const express = require('express');
const db = require('../db-sqlite');
const { hashPassword, verifyPassword } = require('../utils/auth');
const { authenticate, requireAdmin } = require('../middleware/auth');

module.exports = function(app) {
  const router = express.Router();

  router.get('/', authenticate, async (req, res) => {
    try {
      const usersResult = await db.query('SELECT id, username, name, email, phone, role, created_at, updated_at FROM users');
      const users = usersResult.rows;
      res.json({ success: true, data: users, count: users.length });
    } catch (error) {
      console.error('获取用户列表失败:', error);
      res.status(500).json({ success: false, message: '获取用户列表失败' });
    }
  });

  router.get('/:id', authenticate, async (req, res) => {
    try {
      const { id } = req.params;
      const userResult = await db.query('SELECT id, username, name, email, phone, role, created_at, updated_at FROM users WHERE id = ?', [id]);
      
      if (userResult.rows.length === 0) {
        return res.status(404).json({ success: false, message: '用户不存在' });
      }
      
      const user = userResult.rows[0];
      res.json({ success: true, data: user });
    } catch (error) {
      console.error('获取用户详情失败:', error);
      res.status(500).json({ success: false, message: '获取用户详情失败' });
    }
  });

  router.put('/:id', authenticate, async (req, res) => {
    try {
      const { id } = req.params;
      const { name, email, phone, role } = req.body;
      
      await db.query(
        'UPDATE users SET name = ?, email = ?, phone = ?, role = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?',
        [name, email, phone, role, id]
      );
      
      const updatedUserResult = await db.query('SELECT id, username, name, email, phone, role, created_at, updated_at FROM users WHERE id = ?', [id]);
      const updatedUser = updatedUserResult.rows[0];
      res.json({ success: true, data: updatedUser });
    } catch (error) {
      console.error('更新用户信息失败:', error);
      res.status(500).json({ success: false, message: '更新用户信息失败' });
    }
  });

  router.put('/:id/password', authenticate, async (req, res) => {
    try {
      const { id } = req.params;
      const { currentPassword, newPassword } = req.body;
      
      if (req.user.id !== parseInt(id) && req.user.role !== 'admin') {
        return res.status(403).json({ success: false, message: '只能修改自己的密码' });
      }
      
      const userResult = await db.query('SELECT password, password_hash FROM users WHERE id = ?', [id]);
      if (userResult.rows.length === 0) {
        return res.status(404).json({ success: false, message: '用户不存在' });
      }
      
      const user = userResult.rows[0];
      
      let isValidPassword = false;
      if (user.password_hash) {
        isValidPassword = verifyPassword(currentPassword, user.password_hash);
      } else {
        isValidPassword = (user.password === currentPassword);
      }
      
      if (!isValidPassword) {
        return res.status(400).json({ success: false, message: '当前密码错误' });
      }
      
      const newPasswordHash = hashPassword(newPassword);
      
      await db.query(
        'UPDATE users SET password = ?, password_hash = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?',
        [newPassword, newPasswordHash, id]
      );
      
      console.log(`用户 ID ${id} 密码已更新`);
      res.json({ success: true, message: '密码更新成功' });
    } catch (error) {
      console.error('更新密码失败:', error);
      res.status(500).json({ success: false, message: '更新密码失败' });
    }
  });

  router.post('/', authenticate, async (req, res) => {
    try {
      const { username, name, email, phone, role, password } = req.body;
      
      if (!username || !name || !password) {
        return res.status(400).json({ success: false, message: '用户名、姓名和密码为必填项' });
      }
      
      const existingUser = await db.query('SELECT id FROM users WHERE username = ?', [username]);
      if (existingUser.rows.length > 0) {
        return res.status(400).json({ success: false, message: '用户名已存在' });
      }
      
      const passwordHash = hashPassword(password);
      
      const result = await db.query(
        'INSERT INTO users (username, password, password_hash, name, email, phone, role, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)',
        [username, password, passwordHash, name, email || '', phone || '', role || 'user']
      );
      
      const newUserResult = await db.query('SELECT id, username, name, email, phone, role, created_at, updated_at FROM users WHERE id = ?', [result.lastID]);
      const newUser = newUserResult.rows[0];
      
      console.log(`用户 ${username} 创建成功，由 ${req.user.username} 操作`);
      res.json({ success: true, data: newUser });
    } catch (error) {
      console.error('创建用户失败:', error);
      res.status(500).json({ success: false, message: '创建用户失败' });
    }
  });

  router.delete('/:id', authenticate, async (req, res) => {
    try {
      const { id } = req.params;
      
      const existingUser = await db.query('SELECT id FROM users WHERE id = ?', [id]);
      if (existingUser.rows.length === 0) {
        return res.status(404).json({ success: false, message: '用户不存在' });
      }
      
      await db.query('DELETE FROM users WHERE id = ?', [id]);
      
      res.json({ success: true, message: '用户删除成功' });
    } catch (error) {
      console.error('删除用户失败:', error);
      res.status(500).json({ success: false, message: '删除用户失败' });
    }
  });

  app.use('/api/users', router);
};