from datetime import datetime
from decimal import Decimal, InvalidOperation
from functools import wraps
import hashlib
import hmac
import logging
import secrets
from typing import Any, Callable

from flask import (
    Flask,
    abort,
    flash,
    jsonify,
    redirect,
    render_template,
    request,
    session,
    url_for,
)
from pymysql import MySQLError
from werkzeug.exceptions import HTTPException

from chatwoot_guest import ChatwootGuestError, create_guest_conversation
from chatwoot_proxy import proxy_chatwoot
from config import CONFIG
from maxkb_chatwoot_bridge import handle_chatwoot_webhook
from repository import MappingError, PlatformRepository, decimal_string
import threading


app = Flask(__name__)
app.config.update(
    JSON_AS_ASCII=False,
    SECRET_KEY=CONFIG.secret_key,
    SESSION_COOKIE_NAME="api_interface_session",
    SESSION_COOKIE_HTTPONLY=True,
    SESSION_COOKIE_SAMESITE="Lax",
    SESSION_COOKIE_SECURE=CONFIG.session_cookie_secure,
    PERMANENT_SESSION_LIFETIME=28800,
    MAX_CONTENT_LENGTH=1024 * 1024,
)

logging.basicConfig(
    level=logging.DEBUG if CONFIG.debug else logging.INFO,
    format="%(asctime)s %(levelname)s %(name)s %(message)s",
)

repo = PlatformRepository()


def payload() -> dict[str, Any]:
    data: dict[str, Any] = {}
    body = request.get_json(silent=True)
    if isinstance(body, dict):
        data.update(body)
    data.update(request.form.to_dict())
    data.update(request.args.to_dict())
    return data


def api_auth(view: Callable):
    @wraps(view)
    def wrapped(*args, **kwargs):
        if CONFIG.api_key:
            provided = request.headers.get("X-API-Key", "")
            if not hmac.compare_digest(provided, CONFIG.api_key):
                return jsonify(
                    {"error": "unauthorized", "message": "API Key 無效"}
                ), 401
        return view(*args, **kwargs)

    return wrapped


def login_required(view: Callable):
    @wraps(view)
    def wrapped(*args, **kwargs):
        if not session.get("username"):
            return redirect(url_for("login"))
        return view(*args, **kwargs)

    return wrapped


def csrf_token() -> str:
    token = session.get("csrf_token")
    if not token:
        token = secrets.token_urlsafe(32)
        session["csrf_token"] = token
    return str(token)


def verify_csrf() -> None:
    received = str(request.form.get("csrf_token", ""))
    saved = str(session.get("csrf_token", ""))
    if not received or not saved or not hmac.compare_digest(received, saved):
        abort(403, description="CSRF 验证失败")


def required_text(
    data: dict[str, Any],
    name: str,
    max_length: int = 191,
) -> str:
    value = str(data.get(name, "")).strip()
    if not value:
        raise ValueError(f"{name} 為必填")
    if len(value) > max_length:
        raise ValueError(f"{name} 長度不可超過 {max_length}")
    return value


def is_api_request() -> bool:
    return request.path == "/health" or request.path.startswith("/platform/")


def update_member_session(account: dict[str, Any]) -> None:
    """將目前會員資料同步到 Flask Session。"""
    session["username"] = account.get("username_clean") or account.get("username") or ""
    session["username_clean"] = account.get("username_clean") or ""
    session["raw_username"] = account.get("raw_username") or ""
    session["uid"] = account.get("uid")
    session["account_status"] = account.get("status") or "normal"
    session["locked_reason"] = account.get("locked_reason") or ""
    session["member_type"] = account.get("member_type") or ""
    session["vip_level"] = account.get("vip_level") or ""
    session["tier"] = account.get("tier") or ""


def build_chatwoot_user() -> dict[str, Any]:
    """建立傳給 Chatwoot 前端 SDK 的安全會員資料。

    identifier 直接使用 username_clean，作為 Chatwoot 抓取會員名的關鍵標識。
    顯示名稱與自訂屬性同樣使用 username_clean。
    """
    username = str(
        session.get("username_clean")
        or session.get("username")
        or ""
    ).strip()
    uid = session.get("uid")

    # Chatwoot 的 identifier 直接使用登入會員名。
    # 例如：yongle001，而不是 member-311。
    identifier = username if username else ""

    identifier_hash = ""
    if identifier and CONFIG.chatwoot_identity_secret:
        identifier_hash = hmac.new(
            CONFIG.chatwoot_identity_secret.encode("utf-8"),
            identifier.encode("utf-8"),
            hashlib.sha256,
        ).hexdigest()

    return {
        "is_authenticated": bool(identifier),
        "visitor_type": "member" if identifier else "guest",
        "identifier": identifier,
        "identifier_hash": identifier_hash,
        "name": username,
        "username": username,
        "uid": uid,
        "account_status": str(
            session.get("account_status", "")
        ),
        "locked_reason": str(
            session.get("locked_reason", "")
        ),
        "member_type": str(
            session.get("member_type", "")
        ),
        "vip_level": str(
            session.get("vip_level", "")
        ),
        "tier": str(
            session.get("tier", "")
        ),
    }


@app.context_processor
def inject_template_values():
    use_guest_widget = request.path.startswith("/guest-customer-service")
    guest_token = CONFIG.chatwoot_guest_website_token
    if use_guest_widget and guest_token:
        # 依访客实际访问的 host（IP 或 test.pubuli.com）加载 /cw，避免写死域名
        base_url = f"{request.scheme}://{request.host}/cw"
    else:
        base_url = CONFIG.chatwoot_base_url
    website_token = (
        guest_token
        if use_guest_widget and guest_token
        else CONFIG.chatwoot_website_token
    )
    chatwoot_config = {
        "enabled": bool(
            CONFIG.chatwoot_enabled
            and base_url
            and website_token
        ),
        "base_url": base_url,
        "website_token": website_token,
        "debug": CONFIG.chatwoot_debug,
        "csrf_token": csrf_token(),
        "guest_new_path": "/guest-chat/new",
    }

    return {
        "app_name": CONFIG.app_name,
        "csrf_token": csrf_token,
        "chatwoot_config": chatwoot_config,
        "chatwoot_user": build_chatwoot_user(),

        # 只在登出後首次渲染未登入頁面時為 True。
        # 使用 pop() 確保該標記只消費一次。
        "chatwoot_guest_reset_required": bool(
            session.pop(
                "chatwoot_guest_reset_required",
                False,
            )
        ),
    }


@app.get("/")
def root():
    if session.get("username"):
        return redirect(url_for("home"))
    return redirect(url_for("login"))


@app.get("/guest-customer-service")
def guest_customer_service():
    """遊客客服頁：不登入、不查會員資料，只載入匿名 Chatwoot。"""
    return render_template(
        "guest_customer_service.html",
        is_guest=True,
    )


@app.route(
    "/cw/",
    defaults={"subpath": ""},
    methods=["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"],
)
@app.route(
    "/cw/<path:subpath>",
    methods=["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"],
)
def chatwoot_guest_proxy(subpath: str):
    """把本機 Chatwoot widget 代理進來，才能注入略過「開始對話」的腳本。"""
    return proxy_chatwoot(subpath)


@app.route(
    "/vite/<path:subpath>",
    methods=["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"],
)
def chatwoot_vite_proxy(subpath: str):
    """widget HTML 用絕對路徑 /vite/assets，需一併代理。"""
    return proxy_chatwoot(f"vite/{subpath}")


@app.route(
    "/api/v1/widget/",
    defaults={"subpath": ""},
    methods=["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"],
)
@app.route(
    "/api/v1/widget/<path:subpath>",
    methods=["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"],
)
def chatwoot_widget_api_proxy(subpath: str):
    """widget 會打同源 /api/v1/widget。"""
    suffix = f"api/v1/widget/{subpath}" if subpath else "api/v1/widget"
    return proxy_chatwoot(suffix)


@app.route(
    "/rails/<path:subpath>",
    methods=["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"],
)
def chatwoot_rails_proxy(subpath: str):
    """歡迎圖走 Active Storage，widget 會打同源 /rails/active_storage。"""
    return proxy_chatwoot(f"rails/{subpath}")


@app.post("/guest-chat/new")
def guest_chat_new():
    """為遊客預先建立 Chatwoot 對話，前端 setUser 後可略過「開始對話」。"""
    received = str(request.headers.get("X-CSRF-Token", ""))
    saved = str(session.get("csrf_token", ""))
    if not received or not saved or not hmac.compare_digest(received, saved):
        return jsonify(
            {"error": "csrf_failed", "message": "CSRF 验证失败"}
        ), 403

    try:
        created = create_guest_conversation()
    except ChatwootGuestError as exc:
        app.logger.exception("建立游客对话失败")
        return jsonify(
            {"error": "chatwoot_guest_failed", "message": str(exc)}
        ), 502

    identifier = created["identifier"]
    identifier_hash = ""
    if identifier and CONFIG.chatwoot_identity_secret:
        identifier_hash = hmac.new(
            CONFIG.chatwoot_identity_secret.encode("utf-8"),
            identifier.encode("utf-8"),
            hashlib.sha256,
        ).hexdigest()

    return jsonify(
        {
            "identifier": identifier,
            "identifier_hash": identifier_hash,
            "name": created["name"],
            "source_id": created.get("source_id") or "",
            "widget_token": created.get("widget_token") or "",
        }
    )


@app.post("/webhook/bot1/chatwoot")
def chatwoot_maxkb_webhook():
    """本機 Chatwoot Agent Bot → PAI MaxKB 橋接（對齊正式站 :6666 路徑）。"""
    body = request.get_json(silent=True)
    if not isinstance(body, dict):
        return jsonify({"ok": False, "error": "invalid_json"}), 400

    # Chatwoot SafeFetch 讀超時約 20s；MaxKB 常更久，先快速 200 再背景回覆。
    def _run() -> None:
        try:
            result = handle_chatwoot_webhook(body)
            app.logger.info("Chatwoot→MaxKB 橋接完成: %s", result)
        except Exception:
            app.logger.exception("Chatwoot→MaxKB 橋接失敗")

    threading.Thread(target=_run, daemon=True).start()
    return jsonify({"ok": True, "accepted": True})


@app.route("/login", methods=["GET", "POST"])
def login():
    if session.get("username"):
        return redirect(url_for("home"))

    username = ""
    if request.method == "POST":
        verify_csrf()
        username = str(request.form.get("username", "")).strip()

        if not username or len(username) > 191:
            flash("请输入有效的用户名", "error")
        else:
            try:
                account = repo.get_user_account(username)
            except Exception as exc:
                app.logger.exception("会员登录查询失败")
                flash(f"登录验证失败：{exc}", "error")
            else:
                if not account["is_exist"]:
                    flash("该用户名不存在于 members 表", "error")
                else:
                    session.clear()
                    update_member_session(account)
                    session.permanent = True
                    csrf_token()
                    return redirect(url_for("home"))

    return render_template("login.html", username=username)


@app.get("/home")
@login_required
def home():
    username = str(session["username"])
    warning = ""
    account = {
        "username": username,
        "username_clean": username,
        "raw_username": str(session.get("raw_username", username)),
        "status": str(session.get("account_status", "normal")),
        "locked_reason": str(session.get("locked_reason", "")),
    }

    try:
        refreshed = repo.get_user_account(username)
        if refreshed["is_exist"]:
            account = refreshed
            update_member_session(refreshed)
    except Exception as exc:
        app.logger.exception("帳戶狀態刷新失敗")
        warning = str(exc)

    games = [
        {"icon": "🎰", "name": "幸運拉霸", "category": "電子遊戲"},
        {"icon": "🃏", "name": "經典百家樂", "category": "真人遊戲"},
        {"icon": "⚽", "name": "體育競猜", "category": "體育遊戲"},
        {"icon": "🎲", "name": "骰寶大廳", "category": "桌面遊戲"},
        {"icon": "🐉", "name": "龍虎鬥", "category": "真人遊戲"},
        {"icon": "🚀", "name": "飛行挑戰", "category": "休閒遊戲"},
    ]

    return render_template(
        "home.html",
        username=username,
        account=account,
        warning=warning,
        games=games,
    )


@app.get("/customer-service")
@login_required
def customer_service():
    username = str(session["username"])
    withdrawals: list[dict[str, Any]] = []
    deposits: list[dict[str, Any]] = []
    account: dict[str, Any] = {}
    error = ""

    try:
        account = repo.get_user_account(username)
        if account.get("is_exist"):
            update_member_session(account)
        withdrawals = repo.get_withdraw_orders(username, unfinished_only=True)
        deposits = repo.get_deposit_orders(username)[:10]
    except Exception as exc:
        app.logger.exception("客服頁資料查詢失敗")
        error = str(exc)

    return render_template(
        "customer_service.html",
        username=username,
        account=account,
        withdrawals=withdrawals,
        deposits=deposits,
        error=error,
    )


@app.post("/logout")
@login_required
def logout():
    verify_csrf()

    # 清除會員 Session 後，保留一個一次性標記。
    # 登出後首次載入未登入頁面時，前端會再次 reset Chatwoot，
    # 避免上一位會員身份殘留在匿名訪客頁面。
    session.clear()
    session["chatwoot_guest_reset_required"] = True

    return redirect(url_for("login"))


@app.get("/health")
@app.get("/platform/health")
def health():
    return jsonify(
        {
            "service": CONFIG.app_name,
            "status": "ok",
            "read_only_mode": CONFIG.read_only_mode,
        }
    )


@app.get("/platform/get-user-account")
@api_auth
def get_user_account():
    username = required_text(payload(), "username")
    return jsonify(repo.get_user_account(username))


@app.get("/platform/withdraw-orders")
@api_auth
def withdraw_orders():
    username = required_text(payload(), "username")
    return jsonify(repo.get_withdraw_orders(username, unfinished_only=False))


@app.get("/platform/withdraw-orders-unfinish")
@api_auth
def withdraw_orders_unfinish():
    username = required_text(payload(), "username")
    return jsonify(repo.get_withdraw_orders(username, unfinished_only=True))


@app.get("/platform/deposit-orders")
@app.get("/platform/deposit-not-received")
@api_auth
def deposit_orders():
    data = payload()
    username = required_text(data, "username")

    amount: Decimal | None = None
    raw_amount = str(data.get("amount", "")).strip()
    if raw_amount:
        try:
            amount = Decimal(raw_amount)
        except InvalidOperation as exc:
            raise ValueError("amount 格式不正確") from exc

    created_at: datetime | None = None
    raw_created_at = str(data.get("created_at", "")).strip()
    if raw_created_at:
        try:
            created_at = datetime.fromisoformat(
                raw_created_at.replace("Z", "+00:00")
            )
            if created_at.tzinfo is not None:
                created_at = created_at.astimezone().replace(tzinfo=None)
        except ValueError as exc:
            raise ValueError("created_at 必須為 ISO-8601 日期時間") from exc

    return jsonify(repo.get_deposit_orders(username, amount, created_at))


@app.route("/platform/apply-activity", methods=["POST", "PUT"])
@api_auth
def apply_activity():
    data = payload()
    username = required_text(data, "username")
    activity_id = required_text(data, "activity_id", max_length=64)
    return jsonify(repo.apply_activity(username, activity_id))


@app.route("/platform/fix-balance", methods=["POST", "PUT"])
@api_auth
def fix_balance():
    username = required_text(payload(), "username")
    account = repo.get_user_account(username)
    if not account["is_exist"]:
        return jsonify({"error": "not_found", "message": "找不到用戶"}), 404

    balance = repo.get_balance(username)
    repo.log_balance_fix(username, balance)
    return jsonify(
        {
            "username": account["username_clean"],
            "balance": decimal_string(balance),
            "simulated": True,
            "message": "唯讀測試模式：僅回傳 members.balance，未修改資料庫",
        }
    )


@app.errorhandler(403)
def handle_forbidden_error(exc: HTTPException):
    message = getattr(exc, "description", "拒絕存取")
    if is_api_request():
        return jsonify({"error": "forbidden", "message": message}), 403
    return render_template(
        "error.html", title="請求驗證失敗", message=message
    ), 403


@app.errorhandler(ValueError)
def handle_value_error(exc: ValueError):
    if is_api_request():
        return jsonify({"error": "bad_request", "message": str(exc)}), 400
    return render_template(
        "error.html", title="請求錯誤", message=str(exc)
    ), 400


@app.errorhandler(MappingError)
def handle_mapping_error(exc: MappingError):
    if is_api_request():
        return jsonify({"error": "mapping_error", "message": str(exc)}), 500
    return render_template(
        "error.html", title="資料映射錯誤", message=str(exc)
    ), 500


@app.errorhandler(MySQLError)
def handle_mysql_error(exc: MySQLError):
    app.logger.exception("Database error")
    message = str(exc) if CONFIG.debug else "資料庫查詢失敗，請檢查連線與欄位設定"
    if is_api_request():
        return jsonify({"error": "database_error", "message": message}), 500
    return render_template(
        "error.html", title="資料庫錯誤", message=message
    ), 500


@app.errorhandler(HTTPException)
def handle_http_exception(exc: HTTPException):
    status_code = int(exc.code or 500)
    message = str(exc.description or exc.name)
    if is_api_request():
        return jsonify(
            {
                "error": exc.name.lower().replace(" ", "_"),
                "message": message,
            }
        ), status_code
    return render_template(
        "error.html", title=exc.name, message=message
    ), status_code


@app.errorhandler(Exception)
def handle_unexpected_error(exc: Exception):
    app.logger.exception("Unexpected error")
    if is_api_request():
        return jsonify(
            {"error": "internal_error", "message": "系統內部錯誤"}
        ), 500
    return render_template(
        "error.html", title="系統錯誤", message="系統內部錯誤"
    ), 500


if __name__ == "__main__":
    app.logger.info(
        "啟動 %s host=%s port=%s read_only=%s",
        CONFIG.app_name,
        CONFIG.host,
        CONFIG.port,
        CONFIG.read_only_mode,
    )
    app.run(host=CONFIG.host, port=CONFIG.port, debug=CONFIG.debug)