package app

import (
	"context"
	cryptorand "crypto/rand"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"io"
	"math/big"
	"net/http"
	"net/url"
	"strconv"
	"strings"
	"time"

	"git.5iot.com/iotlcm-public/iotlcm-app/internal/consts"
	"git.5iot.com/iotlcm-public/iotlcm-app/internal/dao"
	"git.5iot.com/iotlcm-public/iotlcm-app/internal/library/contexts"
	"git.5iot.com/iotlcm-public/iotlcm-app/internal/library/mcache"
	"git.5iot.com/iotlcm-public/iotlcm-app/internal/model"
	"git.5iot.com/iotlcm-public/iotlcm-app/internal/model/do"
	"git.5iot.com/iotlcm-public/iotlcm-app/internal/model/entity"
	"git.5iot.com/iotlcm-public/iotlcm-app/internal/service"
	"git.5iot.com/iotlcm-public/iotlcm-app/utility"

	"github.com/gogf/gf/v2/container/gvar"
	"github.com/gogf/gf/v2/crypto/gmd5"
	"github.com/gogf/gf/v2/database/gdb"
	"github.com/gogf/gf/v2/errors/gerror"
	"github.com/gogf/gf/v2/frame/g"
	"github.com/gogf/gf/v2/os/gtime"
	"github.com/wenlng/go-captcha-assets/resources/images"
	"github.com/wenlng/go-captcha-assets/resources/tiles"
	"github.com/wenlng/go-captcha/v2/base/option"
	"github.com/wenlng/go-captcha/v2/slide"
	"gorm.io/gorm"
)

const appSideCaptchaCachePrefix = "app:side:captcha:"
const appSmsCachePrefix = "app:sms:"
const appSmsCooldownPrefix = "app:sms:cooldown:"
const appSmsDailyPhonePrefix = "app:sms:daily:phone:"
const appSmsDailyIPPrefix = "app:sms:daily:ip:"
const appWechatBindTicketCachePrefix = "app:wechat:bind:"
const appWechatMiniAppSecretPlaceholder = "CHANGE_ME_WECHAT_MINI_APP_SECRET"
const appWechatBindTicketExpire = 10 * time.Minute

const (
	appSmsCodeTTL     = 5 * time.Minute
	appSmsCooldownTTL = 60 * time.Second
	appSmsDailyLimit  = 10
	appSmsDailyExpire = 24 * time.Hour
)

var appSlideCaptcha slide.Captcha

type appWechatCode2SessionRes struct {
	OpenId     string `json:"openid"`
	SessionKey string `json:"session_key"`
	UnionId    string `json:"unionid"`
	ErrCode    int    `json:"errcode"`
	ErrMsg     string `json:"errmsg"`
}

type appWechatBindTicketCache struct {
	TenantId      string `json:"tenantId"`
	OpenId        string `json:"openId"`
	UnionId       string `json:"unionId"`
	VerifiedPhone string `json:"verifiedPhone"`
}

type appCodeHttpSenderConfig struct {
	Url           string            `json:"url"`
	Method        string            `json:"method"`
	Headers       map[string]string `json:"headers"`
	BodyTemplate  string            `json:"bodyTemplate"`
	SuccessStatus int               `json:"successStatus"`
}

type appSmsHTTPResponse struct {
	Code    int    `json:"code"`
	Message string `json:"message"`
}

type sAppAuth struct{}

func NewAppAuth() *sAppAuth {
	return &sAppAuth{}
}

func init() {
	service.RegisterAppAuth(NewAppAuth())
	initAppSlideCaptcha()
}

func (s *sAppAuth) Captcha(ctx context.Context) (captchaID string, captchaImage string, err error) {
	return service.SysCaptcha().GenerateCaptcha(ctx)
}

func initAppSlideCaptcha() {
	builder := slide.NewBuilder(slide.WithEnableGraphVerticalRandom(true))
	imgs, err := images.GetImages()
	if err != nil {
		panic(err)
	}
	graphs, err := tiles.GetTiles()
	if err != nil {
		panic(err)
	}
	newGraphs := make([]*slide.GraphImage, 0, len(graphs))
	for _, graph := range graphs {
		newGraphs = append(newGraphs, &slide.GraphImage{
			OverlayImage: graph.OverlayImage,
			MaskImage:    graph.MaskImage,
			ShadowImage:  graph.ShadowImage,
		})
	}
	builder.SetResources(
		slide.WithGraphImages(newGraphs),
		slide.WithBackgrounds(imgs),
	)
	builder.SetOptions(slide.WithImageSize(option.Size{Width: 280, Height: 170}))
	appSlideCaptcha = builder.Make()
}

func (s *sAppAuth) SideCaptcha(ctx context.Context) (res *model.AppSideCaptchaModel, err error) {
	captchaData, err := appSlideCaptcha.Generate()
	if err != nil {
		return nil, gerror.New("获取滑块验证码出错")
	}
	blockData := captchaData.GetData()
	if blockData == nil {
		return nil, gerror.New("获取滑块验证码出错")
	}
	imageBase64, err := captchaData.GetMasterImage().ToBase64()
	if err != nil {
		return nil, gerror.New("获取滑块验证码出错")
	}
	tileBase64, err := captchaData.GetTileImage().ToBase64()
	if err != nil {
		return nil, gerror.New("获取滑块验证码出错")
	}
	dotsByte, err := json.Marshal(blockData)
	if err != nil {
		return nil, gerror.New("获取滑块验证码出错")
	}
	key, err := gmd5.EncryptBytes(dotsByte)
	if err != nil {
		return nil, gerror.New("获取滑块验证码出错")
	}
	if err = mcache.Set(ctx, appSideCaptchaCachePrefix+key, hex.EncodeToString(dotsByte), 5*time.Minute); err != nil {
		return nil, gerror.New("获取滑块验证码出错")
	}
	return &model.AppSideCaptchaModel{
		CaptchaKey:  key,
		ImageBase64: imageBase64,
		TileBase64:  tileBase64,
		TileWidth:   blockData.Width,
		TileHeight:  blockData.Height,
		TileX:       blockData.DX,
		TileY:       blockData.DY,
	}, nil
}

func (s *sAppAuth) CheckSideCaptcha(ctx context.Context, param *model.AppCheckSideCaptchaParam) (err error) {
	cacheKey := appSideCaptchaCachePrefix + param.CaptchaKey
	value, err := mcache.Get(ctx, cacheKey)
	if err != nil || value == nil {
		return gerror.New("滑块验证已失效")
	}
	defer mcache.Remove(ctx, cacheKey)

	dotsByte, err := hex.DecodeString(fmt.Sprintf("%v", value))
	if err != nil {
		return gerror.New("滑块验证出错")
	}
	var blockData *slide.Block
	if err = json.Unmarshal(dotsByte, &blockData); err != nil {
		return gerror.New("滑块验证出错")
	}
	point := strings.Split(param.Point, ",")
	if len(point) != 2 {
		return gerror.New("滑块验证出错")
	}
	x, _ := strconv.ParseFloat(fmt.Sprintf("%v", point[0]), 64)
	y, _ := strconv.ParseFloat(fmt.Sprintf("%v", point[1]), 64)
	if !slide.Validate(int(x), int(y), int(blockData.X), int(blockData.Y), 4) {
		return gerror.New("滑块验证失败")
	}
	return nil
}

func (s *sAppAuth) SendSms(ctx context.Context, param *model.AppSendSmsParam) (res *model.AppSendSmsModel, err error) {
	if param == nil {
		return nil, gerror.New("短信验证码参数不能为空")
	}
	param.TenantId = strings.TrimSpace(param.TenantId)
	param.Phone = strings.TrimSpace(param.Phone)
	param.Scene = strings.TrimSpace(param.Scene)
	if err = s.validateAppSmsScene(ctx, param); err != nil {
		return nil, err
	}
	if err = s.reserveAppSmsCooldown(ctx, param.TenantId, param.Phone); err != nil {
		return nil, err
	}
	if err = s.checkAppSmsRateLimit(ctx, param.TenantId, param.Phone); err != nil {
		_ = releaseAppSmsCooldown(ctx, param.TenantId, param.Phone)
		return nil, err
	}

	code, err := appRandomDigits(6)
	if err != nil {
		_ = releaseAppSmsCooldown(ctx, param.TenantId, param.Phone)
		return nil, gerror.Wrap(err, "生成短信验证码失败")
	}
	cacheKey := appSmsCacheKey(param.TenantId, param.Phone, param.Scene)
	if err = setAppSmsCode(ctx, cacheKey, code); err != nil {
		_ = releaseAppSmsCooldown(ctx, param.TenantId, param.Phone)
		return nil, gerror.New("短信验证码发送失败")
	}

	sentByHTTP, err := sendAppPhoneCode(ctx, param.Phone, code, appSmsServiceScene(param.Scene))
	if err != nil {
		_ = deleteAppSmsCode(ctx, cacheKey)
		_ = releaseAppSmsCooldown(ctx, param.TenantId, param.Phone)
		g.Log().Errorf(ctx, "APP短信验证码发送失败 scene=%s phone=%s err=%+v", param.Scene, param.Phone, err)
		return nil, gerror.New("短信验证码发送失败，请稍后重试")
	}

	res = &model.AppSendSmsModel{Success: true}
	if !sentByHTTP {
		res.SmsCode = code
	}
	return res, nil
}

func (s *sAppAuth) validateAppSmsScene(ctx context.Context, param *model.AppSendSmsParam) error {
	if err := service.AppAuth().CheckSideCaptcha(ctx, &model.AppCheckSideCaptchaParam{
		CaptchaKey: strings.TrimSpace(param.CaptchaKey),
		Point:      strings.TrimSpace(param.CaptchaPoint),
	}); err != nil {
		return err
	}
	users, err := s.findAppLoginUsersByAccount(ctx, param.TenantId, param.Phone)
	if err != nil {
		return err
	}
	switch param.Scene {
	case "register":
		if len(users) > 0 {
			return gerror.New("手机号已注册")
		}
	case "login", "forgotPassword", "wechatBindPhone":
		if len(users) == 0 {
			return gerror.New("手机号未注册")
		}
	}
	return nil
}

func (s *sAppAuth) checkAppSmsRateLimit(ctx context.Context, tenantId string, phone string) error {
	tenantId = strings.TrimSpace(tenantId)
	if tenantId == "" {
		tenantId = consts.DefaultSystemTenantCode
	}
	clientIP := strings.TrimSpace(utility.GetClientIp(ctx))
	for _, item := range []struct {
		key  string
		name string
		skip bool
	}{
		{appSmsDailyPhonePrefix + strings.TrimSpace(tenantId) + ":" + phone, "手机号", false},
		{appSmsDailyIPPrefix + clientIP, "当前网络", clientIP == ""},
	} {
		if item.skip {
			continue
		}
		value, err := g.Redis().Do(ctx, "INCR", item.key)
		if err != nil {
			return gerror.Wrap(err, "短信服务暂不可用")
		}
		if value.Int() == 1 {
			_, _ = g.Redis().Do(ctx, "EXPIRE", item.key, int(appSmsDailyExpire.Seconds()))
		}
		if value.Int() > appSmsDailyLimit {
			return gerror.Newf("%s今日短信发送次数已达上限", item.name)
		}
	}
	return nil
}

func (s *sAppAuth) reserveAppSmsCooldown(ctx context.Context, tenantId string, phone string) error {
	key := appSmsCooldownCacheKey(tenantId, phone)
	value, err := g.Redis().Do(ctx, "SET", key, "1", "NX", "EX", int(appSmsCooldownTTL.Seconds()))
	if err != nil {
		return gerror.Wrap(err, "短信服务暂不可用")
	}
	if value.IsNil() || strings.EqualFold(value.String(), "") {
		return gerror.New("短信验证码发送过于频繁，请稍后再试")
	}
	return nil
}

func releaseAppSmsCooldown(ctx context.Context, tenantId string, phone string) error {
	_, err := g.Redis().Do(ctx, "DEL", appSmsCooldownCacheKey(tenantId, phone))
	return err
}

func appSmsCooldownCacheKey(tenantId string, phone string) string {
	if tenantId == "" {
		tenantId = consts.DefaultSystemTenantCode
	}
	return fmt.Sprintf("%s%s:%s", appSmsCooldownPrefix, tenantId, phone)
}

func appSmsServiceScene(scene string) string {
	switch scene {
	case "wechatBindPhone":
		return "bind_phone"
	default:
		return scene
	}
}

func sendAppPhoneCode(ctx context.Context, phone string, code string, scene string) (sentByHTTP bool, err error) {
	var cfg appCodeHttpSenderConfig
	if v, cfgErr := g.Cfg().Get(ctx, "register.sms"); cfgErr == nil && !v.IsNil() {
		_ = v.Scan(&cfg)
	}
	if strings.TrimSpace(cfg.Url) != "" {
		return true, callAppCodeHTTP(ctx, cfg, phone, code, scene)
	}
	if !strings.EqualFold(strings.TrimSpace(g.Cfg().MustGet(ctx, "system.gfmode", "prod").String()), "dev") {
		return false, gerror.New("短信服务未配置")
	}
	g.Log().Infof(ctx, "APP短信验证码已生成 phone=%s code=%s", phone, code)
	return false, nil
}

func callAppCodeHTTP(ctx context.Context, cfg appCodeHttpSenderConfig, contact string, code string, scene string) error {
	method := strings.ToUpper(strings.TrimSpace(cfg.Method))
	if method == "" {
		method = http.MethodPost
	}
	successStatus := cfg.SuccessStatus
	if successStatus <= 0 {
		successStatus = http.StatusOK
	}

	body := renderAppCodeTemplate(cfg.BodyTemplate, contact, code, scene)
	if strings.TrimSpace(body) == "" {
		bodyBytes, _ := json.Marshal(g.Map{
			"contact": contact,
			"phone":   contact,
			"code":    code,
		})
		body = string(bodyBytes)
	}

	headers := cfg.Headers
	if headers == nil {
		headers = map[string]string{}
	}
	if _, ok := headers["Content-Type"]; !ok {
		headers["Content-Type"] = "application/json"
	}

	resp, err := g.Client().SetHeaderMap(headers).DoRequest(ctx, method, cfg.Url, body)
	if err != nil {
		return gerror.Wrap(err, "请求短信服务失败")
	}
	defer resp.Close()

	respBody := strings.TrimSpace(resp.ReadAllString())
	if resp.StatusCode != successStatus {
		if respBody != "" {
			return gerror.Newf("短信服务响应异常：%d，%s", resp.StatusCode, respBody)
		}
		return gerror.Newf("短信服务响应异常：%d", resp.StatusCode)
	}
	if respBody == "" {
		return nil
	}

	var result appSmsHTTPResponse
	if err = json.Unmarshal([]byte(respBody), &result); err != nil {
		return gerror.Wrap(err, "解析短信服务响应失败")
	}
	if result.Code != 0 {
		message := strings.TrimSpace(result.Message)
		if message == "" {
			message = "短信服务返回失败"
		}
		return gerror.New(message)
	}
	return nil
}

func renderAppCodeTemplate(template string, contact string, code string, scene string) string {
	template = strings.TrimSpace(template)
	if template == "" {
		return ""
	}
	replacer := strings.NewReplacer(
		"{contact}", contact,
		"{{contact}}", contact,
		"${contact}", contact,
		"{email}", contact,
		"{{email}}", contact,
		"${email}", contact,
		"{phone}", contact,
		"{{phone}}", contact,
		"${phone}", contact,
		"{scene}", scene,
		"{{scene}}", scene,
		"${scene}", scene,
		"{code}", code,
		"{{code}}", code,
		"${code}", code,
	)
	return replacer.Replace(template)
}

func appSmsCacheKey(tenantId string, phone string, scene string) string {
	if tenantId == "" {
		tenantId = consts.DefaultSystemTenantCode
	}
	return fmt.Sprintf("%s%s:%s:%s", appSmsCachePrefix, tenantId, scene, phone)
}

func setAppSmsCode(ctx context.Context, key string, code string) error {
	_, err := g.Redis().Do(ctx, "SETEX", key, int(appSmsCodeTTL.Seconds()), code)
	return err
}

func deleteAppSmsCode(ctx context.Context, key string) error {
	_, err := g.Redis().Do(ctx, "DEL", key)
	return err
}

func verifyAppSmsCode(ctx context.Context, tenantId string, phone string, scene string, code string) error {
	value, err := g.Redis().Get(ctx, appSmsCacheKey(tenantId, phone, scene))
	if err != nil || value == nil {
		return gerror.NewCode(consts.CodeCaptchaError, "短信验证码已失效")
	}
	if strings.TrimSpace(value.String()) != strings.TrimSpace(code) {
		return gerror.NewCode(consts.CodeCaptchaError, "短信验证码错误")
	}
	return nil
}

func appRandomDigits(length int) (string, error) {
	if length <= 0 {
		length = 6
	}
	limit := new(big.Int).Exp(big.NewInt(10), big.NewInt(int64(length)), nil)
	value, err := cryptorand.Int(cryptorand.Reader, limit)
	if err != nil {
		return "", err
	}
	return fmt.Sprintf("%0*d", length, value.Int64()), nil
}

func (s *sAppAuth) PhoneRegister(ctx context.Context, param *model.AppPhoneRegisterParam) (res *model.AppAuthTokenModel, err error) {
	if param == nil {
		return nil, gerror.New("请求参数不能为空")
	}
	param.TenantId = strings.TrimSpace(param.TenantId)
	param.Phone = strings.TrimSpace(param.Phone)
	param.SmsCode = strings.TrimSpace(param.SmsCode)
	if err = verifyAppSmsCode(ctx, param.TenantId, param.Phone, "register", param.SmsCode); err != nil {
		return nil, err
	}
	if param.TenantId == "" {
		param.TenantId = consts.DefaultSystemTenantCode
	}
	settings, err := appLoadRegisterSettings(ctx, param.TenantId)
	if err != nil {
		return nil, err
	}

	salt := utility.RandomString(5)
	password := appPasswordEncryptForStore(param.Password, salt)
	nickName := param.NickName
	if nickName == "" {
		nickName = "用户" + param.Phone[len(param.Phone)-4:]
	}
	now := gtime.Now()

	err = dao.SysUser.Transaction(ctx, func(ctx context.Context, tx gdb.TX) error {
		if err := s.releaseDeletedPhoneRegisterAccounts(ctx, tx, param.TenantId, param.Phone, now); err != nil {
			return err
		}
		userId, err := dao.SysUser.Ctx(ctx).TX(tx).Data(do.SysUser{
			TenantId:    param.TenantId,
			DeptId:      settings.DeptId,
			UserName:    param.Phone,
			NickName:    nickName,
			UserType:    consts.SysUserTypeAPP,
			Phonenumber: param.Phone,
			Sex:         "2",
			Salt:        salt,
			Password:    password,
			Status:      consts.SysUserStatusNormal,
			CreatedDept: settings.DeptId,
			CreatedAt:   now,
			UpdatedAt:   now,
		}).InsertAndGetId()
		if err != nil {
			return err
		}
		if _, err = dao.SysUserRole.Ctx(ctx).TX(tx).Data(do.SysUserRole{
			UserId: userId,
			RoleId: settings.RoleId,
		}).Insert(); err != nil {
			return err
		}
		_, err = dao.TTerminal.Ctx(ctx).TX(tx).Data(do.TTerminal{
			TerminalId:        userId,
			TerminalName:      nickName,
			Phone:             param.Phone,
			Status:            consts.SysUserStatusNormal,
			FullName:          nickName,
			LegalPersonName:   nickName,
			LegalPersonIdCard: "000000000000000000",
			Balance:           0,
			TenantId:          param.TenantId,
			CreatedDept:       settings.DeptId,
			CreatedBy:         userId,
			CreatedAt:         now,
			UpdatedBy:         userId,
			UpdatedAt:         now,
		}).Insert()
		return err
	})
	if err != nil {
		if isSysUserNameUniqueKeyError(err) {
			return nil, gerror.New("手机号已注册或账号已被占用")
		}
		return nil, err
	}
	_ = deleteAppSmsCode(ctx, appSmsCacheKey(param.TenantId, param.Phone, "register"))

	return s.PhoneLogin(ctx, &model.AppPhoneLoginParam{
		TenantId: param.TenantId,
		Account:  param.Phone,
		Password: param.Password,
	})
}

func (s *sAppAuth) releaseDeletedPhoneRegisterAccounts(ctx context.Context, tx gdb.TX, tenantId string, phone string, now *gtime.Time) error {
	tenantId = strings.TrimSpace(tenantId)
	phone = strings.TrimSpace(phone)
	if tenantId == "" {
		tenantId = consts.DefaultSystemTenantCode
	}
	if phone == "" {
		return nil
	}
	if now == nil {
		now = gtime.Now()
	}

	mod := dao.SysUser.Ctx(ctx).Unscoped()
	if tx != nil {
		mod = dao.SysUser.Ctx(ctx).TX(tx).Unscoped()
	}

	var users []*entity.SysUser
	if err := mod.
		Where(dao.SysUser.Columns().TenantId, tenantId).
		Where("("+dao.SysUser.Columns().Phonenumber+" = ? OR "+dao.SysUser.Columns().UserName+" = ?)", phone, phone).
		OrderAsc(dao.SysUser.Columns().UserId).
		Scan(&users); err != nil {
		return gerror.Wrap(err, "检查手机号注册状态失败")
	}

	for _, user := range users {
		if user == nil || user.UserId <= 0 {
			continue
		}
		if user.DeletedAt == nil || user.DeletedAt.IsZero() {
			return gerror.New("手机号已注册")
		}
	}

	for _, user := range users {
		if user == nil || user.UserId <= 0 {
			continue
		}
		data := do.SysUser{
			UpdatedAt: now,
		}
		needsUpdate := false
		if strings.TrimSpace(user.UserName) == phone {
			data.UserName = deletedRegisterUserName(user.UserId, phone)
			needsUpdate = true
		}
		if strings.TrimSpace(user.Phonenumber) == phone {
			data.Phonenumber = ""
			needsUpdate = true
		}
		if !needsUpdate {
			continue
		}
		updateMod := dao.SysUser.Ctx(ctx).Unscoped()
		if tx != nil {
			updateMod = dao.SysUser.Ctx(ctx).TX(tx).Unscoped()
		}
		if _, err := updateMod.
			WherePri(user.UserId).
			Data(data).
			OmitNil().
			Update(); err != nil {
			if isSysUserNameUniqueKeyError(err) {
				return gerror.New("手机号已注册或账号已被占用")
			}
			return gerror.Wrap(err, "释放已删除账号手机号占用失败")
		}
	}
	return nil
}

func deletedRegisterUserName(userId int64, phone string) string {
	phone = strings.TrimSpace(phone)
	if len(phone) > 6 {
		phone = phone[len(phone)-6:]
	}
	return fmt.Sprintf("del%d_%s", userId, phone)
}

func isSysUserNameUniqueKeyError(err error) bool {
	if err == nil {
		return false
	}
	errText := err.Error()
	return strings.Contains(errText, "Duplicate entry") &&
		strings.Contains(errText, "uk_user_name")
}

func (s *sAppAuth) PhoneLogin(ctx context.Context, param *model.AppPhoneLoginParam) (res *model.AppAuthTokenModel, err error) {
	if param == nil {
		param = &model.AppPhoneLoginParam{}
	}
	user, candidates, err := s.resolveAppLoginUser(ctx, param)
	if err != nil {
		return nil, err
	}
	if len(candidates) > 0 {
		return &model.AppAuthTokenModel{
			NeedSelect: true,
			Candidates: candidates,
		}, nil
	}
	return s.buildAppAuthToken(ctx, user)
}

func (s *sAppAuth) PhoneSmsLogin(ctx context.Context, param *model.AppPhoneSmsLoginParam) (res *model.AppAuthTokenModel, err error) {
	if param == nil {
		return nil, gerror.New("请求参数不能为空")
	}
	param.TenantId = strings.TrimSpace(param.TenantId)
	param.Phone = strings.TrimSpace(param.Phone)
	param.SmsCode = strings.TrimSpace(param.SmsCode)
	if err = verifyAppSmsCode(ctx, param.TenantId, param.Phone, "login", param.SmsCode); err != nil {
		return nil, err
	}
	users, err := s.findAppWechatBindUsersByPhone(ctx, param.TenantId, param.Phone)
	if err != nil {
		return nil, err
	}
	if len(users) == 0 {
		return nil, gerror.New("手机号未注册")
	}
	if len(users) > 1 && param.SelectedUserId <= 0 {
		return &model.AppAuthTokenModel{NeedSelect: true, Candidates: appLoginCandidateModels(ctx, users)}, nil
	}
	user := users[0]
	if param.SelectedUserId > 0 {
		user = nil
		for _, item := range users {
			if item != nil && item.UserId == param.SelectedUserId {
				user = item
				break
			}
		}
		if user == nil {
			return nil, gerror.New("选择的账号不属于当前手机号")
		}
	}
	_ = deleteAppSmsCode(ctx, appSmsCacheKey(param.TenantId, param.Phone, "login"))
	return s.buildAppAuthToken(ctx, user)
}

func (s *sAppAuth) WechatLogin(ctx context.Context, param *model.AppWechatLoginParam) (res *model.AppWechatLoginModel, err error) {
	if param == nil {
		return nil, gerror.New("请求参数不能为空")
	}
	tenantId := strings.TrimSpace(param.TenantId)
	if tenantId == "" {
		tenantId = consts.DefaultSystemTenantCode
	}
	session, err := appWechatMiniSessionByLoginCode(ctx, param.WxCode, false)
	if err != nil {
		return nil, err
	}
	social, err := s.getWechatSocialByOpenId(ctx, tenantId, session.OpenId)
	if err != nil {
		return nil, err
	}
	if social != nil && social.UserId > 0 {
		user, err := s.getAppUserByIdForWechat(ctx, tenantId, social.UserId)
		if err != nil {
			return nil, err
		}
		token, err := s.buildAppAuthToken(ctx, user)
		if err != nil {
			return nil, err
		}
		return &model.AppWechatLoginModel{AppAuthTokenModel: *token}, nil
	}

	ticket, err := appCreateWechatBindTicket(ctx, tenantId, session.OpenId, session.UnionId)
	if err != nil {
		return nil, err
	}
	return &model.AppWechatLoginModel{
		NeedBindPhone: true,
		BindTicket:    ticket,
		BindExpireIn:  int64(appWechatBindTicketExpire / time.Second),
	}, nil
}

func (s *sAppAuth) WechatBindPhone(ctx context.Context, param *model.AppWechatBindPhoneParam) (res *model.AppWechatBindPhoneModel, err error) {
	if param == nil {
		return nil, gerror.New("请求参数不能为空")
	}
	tenantId := strings.TrimSpace(param.TenantId)
	if tenantId == "" {
		tenantId = consts.DefaultSystemTenantCode
	}
	phone := strings.TrimSpace(param.Phone)
	if phone == "" {
		return nil, gerror.New("手机号不能为空")
	}

	ticketData, err := appLoadWechatBindTicket(ctx, param.BindTicket)
	if err != nil {
		return nil, err
	}
	if ticketData.TenantId != tenantId {
		return nil, gerror.New("微信绑定凭证与当前租户不匹配，请重新发起微信登录")
	}
	if err = appEnsureWechatBindPhoneVerified(ctx, param, ticketData, phone); err != nil {
		return nil, err
	}

	users, err := s.findAppWechatBindUsersByPhone(ctx, tenantId, phone)
	if err != nil {
		return nil, err
	}
	if len(users) == 0 {
		return nil, gerror.New("该手机号未找到可绑定账号，请先注册或联系管理员分配账号")
	}
	if len(users) > 1 && param.SelectedUserId <= 0 {
		return &model.AppWechatBindPhoneModel{
			NeedBindPhone: true,
			BindTicket:    strings.TrimSpace(param.BindTicket),
			AppAuthTokenModel: model.AppAuthTokenModel{
				NeedSelect: true,
				Candidates: appLoginCandidateModels(ctx, users),
			},
		}, nil
	}

	user := users[0]
	if param.SelectedUserId > 0 {
		user = nil
		for _, item := range users {
			if item != nil && item.UserId == param.SelectedUserId {
				user = item
				break
			}
		}
		if user == nil {
			return nil, gerror.New("选择的账号不属于当前手机号")
		}
	}
	if err = s.saveWechatOpenId(ctx, user, ticketData.OpenId, ticketData.UnionId); err != nil {
		return nil, err
	}
	_ = deleteAppSmsCode(ctx, appSmsCacheKey(tenantId, phone, "wechatBindPhone"))
	_ = mcache.Remove(ctx, appWechatBindTicketKey(param.BindTicket))

	token, err := s.buildAppAuthToken(ctx, user)
	if err != nil {
		return nil, err
	}
	return &model.AppWechatBindPhoneModel{AppAuthTokenModel: *token}, nil
}

func (s *sAppAuth) BindWechatOpenIdByLoginCode(ctx context.Context, user *entity.SysUser, wxCode string) error {
	wxCode = strings.TrimSpace(wxCode)
	if wxCode == "" {
		return nil
	}
	if user == nil || user.UserId <= 0 {
		return gerror.New("当前登录账号不存在，无法绑定微信openid")
	}
	session, err := appWechatMiniSessionByLoginCode(ctx, wxCode, true)
	if err != nil {
		return err
	}
	if session == nil {
		return nil
	}
	return s.saveWechatOpenId(ctx, user, session.OpenId, session.UnionId)
}

func appWechatMiniSessionByLoginCode(ctx context.Context, wxCode string, skipWhenDisabled bool) (*appWechatCode2SessionRes, error) {
	wxCode = strings.TrimSpace(wxCode)
	if wxCode == "" {
		return nil, gerror.New("微信登录凭证不能为空")
	}
	cfg, err := appLoadWechatConfig(ctx)
	if err != nil {
		return nil, err
	}
	if !cfg.Mini.Enabled {
		if skipWhenDisabled {
			return nil, nil
		}
		return nil, gerror.New("微信小程序登录未启用")
	}
	appId := strings.TrimSpace(cfg.Mini.AppId)
	appSecret := strings.TrimSpace(cfg.Mini.AppSecret)
	if appId == "" {
		return nil, gerror.New("微信小程序AppID未配置，无法登录")
	}
	if appWechatMiniSecretMissing(appSecret) {
		return nil, gerror.New("微信小程序AppSecret未配置，无法登录")
	}
	return appWechatMiniCode2Session(ctx, appId, appSecret, wxCode)
}

func appWechatMiniSecretMissing(secret string) bool {
	secret = strings.TrimSpace(secret)
	if secret == "" {
		return true
	}
	upper := strings.ToUpper(secret)
	return upper == appWechatMiniAppSecretPlaceholder ||
		strings.Contains(upper, "CHANGE_ME") ||
		strings.Contains(upper, "PLACEHOLDER") ||
		strings.Contains(secret, "请填写")
}

func appWechatMiniCode2Session(ctx context.Context, appId string, appSecret string, wxCode string) (*appWechatCode2SessionRes, error) {
	params := url.Values{}
	params.Set("appid", appId)
	params.Set("secret", appSecret)
	params.Set("js_code", wxCode)
	params.Set("grant_type", "authorization_code")

	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://api.weixin.qq.com/sns/jscode2session?"+params.Encode(), nil)
	if err != nil {
		return nil, gerror.Wrap(err, "创建微信openid换取请求失败")
	}
	client := &http.Client{Timeout: 8 * time.Second}
	resp, err := client.Do(req)
	if err != nil {
		return nil, gerror.Wrap(err, "请求微信openid失败")
	}
	defer resp.Body.Close()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return nil, gerror.Wrap(err, "读取微信openid响应失败")
	}
	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
		return nil, gerror.Newf("请求微信openid失败，HTTP状态码：%d", resp.StatusCode)
	}

	var result appWechatCode2SessionRes
	if err = json.Unmarshal(body, &result); err != nil {
		return nil, gerror.Wrap(err, "解析微信openid响应失败")
	}
	if result.ErrCode != 0 {
		msg := strings.TrimSpace(result.ErrMsg)
		if msg == "" {
			msg = "微信返回错误"
		}
		return nil, gerror.Newf("换取微信openid失败：%s(%d)", msg, result.ErrCode)
	}
	if strings.TrimSpace(result.OpenId) == "" {
		return nil, gerror.New("微信未返回openid")
	}
	return &result, nil
}

func appCreateWechatBindTicket(ctx context.Context, tenantId string, openId string, unionId string) (string, error) {
	openId = strings.TrimSpace(openId)
	if openId == "" {
		return "", gerror.New("微信openid为空，无法生成绑定凭证")
	}
	ticket, err := appRandomHex(24)
	if err != nil {
		return "", gerror.Wrap(err, "生成微信绑定凭证失败")
	}
	data := &appWechatBindTicketCache{
		TenantId: strings.TrimSpace(tenantId),
		OpenId:   openId,
		UnionId:  strings.TrimSpace(unionId),
	}
	if data.TenantId == "" {
		data.TenantId = consts.DefaultSystemTenantCode
	}
	if err = mcache.Set(ctx, appWechatBindTicketKey(ticket), data, appWechatBindTicketExpire); err != nil {
		return "", gerror.Wrap(err, "保存微信绑定凭证失败")
	}
	return ticket, nil
}

func appRandomHex(size int) (string, error) {
	if size <= 0 {
		size = 16
	}
	buf := make([]byte, size)
	if _, err := cryptorand.Read(buf); err != nil {
		return "", err
	}
	return hex.EncodeToString(buf), nil
}

func appWechatBindTicketKey(ticket string) string {
	return appWechatBindTicketCachePrefix + strings.TrimSpace(ticket)
}

func appLoadWechatBindTicket(ctx context.Context, ticket string) (*appWechatBindTicketCache, error) {
	ticket = strings.TrimSpace(ticket)
	if ticket == "" {
		return nil, gerror.New("微信绑定凭证不能为空")
	}
	value, err := mcache.Get(ctx, appWechatBindTicketKey(ticket))
	if err != nil || value == nil {
		return nil, gerror.New("微信绑定凭证已过期，请重新发起微信登录")
	}
	var data appWechatBindTicketCache
	if err = gvarToStruct(value, &data); err != nil {
		return nil, gerror.Wrap(err, "读取微信绑定凭证失败")
	}
	data.TenantId = strings.TrimSpace(data.TenantId)
	data.OpenId = strings.TrimSpace(data.OpenId)
	data.UnionId = strings.TrimSpace(data.UnionId)
	if data.TenantId == "" {
		data.TenantId = consts.DefaultSystemTenantCode
	}
	if data.OpenId == "" {
		return nil, gerror.New("微信绑定凭证无效，请重新发起微信登录")
	}
	return &data, nil
}

func gvarToStruct(value interface{}, pointer interface{}) error {
	switch v := value.(type) {
	case *gvar.Var:
		return v.Scan(pointer)
	case *appWechatBindTicketCache:
		if data, ok := pointer.(*appWechatBindTicketCache); ok {
			*data = *v
			return nil
		}
	case appWechatBindTicketCache:
		if data, ok := pointer.(*appWechatBindTicketCache); ok {
			*data = v
			return nil
		}
	}
	bytes, err := json.Marshal(value)
	if err != nil {
		return err
	}
	return json.Unmarshal(bytes, pointer)
}

func appEnsureWechatBindPhoneVerified(ctx context.Context, param *model.AppWechatBindPhoneParam, ticketData *appWechatBindTicketCache, phone string) error {
	if param == nil {
		return gerror.New("请求参数不能为空")
	}
	if ticketData != nil && strings.TrimSpace(ticketData.VerifiedPhone) == strings.TrimSpace(phone) {
		return nil
	}
	if ticketData == nil || strings.TrimSpace(ticketData.OpenId) == "" || strings.TrimSpace(phone) == "" {
		return gerror.New("微信绑定参数不完整")
	}
	if err := verifyAppSmsCode(ctx, ticketData.TenantId, phone, "wechatBindPhone", param.SmsCode); err != nil {
		return err
	}
	ticketData.VerifiedPhone = strings.TrimSpace(phone)
	if err := mcache.Set(ctx, appWechatBindTicketKey(param.BindTicket), ticketData, appWechatBindTicketExpire); err != nil {
		return gerror.Wrap(err, "保存手机号验证状态失败")
	}
	return nil
}

func (s *sAppAuth) getWechatSocialByOpenId(ctx context.Context, tenantId string, openId string) (*entity.SysSocial, error) {
	openId = strings.TrimSpace(openId)
	if openId == "" {
		return nil, nil
	}
	if tenantId == "" {
		tenantId = consts.DefaultSystemTenantCode
	}
	var socials []*entity.SysSocial
	err := dao.SysSocial.Ctx(ctx).
		Where(dao.SysSocial.Columns().TenantId, tenantId).
		Where(dao.SysSocial.Columns().Source, consts.SourceWechatMp).
		Where(dao.SysSocial.Columns().OpenId, openId).
		WhereNull(dao.SysSocial.Columns().DeletedAt).
		OrderDesc(dao.SysSocial.Columns().Id).
		Limit(2).
		Scan(&socials)
	if err != nil && err != gorm.ErrRecordNotFound {
		return nil, gerror.Wrap(err, "查询微信绑定账号失败")
	}
	if len(socials) == 0 {
		return nil, nil
	}
	if len(socials) > 1 && socials[0] != nil && socials[1] != nil && socials[0].UserId != socials[1].UserId {
		return nil, gerror.New("当前微信绑定了多个账号，请联系管理员处理")
	}
	return socials[0], nil
}

func (s *sAppAuth) getAppUserByIdForWechat(ctx context.Context, tenantId string, userId int64) (*entity.SysUser, error) {
	if tenantId == "" {
		tenantId = consts.DefaultSystemTenantCode
	}
	var user *entity.SysUser
	err := dao.SysUser.Ctx(ctx).
		Where(dao.SysUser.Columns().TenantId, tenantId).
		Where(dao.SysUser.Columns().UserId, userId).
		WhereNull(dao.SysUser.Columns().DeletedAt).
		Limit(1).
		Scan(&user)
	if err != nil && err != gorm.ErrRecordNotFound {
		return nil, err
	}
	if user == nil || user.UserId == 0 {
		return nil, gerror.New("微信绑定账号不存在")
	}
	if err = s.checkAppLoginUserStatus(user); err != nil {
		return nil, err
	}
	return user, nil
}

func (s *sAppAuth) findAppWechatBindUsersByPhone(ctx context.Context, tenantId string, phone string) ([]*entity.SysUser, error) {
	tenantId = strings.TrimSpace(tenantId)
	phone = strings.TrimSpace(phone)
	if tenantId == "" {
		tenantId = consts.DefaultSystemTenantCode
	}
	if phone == "" {
		return nil, gerror.New("手机号不能为空")
	}
	var users []*entity.SysUser
	err := dao.SysUser.Ctx(ctx).
		Where(dao.SysUser.Columns().TenantId, tenantId).
		Where(dao.SysUser.Columns().Phonenumber, phone).
		WhereNull(dao.SysUser.Columns().DeletedAt).
		OrderAsc(dao.SysUser.Columns().UserId).
		Scan(&users)
	if err != nil && err != gorm.ErrRecordNotFound {
		return nil, err
	}
	available := make([]*entity.SysUser, 0, len(users))
	var firstStatusErr error
	for _, user := range users {
		if user == nil || user.UserId <= 0 {
			continue
		}
		if err = s.checkAppLoginUserStatus(user); err != nil {
			if firstStatusErr == nil {
				firstStatusErr = err
			}
			continue
		}
		available = append(available, user)
	}
	if len(available) == 0 && firstStatusErr != nil {
		return nil, firstStatusErr
	}
	return available, nil
}

func (s *sAppAuth) saveWechatOpenId(ctx context.Context, user *entity.SysUser, openId string, unionId string) error {
	openId = strings.TrimSpace(openId)
	if openId == "" {
		return gerror.New("微信openid为空，无法绑定")
	}
	if user == nil || user.UserId <= 0 {
		return gerror.New("绑定账号不存在")
	}
	if user.TenantId == "" {
		user.TenantId = consts.DefaultSystemTenantCode
	}
	now := gtime.Now()
	if err := s.ensureWechatOpenIdNotBoundToOtherUser(ctx, user, openId); err != nil {
		return err
	}
	var social *entity.SysSocial
	err := dao.SysSocial.Ctx(ctx).
		Where(dao.SysSocial.Columns().TenantId, user.TenantId).
		Where(dao.SysSocial.Columns().UserId, user.UserId).
		Where(dao.SysSocial.Columns().Source, consts.SourceWechatMp).
		WhereNull(dao.SysSocial.Columns().DeletedAt).
		OrderDesc(dao.SysSocial.Columns().Id).
		Limit(1).
		Scan(&social)
	if err != nil && err != gorm.ErrRecordNotFound {
		return gerror.Wrap(err, "查询微信openid绑定信息失败")
	}

	data := do.SysSocial{
		UserId:      user.UserId,
		TenantId:    user.TenantId,
		AuthId:      consts.SourceWechatMp + ":" + openId,
		Source:      consts.SourceWechatMp,
		OpenId:      openId,
		UserName:    strings.TrimSpace(user.UserName),
		NickName:    strings.TrimSpace(user.NickName),
		Avatar:      strings.TrimSpace(user.Avatar),
		AccessToken: openId,
		UnionId:     strings.TrimSpace(unionId),
		UpdatedBy:   user.UserId,
		UpdatedAt:   now,
		CreatedDept: user.DeptId,
	}
	if social != nil && social.Id > 0 {
		_, err = dao.SysSocial.Ctx(ctx).
			WherePri(social.Id).
			Data(data).
			OmitNil().
			Update()
		if err != nil {
			g.Log().Errorf(ctx, "更新微信openid绑定失败 userId=%d source=%s err=%v", user.UserId, consts.SourceWechatMp, err)
			return gerror.New("绑定微信openid失败，请稍后重试")
		}
		return nil
	}

	data.CreatedBy = user.UserId
	data.CreatedAt = now
	_, err = dao.SysSocial.Ctx(ctx).Data(data).OmitNil().Insert()
	if err != nil {
		g.Log().Errorf(ctx, "创建微信openid绑定失败 userId=%d source=%s err=%v", user.UserId, consts.SourceWechatMp, err)
		return gerror.New("绑定微信openid失败，请稍后重试")
	}
	return nil
}

func (s *sAppAuth) ensureWechatOpenIdNotBoundToOtherUser(ctx context.Context, user *entity.SysUser, openId string) error {
	var exists *entity.SysSocial
	err := dao.SysSocial.Ctx(ctx).
		Fields(dao.SysSocial.Columns().Id, dao.SysSocial.Columns().UserId).
		Where(dao.SysSocial.Columns().TenantId, user.TenantId).
		Where(dao.SysSocial.Columns().Source, consts.SourceWechatMp).
		Where(dao.SysSocial.Columns().OpenId, strings.TrimSpace(openId)).
		WhereNot(dao.SysSocial.Columns().UserId, user.UserId).
		WhereNull(dao.SysSocial.Columns().DeletedAt).
		Limit(1).
		Scan(&exists)
	if err != nil && err != gorm.ErrRecordNotFound {
		return gerror.Wrap(err, "检查微信绑定冲突失败")
	}
	if exists != nil && exists.Id > 0 {
		return gerror.New("当前微信已绑定其他账号，请先解绑或更换微信")
	}
	return nil
}

func (s *sAppAuth) buildAppAuthToken(ctx context.Context, user *entity.SysUser) (*model.AppAuthTokenModel, error) {
	if user == nil || user.UserId == 0 {
		return nil, gerror.New("账号不存在")
	}

	ip := g.RequestFromCtx(ctx).GetClientIp()
	if err := service.SysUser().UpdateLoginInfo(ctx, user.UserId, ip); err != nil {
		g.Log().Warningf(ctx, "APP账号登录更新登录信息失败 userId=%d err=%v", user.UserId, err)
	}

	userInfo, err := getAppUserInfoById(ctx, user.UserId)
	if err != nil {
		return nil, err
	}

	ctx = contexts.Set(ctx, &model.Context{
		User: &model.Identity{
			BaseClaims: model.BaseClaims{
				ID:       user.UserId,
				Username: user.UserName,
				NickName: user.NickName,
				TenantId: user.TenantId,
				DeptId:   user.DeptId,
				Roles:    []model.Role{},
				LoginAt:  time.Now().Unix(),
			},
		},
	})

	_, token, err := service.SysAuth().GenerateToken(ctx, &model.LoginUserOut{
		ID:       user.UserId,
		Username: user.UserName,
		NickName: user.NickName,
		Avatar:   user.Avatar,
		TenantId: user.TenantId,
		DeptId:   user.DeptId,
	})
	if err != nil {
		return nil, err
	}

	expiresText := g.Cfg().MustGet(ctx, "jwt.expiresTime", "7d").String()
	expiresDuration, _ := utility.ParseDuration(expiresText)
	return &model.AppAuthTokenModel{
		Token:     token,
		ExpiresIn: int64(expiresDuration / time.Second),
		UserInfo:  userInfo,
	}, nil
}

func (s *sAppAuth) ForgotPassword(ctx context.Context, param *model.AppForgotPasswordParam) (err error) {
	if err = verifyAppSmsCode(ctx, param.TenantId, param.Phone, "forgotPassword", param.SmsCode); err != nil {
		return err
	}
	user, err := s.getUserByPhone(ctx, param.TenantId, param.Phone)
	if err != nil {
		return err
	}
	_ = deleteAppSmsCode(ctx, appSmsCacheKey(param.TenantId, param.Phone, "forgotPassword"))

	salt := utility.RandomString(5)
	password := appPasswordEncryptForStore(param.Password, salt)
	_, err = dao.SysUser.Ctx(ctx).
		Where(dao.SysUser.Columns().UserId, user.UserId).
		Data(do.SysUser{
			Password:  password,
			Salt:      salt,
			UpdatedBy: user.UserId,
			UpdatedAt: gtime.Now(),
		}).
		OmitNil().
		Update()
	return err
}

func appLoginAccount(param *model.AppPhoneLoginParam) string {
	if param == nil {
		return ""
	}
	if account := strings.TrimSpace(param.Account); account != "" {
		return account
	}
	if username := strings.TrimSpace(param.Username); username != "" {
		return username
	}
	return strings.TrimSpace(param.Phone)
}

func appPasswordEncryptForStore(password string, salt string) string {
	return utility.PasswordEncrypt(utility.Md5(password), salt)
}

func appPasswordMatches(password string, salt string, storedPassword string) bool {
	return appPasswordEncryptForStore(password, salt) == storedPassword
}

func (s *sAppAuth) resolveAppLoginUser(ctx context.Context, param *model.AppPhoneLoginParam) (*entity.SysUser, []*model.AppLoginCandidateModel, error) {
	account := appLoginAccount(param)
	if account == "" {
		return nil, nil, gerror.New("请输入手机号或用户名")
	}
	tenantId := strings.TrimSpace(param.TenantId)
	if tenantId == "" {
		tenantId = consts.DefaultSystemTenantCode
	}
	if param.SelectedUserId > 0 {
		user, err := s.getSelectedAppLoginUser(ctx, tenantId, account, param.SelectedUserId)
		if err != nil {
			return nil, nil, err
		}
		if !appPasswordMatches(param.Password, user.Salt, user.Password) {
			return nil, nil, gerror.New("账号或密码错误")
		}
		return user, nil, s.checkAppLoginUserStatus(user)
	}

	users, err := s.findAppLoginUsersByAccount(ctx, tenantId, account)
	if err != nil {
		return nil, nil, err
	}
	switch len(users) {
	case 0:
		return nil, nil, gerror.New("账号或密码错误")
	case 1:
		user := users[0]
		if !appPasswordMatches(param.Password, user.Salt, user.Password) {
			return nil, nil, gerror.New("账号或密码错误")
		}
		return user, nil, s.checkAppLoginUserStatus(user)
	default:
		matchedUsers, err := s.availableAppLoginUsersByPassword(users, param.Password)
		if err != nil {
			return nil, nil, err
		}
		switch len(matchedUsers) {
		case 0:
			return nil, nil, gerror.New("账号或密码错误")
		case 1:
			return matchedUsers[0], nil, nil
		default:
			return nil, appLoginCandidateModels(ctx, matchedUsers), nil
		}
	}
}

func (s *sAppAuth) getSelectedAppLoginUser(ctx context.Context, tenantId string, account string, userId int64) (*entity.SysUser, error) {
	var user *entity.SysUser
	err := dao.SysUser.Ctx(ctx).
		Where(dao.SysUser.Columns().TenantId, tenantId).
		Where(dao.SysUser.Columns().UserId, userId).
		Where("("+dao.SysUser.Columns().UserName+" = ? OR "+dao.SysUser.Columns().Phonenumber+" = ?)", account, account).
		Limit(1).
		Scan(&user)
	if err != nil && err != gorm.ErrRecordNotFound {
		return nil, err
	}
	if user == nil || user.UserId == 0 {
		return nil, gerror.New("选择的登录账号不存在")
	}
	return user, nil
}

func (s *sAppAuth) findAppLoginUsersByAccount(ctx context.Context, tenantId string, account string) ([]*entity.SysUser, error) {
	var users []*entity.SysUser
	account = strings.TrimSpace(account)
	err := dao.SysUser.Ctx(ctx).
		Where(dao.SysUser.Columns().TenantId, tenantId).
		Where("("+dao.SysUser.Columns().UserName+" = ? OR "+dao.SysUser.Columns().Phonenumber+" = ?)", account, account).
		OrderAsc(dao.SysUser.Columns().UserId).
		Scan(&users)
	if err != nil && err != gorm.ErrRecordNotFound {
		return nil, err
	}
	if len(users) <= 1 {
		return users, nil
	}
	unique := make([]*entity.SysUser, 0, len(users))
	seen := make(map[int64]struct{}, len(users))
	for _, user := range users {
		if user == nil || user.UserId == 0 {
			continue
		}
		if _, ok := seen[user.UserId]; ok {
			continue
		}
		seen[user.UserId] = struct{}{}
		unique = append(unique, user)
	}
	return unique, nil
}

func (s *sAppAuth) availableAppLoginUsersByPassword(users []*entity.SysUser, password string) ([]*entity.SysUser, error) {
	matched := make([]*entity.SysUser, 0, len(users))
	var firstStatusErr error
	for _, user := range users {
		if user == nil || user.UserId == 0 {
			continue
		}
		if !appPasswordMatches(password, user.Salt, user.Password) {
			continue
		}
		if err := s.checkAppLoginUserStatus(user); err != nil {
			if firstStatusErr == nil {
				firstStatusErr = err
			}
			continue
		}
		matched = append(matched, user)
	}
	if len(matched) == 0 && firstStatusErr != nil {
		return nil, firstStatusErr
	}
	return matched, nil
}

func appLoginCandidateModels(ctx context.Context, users []*entity.SysUser) []*model.AppLoginCandidateModel {
	deptNames := appLoginDeptNames(ctx, users)
	candidates := make([]*model.AppLoginCandidateModel, 0, len(users))
	for _, user := range users {
		if user == nil || user.UserId == 0 {
			continue
		}
		role := "企业用户"
		if appIsTerminalUser(ctx, user) {
			role = "终端用户"
		}
		candidates = append(candidates, &model.AppLoginCandidateModel{
			UserId:   user.UserId,
			Username: strings.TrimSpace(user.UserName),
			NickName: strings.TrimSpace(user.NickName),
			Phone:    appMaskPhone(user.Phonenumber),
			DeptId:   user.DeptId,
			DeptName: deptNames[user.DeptId],
			UserType: strings.TrimSpace(user.UserType),
			Role:     role,
		})
	}
	return candidates
}

func appLoginDeptNames(ctx context.Context, users []*entity.SysUser) map[int64]string {
	deptIds := make([]int64, 0, len(users))
	seen := make(map[int64]struct{}, len(users))
	for _, user := range users {
		if user == nil || user.DeptId <= 0 {
			continue
		}
		if _, exists := seen[user.DeptId]; exists {
			continue
		}
		seen[user.DeptId] = struct{}{}
		deptIds = append(deptIds, user.DeptId)
	}
	result := make(map[int64]string, len(deptIds))
	if len(deptIds) == 0 {
		return result
	}
	var depts []*entity.SysDept
	if err := dao.SysDept.Ctx(ctx).
		Fields(dao.SysDept.Columns().DeptId, dao.SysDept.Columns().DeptName).
		WhereIn(dao.SysDept.Columns().DeptId, deptIds).
		Scan(&depts); err != nil {
		return result
	}
	for _, dept := range depts {
		if dept != nil && dept.DeptId > 0 {
			result[dept.DeptId] = strings.TrimSpace(dept.DeptName)
		}
	}
	return result
}

func (s *sAppAuth) getUserByAccount(ctx context.Context, tenantId string, account string) (user *entity.SysUser, err error) {
	account = strings.TrimSpace(account)
	if account == "" {
		return nil, gerror.New("请输入手机号或用户名")
	}
	if tenantId == "" {
		tenantId = consts.DefaultSystemTenantCode
	}

	err = dao.SysUser.Ctx(ctx).
		Where(dao.SysUser.Columns().TenantId, tenantId).
		Where(dao.SysUser.Columns().UserName, account).
		Scan(&user)
	if err != nil && err != gorm.ErrRecordNotFound {
		return nil, err
	}
	if user != nil {
		return user, s.checkAppLoginUserStatus(user)
	}

	var users []*entity.SysUser
	err = dao.SysUser.Ctx(ctx).
		Where(dao.SysUser.Columns().TenantId, tenantId).
		Where(dao.SysUser.Columns().Phonenumber, account).
		Limit(2).
		Scan(&users)
	if err != nil && err != gorm.ErrRecordNotFound {
		return nil, err
	}
	if len(users) > 1 {
		return nil, gerror.New("该手机号绑定多个账号，请使用用户名登录")
	}
	if len(users) == 0 || users[0] == nil {
		return nil, gerror.New("账号不存在")
	}
	return users[0], s.checkAppLoginUserStatus(users[0])
}

func (s *sAppAuth) getUserByPhone(ctx context.Context, tenantId string, phone string) (user *entity.SysUser, err error) {
	if tenantId == "" {
		tenantId = consts.DefaultSystemTenantCode
	}
	var users []*entity.SysUser
	err = dao.SysUser.Ctx(ctx).
		Where(dao.SysUser.Columns().TenantId, tenantId).
		Where(dao.SysUser.Columns().Phonenumber, phone).
		Limit(2).
		Scan(&users)
	if err != nil && err != gorm.ErrRecordNotFound {
		return nil, err
	}
	if len(users) > 1 {
		return nil, gerror.New("该手机号绑定多个账号，请联系管理员处理")
	}
	if len(users) == 0 || users[0] == nil {
		return nil, gerror.New("手机号未注册")
	}
	user = users[0]
	return user, s.checkAppLoginUserStatus(user)
}

func (s *sAppAuth) checkAppLoginUserStatus(user *entity.SysUser) error {
	if user == nil {
		return gerror.New("账号不存在")
	}
	switch user.Status {
	case consts.SysUserStatusDisable:
		return gerror.New("账号已停用")
	case consts.SysUserStatusLocked:
		return gerror.New("账号已锁定")
	case consts.SysUserStatusExpired:
		return gerror.New("账号已过期")
	case consts.SysUserStatusDeleted:
		return gerror.New("账号已删除")
	}
	return nil
}