// 系统管理分区面板（重设计方案 阶段②）：普通用户界面不再暴露的系统能力
// 全部收进这里，由 AdminZone 以分区注册表呈现。数据入口与原弹窗完全一致
//（api.* 不变），只换呈现位置；插件面板/声明工作区经 UIRenderer 内联渲染。
import { useEffect, useState } from 'react'
import { api } from '../api'
import { store, useStore } from '../store'
import type { AgentProfile } from '../contracts'
import { Btn, EmptyState, Icon, SettingRow, SettingsGroup, UIRenderer, type DocBridge } from '@ui'
import { SettingInput, flatten, unflatten } from './SettingsModal'
import type { SettingDesc } from '../contracts'
import { docBridge } from './Workbench'
import { randomPassword } from '../passwords'

// ---- 用户管理（原 AdminUsersModal 主体，R2 管理员发放制 + 2026-10-13 恢复 Key）----
interface AdminUserRow { owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; hasPassword: boolean; passwordSetAt?: string; createdAt: string }
interface LoginKeyRow { id: string; owner: string; purpose: string; status: string; expiresAt: string; createdAt: string; createdBy?: string }

/** Key 状态徽标：复用既有 chip 体系，不新增颜色。 */
function keyStatusChip(status: string) {
  if (status === 'unused') return <span className="ad-chip ad-chip-warn">待使用</span>
  if (status === 'consumed') return <span className="ad-chip">已使用</span>
  if (status === 'expired') return <span className="ad-chip">已过期</span>
  return <span className="ad-chip">已撤销</span>
}

export function UsersPanel() {
  const me = useStore(s => s.me)
  const [users, setUsers] = useState<AdminUserRow[] | null>(null)
  const [err, setErr] = useState('')
  const [notice, setNotice] = useState('')
  const [owner, setOwner] = useState('')
  const [name, setName] = useState('')
  const [pw, setPw] = useState('')
  const [asAdmin, setAsAdmin] = useState(false)
  const [busy, setBusy] = useState(false)
  // 登录 Key 面板：keyFor 打开指定用户的签发/状态视图；issued 明文仅签发响应持有一次。
  const [keyFor, setKeyFor] = useState<string | null>(null)
  const [issued, setIssued] = useState<{ key: string; expiresAt: string } | null>(null)
  const [keys, setKeys] = useState<LoginKeyRow[] | null>(null)

  const refresh = async () => {
    try { setUsers(await api.listAdminUsers()) } catch (e) { setErr(String(e)) }
  }
  const refreshKeys = async (owner: string) => {
    try { setKeys(await api.adminListLoginKeys(owner)) } catch (e) { setErr(String(e)) }
  }
  useEffect(() => { refresh() }, [])

  const openKeyPanel = async (owner: string) => {
    setErr(''); setNotice(''); setIssued(null); setKeyFor(owner); setKeys(null)
    await refreshKeys(owner)
  }

  const create = async () => {
    setErr(''); setNotice('')
    if (pw.length < 8) { setErr('初始密码至少 8 位'); return }
    setBusy(true)
    try {
      await api.createAdminUser(owner.trim(), name.trim(), pw, asAdmin)
      setNotice(`已创建 ${owner.trim()}：首次登录须改密`)
      setOwner(''); setName(''); setPw('')
      await refresh()
    } catch (e) { setErr(String(e).includes('409') ? '用户名已存在' : String(e)) } finally { setBusy(false) }
  }

  const issue = async () => {
    if (!keyFor) return
    setErr(''); setNotice(''); setBusy(true)
    try {
      const out = await api.adminIssueLoginKey(keyFor)
      setIssued({ key: out.key, expiresAt: out.expiresAt })
      await refreshKeys(keyFor)
    } catch (e) { setErr(String(e)) } finally { setBusy(false) }
  }

  const copyKey = async () => {
    if (!issued) return
    try { await navigator.clipboard.writeText(issued.key); setNotice('已复制到剪贴板，请安全交付给该用户') } catch { setErr('复制失败，请手动选择复制') }
  }

  const revoke = async (id: string) => {
    if (!keyFor) return
    setErr(''); setBusy(true)
    try {
      await api.adminRevokeLoginKey(keyFor, id)
      await refreshKeys(keyFor)
    } catch (e) { setErr(String(e)) } finally { setBusy(false) }
  }

  return (
    <div>
      {me?.isAdmin && (
        <div className="ad-create">
          <div className="ad-row">
            <input className="lg-input" placeholder="用户名（登录名）" value={owner} onChange={e => setOwner(e.target.value)} />
            <input className="lg-input" placeholder="显示名（可空）" value={name} onChange={e => setName(e.target.value)} />
          </div>
          <div className="ad-row">
            <input className="lg-input lg-mono" placeholder="初始密码（≥8 位）" value={pw} onChange={e => setPw(e.target.value)} />
            <button type="button" className="ad-mini" title="生成随机密码" onClick={() => setPw(randomPassword())}>随机</button>
            <label className="ad-check"><input type="checkbox" checked={asAdmin} onChange={e => setAsAdmin(e.target.checked)} />管理员</label>
            <button className="lg-submit ad-create-btn" disabled={busy || !owner.trim() || !pw} onClick={create}>创建账号</button>
          </div>
          <p className="ad-hint">创建后该用户首次登录必须修改此初始密码；忘记密码时为其生成一次性登录 Key。</p>
        </div>
      )}
      {notice && <div className="ad-notice"><Icon name="check" size={14} />{notice}</div>}
      {err && <div className="lg-err"><Icon name="alert" size={14} />{err}</div>}
      {keyFor ? (
        <div className="ad-reset">
          <div className="ad-row">
            <span><b>{keyFor}</b> 的一次性登录 Key（忘记密码恢复）</span>
            <button className="lg-submit ad-create-btn" disabled={busy} onClick={issue}>{issued ? '重新签发（旧 Key 与受限会话立即失效）' : '生成 Key'}</button>
            <button type="button" className="ad-mini" onClick={() => { setKeyFor(null); setIssued(null); setKeys(null) }}>关闭</button>
          </div>
          {issued && (
            <div className="ad-row">
              <input className="lg-input lg-mono" readOnly value={issued.key} aria-label="一次性登录 Key（仅显示一次）" onFocus={e => e.currentTarget.select()} />
              <button type="button" className="ad-mini" onClick={copyKey}>复制</button>
            </div>
          )}
          {issued && <p className="ad-hint">明文仅此一次显示，关闭后不可再取；单次有效，{new Date(issued.expiresAt).toLocaleString()} 过期。请经安全渠道交付本人。</p>}
          {keys !== null && keys.length > 0 && (
            <table className="ad-table">
              <thead><tr><th>签发时间</th><th>用途</th><th>状态</th><th>过期时间</th><th></th></tr></thead>
              <tbody>
                {keys.map(k => (
                  <tr key={k.id}>
                    <td className="ad-dim">{new Date(k.createdAt).toLocaleString()}</td>
                    <td>{k.purpose === 'recover' ? '恢复' : '激活'}</td>
                    <td>{keyStatusChip(k.status)}</td>
                    <td className="ad-dim">{new Date(k.expiresAt).toLocaleString()}</td>
                    <td>{k.status === 'unused' && <button className="ad-mini" disabled={busy} onClick={() => revoke(k.id)}>撤销</button>}</td>
                  </tr>
                ))}
              </tbody>
            </table>
          )}
        </div>
      ) : (
        <table className="ad-table">
          <thead><tr><th>用户名</th><th>显示名</th><th>角色</th><th>状态</th><th>密码设置于</th><th></th></tr></thead>
          <tbody>
            {(users ?? []).map(u => (
              <tr key={u.owner}>
                <td className="ad-user-cell"><span className="ad-mono">{u.owner}</span></td>
                <td>{u.name || '—'}</td>
                <td>{u.isAdmin ? <span className="ad-chip ad-chip-admin">ADMIN</span> : <span className="ad-chip">USER</span>}</td>
                <td>{u.mustChangePassword ? <span className="ad-chip ad-chip-warn">待改密</span> : u.hasPassword ? '正常' : '未设密码'}</td>
                <td className="ad-dim">{u.passwordSetAt ? new Date(u.passwordSetAt).toLocaleString() : '—'}</td>
                <td>{me?.isAdmin && (
                  <button className="ad-mini" onClick={() => openKeyPanel(u.owner)}>生成登录 Key</button>
                )}</td>
              </tr>
            ))}
            {users !== null && users.length === 0 && <tr><td colSpan={6} className="ad-dim">暂无账号</td></tr>}
          </tbody>
        </table>
      )}
    </div>
  )
}

// ---- 智能体画像（原 SettingsModal ProfilesSection：数据化导入导出 + 编辑）----
export function ProfilesSection({ profiles }: { profiles: AgentProfile[] }) {
  const [editing, setEditing] = useState<AgentProfile | null>(null)
  const [text, setText] = useState('')
  return (
    <div>
      <div className="doc-toolbar">
        <Btn variant="primary" icon="plus" onClick={() => { setEditing(newProfile()); setText('') }}>新建画像</Btn>
        <label className="btn ghost" style={{ cursor: 'pointer' }}>
          导入 JSON<input type="file" accept=".json" style={{ display: 'none' }} onChange={async e => {
            const f = e.target.files?.[0]
            if (!f) return
            try {
              const p = JSON.parse(await f.text())
              p.id = p.id || 'prof_imported'
              p.builtin = false
              await api.saveProfile(p)
              store.refreshProfiles()
              store.toast('画像已导入')
            } catch (err) { store.toast(`导入失败：${err}`) }
          }} />
        </label>
      </div>
      {profiles.map(p => (
        <SettingRow key={p.id}
          label={<>{p.name} <span style={{ color: 'var(--text-faint)', fontSize: 'var(--fs-ui-xs)' }}>{p.id}{p.builtin ? ' · 内置' : ''}</span></>}
          desc={p.description}>
          <div style={{ display: 'flex', gap: 6, justifyContent: 'flex-end' }}>
            <Btn variant="ghost" icon="download" onClick={() => {
              const blob = new Blob([JSON.stringify(p, null, 2)], { type: 'application/json' })
              const a = document.createElement('a')
              a.href = URL.createObjectURL(blob); a.download = `${p.id}.json`; a.click()
            }}>导出</Btn>
            {!p.builtin && <Btn variant="ghost" onClick={() => { setEditing(p); setText(p.systemPrompt) }}>编辑</Btn>}
            {!p.builtin && <Btn variant="ghost" icon="trash" onClick={async () => { await api.deleteProfile(p.id); store.refreshProfiles() }}>删除</Btn>}
          </div>
        </SettingRow>
      ))}
      {editing && (
        <SettingsGroup title={`编辑画像：${editing.name}`}>
          <div className="ui-form">
            <label>名称<input value={editing.name} onChange={e => setEditing({ ...editing, name: e.target.value })} /></label>
            <label>系统提示<textarea className="search-input" rows={4} style={{ height: 'auto' }} value={text} onChange={e => setText(e.target.value)} /></label>
            <label>允许工具（逗号分隔，* 全部）<input value={editing.tools.allow.join(',')} onChange={e => setEditing({ ...editing, tools: { ...editing.tools, allow: e.target.value.split(',').map(s => s.trim()).filter(Boolean) } })} /></label>
            <label>执行前确认（前缀. 结尾表示族）<input value={editing.tools.confirm?.join(',') ?? ''} onChange={e => setEditing({ ...editing, tools: { ...editing.tools, confirm: e.target.value.split(',').map(s => s.trim()).filter(Boolean) } })} /></label>
            <label>拒绝工具<input value={editing.tools.deny?.join(',') ?? ''} onChange={e => setEditing({ ...editing, tools: { ...editing.tools, deny: e.target.value.split(',').map(s => s.trim()).filter(Boolean) } })} /></label>
          </div>
          <Btn variant="primary" icon="check" onClick={async () => {
            try {
              await api.saveProfile({ ...editing, builtin: false, source: 'user', systemPrompt: text })
              await store.refreshProfiles()
              setEditing(null)
              store.toast('画像已保存')
            } catch (e) { store.toast(`保存失败：${e}`) }
          }}>保存画像</Btn>
        </SettingsGroup>
      )}
    </div>
  )
}

function newProfile(): AgentProfile {
  return {
    id: '', name: '新画像', systemPrompt: '', model: {}, tools: { allow: ['*'] },
    context: { maxHistoryMessages: 40 }, hitl: { askOnAmbiguity: true }, budget: {},
  } as AgentProfile
}

// ---- 插件管理（原 SettingsModal PluginsSection：清单 + 热重载）----
export function PluginsSection() {
  const [plugins, setPlugins] = useState<any[]>([])
  const refresh = () => api.listPlugins().then(setPlugins).catch(() => undefined)
  useEffect(() => { refresh() }, [])
  return (
    <div>
      <div className="doc-toolbar">
        <Btn variant="ghost" icon="undo" onClick={async () => {
          await api.reloadPlugins()
          await refresh()
          store.refreshPlugins()
          store.toast('插件已热重载')
        }}>热重载</Btn>
        <span style={{ color: 'var(--text-faint)', fontSize: 'var(--fs-ui-sm)' }}>声明资产（工作流/意图/提示词/面板）热加载；装卸不影响核心</span>
      </div>
      {plugins.length === 0 && <EmptyState icon="puzzle">暂无已装载插件<br />（插件目录在 设置 → 常规 → 插件目录；示例见 Dev 仓 plugins/example）</EmptyState>}
      {plugins.map(p => (
        <SettingRow key={p.manifest.id}
          label={p.manifest.name + (p.manifest.version ? ` v${p.manifest.version}` : '')}
          desc={[
            `工具 ${p.manifest.provides.tools?.length ?? 0}`,
            `命令 ${p.manifest.provides.commands?.length ?? 0}`,
            `面板 ${p.panels?.length ?? 0}`,
            `意图 ${p.intents?.length ?? p.manifest.provides.intents?.length ?? 0}`,
            `工作流 ${p.workflows?.length ?? 0}`,
          ].join(' · ')}>
          <span style={{ display: 'inline-flex', gap: 6, alignItems: 'center' }}>
            {p.manifest.backend?.mode === 'inproc' && <span className="effect-badge">内置</span>}
            <span className="effect-badge">api {p.manifest.apiVersion}</span>
          </span>
        </SettingRow>
      ))}
    </div>
  )
}

// ---- 插件工作区（插件声明面板 + 服务端声明工作区；声明体经 UIRenderer 内联渲染）----
export function PluginWorkspacesPanel() {
  const pluginPanels = useStore(s => s.pluginPanels)
  const serverWorkspaces = useStore(s => s.serverWorkspaces)
  const [selected, setSelected] = useState<string | null>(null)

  const entries = [
    ...pluginPanels.map(p => ({ key: `plugin:${p.id}`, title: p.title, icon: '🧩', body: p.body ?? [] })),
    ...serverWorkspaces.map(w => ({ key: `ws:${w.id}`, title: w.title, icon: w.icon || '🗂', body: (w.body ?? []) as any[] })),
  ]
  const current = entries.find(e => e.key === selected) ?? entries[0]
  if (entries.length === 0) {
    return <EmptyState icon="grid">暂无插件声明工作区<br />（插件可在 manifest 里声明 panels / workspaces）</EmptyState>
  }
  return (
    <div>
      <div className="doc-toolbar" style={{ flexWrap: 'wrap' }}>
        {entries.map(e => (
          <button key={e.key} className={`kind-pill ${current?.key === e.key ? 'on' : ''}`} onClick={() => setSelected(e.key)}>
            {e.icon} {e.title}
          </button>
        ))}
        <span style={{ flex: 1 }} />
        <Btn variant="ghost" icon="undo" onClick={() => store.refreshPlugins()}>刷新</Btn>
      </div>
      {current && <UIRenderer nodes={current.body} docBridge={docBridge as DocBridge} />}
    </div>
  )
}

// ---- 模型与服务配置（P2 系统受管项的唯一写入面）----

/**
 * SystemSettingsPanel：消费 GET/PUT /api/settings/system。
 * - 仅渲染 schema 中 scope=system 的受管项（模型、密钥、Tavily、遥测、运行基础设施）；
 *   非受管项属于用户/项目偏好，不在本面板出现。
 * - 保存后重新 GET 以服务端结果回填（保存成功 ≠ 本地草稿即真相）；掩码占位符
 *   原样传回，由服务端视为未修改。
 * - 权限不足（非管理员）由分区门控与 API 403 双层拦截，403 时如实提示。
 */
export function SystemSettingsPanel() {
  const [schema, setSchema] = useState<SettingDesc[] | null>(null)
  const [draft, setDraft] = useState<Record<string, any>>({})
  const [loaded, setLoaded] = useState(false)
  const [forbidden, setForbidden] = useState(false)
  const [err, setErr] = useState('')
  const [notice, setNotice] = useState('')
  const [busy, setBusy] = useState(false)

  const load = async () => {
    setErr(''); setForbidden(false)
    try {
      const out = await api.getSystemSettings()
      setSchema(out.schema.filter(d => d.scope === 'system'))
      setDraft(flatten(out.system))
      setLoaded(true)
    } catch (e) {
      if (String(e).includes('403')) { setForbidden(true); setLoaded(true) }
      else setErr(String(e))
    }
  }
  useEffect(() => { load() }, [])

  const groups: Record<string, SettingDesc[]> = {}
  for (const d of schema ?? []) (groups[d.group] ??= []).push(d)

  const save = async () => {
    setErr(''); setNotice(''); setBusy(true)
    try {
      await api.putSystemSettings(unflatten(draft))
      setNotice('已保存；按各项标注的生效时机生效（需重启的项在重启后生效）')
      await load()
    } catch (e) { setErr(String(e)) } finally { setBusy(false) }
  }

  if (!loaded) return <EmptyState icon="settings">加载系统设置…</EmptyState>
  if (forbidden) return <EmptyState icon="shield">系统设置仅管理员可配置</EmptyState>

  return (
    <div>
      <p className="ad-hint" style={{ marginBottom: 14 }}>
        模型、密钥与运行基础设施为系统受管配置：仅此面板（管理员）可写，用户与项目设置中的同名项不再生效。
      </p>
      {Object.entries(groups).map(([group, descs]) => (
        <SettingsGroup key={group} title={group === 'models' ? '模型' : group === 'tools' ? '工具服务' : group === 'telemetry' ? '遥测' : group === 'runtime' ? '运行基础设施' : group}>
          {descs.map(d => (
            <SettingRow key={d.key} label={d.label} desc={d.description} effect={d.effect}>
              <SettingInput desc={d} value={draft[d.key]} onChange={v => setDraft(prev => ({ ...prev, [d.key]: v }))} />
            </SettingRow>
          ))}
        </SettingsGroup>
      ))}
      <div className="ad-row" style={{ marginTop: 12 }}>
        <Btn variant="primary" icon="check" disabled={busy} onClick={save}>保存系统配置</Btn>
      </div>
      {notice && <div className="ad-notice"><Icon name="check" size={14} />{notice}</div>}
      {err && <div className="lg-err"><Icon name="alert" size={14} />{err}</div>}
    </div>
  )
}