#!/usr/bin/env node

import { randomBytes } from 'node:crypto';
import { writeFile } from 'node:fs/promises';

const APP_ID = process.env.XIAOSHU_PARSE_APP_ID || '7pIbDBJmKx_main';
const MASTER_KEY = process.env.XIAOSHU_MASTER_KEY || '';
const PARSE_URL = (process.env.XIAOSHU_PARSE_URL || 'https://server.xiaoshu.pro/parse').replace(/\/$/, '');
const FUNCTION_URL = PARSE_URL.replace(/\/parse$/, '/api/functions');
const commit = process.argv.includes('--commit');
const refreshExisting = process.argv.includes('--refresh-existing');
if (!MASTER_KEY) throw new Error('缺少 XIAOSHU_MASTER_KEY');

const headers = {
  'X-Parse-Application-Id': APP_ID,
  'X-Parse-Master-Key': MASTER_KEY,
  'Content-Type': 'application/json',
};

const sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));

async function parse(path, init = {}, retries = 4) {
  try {
    const response = await fetch(`${PARSE_URL}${path}`, { ...init, headers: { ...headers, ...(init.headers || {}) } });
    const payload = await response.json().catch(() => ({}));
    if (!response.ok || payload.error) {
      const error = new Error(typeof payload.error === 'string' ? payload.error : JSON.stringify(payload.error || { status: response.status }));
      error.status = response.status;
      throw error;
    }
    return payload;
  } catch (error) {
    if (!retries || (error.status && error.status < 500 && error.status !== 429)) throw error;
    await sleep((5 - retries) * 800);
    return parse(path, init, retries - 1);
  }
}

const config = (await parse('/config')).params || {};
const legacyUrl = String(config.legacyScheduleApiUrl || '');
const legacyApiId = String(config.legacyScheduleApiId || '');
const legacyApiKey = String(config.legacyScheduleApiKey || '');
if (!legacyUrl || !legacyApiId || !legacyApiKey) throw new Error('生产 Parse Config 未配置旧系统只读接口');

const companyRow = (await parse('/classes/Company?limit=1&keys=objectId')).results?.[0];
if (!companyRow?.objectId) throw new Error('生产 Parse 未找到 Company');
const company = { __type: 'Pointer', className: 'Company', objectId: companyRow.objectId };

async function legacyPage(page) {
  const query = new URLSearchParams({ action: 'user_list', uid: '0', psize: '1000', cpage: String(page), apiId: legacyApiId, apiKey: legacyApiKey });
  const response = await fetch(`${legacyUrl}${legacyUrl.includes('?') ? '&' : '?'}${query}`, { headers: { accept: 'application/json' } });
  const payload = await response.json().catch(() => ({}));
  if (!response.ok || Number(payload.retcode) === -1) throw new Error(payload.retmsg || `旧账号接口失败：${response.status}`);
  let result = payload.result;
  if (typeof result === 'string') result = JSON.parse(result);
  return { items: Array.isArray(result) ? result : [], page: payload.page || {} };
}

async function legacyUsers() {
  const first = await legacyPage(1);
  const total = Number(first.page.itemCount ?? first.items.length);
  const pageCount = Math.max(1, Number(first.page.pageCount || Math.ceil(total / 1000)));
  const items = [...first.items];
  for (let page = 2; page <= pageCount; page += 1) items.push(...(await legacyPage(page)).items);
  const byId = new Map();
  for (const row of items) {
    const id = Number(row.UserID ?? row.userId ?? 0);
    if (id > 0) byId.set(id, row);
  }
  return { total, rows: [...byId.values()], duplicates: items.length - byId.size };
}

async function parseUsers() {
  const rows = [];
  for (let skip = 0; ; skip += 1000) {
    const query = new URLSearchParams({
      where: JSON.stringify({ company }), limit: '1000', skip: String(skip), order: 'objectId',
      keys: 'objectId,username,legacyUserId,legacyGroupId,legacyUserData,isAdmin,isDeleted,identityType',
    });
    const page = (await parse(`/users?${query}`)).results || [];
    rows.push(...page);
    if (page.length < 1000) break;
  }
  return rows;
}

function text(value) { return String(value ?? '').trim(); }
function number(value, fallback = 0) { const parsed = Number(value); return Number.isFinite(parsed) ? parsed : fallback; }
function first(row, ...keys) { for (const key of keys) if (row[key] !== undefined && row[key] !== null) return row[key]; return undefined; }
function dateIso(value) {
  const raw = text(value);
  if (!raw) return '';
  const normalized = raw.replace(' ', 'T');
  const parsed = new Date(normalized + (/Z$|[+-]\d\d:\d\d$/.test(normalized) ? '' : '+08:00'));
  return Number.isNaN(parsed.getTime()) ? '' : parsed.toISOString();
}
function safeUsername(raw, legacyId) {
  const value = text(raw).slice(0, 120);
  return value || `legacy_${legacyId}`;
}

function projection(row) {
  const legacyUserId = number(first(row, 'UserID', 'userId'));
  const username = safeUsername(first(row, 'UserName', 'username'), legacyUserId);
  const nickname = text(first(row, 'HoneyName', 'nickname'));
  const realName = text(first(row, 'TrueName', 'RealName', 'realName'));
  const mobile = text(first(row, 'Mobile', 'mobile'));
  const legacyGroupId = number(first(row, 'GroupID', 'groupId'));
  const parentUserId = number(first(row, 'ParentUserID', 'parentUserId'));
  const registeredAt = dateIso(first(row, 'RegTime', 'registeredAt'));
  const lastLoginAt = dateIso(first(row, 'LastLoginTimes', 'LastLoginTime', 'lastLoginAt'));
  const loginCount = number(first(row, 'LoginTimes', 'loginCount'));
  const state = number(first(row, 'State', 'state'), 1);
  // Deliberate field whitelist: password hashes, payment passwords, security
  // questions/answers, sessions and API tokens are never copied.
  const legacyUserData = {
    UserID: legacyUserId,
    UserName: username,
    HoneyName: nickname,
    TrueName: realName,
    Email: text(first(row, 'Email', 'email')),
    Mobile: mobile,
    GroupID: legacyGroupId,
    ParentUserID: parentUserId,
    RegTime: registeredAt,
    LastLoginTime: lastLoginAt,
    LoginTimes: loginCount,
    State: state,
    Purse: number(first(row, 'Purse', 'purse')),
    SilverCoin: number(first(row, 'SilverCoin', 'silverCoin')),
    UserExp: number(first(row, 'UserExp', 'userExp')),
    UserPoint: number(first(row, 'UserPoint', 'userPoint')),
    DummyPurse: number(first(row, 'DummyPurse', 'dummyPurse')),
    UserCreit: number(first(row, 'UserCreit', 'Credit', 'credit')),
    VIP: number(first(row, 'VIP', 'vip')),
  };
  const body = {
    company, sourceKey: `legacy-sync:user:${legacyUserId}`, legacyUserId, legacyGroupId, legacyUserData,
    nickname, realName, mobile, isDisabled: state === 0, isDeleted: false,
  };
  if (registeredAt) body.registeredAt = { __type: 'Date', iso: registeredAt };
  return { legacyUserId, username, body };
}

function requestGroups(requests, size = 40) {
  const groups = [];
  for (let index = 0; index < requests.length; index += size) groups.push(requests.slice(index, index + size));
  return groups;
}

async function executeGroups(groups) {
  for (let index = 0; index < groups.length; index += 1) {
    const result = await parse('/batch', { method: 'POST', body: JSON.stringify({ requests: groups[index] }) });
    const failures = (result || []).filter((item) => item.error);
    if (failures.length) throw new Error(`账号批次 ${index + 1} 写入失败：${JSON.stringify(failures.slice(0, 3))}`);
    process.stderr.write(`账号写入 ${index + 1}/${groups.length}\n`);
  }
}

let tempUserId = '';
let tempFunctionId = '';
let tempToken = '';
let tempPath = '';

async function refreshIdentities() {
  const suffix = `${Date.now()}_${randomBytes(4).toString('hex')}`;
  const username = `identity_refresh_${suffix}`;
  const password = `${randomBytes(24).toString('base64url')}Aa9!`;
  tempPath = `xiaoshu/system/refresh-identities-${suffix}`;
  const createdUser = await parse('/users', { method: 'POST', body: JSON.stringify({
    username, password, isAdmin: true, role: 'admin', roles: ['admin', 'super-admin'], adminRoleKey: 'super-admin',
    company, realName: '账号迁移身份刷新临时管理员', testCreatedBy: 'backfill-legacy-users',
  }) });
  tempUserId = createdUser.objectId;
  tempToken = createdUser.sessionToken || (await parse('/login', { method: 'POST', body: JSON.stringify({ username, password }) })).sessionToken;
  const code = String.raw`
async function handler(request,response){
  try{
    const current=request.user||(typeof user!=='undefined'?user:null);if(!current)return response.status(401).json({success:false,message:'需要超级管理员会话'});await current.fetch({useMasterKey:true});
    const roles=Array.isArray(current.get('roles'))?current.get('roles').map(String):[];if(current.get('adminRoleKey')!=='super-admin'&&!roles.includes('super-admin'))return response.status(403).json({success:false,message:'仅超级管理员可执行'});
    const company=current.get('company'),companyId=company&&company.id;if(!companyId)return response.status(400).json({success:false,message:'管理员缺少帐套'});
    const rows=await Psql.query('WITH coach AS (SELECT DISTINCT uid FROM (SELECT NULLIF(CAST("pl" AS text),\'\') uid FROM "CourseAppointment" WHERE "company"=$1 UNION SELECT NULLIF(CAST("fxpl" AS text),\'\') FROM "CourseAppointment" WHERE "company"=$1 UNION SELECT NULLIF(CAST("jsmz" AS text),\'\') FROM "LessonRecord" WHERE "company"=$1) q WHERE uid IS NOT NULL),student AS (SELECT DISTINCT uid FROM (SELECT NULLIF(CAST("szyh" AS text),\'\') uid FROM "CourseAppointment" WHERE "company"=$1 UNION SELECT NULLIF(CAST("userId" AS text),\'\') FROM "DailyStudyRecord" WHERE "company"=$1 UNION SELECT NULLIF(CAST("yhid" AS text),\'\') FROM "CourseBinding" WHERE "company"=$1 UNION SELECT NULLIF(CAST("yhid" AS text),\'\') FROM "PracticeRecord" WHERE "company"=$1) q WHERE uid IS NOT NULL),classified AS (SELECT u."objectId",CASE WHEN COALESCE(CAST(u."legacyGroupId" AS text),u."legacyUserData"->>\'GroupID\')=\'2\' THEN \'store\' WHEN c.uid IS NOT NULL AND s.uid IS NOT NULL THEN \'conflict\' WHEN c.uid IS NOT NULL THEN \'coach\' WHEN s.uid IS NOT NULL OR COALESCE(CAST(u."legacyGroupId" AS text),u."legacyUserData"->>\'GroupID\')=\'1\' THEN \'member\' ELSE \'unknown\' END identity FROM "_User" u LEFT JOIN coach c ON c.uid=COALESCE(CAST(u."legacyUserId" AS text),u."legacyUserData"->>\'UserID\') LEFT JOIN student s ON s.uid=COALESCE(CAST(u."legacyUserId" AS text),u."legacyUserData"->>\'UserID\') WHERE u."company"=$1 AND COALESCE(u."isAdmin",FALSE)=FALSE AND COALESCE(u."isDeleted",FALSE)=FALSE) UPDATE "_User" u SET "identityType"=classified.identity,"updatedAt"=NOW() FROM classified WHERE u."objectId"=classified."objectId" AND u."identityType" IS DISTINCT FROM classified.identity RETURNING classified.identity',[companyId]);
    const counts={};for(const row of rows)counts[row.identity]=(counts[row.identity]||0)+1;response.json({success:true,data:{updated:rows.length,counts}});
  }catch(error){response.status(Number(error.status)||500).json({success:false,message:String(error.message||error)});}
}`;
  const fn = await parse('/classes/Function', { method: 'POST', body: JSON.stringify({
    name: tempPath, desc: '一次性刷新迁移账号业务身份', type: 'standalone', path: tempPath, code,
    params: [], paramList: [], respType: 'json', respJson: { success: true }, enabled: true,
  }) });
  tempFunctionId = fn.objectId;
  const response = await fetch(`${FUNCTION_URL}/${tempPath}`, {
    method: 'POST', headers: { 'X-Parse-Application-Id': APP_ID, 'Content-Type': 'application/json' },
    body: JSON.stringify({ token: tempToken, params: {} }),
  });
  const payload = await response.json().catch(() => ({}));
  if (!response.ok || payload.success !== true) throw new Error(payload.message || payload.error || `身份刷新失败：${response.status}`);
  return payload.data;
}

async function cleanup() {
  if (tempFunctionId) await parse(`/classes/Function/${tempFunctionId}`, { method: 'DELETE' }).catch(() => undefined);
  if (tempUserId) {
    const where = encodeURIComponent(JSON.stringify({ user: { __type: 'Pointer', className: '_User', objectId: tempUserId } }));
    const sessions = await parse(`/classes/_Session?where=${where}&limit=1000&keys=objectId`).catch(() => ({ results: [] }));
    for (const session of sessions.results || []) await parse(`/classes/_Session/${session.objectId}`, { method: 'DELETE' }).catch(() => undefined);
    await parse(`/users/${tempUserId}`, { method: 'DELETE' }).catch(() => undefined);
  }
}

const source = await legacyUsers();
const existing = await parseUsers();
const byLegacyId = new Map();
const byUsername = new Map();
for (const row of existing) {
  const legacy = row.legacyUserData || {};
  const id = number(row.legacyUserId || legacy.UserID);
  if (id > 0) byLegacyId.set(id, row);
  if (text(row.username)) byUsername.set(text(row.username).toLowerCase(), row);
}

const requests = [];
const conflicts = [];
let creates = 0;
let attaches = 0;
let updates = 0;
for (const row of source.rows) {
  const item = projection(row);
  let target = byLegacyId.get(item.legacyUserId);
  if (!target) {
    const sameUsername = byUsername.get(item.username.toLowerCase());
    if (sameUsername && sameUsername.isAdmin !== true && !number(sameUsername.legacyUserId || sameUsername.legacyUserData?.UserID)) {
      target = sameUsername;
      attaches += 1;
    } else if (sameUsername) {
      conflicts.push({ legacyUserId: item.legacyUserId, username: item.username, reason: sameUsername.isAdmin === true ? 'username-used-by-admin' : 'username-used-by-another-legacy-id' });
      item.username = `legacy_${item.legacyUserId}_${item.username}`.slice(0, 120);
    }
  }
  if (target) {
    if (refreshExisting || !number(target.legacyUserId || target.legacyUserData?.UserID)) {
      requests.push({ method: 'PUT', path: `/parse/users/${target.objectId}`, body: item.body });
      updates += 1;
    }
  } else {
    requests.push({ method: 'POST', path: '/parse/users', body: {
      ...item.body, username: item.username, password: `${randomBytes(24).toString('base64url')}Aa9!`,
    } });
    creates += 1;
  }
}

const groups = requestGroups(requests);
const report = {
  startedAt: new Date().toISOString(), mode: commit ? 'commit' : 'dry-run', companyId: company.objectId,
  legacyTotal: source.total, legacyUnique: source.rows.length, legacyDuplicates: source.duplicates,
  parseTotalBefore: existing.length, parseLegacyIdsBefore: byLegacyId.size,
  creates, attaches, updates, conflicts, requests: requests.length, batches: groups.length,
};

try {
  if (commit && groups.length) await executeGroups(groups);
  if (commit) report.identityRefresh = await refreshIdentities();
  report.completedAt = new Date().toISOString();
  const reportFile = `docs/migration/legacy-user-backfill-${commit ? 'commit' : 'dry-run'}-${new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19)}.json`;
  await writeFile(reportFile, `${JSON.stringify(report, null, 2)}\n`, 'utf8');
  process.stdout.write(`${JSON.stringify({ ...report, reportFile }, null, 2)}\n`);
} finally {
  await cleanup();
}