historyID uint64
		var historyValidFrom, historyValidTo sql.NullTime
		if err := rows.Scan(&vin, &validFrom, &validTo, &historyID, &historyValidFrom, &historyValidTo); err != nil {
			rows.Close()
			return err
		}
		item := currentVehicleGrant{ValidFrom: validFrom, HistoryID: historyID}
		if validTo.Valid {
			value := validTo.Time
			item.ValidTo = &value
		}
		if historyValidFrom.Valid {
			value := historyValidFrom.Time
			item.HistoryValidFrom = &value
		}
		if historyValidTo.Valid {
			value := historyValidTo.Time
			item.HistoryValidTo = &value
		}
		current[strings.ToUpper(strings.TrimSpace(vin))] = item
	}
	if err := rows.Close(); err != nil {
		return err
	}
	selected := make(map[string]vehicleGrantMutation, len(grants))
	for _, grant := range grants {
		selected[grant.VIN] = grant
	}
	removedHistoryIDs := []uint64{}
	for vin, item := range current {
		if _, kept := selected[vin]; kept {
			continue
		}
		if item.HistoryID == 0 {
			return fmt.Errorf("active vehicle grant %s is missing history", vin)
		}
		if item.HistoryID > 0 {
			removedHistoryIDs = append(removedHistoryIDs, item.HistoryID)
			appendVehicleGrantChange(changes, vin, &item, nil)
		}
	}
	for _, historyID := range removedHistoryIDs {
		if _, err := tx.ExecContext(ctx, `UPDATE platform_user_vehicle_grant_history
SET valid_to=CASE WHEN valid_to IS NOT NULL AND valid_to<=NOW(3) THEN valid_to WHEN valid_from>NOW(3) THEN valid_from ELSE NOW(3) END,
revoked_by=?,updated_at=NOW(3) WHERE id=?`, actor, historyID); err != nil {
			return err
		}
	}
	if len(grants) == 0 {
		if _, err := tx.ExecContext(ctx, `DELETE FROM platform_user_vehicle WHERE user_id=?`, userID); err != nil {
			return err
		}
	} else {
		vins := grantVINs(grants)
		placeholders := strings.TrimSuffix(strings.Repeat("?,", len(vins)), ",")
		args := make([]any, 0, len(vins)+1)
		args = append(args, userID)
		for _, vin := range vins {
			args = append(args, vin)
		}
		if _, err := tx.ExecContext(ctx, `DELETE FROM platform_user_vehicle WHERE user_id=? AND vin NOT IN (`+placeholders+`)`, args...); err != nil {
			return err
		}
	}
	now := time.Now()
	for _, grant := range grants {
		existing, exists := current[grant.VIN]
		validFrom := now
		validTo := grant.ValidTo
		if grant.ValidFrom != nil {
			validFrom = *grant.ValidFrom
		} else if exists {
			validFrom = existing.ValidFrom
			validTo = existing.ValidTo
		}
		if exists {
			projectionMatches := existing.ValidFrom.Equal(validFrom) && equalOptionalTimes(existing.ValidTo, validTo)
			historyMatches := existing.HistoryValidFrom != nil && existing.HistoryValidFrom.Equal(validFrom) && equalOptionalTimes(existing.HistoryValidTo, validTo)
			if projectionMatches && historyMatches {
				continue
			}
			if _, err := tx.ExecContext(ctx, `UPDATE platform_user_vehicle SET valid_from=?,valid_to=?,source_system='manual',granted_by=? WHERE user_id=? AND vin=?`,
				validFrom, nullableTime(validTo), actor, userID, grant.VIN); err != nil {
				return err
			}
			if existing.HistoryID == 0 {
				return fmt.Errorf("active vehicle grant %s is missing history", grant.VIN)
			}
			if _, err := tx.ExecContext(ctx, `UPDATE platform_user_vehicle_grant_history
SET valid_from=?,valid_to=?,source_system='manual',granted_by=?,revoked_by='',updated_at=NOW(3) WHERE id=?`,
				validFrom, nullableTime(validTo), actor, existing.HistoryID); err != nil {
				return err
			}
			after := currentVehicleGrant{ValidFrom: validFrom, ValidTo: validTo, HistoryID: existing.HistoryID}
			appendVehicleGrantChange(changes, grant.VIN, &existing, &after)
			continue
		}
		if _, err := tx.ExecContext(ctx, `INSERT INTO platform_user_vehicle(user_id,vin,valid_from,valid_to,source_system,granted_by) VALUES(?,?,?,?,'manual',?)`,
			userID, grant.VIN, validFrom, nullableTime(validTo), actor); err != nil {
			return err
		}
		if _, err := tx.ExecContext(ctx, `INSERT INTO platform_user_vehicle_grant_history(user_id,vin,valid_from,valid_to,source_system,external_ref,granted_by)
VALUES(?,?,?,?, 'manual','',?)`, userID, grant.VIN, validFrom, nullableTime(validTo), actor); err != nil {
			return err
		}
		after := currentVehicleGrant{ValidFrom: validFrom, ValidTo: validTo}
		appendVehicleGrantChange(changes, grant.VIN, nil, &after)
	}
	return nil
}

func existingVINs(ctx context.Context, db *sql.DB, vins []string) (map[string]bool, error) {
	result := map[string]bool{}
	for start := 0; start < len(vins); start += 500 {
		end := start + 500
		if end > len(vins) {
			end = len(vins)
		}
		part := vins[start:end]
		placeholders := strings.TrimSuffix(strings.Repeat("?,", len(part)), ",")
		args := make([]any, len(part))
		for index := range part {
			args[index] = part[index]
		}
		rows, err := db.QueryContext(ctx, `SELECT vin FROM (SELECT vin FROM vehicle_identity_binding WHERE vin IS NOT NULL AND vin<>'' UNION SELECT vin FROM vehicle_realtime_snapshot WHERE vin IS NOT NULL AND vin<>'') v WHERE vin IN (`+placeholders+`)`, args...)
		if err != nil {
			return nil, err
		}
		for rows.Next() {
			var vin string
			if err := rows.Scan(&vin); err != nil {
				rows.Close()
				return nil, err
			}
			result[strings.ToUpper(strings.TrimSpace(vin))] = true
		}
		if err := rows.Close(); err != nil {
			return nil, err
		}
	}
	return result, nil
}

func normalizeMenus(values []string) []string {
	seen := map[string]bool{}
	menus := []string{}
	for _, value := range values {
		value = strings.ToLower(strings.TrimSpace(value))
		if customerMenuSet[value] && !seen[value] {
			seen[value] = true
			menus = append(menus, value)
		}
	}
	sort.Strings(menus)
	return menus
}

func normalizeVINs(values []string) []string {
	seen := map[string]bool{}
	vins := []string{}
	for _, value := range values {
		for _, part := range strings.FieldsFunc(value, func(r rune) bool {
			return r == ',' || r == '，' || r == ';' || r == '；' || r == '\n' || r == '\t' || r == ' '
		}) {
			vin := strings.ToUpper(strings.TrimSpace(part))
			if vin != "" && len(vin) <= 64 && !seen[vin] {
				seen[vin] = true
				vins = append(vins, vin)
			}
		}
	}
	sort.Strings(vins)
	return vins
}

func normalizeVehicleGrantMutations(input userMutation) ([]vehicleGrantMutation, error) {
	if len(input.VehicleGrants) == 0 {
		vins := normalizeVINs(input.VehicleVINs)
		grants := make([]vehicleGrantMutation, 0, len(vins))
		for _, vin := range vins {
			grants = append(grants, vehicleGrantMutation{VIN: vin})
		}
		return grants, nil
	}
	seen := map[string]bool{}
	grants := make([]vehicleGrantMutation, 0, len(input.VehicleGrants))
	for _, raw := range input.VehicleGrants {
		vin := strings.ToUpper(strings.TrimSpace(raw.VIN))
		if vin == "" || len(vin) > 64 {
			return nil, fmt.Errorf("车辆授权包含无效 VIN")
		}
		if seen[vin] {
			return nil, fmt.Errorf("车辆 %s 的授权区间重复", vin)
		}
		seen[vin] = true
		validFrom, err := parseVehicleGrantTime(raw.ValidFrom, true)
		if err != nil {
			return nil, fmt.Errorf("车辆 %s 的启用时间无效：%v", vin, err)
		}
		validTo, err := parseVehicleGrantTime(raw.ValidTo, false)
		if err != nil {
			return nil, fmt.Errorf("车辆 %s 的停用时间无效：%v", vin, err)
		}
		if validTo != nil && !validTo.After(*validFrom) {
			return nil, fmt.Errorf("车辆 %s 的停用时间必须晚于启用时间", vin)
		}
		grants = append(grants, vehicleGrantMutation{VIN: vin, ValidFrom: validFrom, ValidTo: validTo})
	}
	sort.Slice(grants, func(i, j int) bool { return grants[i].VIN < grants[j].VIN })
	return grants, nil
}

func parseVehicleGrantTime(value string, required bool) (*time.Time, error) {
	value = strings.TrimSpace(value)
	if value == "" {
		if required {
			return nil, fmt.Errorf("不能为空")
		}
		return nil, nil
	}
	if parsed, err := time.Parse(time.RFC3339Nano, value); err == nil {
		return &parsed, nil
	}
	shanghai := time.FixedZone("Asia/Shanghai", 8*60*60)
	for _, layout := range []string{"2006-01-02T15:04:05.999999999", "2006-01-02T15:04:05", "2006-01-02T15:04", "2006-01-02 15:04:05", "2006-01-02"} {
		if parsed, err := time.ParseInLocation(layout, value, shanghai); err == nil {
			return &parsed, nil
		}
	}
	return nil, fmt.Errorf("应为有效日期时间")
}

func grantVINs(grants []vehicleGrantMutation) []string {
	vins := make([]string, 0, len(grants))
	for _, grant := range grants {
		vins = append(vins, grant.VIN)
	}
	return vins
}

func nullableTime(value *time.Time) any {
	if value == nil {
		return nil
	}
	return *value
}

func equalOptionalTimes(left, right *time.Time) bool {
	if left == nil || right == nil {
		return left == nil && right == nil
	}
	return left.Equal(*right)
}

func appendVehicleGrantChange(changes *[]vehicleGrantAuditChange, vin string, before, after *currentVehicleGrant) {
	if changes == nil {
		return
	}
	change := vehicleGrantAuditChange{VIN: vin}
	if before != nil {
		change.Before = &vehicleGrantAuditSnapshot{ValidFrom: before.ValidFrom, ValidTo: before.ValidTo}
	}
	if after != nil {
		change.After = &vehicleGrantAuditSnapshot{ValidFrom: after.ValidFrom, ValidTo: after.ValidTo}
	}
	*changes = append(*changes, change)
}

func validatePassword(password string) error {
	if len(password) < 10 || len(password) > 128 {
		return fmt.Errorf("密码长度需为 10-128 位")
	}
	classes := 0
	if regexp.MustCompile(`[a-z]`).MatchString(password) {
		classes++
	}
	if regexp.MustCompile(`[A-Z]`).MatchString(password) {
		classes++
	}
	if regexp.MustCompile(`[0-9]`).MatchString(password) {
		classes++
	}
	if regexp.MustCompile(`[^A-Za-z0-9]`).MatchString(password) {
		classes++
	}
	if classes < 3 {
		return fmt.Errorf("密码需包含大小写字母、数字、特殊字符中的至少三类")
	}
	return nil
}

func randomSessionToken() (string, [sha256.Size]byte, error) {
	var raw [32]byte
	if _, err := rand.Read(raw[:]); err != nil {
		return "", [sha256.Size]byte{}, err
	}
	token := base64.RawURLEncoding.EncodeToString(raw[:])
	return token, sha256.Sum256([]byte(token)), nil
}

func randomHex(size int) (string, error) {
	raw := make([]byte, size)
	if _, err := rand.Read(raw); err != nil {
		return "", err
	}
	return hex.EncodeToString(raw), nil
}

func (s *authStore) cacheGet(key string) (platform.Principal, bool) {
	s.cacheMu.RLock()
	entry, ok := s.cache[key]
	s.cacheMu.RUnlock()
	now := time.Now()
	if !ok || now.After(entry.expiresAt) || now.Sub(entry.cachedAt) > localSessionCacheTTL {
		return platform.Principal{}, false
	}
	return entry.principal.Clone(), true
}

func (s *authStore) cachePut(key string, principal platform.Principal, expiresAt time.Time) {
	s.cacheMu.Lock()
	s.cache[key] = cachedSession{principal: principal.Clone(), expiresAt: expiresAt, cachedAt: time.Now()}
	s.cacheMu.Unlock()
}

func (s *authStore) invalidateUser(userID uint64) {
	subject := strconv.FormatUint(userID, 10)
	s.cacheMu.Lock()
	for key, entry := range s.cache {
		if entry.principal.SubjectID == subject {
			delete(s.cache, key)
		}
	}
	s.cacheMu.Unlock()
}

func (s *authStore) audit(ctx context.Context, actor, action, targetType, targetID, result string, detail any, remote string) {
	var detailJSON any
	if detail != nil {
		if encoded, err := json.Marshal(detail); err == nil {
			detailJSON = encoded
		}
	}
	_, _ = s.db.ExecContext(ctx, `INSERT INTO platform_auth_audit(actor,action,target_type,target_id,result,detail_json,remote_addr) VALUES(?,?,?,?,?,?,?)`, truncateUTF8(actor, 96), action, targetType, targetID, result, detailJSON, truncateUTF8(remote, 96))
}

func decodeAuthJSON(w http.ResponseWriter, r *http.Request, target any) bool {
	defer r.Body.Close()
	decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 2<<20))
	decoder.DisallowUnknownFields()
	if err := decoder.Decode(target); err != nil {
		httpx.WriteError(w, http.StatusBadRequest, "BAD_JSON", "请求 JSON 解析失败", "", requestTraceID(r))
		return false
	}
	return true
}

func remoteAddress(r *http.Request) string {
	if forwarded := strings.TrimSpace(strings.Split(r.Header.Get("X-Forwarded-For"), ",")[0]); forwarded != "" {
		return forwarded
	}
	host, _, err := net.SplitHostPort(r.RemoteAddr)
	if err == nil {
		return host
	}
	return r.RemoteAddr
}

func truncateUTF8(value string, max int) string {
	runes := []rune(strings.TrimSpace(value))
	if len(runes) > max {
		runes = runes[:max]
	}
	return string(runes)
}

func writeUserMutationError(w http.ResponseWriter, r *http.Request, err error, action string) {
	message := "无法" + action + "客户账号"
	if strings.Contains(strings.ToLower(err.Error()), "duplicate") {
		message = "用户名已存在"
	}
	httpx.WriteError(w, http.StatusConflict, "USER_MUTATION_FAILED", message, "", requestTraceID(r))
}