<?php

namespace app\api\controller;

use think\Db;

/**
 * 后台管理端 · 权限管理（Module-ADM-RBAC）
 * 路由：
 *   GET  /api/v1/admin/roles      AR1 角色列表
 *   POST /api/v1/admin/role       AR2 新增/保存角色
 *   GET  /api/v1/admin/accounts   AR3 子账号列表
 *   GET  /api/v1/admin/logs       AR4 操作日志
 *
 * 注意：fa_auth_group 实际无 remark 字段（id,pid,name,rules,createtime,updatetime,status），
 *       roles() 的 remark 固定返回 ''；saveRole() 写库不写 remark。
 */
class AdminRbac extends V1
{
    /** 管理端接口必须校验管理员身份（V1 默认关闭了 URI 权限校验） */
    public function _initialize()
    {
        parent::_initialize();
        $this->adminOnly();
    }

    /**
     * AR1 角色列表
     * GET /api/v1/admin/roles → 数组 [{id,name,permissions,remark}]
     */
    public function roles()
    {
        $rows = Db::name('auth_group')->order('id asc')->select();

        $list = [];
        foreach ($rows as $row) {
            $rules = (string)$row['rules'];
            if ($rules === '*') {
                $permissions = ['*'];
            } else {
                $permissions = array_values(array_filter(array_map('strval', explode(',', $rules)), function ($v) {
                    return $v !== '';
                }));
            }
            $list[] = [
                'id'          => (int)$row['id'],
                'name'        => (string)$row['name'],
                'permissions' => $permissions,
                'remark'      => '',
            ];
        }

        $this->ok($list);
    }

    /**
     * AR2 新增/保存角色
     * POST /api/v1/admin/role 入参 {name,permissions[],remark?,id?} → {id,name,permissions,remark}
     * 规则 BR-12：name 必填、permissions 非空
     */
    public function saveRole()
    {
        $id = (int)$this->input('id', 0);
        $name = trim((string)$this->input('name', ''));
        $remark = trim((string)$this->input('remark', ''));

        // 注意：permissions 是数组，不能走 $this->input()（TP5.0 Request::input 默认按字符串强转，
        // 传入数组会抛 "variable type error：array"）；统一从 inputs() 取原始值。
        $allInputs = $this->inputs();
        $permissions = (array)(array_key_exists('permissions', $allInputs) ? $allInputs['permissions'] : []);
        $permissions = array_values(array_filter(array_map(function ($v) {
            return (string)$v;
        }, $permissions), function ($v) {
            return $v !== '';
        }));

        if ($name === '') {
            $this->fail('请填写角色名称');
        }
        if (empty($permissions)) {
            $this->fail('请至少分配一项权限');
        }

        $rules = implode(',', $permissions);
        $data = [
            'name'       => $name,
            'rules'      => $rules,
            'pid'        => 0,
            'status'     => 'normal',
            'updatetime' => time(),
        ];

        if ($id && Db::name('auth_group')->where('id', $id)->find()) {
            Db::name('auth_group')->where('id', $id)->update($data);
        } else {
            $data['createtime'] = time();
            $id = Db::name('auth_group')->insertGetId($data);
        }

        $this->adminLog('保存角色 #' . $id . ' ' . $name);

        $this->ok([
            'id'          => (int)$id,
            'name'        => $name,
            'permissions' => $permissions,
            'remark'      => $remark,
        ]);
    }

    /**
     * AR3 子账号列表
     * GET /api/v1/admin/accounts → 数组 [{id,username,roleId,roleName,status,lastLoginAt}]
     */
    public function accounts()
    {
        $groups = Db::name('auth_group')->column('name', 'id');
        // fa_admin 表本身没有 group_id：角色关系存放于 fa_auth_group_access(uid,group_id)，
        // 必须显式 join 取出 group_id，否则 $row['group_id'] 未定义。
        $rows = Db::name('admin')->alias('a')
            ->join('auth_group_access ga', 'ga.uid = a.id', 'LEFT')
            ->field('a.id,a.username,a.logintime,ga.group_id')
            ->order('a.id asc')
            ->select();

        $list = [];
        foreach ($rows as $row) {
            $gid = isset($row['group_id']) ? (int)$row['group_id'] : 0;
            $roleName = ($gid && isset($groups[$gid])) ? (string)$groups[$gid] : '';
            $list[] = [
                'id'          => (int)$row['id'],
                'username'    => (string)$row['username'],
                'roleId'      => $gid,
                'roleName'    => $roleName,
                'status'      => ((int)$row['logintime'] > 0) ? 1 : 0,
                'lastLoginAt' => $this->iso($row['logintime']),
            ];
        }

        $this->ok($list);
    }

    /**
     * AR4 操作日志
     * GET /api/v1/admin/logs 入参 {page,size}
     * → 分页 {list:[{id,account,action,ip,createdAt}],page,size,total,hasMore}
     */
    public function logs()
    {
        list($page, $size) = $this->pager();

        $total = Db::name('admin_log')->count();
        $rows = Db::name('admin_log')->order('createtime desc')->page($page, $size)->select();

        $list = [];
        foreach ($rows as $row) {
            $list[] = [
                'id'        => (int)$row['id'],
                'account'   => (string)$row['username'],
                'action'    => (string)$row['title'],
                'ip'        => (string)$row['ip'],
                'createdAt' => $this->iso($row['createtime']),
            ];
        }

        $this->ok($this->paginate($list, $total, $page, $size));
    }
}