backend/internal/service/user_service.go

package service

import (
	"bytes"
	"context"
	"crypto/sha256"
	"encoding/hex"
	"errors"
	"fmt"
	"net/url"
	"path/filepath"
	"strings"
	"time"

	apperrors "carrotskin/internal/errors"
	"carrotskin/internal/model"
	"carrotskin/internal/repository"
	"carrotskin/pkg/auth"
	"carrotskin/pkg/config"
	"carrotskin/pkg/database"
	"carrotskin/pkg/redis"
	"carrotskin/pkg/storage"

	"go.uber.org/zap"
)

// userService UserService的实现
type userService struct {
	userRepo   repository.UserRepository
	jwtService *auth.JWTService
	redis      *redis.Client
	cache      *database.CacheManager
	cacheKeys  *database.CacheKeyBuilder
	cacheInv   *database.CacheInvalidator
	storage    *storage.StorageClient
	logger     *zap.Logger
}

// NewUserService 创建UserService实例
func NewUserService(
	userRepo repository.UserRepository,
	jwtService *auth.JWTService,
	redisClient *redis.Client,
	cacheManager *database.CacheManager,
	storageClient *storage.StorageClient,
	logger *zap.Logger,
) UserService {
	// CacheKeyBuilder 使用空前缀，因为 CacheManager 已经处理了前缀
	// 这样缓存键的格式为: CacheManager前缀 + CacheKeyBuilder生成的键
	return &userService{
		userRepo:   userRepo,
		jwtService: jwtService,
		redis:      redisClient,
		cache:      cacheManager,
		cacheKeys:  database.NewCacheKeyBuilder(""),
		cacheInv:   database.NewCacheInvalidator(cacheManager),
		storage:    storageClient,
		logger:     logger,
	}
}

func (s *userService) Register(ctx context.Context, username, password, email, avatar string) (*model.User, string, error) {
	// 检查用户名是否已存在
	existingUser, err := s.userRepo.FindByUsername(ctx, username)
	if err != nil {
		return nil, "", err
	}
	if existingUser != nil {
		return nil, "", apperrors.ErrUserAlreadyExists
	}

	// 检查邮箱是否已存在
	existingEmail, err := s.userRepo.FindByEmail(ctx, email)
	if err != nil {
		return nil, "", err
	}
	if existingEmail != nil {
		return nil, "", apperrors.ErrEmailAlreadyExists
	}

	// 加密密码
	hashedPassword, err := auth.HashPassword(password)
	if err != nil {
		return nil, "", errors.New("密码加密失败")
	}

	// 确定头像URL
	avatarURL := avatar
	if avatarURL != "" {
		if err := s.ValidateAvatarURL(ctx, avatarURL); err != nil {
			return nil, "", err
		}
	} else {
		avatarURL = s.getDefaultAvatar()
	}

	// 创建用户
	user := &model.User{
		Username: username,
		Password: hashedPassword,
		Email:    email,
		Avatar:   avatarURL,
		Role:     "user",
		Status:   1,
		Points:   0,
	}

	if err := s.userRepo.Create(ctx, user); err != nil {
		return nil, "", err
	}

	// 生成JWT Token
	token, err := s.jwtService.GenerateToken(user.ID, user.Username, user.Role)
	if err != nil {
		return nil, "", errors.New("生成Token失败")
	}

	return user, token, nil
}

func (s *userService) Login(ctx context.Context, usernameOrEmail, password, ipAddress, userAgent string) (*model.User, string, error) {
	// 检查账号是否被锁定
	if s.redis != nil {
		identifier := usernameOrEmail + ":" + ipAddress
		locked, ttl, err := CheckLoginLocked(ctx, s.redis, identifier)
		if err == nil && locked {
			return nil, "", fmt.Errorf("登录尝试次数过多，请在 %d 分钟后重试", int(ttl.Minutes())+1)
		}
	}

	// 查找用户
	var user *model.User
	var err error

	if strings.Contains(usernameOrEmail, "@") {
		user, err = s.userRepo.FindByEmail(ctx, usernameOrEmail)
	} else {
		user, err = s.userRepo.FindByUsername(ctx, usernameOrEmail)
	}

	if err != nil {
		return nil, "", err
	}
	if user == nil {
		s.recordLoginFailure(ctx, usernameOrEmail, ipAddress, userAgent, 0, "用户不存在")
		return nil, "", errors.New("用户名/邮箱或密码错误")
	}

	// 检查用户状态
	if user.Status != 1 {
		s.recordLoginFailure(ctx, usernameOrEmail, ipAddress, userAgent, user.ID, "账号已被禁用")
		return nil, "", errors.New("账号已被禁用")
	}

	// 验证密码
	if !auth.CheckPassword(user.Password, password) {
		s.recordLoginFailure(ctx, usernameOrEmail, ipAddress, userAgent, user.ID, "密码错误")
		return nil, "", errors.New("用户名/邮箱或密码错误")
	}

	// 登录成功，清除失败计数
	if s.redis != nil {
		identifier := usernameOrEmail + ":" + ipAddress
		_ = ClearLoginAttempts(ctx, s.redis, identifier)
	}

	// 生成JWT Token
	token, err := s.jwtService.GenerateToken(user.ID, user.Username, user.Role)
	if err != nil {
		return nil, "", errors.New("生成Token失败")
	}

	// 更新最后登录时间
	now := time.Now()
	user.LastLoginAt = &now
	_ = s.userRepo.UpdateFields(ctx, user.ID, map[string]interface{}{
		"last_login_at": now,
	})

	// 记录成功登录日志
	s.logSuccessLogin(ctx, user.ID, ipAddress, userAgent)

	return user, token, nil
}

func (s *userService) GetByID(ctx context.Context, id int64) (*model.User, error) {
	// 使用 Cached 装饰器自动处理缓存
	cacheKey := s.cacheKeys.User(id)
	return database.Cached(ctx, s.cache, cacheKey, func() (*model.User, error) {
		return s.userRepo.FindByID(ctx, id)
	}, 5*time.Minute)
}

func (s *userService) GetByEmail(ctx context.Context, email string) (*model.User, error) {
	// 使用 Cached 装饰器自动处理缓存
	cacheKey := s.cacheKeys.UserByEmail(email)
	return database.Cached(ctx, s.cache, cacheKey, func() (*model.User, error) {
		return s.userRepo.FindByEmail(ctx, email)
	}, 5*time.Minute)
}

func (s *userService) UpdateInfo(ctx context.Context, user *model.User) error {
	err := s.userRepo.Update(ctx, user)
	if err != nil {
		return err
	}

	// 清除缓存
	s.cacheInv.OnUpdate(ctx,
		s.cacheKeys.User(user.ID),
		s.cacheKeys.UserByEmail(user.Email),
		s.cacheKeys.UserByUsername(user.Username),
	)

	return nil
}

func (s *userService) UpdateAvatar(ctx context.Context, userID int64, avatarURL string) error {
	err := s.userRepo.UpdateFields(ctx, userID, map[string]interface{}{
		"avatar": avatarURL,
	})
	if err != nil {
		return err
	}

	// 清除用户缓存
	s.cacheInv.OnUpdate(ctx, s.cacheKeys.User(userID))

	return nil
}

func (s *userService) ChangePassword(ctx context.Context, userID int64, oldPassword, newPassword string) error {
	user, err := s.userRepo.FindByID(ctx, userID)
	if err != nil || user == nil {
		return errors.New("用户不存在")
	}

	if !auth.CheckPassword(user.Password, oldPassword) {
		return errors.New("原密码错误")
	}

	hashedPassword, err := auth.HashPassword(newPassword)
	if err != nil {
		return errors.New("密码加密失败")
	}

	err = s.userRepo.UpdateFields(ctx, userID, map[string]interface{}{
		"password": hashedPassword,
	})
	if err != nil {
		return err
	}

	// 清除用户缓存
	s.cacheInv.OnUpdate(ctx, s.cacheKeys.User(userID))

	return nil
}

func (s *userService) ResetPassword(ctx context.Context, email, newPassword string) error {
	user, err := s.userRepo.FindByEmail(ctx, email)
	if err != nil || user == nil {
		return errors.New("用户不存在")
	}

	hashedPassword, err := auth.HashPassword(newPassword)
	if err != nil {
		return errors.New("密码加密失败")
	}

	err = s.userRepo.UpdateFields(ctx, user.ID, map[string]interface{}{
		"password": hashedPassword,
	})
	if err != nil {
		return err
	}

	// 清除用户缓存
	s.cacheInv.OnUpdate(ctx,
		s.cacheKeys.User(user.ID),
		s.cacheKeys.UserByEmail(email),
	)

	return nil
}

func (s *userService) ChangeEmail(ctx context.Context, userID int64, newEmail string) error {
	// 获取旧邮箱
	oldUser, _ := s.userRepo.FindByID(ctx, userID)

	existingUser, err := s.userRepo.FindByEmail(ctx, newEmail)
	if err != nil {
		return err
	}
	if existingUser != nil && existingUser.ID != userID {
		return apperrors.ErrEmailAlreadyExists
	}

	err = s.userRepo.UpdateFields(ctx, userID, map[string]interface{}{
		"email": newEmail,
	})
	if err != nil {
		return err
	}

	// 清除旧邮箱和用户ID的缓存
	keysToInvalidate := []string{
		s.cacheKeys.User(userID),
		s.cacheKeys.UserByEmail(newEmail),
	}
	if oldUser != nil {
		keysToInvalidate = append(keysToInvalidate, s.cacheKeys.UserByEmail(oldUser.Email))
	}
	s.cacheInv.OnUpdate(ctx, keysToInvalidate...)

	return nil
}

func (s *userService) ValidateAvatarURL(ctx context.Context, avatarURL string) error {
	if avatarURL == "" {
		return nil
	}

	// 允许相对路径
	if strings.HasPrefix(avatarURL, "/") {
		return nil
	}

	// 解析URL
	parsedURL, err := url.Parse(avatarURL)
	if err != nil {
		return errors.New("无效的URL格式")
	}

	// 必须是HTTP或HTTPS协议
	if parsedURL.Scheme != "http" && parsedURL.Scheme != "https" {
		return errors.New("URL必须使用http或https协议")
	}

	host := parsedURL.Hostname()
	if host == "" {
		return errors.New("URL缺少主机名")
	}

	// 从配置获取允许的域名列表
	cfg, err := config.GetConfig()
	if err != nil {
		allowedDomains := []string{"localhost", "127.0.0.1"}
		return s.checkDomainAllowed(host, allowedDomains)
	}

	return s.checkDomainAllowed(host, cfg.Security.AllowedDomains)
}

func (s *userService) UploadAvatar(ctx context.Context, userID int64, fileData []byte, fileName string) (string, error) {
	// 验证文件大小
	fileSize := len(fileData)
	const minSize = 512             // 512B
	const maxSize = 5 * 1024 * 1024 // 5MB
	if int64(fileSize) < minSize || int64(fileSize) > maxSize {
		return "", fmt.Errorf("文件大小必须在 %d 到 %d 字节之间", minSize, maxSize)
	}

	// 验证文件扩展名
	ext := strings.ToLower(filepath.Ext(fileName))
	allowedExts := map[string]bool{".jpg": true, ".jpeg": true, ".png": true, ".gif": true, ".webp": true}
	if !allowedExts[ext] {
		return "", fmt.Errorf("不支持的文件格式: %s，仅支持 jpg/jpeg/png/gif/webp", ext)
	}

	// 检查存储服务
	if s.storage == nil {
		return "", errors.New("存储服务不可用")
	}

	// 计算文件哈希
	hashBytes := sha256.Sum256(fileData)
	hash := hex.EncodeToString(hashBytes[:])

	// 获取存储桶
	bucketName, err := s.storage.GetBucket("avatars")
	if err != nil {
		return "", fmt.Errorf("获取存储桶失败: %w", err)
	}

	// 生成对象路径: avatars/{hash[:2]}/{hash[2:4]}/{hash}{ext}
	objectName := fmt.Sprintf("%s/%s/%s%s", hash[:2], hash[2:4], hash, ext)

	// 上传文件
	reader := bytes.NewReader(fileData)
	contentType := "image/" + strings.TrimPrefix(ext, ".")
	if ext == ".jpg" {
		contentType = "image/jpeg"
	}
	if err := s.storage.UploadObject(ctx, bucketName, objectName, reader, int64(fileSize), contentType); err != nil {
		return "", fmt.Errorf("上传文件失败: %w", err)
	}

	// 构建文件URL
	avatarURL := s.storage.BuildFileURL(bucketName, objectName)

	// 更新用户头像
	if err := s.UpdateAvatar(ctx, userID, avatarURL); err != nil {
		return "", fmt.Errorf("更新用户头像失败: %w", err)
	}

	s.logger.Info("上传头像成功",
		zap.Int64("user_id", userID),
		zap.String("hash", hash),
		zap.String("url", avatarURL),
	)

	return avatarURL, nil
}

func (s *userService) GetMaxProfilesPerUser() int {
	cfg, err := config.GetConfig()
	if err != nil || cfg.Site.MaxProfilesPerUser <= 0 {
		return 5
	}
	return cfg.Site.MaxProfilesPerUser
}

func (s *userService) GetMaxTexturesPerUser() int {
	cfg, err := config.GetConfig()
	if err != nil || cfg.Site.MaxTexturesPerUser <= 0 {
		return 50
	}
	return cfg.Site.MaxTexturesPerUser
}

// 私有辅助方法

func (s *userService) getDefaultAvatar() string {
	cfg, err := config.GetConfig()
	if err != nil {
		return ""
	}
	return cfg.Site.DefaultAvatar
}

func (s *userService) checkDomainAllowed(host string, allowedDomains []string) error {
	host = strings.ToLower(host)

	for _, allowed := range allowedDomains {
		allowed = strings.ToLower(strings.TrimSpace(allowed))
		if allowed == "" {
			continue
		}

		if host == allowed {
			return nil
		}

		if strings.HasPrefix(allowed, "*.") {
			suffix := allowed[1:]
			if strings.HasSuffix(host, suffix) {
				return nil
			}
		}
	}

	return errors.New("URL域名不在允许的列表中")
}

func (s *userService) recordLoginFailure(ctx context.Context, usernameOrEmail, ipAddress, userAgent string, userID int64, reason string) {
	if s.redis != nil {
		identifier := usernameOrEmail + ":" + ipAddress
		count, _ := RecordLoginFailure(ctx, s.redis, identifier)
		if count >= MaxLoginAttempts {
			s.logFailedLogin(ctx, userID, ipAddress, userAgent, reason+"-账号已锁定")
			return
		}
	}
	s.logFailedLogin(ctx, userID, ipAddress, userAgent, reason)
}

func (s *userService) logSuccessLogin(ctx context.Context, userID int64, ipAddress, userAgent string) {
	log := &model.UserLoginLog{
		UserID:      userID,
		IPAddress:   ipAddress,
		UserAgent:   userAgent,
		LoginMethod: "PASSWORD",
		IsSuccess:   true,
	}
	_ = s.userRepo.CreateLoginLog(ctx, log)
}

func (s *userService) logFailedLogin(ctx context.Context, userID int64, ipAddress, userAgent, reason string) {
	log := &model.UserLoginLog{
		UserID:        userID,
		IPAddress:     ipAddress,
		UserAgent:     userAgent,
		LoginMethod:   "PASSWORD",
		IsSuccess:     false,
		FailureReason: reason,
	}
	_ = s.userRepo.CreateLoginLog(ctx, log)
}