#!/usr/bin/env node
require("dotenv/config");

const fs = require("node:fs");
const path = require("node:path");

const { createPrismaClient } = require("../prismaClient");
const { maskApprovalIdentifier } = require("../services/integrations/wecomApproval");

const DEFAULT_REPORT_ROOT = path.resolve(__dirname, "../../../artifacts/qa-flow");
const DEFAULT_TARGETS = Object.freeze(["leave", "missed_punch"]);
const SUPPORTED_TARGETS = Object.freeze(["leave", "missed_punch", "outing", "overtime"]);
const REPORT_PRIVACY =
  "OA DB archive counts/status summaries/masked sp_no/template/userid prefixes only; no phone/email/token/secret/full userid/full template_id/full sp_no/reason text/attachments/comments/raw payload";

function printHelp() {
  process.stdout.write(`Usage: node src/scripts/check-wecom-approval-archive.js [options]

QA-only 企业微信审批自建留存离线读取检查。
该脚本只读取 OA DB，不调用企业微信 API，不写 OA/企微数据。

Options:
  --offline                      明确以离线模式验证 OA 自建留存可读。
  --format=text|json             输出格式，默认 text。
  --report-dir=<path>            报告目录，默认 artifacts/qa-flow/wecom-approval-archive-<timestamp>。
  --template=leave               只检查请假留存。
  --template=missed_punch        只检查补卡留存。
  --template=outing              只检查外出留存。
  --template=overtime            只检查加班留存。
  --status=<status>              按规范化状态过滤。
  --limit=<1..100>               最大读取条数，默认 20。
  --help                         显示帮助。

隐私边界：
  报告只输出计数、状态摘要、字段类型、脱敏 sp_no/template/userid 前缀和 finding 类型。
  不输出手机号、邮箱、token、secret、完整 userid、完整 template_id、完整 sp_no、原因全文、附件、评论或企微原始 payload。
`);
}

function timestamp() {
  return new Date().toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
}

function toSafeString(value, maxLength = 500) {
  if (value == null) return "";
  return String(value).trim().slice(0, maxLength);
}

function safeMessage(value) {
  return toSafeString(value, 500)
    .replace(/access_token=[^&\s]+/gi, "access_token=***")
    .replace(/[A-Za-z0-9+/=_-]{24,}/g, "***")
    .slice(0, 240);
}

function parseArgs(argv) {
  const options = {
    offline: false,
    format: "text",
    reportDir: path.join(DEFAULT_REPORT_ROOT, `wecom-approval-archive-${timestamp()}`),
    templates: [],
    status: "",
    limit: 20,
    help: false,
  };

  for (let index = 0; index < argv.length; index += 1) {
    const arg = argv[index];
    if (arg === "--help" || arg === "-h") {
      options.help = true;
    } else if (arg === "--offline") {
      options.offline = true;
    } else if (arg === "--format") {
      options.format = argv[index + 1] || options.format;
      index += 1;
    } else if (arg.startsWith("--format=")) {
      options.format = arg.slice("--format=".length);
    } else if (arg === "--report-dir") {
      options.reportDir = argv[index + 1] || options.reportDir;
      index += 1;
    } else if (arg.startsWith("--report-dir=")) {
      options.reportDir = arg.slice("--report-dir=".length);
    } else if (arg === "--template") {
      options.templates.push(toSafeString(argv[index + 1], 40));
      index += 1;
    } else if (arg.startsWith("--template=")) {
      options.templates.push(toSafeString(arg.slice("--template=".length), 40));
    } else if (arg === "--status") {
      options.status = toSafeString(argv[index + 1], 40);
      index += 1;
    } else if (arg.startsWith("--status=")) {
      options.status = toSafeString(arg.slice("--status=".length), 40);
    } else if (arg === "--limit") {
      options.limit = Number(argv[index + 1] || options.limit);
      index += 1;
    } else if (arg.startsWith("--limit=")) {
      options.limit = Number(arg.slice("--limit=".length));
    } else {
      throw new Error(`Unsupported argument: ${arg}`);
    }
  }

  if (!["text", "json"].includes(options.format)) {
    throw new Error(`Unsupported --format: ${options.format}`);
  }
  const uniqueTemplates = Array.from(new Set(options.templates.filter(Boolean)));
  for (const template of uniqueTemplates) {
    if (!SUPPORTED_TARGETS.includes(template)) {
      throw new Error(`Unsupported --template: ${template}`);
    }
  }
  options.templates = uniqueTemplates.length ? uniqueTemplates : [...DEFAULT_TARGETS];
  if (!Number.isFinite(options.limit) || options.limit < 1 || options.limit > 100) {
    throw new Error("--limit must be between 1 and 100");
  }
  options.limit = Math.floor(options.limit);
  return options;
}

function countBy(items, selector) {
  const counts = {};
  for (const item of items || []) {
    const key = toSafeString(selector(item), 80) || "unknown";
    counts[key] = (counts[key] || 0) + 1;
  }
  return counts;
}

function buildWhere(options) {
  const where = {
    template_type: { in: options.templates },
  };
  if (options.status) {
    where.normalized_status = options.status;
  }
  return where;
}

function sanitizeArchiveRow(row) {
  const participants = (row.participants || []).map((item) => ({
    role: item.role,
    nodeIndex: item.node_index,
    userIdPrefix: maskApprovalIdentifier(item.external_user_id),
    mappingStatus: item.mapping_status,
    current: Boolean(item.is_current),
  }));
  const actions = (row.actions || []).map((item) => ({
    actionType: item.action_type,
    operatorPrefix: maskApprovalIdentifier(item.operator_external_user_id),
    actionTime: item.action_time ? new Date(item.action_time).toISOString() : null,
    nodeIndex: item.node_index,
    source: item.source,
  }));
  const fieldSummaries = (row.field_summaries || []).map((item) => ({
    fieldName: item.display_allowed ? item.field_name : null,
    fieldType: item.field_type || "unknown",
    sensitiveLevel: item.sensitive_level,
    displayAllowed: Boolean(item.display_allowed),
  }));
  const findings = (row.reconcile_findings || []).map((item) => ({
    findingType: item.finding_type,
    status: item.status,
    severity: item.severity,
    source: item.source,
    detectedAt: item.detected_at ? new Date(item.detected_at).toISOString() : null,
  }));
  return {
    archiveId: row.id,
    spNoPrefix: maskApprovalIdentifier(row.sp_no),
    templateIdPrefix: maskApprovalIdentifier(row.template_id),
    templateType: row.template_type,
    normalizedStatus: row.normalized_status,
    submittedAt: row.submitted_at ? new Date(row.submitted_at).toISOString() : null,
    statusObservedAt: row.status_observed_at ? new Date(row.status_observed_at).toISOString() : null,
    completedAt: row.completed_at ? new Date(row.completed_at).toISOString() : null,
    lastSource: row.last_source,
    readabilityStatus: row.readability_status,
    singleTapApproveRisk: Boolean(row.single_tap_approve_risk),
    templateAdjustmentRequired: Boolean(row.template_adjustment_required),
    participantRoleCounts: countBy(participants, (item) => item.role),
    actionTypeCounts: countBy(actions, (item) => item.actionType),
    fieldTypeCounts: countBy(fieldSummaries, (item) => item.fieldType),
    openFindingCounts: countBy(findings, (item) => item.findingType),
    participants,
    actions,
    fieldSummaries,
    findings,
    counts: row._count || {},
  };
}

async function readArchiveRows(prisma, options) {
  return prisma.wecomApprovalArchive.findMany({
    where: buildWhere(options),
    orderBy: [
      { status_observed_at: "desc" },
      { updated_at: "desc" },
    ],
    take: options.limit,
    select: {
      id: true,
      sp_no: true,
      template_id: true,
      template_type: true,
      normalized_status: true,
      submitted_at: true,
      completed_at: true,
      status_observed_at: true,
      last_source: true,
      readability_status: true,
      single_tap_approve_risk: true,
      template_adjustment_required: true,
      participants: {
        take: 20,
        orderBy: [{ role: "asc" }, { node_index: "asc" }],
        select: {
          role: true,
          node_index: true,
          external_user_id: true,
          mapping_status: true,
          is_current: true,
        },
      },
      actions: {
        take: 30,
        orderBy: [{ action_time: "asc" }, { created_at: "asc" }],
        select: {
          action_type: true,
          operator_external_user_id: true,
          action_time: true,
          node_index: true,
          source: true,
        },
      },
      field_summaries: {
        take: 30,
        orderBy: [{ field_index: "asc" }],
        select: {
          field_name: true,
          field_type: true,
          sensitive_level: true,
          display_allowed: true,
        },
      },
      reconcile_findings: {
        where: { status: "open" },
        take: 20,
        orderBy: [{ detected_at: "desc" }],
        select: {
          finding_type: true,
          status: true,
          severity: true,
          source: true,
          detected_at: true,
        },
      },
      _count: {
        select: {
          participants: true,
          actions: true,
          field_summaries: true,
          attachment_summaries: true,
          callback_events: true,
          compensation_items: true,
          reconcile_findings: true,
        },
      },
    },
  });
}

function evaluateArchiveReport({ options, archives, error, configGaps }) {
  if (error) {
    return { status: "SKIP", conclusion: "BLOCKED_BY_EXTERNAL_CONFIG" };
  }
  if (configGaps.length || !archives.length) {
    return { status: "PARTIAL_ARCHIVE_NEEDS_DATA", conclusion: "PARTIAL_ARCHIVE_NEEDS_DATA" };
  }
  if (archives.some((item) => item.findings?.length)) {
    return { status: "PASS_WITH_FINDINGS", conclusion: "PASS_WITH_FINDINGS" };
  }
  if (!options.offline) {
    return { status: "PARTIAL_ARCHIVE_NEEDS_DATA", conclusion: "PARTIAL_ARCHIVE_NEEDS_DATA" };
  }
  return { status: "PASS_ARCHIVE_HISTORY_READABLE", conclusion: "PASS_ARCHIVE_HISTORY_READABLE" };
}

async function executeArchiveCheck(options, deps = {}) {
  const generatedAt = deps.generatedAt || new Date().toISOString();
  const env = deps.env || process.env;
  const configGaps = [];
  const mainBlockers = [];
  let ownedPrisma = null;
  let ownedPool = null;
  let rawRows = [];
  let readError = null;

  if (!options.offline) {
    configGaps.push({
      id: "offline_mode",
      status: "NEEDS_CONFIG",
      reason: "run_with_--offline_to_prove_no_wecom_api_dependency",
    });
  }

  try {
    let prisma = deps.prisma;
    if (!prisma) {
      if (!env.DATABASE_URL) {
        throw new Error("DATABASE_URL is required for OA archive offline read");
      }
      const created = deps.createPrismaClientImpl ? deps.createPrismaClientImpl() : createPrismaClient();
      ownedPrisma = created.prisma;
      ownedPool = created.pool;
      prisma = ownedPrisma;
    }
    rawRows = await (deps.readArchiveRowsImpl || readArchiveRows)(prisma, options);
  } catch (error) {
    readError = error;
    mainBlockers.push({
      id: "archive_db_read",
      reason: "oa_archive_db_read_failed",
      message: safeMessage(error?.message || error),
    });
  } finally {
    if (ownedPrisma?.$disconnect) {
      await ownedPrisma.$disconnect().catch(() => null);
    }
    if (ownedPool?.end) {
      await ownedPool.end().catch(() => null);
    }
  }

  const archives = rawRows.map(sanitizeArchiveRow);
  if (!readError && !archives.length) {
    configGaps.push({
      id: "archive_history_data",
      status: "NEEDS_CONFIG",
      reason: "no_wecom_approval_archive_rows_for_scope",
    });
  }
  const conclusion = evaluateArchiveReport({ options, archives, error: readError, configGaps });

  return {
    mode: "qa_only",
    generatedAt,
    status: conclusion.status,
    conclusion: conclusion.conclusion,
    privacy: REPORT_PRIVACY,
    scope: {
      issue: "WARCH1",
      source: "OA_DB_ONLY",
      offline: Boolean(options.offline),
      wecomApiCalls: false,
      writeBehavior: "read-only OA DB; no OA writes, no WeCom reads, no WeCom writes",
      targets: options.templates,
      deepMirror: "not_started",
      nextStage: "wecom_attendance_approval_mirror_v1_after_WARCH1_acceptance",
    },
    filters: {
      templates: options.templates,
      status: options.status || null,
      limit: options.limit,
    },
    checks: {
      archiveRead: {
        id: "archive_history_read",
        status: readError ? "BLOCKED" : (archives.length ? "OK" : "NEEDS_DATA"),
        count: archives.length,
        statusCounts: countBy(archives, (item) => item.normalizedStatus),
        templateCounts: countBy(archives, (item) => item.templateType),
        singleTapApproveRiskCount: archives.filter((item) => item.singleTapApproveRisk).length,
      },
      archives,
    },
    configGaps,
    mainBlockers,
  };
}

function ensureReportDir(reportDir) {
  fs.mkdirSync(reportDir, { recursive: true });
}

function writeReport(reportDir, report) {
  ensureReportDir(reportDir);
  const filePath = path.join(reportDir, "summary.json");
  fs.writeFileSync(filePath, `${JSON.stringify(report, null, 2)}\n`, "utf8");
  return filePath;
}

function printText(report, reportPath) {
  process.stdout.write(`[wecom-approval-archive] status=${report.status} conclusion=${report.conclusion}\n`);
  process.stdout.write(`[wecom-approval-archive] report=${reportPath}\n`);
  process.stdout.write(`[wecom-approval-archive] privacy=${report.privacy}\n`);
  process.stdout.write(`[wecom-approval-archive] offline=${report.scope.offline} targets=${report.scope.targets.join(",")}\n`);
  if (report.configGaps?.length) {
    process.stdout.write(`[wecom-approval-archive] configGaps=${JSON.stringify(report.configGaps)}\n`);
  }
  if (report.mainBlockers?.length) {
    process.stdout.write(`[wecom-approval-archive] mainBlockers=${JSON.stringify(report.mainBlockers)}\n`);
  }
}

async function main() {
  const options = parseArgs(process.argv.slice(2));
  if (options.help) {
    printHelp();
    return;
  }
  const report = await executeArchiveCheck(options);
  const reportPath = writeReport(options.reportDir, report);
  if (options.format === "json") {
    process.stdout.write(`${JSON.stringify({ ...report, reportPath }, null, 2)}\n`);
  } else {
    printText(report, reportPath);
  }
}

if (require.main === module) {
  main().catch((error) => {
    process.stderr.write(`[wecom-approval-archive][FAIL] ${safeMessage(error?.message || error)}\n`);
    process.exitCode = 1;
  });
}

module.exports = {
  buildWhere,
  evaluateArchiveReport,
  executeArchiveCheck,
  parseArgs,
  sanitizeArchiveRow,
};