/*
    * Copyright (C) 2025 B3Partners B.V.
    *
    * SPDX-License-Identifier: MIT
    */
   package org.tailormap.api.drawing;
   
   import static org.tailormap.api.persistence.helper.AdminAdditionalPropertyHelper.KEY_DRAWINGS_ADMIN;
   import static org.tailormap.api.persistence.helper.AdminAdditionalPropertyHelper.KEY_DRAWINGS_READ_ALL;
  
  import java.lang.invoke.MethodHandles;
  import java.sql.ResultSet;
  import java.sql.SQLException;
  import java.time.OffsetDateTime;
  import java.time.ZoneId;
  import java.util.LinkedHashSet;
  import java.util.List;
  import java.util.Map;
  import java.util.Objects;
  import java.util.Optional;
  import java.util.Set;
  import java.util.UUID;
  import org.jspecify.annotations.NonNull;
  import org.postgresql.util.PGobject;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  import org.springframework.core.convert.converter.Converter;
  import org.springframework.core.convert.support.DefaultConversionService;
  import org.springframework.core.convert.support.GenericConversionService;
  import org.springframework.http.HttpStatus;
  import org.springframework.jdbc.core.RowMapper;
  import org.springframework.jdbc.core.SimplePropertyRowMapper;
  import org.springframework.jdbc.core.simple.JdbcClient;
  import org.springframework.security.authentication.AnonymousAuthenticationToken;
  import org.springframework.security.core.Authentication;
  import org.springframework.stereotype.Service;
  import org.springframework.transaction.annotation.Transactional;
  import org.springframework.web.server.ResponseStatusException;
  import org.tailormap.api.security.TailormapUserDetails;
  import org.tailormap.api.viewer.model.Drawing;
  import tools.jackson.core.JacksonException;
  import tools.jackson.databind.JsonNode;
  import tools.jackson.databind.json.JsonMapper;
  import tools.jackson.databind.node.ArrayNode;
  import tools.jackson.databind.node.ObjectNode;
  
  /**
   * Service for managing drawings.
   *
   * <p>This service provides methods for creating, updating, reading, and deleting drawings and persisting these
   * operations in the data schema of the tailormap database. Any call can throw a {@link ResponseStatusException} if the
   * user is not allowed to perform the operation.
   */
  @Service
  public class DrawingService {
    private static final Logger logger =
        LoggerFactory.getLogger(MethodHandles.lookup().lookupClass());
  
    private final JdbcClient jdbcClient;
    private final RowMapper<Drawing> drawingRowMapper;
    private final JsonMapper mapper;
  
    public DrawingService(JdbcClient jdbcClient, JsonMapper jsonMapper) {
      this.jdbcClient = jdbcClient;
      this.mapper = jsonMapper;
  
      final GenericConversionService conversionService = new GenericConversionService();
      DefaultConversionService.addDefaultConverters(conversionService);
  
      conversionService.addConverter(new Converter<PGobject, Map<String, Object>>() {
        @Override
        @SuppressWarnings("unchecked")
        public Map<String, Object> convert(@NonNull PGobject source) {
          try {
            return jsonMapper.readValue(source.getValue(), Map.class);
          } catch (JacksonException e) {
            throw new IllegalArgumentException("Failed to convert PGobject to Map", e);
          }
        }
      });
  
      drawingRowMapper = new SimplePropertyRowMapper<>(Drawing.class, conversionService) {
        @Override
        @NonNull public Drawing mapRow(@NonNull ResultSet rs, int rowNum) throws SQLException {
          return super.mapRow(rs, rowNum);
        }
      };
    }
  
    /**
     * Create a new drawing.
     *
     * @param drawing the drawing to create
     * @param authentication the current user
     * @return the created drawing
     */
    @Transactional
    public Drawing createDrawing(@NonNull Drawing drawing, @NonNull Authentication authentication)
        throws JacksonException {
 
     canCreateDrawing(authentication);
 
     logger.trace(
         "creating new drawing: {}, domainData {}, createdAt {}",
         drawing,
         mapper.writeValueAsString(drawing.getDomainData()),
         OffsetDateTime.now(ZoneId.systemDefault()));
 
     Drawing storedDrawing = jdbcClient
         .sql("""
 INSERT INTO data.drawing (name, description, domain_data, created_at, created_by,srid)
 VALUES (:name, :description, :domainData::jsonb, :createdAt, :createdBy, :srid) RETURNING *
 """)
         .param("name", drawing.getName())
         .param("description", drawing.getDescription())
         .param("domainData", mapper.writeValueAsString(drawing.getDomainData()))
         .param("createdAt", OffsetDateTime.now(ZoneId.systemDefault()))
         .param("createdBy", authentication.getName())
         .param("srid", drawing.getSrid())
         .query(drawingRowMapper)
         .single();
 
     if (drawing.getFeatureCollection() != null) {
       ObjectNode featureCollection = insertGeoJsonFeatureCollection(
           storedDrawing.getId(),
           drawing.getSrid(),
           mapper.writeValueAsString(drawing.getFeatureCollection()));
       storedDrawing.setFeatureCollection(featureCollection);
     }
 
     logger.trace("stored new drawing: {}", storedDrawing);
     return storedDrawing;
   }
 
   private ObjectNode insertGeoJsonFeatureCollection(UUID drawingId, int srid, String featureCollectionToStore)
       throws JacksonException {
     List<JsonNode> storedFeatures = jdbcClient
         .sql("""
 WITH jsonData AS (SELECT :featureCollectionToStore::json AS featureCollection)
 INSERT INTO data.drawing_feature (drawing_id, geometry, properties)
 SELECT :drawingId::uuid AS drawing_id,
 ST_SetSRID(ST_GeomFromGeoJSON(feature ->> 'geometry'), :srid) AS geometry,
 feature -> 'properties' AS properties
 FROM (SELECT json_array_elements(featureCollection -> 'features') AS feature
 FROM jsonData)
 AS f
 RETURNING
 -- since we cannot use aggregate functions in a returning clause, we will return a list of geojson
 -- features and aggregate them into a featureCollection in the next step
 ST_AsGeoJSON(data.drawing_feature.*, geom_column =>'geometry', id_column => 'id')::json;
 """)
         .param("featureCollectionToStore", featureCollectionToStore)
         .param("drawingId", drawingId)
         .param("srid", srid)
         .query(new RowMapper<JsonNode>() {
           @Override
           public JsonNode mapRow(@NonNull ResultSet rs, int rowNum) throws SQLException {
             try {
               JsonNode jsonNode = mapper.readTree(rs.getString(1));
               // merge/un-nest properties with nested properties, because we have a jsonb
               // column
               // called "properties" and we are using the `ST_AsGeoJSON(::record,...)`
               // function
               final ObjectNode properties = (ObjectNode) jsonNode.get("properties");
               JsonNode nestedProperties = properties.get("properties");
               if (nestedProperties != null) {
                 nestedProperties.properties().stream()
                     .iterator()
                     .forEachRemaining(
                         entry -> properties.putIfAbsent(entry.getKey(), entry.getValue()));
               }
               properties.remove("properties");
               return jsonNode;
             } catch (JacksonException e) {
               throw new RuntimeException(e);
             }
           }
         })
         .list();
 
     return mapper.createObjectNode()
         .put("type", "FeatureCollection")
         .set("features", mapper.createArrayNode().addAll(storedFeatures));
   }
 
   /**
    * Update an existing drawing.
    *
    * @param drawing the drawing to create
    * @param authentication the current user
    * @return the created drawing
    */
   @Transactional
   public Drawing updateDrawing(@NonNull Drawing drawing, @NonNull Authentication authentication)
       throws JacksonException {
 
     logger.trace(
         "updating drawing: {}, domainData {}, updatedAt {}",
         drawing,
         mapper.writeValueAsString(drawing.getDomainData()),
         OffsetDateTime.now(ZoneId.systemDefault()));
 
     // Use the same message as when the user is not allowed to read the drawing, so the existence of the drawing is
     // not disclosed
     final Drawing oldDrawing = getDrawing(drawing.getId(), authentication)
         .orElseThrow(() -> new ResponseStatusException(HttpStatus.NOT_FOUND, "Drawing not found"));
 
     canSaveOrDeleteDrawing(oldDrawing, authentication);
 
     if (!Objects.equals(drawing.getVersion(), oldDrawing.getVersion())) {
       throw new ResponseStatusException(HttpStatus.CONFLICT, "Drawing has been updated by another user");
     }
 
     // Only update if the version is unchanged, to prevent lost updates by concurrent requests
     Drawing updatedDrawing = jdbcClient
         .sql("""
 UPDATE data.drawing SET
 name = :name,
 description = :description,
 domain_data = :domainData::jsonb,
 updated_by = :updatedBy,
 updated_at = :updatedAt,
 srid = :srid,
 version = version + 1
 WHERE id = :id AND version = :version RETURNING *""")
         .param("id", drawing.getId())
         .param("name", drawing.getName())
         .param("description", drawing.getDescription())
         .param("domainData", mapper.writeValueAsString(drawing.getDomainData()))
         .param("updatedBy", authentication.getName())
         .param("updatedAt", OffsetDateTime.now(ZoneId.systemDefault()))
         .param("srid", drawing.getSrid())
         .param("version", drawing.getVersion())
         .query(drawingRowMapper)
         .optional()
         .orElseThrow(() ->
             new ResponseStatusException(HttpStatus.CONFLICT, "Drawing has been updated by another user"));
 
     // delete even if drawing.getFeatureCollection()==null, because all features could have been
     // removed, (re)insert the featureCollection afterward
     jdbcClient
         .sql("DELETE FROM data.drawing_feature WHERE drawing_id = :drawingId")
         .param("drawingId", drawing.getId())
         .update();
 
     if (drawing.getFeatureCollection() != null) {
       ObjectNode featureCollection = insertGeoJsonFeatureCollection(
           drawing.getId(), drawing.getSrid(), mapper.writeValueAsString(drawing.getFeatureCollection()));
       updatedDrawing.setFeatureCollection(featureCollection);
     }
 
     logger.trace("stored updated drawing: {}", updatedDrawing);
     return updatedDrawing;
   }
 
   /**
    * Get all drawings for the current user.
    *
    * @param authentication the current user
    * @return the drawings, a possibly empty set
    */
   public Set<Drawing> getDrawingsForUser(Authentication authentication) throws ResponseStatusException {
     if (authentication == null || authentication instanceof AnonymousAuthenticationToken) {
       return Set.of();
     }
     // filter in the database instead of loading all drawings, must match canReadDrawing()
     final List<Drawing> drawings;
     if (canReadAllDrawings(authentication)) {
       drawings = jdbcClient
           .sql("SELECT * FROM data.drawing ORDER BY created_at")
           .query(drawingRowMapper)
           .list();
     } else {
       drawings = jdbcClient
           .sql("SELECT * FROM data.drawing WHERE created_by = :createdBy ORDER BY created_at")
           .param("createdBy", authentication.getName())
           .query(drawingRowMapper)
           .list();
     }
     return new LinkedHashSet<>(drawings);
   }
 
   /**
    * Get a drawing only — no geometry data — by its ID.
    *
    * @param drawingId the ID of the drawing
    * @param authentication the current user
    * @return the — thinly populated — drawing
    */
   @SuppressWarnings("SpringTransactionalMethodCallsInspection")
   public Optional<Drawing> getDrawing(@NonNull UUID drawingId, @NonNull Authentication authentication) {
     return this.getDrawing(drawingId, authentication, false, 0);
   }
 
   /**
    * Get a complete drawing by its ID with GeoJSON geometries in the requested srid.
    *
    * @param drawingId the ID of the drawing
    * @param authentication the current user
    * @param withGeometries whether to fetch the geometries for the drawing
    * @param requestedSrid the SRID to return the geometries in
    * @return the complete drawing
    */
   @Transactional
   public Optional<Drawing> getDrawing(
       @NonNull UUID drawingId,
       @NonNull Authentication authentication,
       boolean withGeometries,
       int requestedSrid) {
     // Check before querying, so anonymous users can't determine whether a drawing exists
     if (authentication == null || authentication instanceof AnonymousAuthenticationToken) {
       throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "Insufficient permissions to access drawing");
     }
 
     Optional<Drawing> drawing = jdbcClient
         .sql("SELECT * FROM data.drawing WHERE id = :id")
         .param("id", drawingId)
         .query(drawingRowMapper)
         .optional();
 
     drawing.ifPresent(d -> {
       // check if the user is allowed to read the drawing
       canReadDrawing(d, authentication);
 
       d.setSrid(requestedSrid);
       if (withGeometries) {
         d.setFeatureCollection(getFeatureCollection(drawingId, requestedSrid));
       }
     });
 
     return drawing;
   }
 
   /**
    * Retrieve the feature collection as GeoJSON for a drawing.
    *
    * @param drawingId the ID of the drawing
    * @param srid the SRID to return the geometries in
    * @return the feature collection as GeoJSON
    */
   private JsonNode getFeatureCollection(UUID drawingId, int srid) {
     return jdbcClient
         .sql("""
 SELECT row_to_json(featureCollection) from (
 SELECT
 'FeatureCollection' AS type,
 array_to_json(array_agg(feature)) AS features FROM (
 SELECT
 'Feature' AS type,
 id as id,
 ST_ASGeoJSON(ST_Transform(geomTable.geometry, :srid))::json AS geometry,
 row_to_json((SELECT l from (SELECT id, drawing_id, properties) AS l)) AS properties
 FROM data.drawing_feature AS geomTable WHERE drawing_id = :drawingId::uuid) AS feature) AS featureCollection
 """)
         .param("drawingId", drawingId)
         .param("srid", srid)
         .query(new RowMapper<JsonNode>() {
           @Override
           public JsonNode mapRow(@NonNull ResultSet rs, int rowNum) throws SQLException {
             try {
               JsonNode jsonNode = mapper.readTree(rs.getString(1));
               // merge/un-nest properties with nested properties, because we have a jsonb column
               // called "properties" and we are using the `ST_AsGeoJSON(::record,...)` function
               ArrayNode features = (ArrayNode) jsonNode.get("features");
               features.elements().forEach(feature -> {
                 ObjectNode properties = (ObjectNode) feature.get("properties");
                 JsonNode nestedProperties = properties.get("properties");
                 if (nestedProperties != null) {
                   nestedProperties
                       .properties()
                       .iterator()
                       .forEachRemaining(
                           entry -> properties.putIfAbsent(entry.getKey(), entry.getValue()));
                 }
                 properties.remove("properties");
               });
               return jsonNode;
             } catch (JacksonException e) {
               throw new RuntimeException(e);
             }
           }
         })
         .single();
   }
 
   /**
    * Delete a drawing by its ID.
    *
    * @param drawingId the ID of the drawing
    * @param authentication the current user
    */
   @Transactional
   public void deleteDrawing(@NonNull UUID drawingId, @NonNull Authentication authentication) {
     canSaveOrDeleteDrawing(
         getDrawing(drawingId, authentication)
             .orElseThrow(() -> new ResponseStatusException(HttpStatus.NOT_FOUND, "Drawing not found")),
         authentication);
 
     jdbcClient
         .sql("DELETE FROM data.drawing WHERE id = :id")
         .param("id", drawingId)
         .update();
   }
 
   /**
    * Check if the current user can create a drawing. If not, throw an unauthorized exception.
    *
    * @param authentication the current user
    * @throws ResponseStatusException if the user is not allowed to create a drawing
    */
   private void canCreateDrawing(@NonNull Authentication authentication) throws ResponseStatusException {
     if ((authentication instanceof AnonymousAuthenticationToken)) {
       throw new ResponseStatusException(
           HttpStatus.UNAUTHORIZED, "Insufficient permissions to create new drawing");
     }
     // TODO check if this user is allowed to create/add drawings using additional properties, currently none are
     // defined
   }
 
   /**
    * Check if the current user can read the drawing. If not, throw an unauthorized exception for anonymous users or a
    * not found exception for authenticated users, so the existence of the drawing is not disclosed.
    *
    * @param drawing the drawing to check
    * @param authentication the current user
    * @throws ResponseStatusException if the user is not allowed to read the drawing
    */
   private void canReadDrawing(@NonNull Drawing drawing, @NonNull Authentication authentication)
       throws ResponseStatusException {
     if (authentication instanceof AnonymousAuthenticationToken) {
       throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "Insufficient permissions to access drawing");
     }
 
     boolean canRead = isDrawingOwner(drawing, authentication) || canReadAllDrawings(authentication);
 
     if (!canRead) {
       throw new ResponseStatusException(HttpStatus.NOT_FOUND, "Drawing not found");
     }
   }
 
   /**
    * Check if the current user can save the drawing. If not, throw an unauthorized exception for anonymous users or a
    * forbidden exception for authenticated users.
    *
    * @param drawing the drawing to check
    * @param authentication the current user
    * @throws ResponseStatusException if the user is not allowed to save/delete the drawing
    */
   private void canSaveOrDeleteDrawing(@NonNull Drawing drawing, @NonNull Authentication authentication)
       throws ResponseStatusException {
     if (authentication instanceof AnonymousAuthenticationToken) {
       // Only authenticated users can save drawings
       throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "Insufficient permissions to save drawing");
     }
 
     boolean canSave = isDrawingOwner(drawing, authentication) || isDrawingsAdmin(authentication);
 
     if (!canSave) {
       throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Insufficient permissions to save drawing");
     }
   }
 
   private static boolean isDrawingOwner(@NonNull Drawing drawing, @NonNull Authentication authentication) {
     return Objects.equals(authentication.getName(), drawing.getCreatedBy());
   }
 
   private static boolean isDrawingsAdmin(@NonNull Authentication authentication) {
     return hasTruePropertyForKey(authentication, KEY_DRAWINGS_ADMIN);
   }
 
   private static boolean canReadAllDrawings(@NonNull Authentication authentication) {
     return isDrawingsAdmin(authentication) || hasTruePropertyForKey(authentication, KEY_DRAWINGS_READ_ALL);
   }
 
   private static boolean hasTruePropertyForKey(@NonNull Authentication authentication, String key) {
     return authentication.getPrincipal() instanceof TailormapUserDetails userDetails
         && userDetails.hasTruePropertyForKey(key);
   }
 }