// package system
// @Link  https://github.com/xiujiecn/xiu-admin
// @Copyright  Copyright (c) 2025 LiXiujie
// @Author  Lxj <xxx@example.com>
// @License  https://github.com/xiujiecn/xiu-admin/blob/master/LICENSE
package system

import (
	"context"
	"crypto/rand"
	"encoding/json"
	"errors"
	"fmt"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/consts"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/dao"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/library/bcache"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/library/contexts"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/library/event"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/library/rolepolicy"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/library/xgorm/handler"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/logic/smsgateway"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/model"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/model/do"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/model/entity"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/model/request"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/service"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/utility"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/utility/uuid32"
	"math/big"
	"mime"
	"net"
	"net/smtp"
	"regexp"
	"slices"
	"strings"
	"time"

	"github.com/gogf/gf/v2/database/gdb"
	"github.com/gogf/gf/v2/errors/gerror"
	"github.com/gogf/gf/v2/frame/g"
	"github.com/gogf/gf/v2/os/gtime"
	"github.com/gogf/gf/v2/util/gconv"
	"gorm.io/gorm"
)

type sSysUser struct {
}

const (
	registerCodeDailyLimit = 5
	registerCodeTTL        = 6 * time.Hour

	userBindCodeTTLSeconds = 300
	userBindEmailCodeType  = "email"
	userBindPhoneCodeType  = "phone"
)

func NewSysUser() *sSysUser {
	return &sSysUser{}
}

func init() {
	service.RegisterSysUser(NewSysUser())
}

func (l *sSysUser) Model(ctx context.Context, option ...*handler.Option) *gdb.Model {
	if len(option) == 0 {
		option = append(option, &handler.Option{
			FilterTenant: true,
			FilterAuth:   true,
		})
	}
	return handler.Model(dao.SysUser.Ctx(ctx), option...)
}

// 根据用户名获取用户信息，不验证当前租户
func (l *sSysUser) GetUserByUsername(ctx context.Context, username string, tenantId string) (user *entity.SysUser, err error) {
	var data *entity.SysUser
	err = dao.SysUser.Ctx(ctx).Where(dao.SysUser.Columns().UserName, username).Where(dao.SysUser.Columns().TenantId, tenantId).Scan(&data)
	if err != nil {
		if err == gorm.ErrRecordNotFound {
			return nil, gerror.NewCode(consts.CodeUserNotFound, "账号不存在")
		}
		return nil, err
	}
	if data == nil {
		return nil, gerror.NewCode(consts.CodeUserNotFound, "账号不存在")
	}
	if data.Status == consts.SysUserStatusDisable {
		return nil, gerror.NewCode(consts.CodeUserDisabled, "账号已禁用")
	}
	if data.Status == consts.SysUserStatusLocked {
		return nil, gerror.NewCode(consts.CodeUserLocked, "账号已锁定")
	}
	if data.Status == consts.SysUserStatusExpired {
		return nil, gerror.NewCode(consts.CodeUserExpired, "账号已过期")
	}
	if data.Status == consts.SysUserStatusDeleted {
		return nil, gerror.NewCode(consts.CodeUserDeleted, "账号已删除")
	}
	return data, nil
}

// 根据邮箱获取用户信息，不验证当前租户
func (l *sSysUser) GetUserByEmail(ctx context.Context, email string, tenantId string) (user *entity.SysUser, err error) {
	err = dao.SysUser.Ctx(ctx).Where(dao.SysUser.Columns().Email, email).Where(dao.SysUser.Columns().TenantId, tenantId).Scan(&user)
	if err != nil {
		if err == gorm.ErrRecordNotFound {
			return nil, gerror.NewCode(consts.CodeUserNotFound, "账号不存在")
		}
		return nil, err
	}
	if user == nil {
		return nil, gerror.NewCode(consts.CodeUserNotFound, "账号不存在")
	}
	if user.Status == consts.SysUserStatusDisable {
		return nil, gerror.NewCode(consts.CodeUserDisabled, "账号已禁用")
	}
	if user.Status == consts.SysUserStatusLocked {
		return nil, gerror.NewCode(consts.CodeUserLocked, "账号已锁定")
	}
	if user.Status == consts.SysUserStatusExpired {
		return nil, gerror.NewCode(consts.CodeUserExpired, "账号已过期")
	}
	if user.Status == consts.SysUserStatusDeleted {
		return nil, gerror.NewCode(consts.CodeUserDeleted, "账号已删除")
	}
	return user, nil
}

// 根据手机号获取用户信息,不验证当前租户
func (l *sSysUser) GetUserByPhone(ctx context.Context, phone string, tenantId string) (user *entity.SysUser, err error) {
	err = dao.SysUser.Ctx(ctx).Where(dao.SysUser.Columns().Phonenumber, phone).Where(dao.SysUser.Columns().TenantId, tenantId).Scan(&user)
	if err != nil {
		if err == gorm.ErrRecordNotFound {
			return nil, gerror.NewCode(consts.CodeUserNotFound, "账号不存在")
		}
		return nil, err
	}
	if user == nil {
		return nil, gerror.NewCode(consts.CodeUserNotFound, "账号不存在")
	}
	if user.Status == consts.SysUserStatusDisable {
		return nil, gerror.NewCode(consts.CodeUserDisabled, "账号已禁用")
	}
	if user.Status == consts.SysUserStatusLocked {
		return nil, gerror.NewCode(consts.CodeUserLocked, "账号已锁定")
	}
	if user.Status == consts.SysUserStatusExpired {
		return nil, gerror.NewCode(consts.CodeUserExpired, "账号已过期")
	}
	if user.Status == consts.SysUserStatusDeleted {
		return nil, gerror.NewCode(consts.CodeUserDeleted, "账号已删除")
	}

	return
}

// ListUsersByPhone 跨租户按手机号查询用户列表（登录场景：手机号可能对应多个租户下的账号）。
// 不校验状态，由调用方逐个处理，便于给出明确的错误提示。
func (l *sSysUser) ListUsersByPhone(ctx context.Context, phone string) (users []*entity.SysUser, err error) {
	err = dao.SysUser.Ctx(ctx).Where(dao.SysUser.Columns().Phonenumber, phone).Scan(&users)
	if err != nil {
		return nil, err
	}
	return users, nil
}

// 根据用户名和密码获取用户信息
func (l *sSysUser) GetUserByUsernameAndPassword(ctx context.Context, tenantId string, username string, password string) (user *entity.SysUser, err error) {
	// 判断用户名是否存在
	user, err = l.GetUserByUsername(ctx, username, tenantId)
	if err != nil {
		return nil, err
	}
	// 判断密码是否正确
	password = utility.PasswordEncrypt(password, user.Salt)
	if password != user.Password {
		g.Log().Errorf(ctx, "密码错误: username:%s, password:%s, user:%+v", username, password, user)
		return nil, gerror.NewCode(consts.CodeUserPasswordError, "密码错误")
	}
	return user, nil
}

// 根据用户ID获取用户信息
func (l *sSysUser) GetUserById(ctx context.Context, id int64) (user *model.SysUserViewModel, err error) {
	err = l.Model(ctx).WithAll().Where(dao.SysUser.Columns().UserId, id).Scan(&user)
	if err != nil {
		return nil, err
	}
	if user == nil {
		return nil, gerror.NewCode(consts.CodeUserNotFound, "用户不存在")
	}
	// 获取用户角色
	userRoles := make([]*entity.SysUserRole, 0)
	err = dao.SysUserRole.Ctx(ctx).
		Where(dao.SysUserRole.Columns().TenantId, user.TenantId).
		Where(dao.SysUserRole.Columns().UserId, id).Scan(&userRoles)
	if err != nil {
		return nil, err
	}
	roleIds := make([]int64, 0)
	for _, userRole := range userRoles {
		roleIds = append(roleIds, userRole.RoleId)
	}
	roles := make([]*entity.SysRole, 0)
	if len(roleIds) > 0 {
		err = dao.SysRole.Ctx(ctx).
			Where(dao.SysRole.Columns().TenantId, user.TenantId).
			WhereIn(dao.SysRole.Columns().RoleId, roleIds).Scan(&roles)
		if err != nil {
			return nil, err
		}
	}
	user.Roles = make([]*model.SysRoleMiniModel, 0)
	for _, role := range roles {
		mini := &model.SysRoleMiniModel{}
		gconv.Struct(role, mini)
		user.Roles = append(user.Roles, mini)
	}
	// 获取用户岗位
	userPosts := make([]*entity.SysUserPost, 0)
	err = dao.SysUserPost.Ctx(ctx).
		Where(dao.SysUserPost.Columns().TenantId, user.TenantId).
		Where(dao.SysUserPost.Columns().UserId, id).Scan(&userPosts)
	if err != nil {
		return nil, err
	}
	postIds := make([]int64, 0)
	for _, userPost := range userPosts {
		postIds = append(postIds, userPost.PostId)
	}
	posts := make([]*entity.SysPost, 0)
	if len(postIds) > 0 {
		err = dao.SysPost.Ctx(ctx).
			Where(dao.SysPost.Columns().TenantId, user.TenantId).
			WhereIn(dao.SysPost.Columns().PostId, postIds).Scan(&posts)
		if err != nil {
			return nil, err
		}
	}
	user.Posts = make([]*model.SysPostMiniModel, 0)
	for _, post := range posts {
		mini := &model.SysPostMiniModel{}
		gconv.Struct(post, mini)
		user.Posts = append(user.Posts, mini)
	}
	return
}

// 获取用户列表
func (l *sSysUser) List(ctx context.Context, page *request.PageInfo, query *model.UserListParam) (items []*model.SysUserListModel, total int, err error) {
	deptIds := make([]int64, 0)
	if query.DeptId != 0 {
		deptIds = append(deptIds, query.DeptId)
		subDeptIds, err := service.SysDept().GetDeptIdsByParentId(ctx, query.DeptId)
		if err != nil {
			return nil, 0, err
		}
		deptIds = append(deptIds, subDeptIds...)
	}
	g.Log().Infof(ctx, "sSysUser.List 获取部门列表: deptIds:%+v", deptIds)
	// 实现分页查询逻辑
	var users []*model.SysUserListModel
	m := l.Model(ctx)
	if query.UserId != 0 {
		m = m.Where(dao.SysUser.Columns().UserId, query.UserId)
	}
	if len(deptIds) > 0 {
		m = m.WhereIn(dao.SysUser.Columns().DeptId, deptIds)
	}
	if query.UserName != "" {
		m = m.WhereLike(dao.SysUser.Columns().UserName, "%"+query.UserName+"%")
	}
	if query.NickName != "" {
		m = m.WhereLike(dao.SysUser.Columns().NickName, "%"+query.NickName+"%")
	}
	if query.Email != "" {
		m = m.WhereLike(dao.SysUser.Columns().Email, "%"+query.Email+"%")
	}
	if query.Phonenumber != "" {
		m = m.WhereLike(dao.SysUser.Columns().Phonenumber, "%"+query.Phonenumber+"%")
	}
	if query.Status != "" {
		m = m.Where(dao.SysUser.Columns().Status, query.Status)
	}
	if len(query.CreatedAt) == 2 {
		begin, end := gtime.NewFromStr(query.CreatedAt[0]), gtime.NewFromStr(query.CreatedAt[1])
		m = m.WhereBetween(dao.SysUser.Columns().CreatedAt, begin, end.EndOfDay())
	}
	if len(query.DeptIdList) > 0 {
		m = m.WhereIn(dao.SysUser.Columns().DeptId, query.DeptIdList)
	}
	total, err = m.Count()
	if err != nil {
		return nil, 0, err
	}
	err = m.WithAll().Page(page.Page, page.PageSize).Scan(&users)
	if err != nil {
		return nil, 0, err
	}
	// g.Log().Infof(ctx, "获取用户列表成功: total:%d, users:%+v", total, users)
	return users, total, nil
}

// 新增用户
func (l *sSysUser) AddUser(ctx context.Context, req *model.SysUserAddModel) (data *model.SysUserViewModel, err error) {
	// 获取当前登录用户的租户
	if req.TenantId == "" {
		req.TenantId = contexts.GetTenantId(ctx)
	}
	// 判断部门是否存在
	dept, err := service.SysDept().GetDeptById(ctx, req.DeptId)
	if err != nil {
		return nil, err
	}
	if dept == nil || dept.TenantId != req.TenantId {
		return nil, gerror.NewCode(consts.CodeDeptNotFound, "部门不存在")
	}

	if err := rolepolicy.ValidateUserRoleAssignment(ctx, req.TenantId, req.DeptId, req.RoleIds, nil); err != nil {
		return nil, err
	}
	// 判断用户名是否存在（在当前租户下）
	var user *entity.SysUser
	err = dao.SysUser.Ctx(ctx).Where(dao.SysUser.Columns().UserName, req.UserName).Where(dao.SysUser.Columns().TenantId, req.TenantId).Scan(&user)
	if err != nil {
		if err != gorm.ErrRecordNotFound {
			return nil, err
		}
	}
	if user != nil {
		return nil, gerror.NewCode(consts.CodeUserExists, "用户名已存在")
	}
	// // 判断邮箱是否存在
	// user, err = l.GetUserByEmail(ctx, req.Email)
	// if err != nil {
	// 	return nil, err
	// }
	// if user != nil {
	// 	return nil, gerror.NewCode(consts.CodeEmailExists, "邮箱已存在")
	// }
	// // 判断手机号是否存在
	// user, err = l.GetUserByPhone(ctx, req.Phone)
	// if err != nil {
	// 	return nil, err
	// }
	// if user != nil {
	// 	return nil, gerror.NewCode(consts.CodePhoneExists, "手机号已存在")
	// }

	// 随机生成5位字符
	salt := utility.RandomString(5)
	password := utility.PasswordEncrypt(req.Password, salt)

	dataInsert := do.SysUser{}
	gconv.Struct(req, &dataInsert)
	dataInsert.Password = password
	dataInsert.Salt = salt
	dataInsert.CreatedDept = contexts.GetDeptId(ctx)
	dataInsert.CreatedBy = contexts.GetUserId(ctx)
	dataInsert.CreatedAt = gtime.Now()
	dataInsert.UpdatedBy = contexts.GetUserId(ctx)
	dataInsert.UpdatedAt = gtime.Now()
	dataInsert.TenantId = req.TenantId
	// 新账号尚未设置密码，标记为「未由用户本人设置」，登录后首登引导修改
	dataInsert.IsInitPassword = 1
	if req.UserType == "" {
		dataInsert.UserType = consts.SysUserTypeSys
	}
	result, err := dao.SysUser.Ctx(ctx).Data(dataInsert).Insert()
	if err != nil {
		return nil, err
	}
	userId, err := result.LastInsertId()
	if err != nil {
		return nil, err
	}
	data, err = l.GetUserById(ctx, userId)
	if err != nil {
		return nil, err
	}
	// 新增用户角色
	d := make([]map[string]any, 0)
	if len(req.RoleIds) > 0 {
		for _, roleId := range req.RoleIds {
			d = append(d, map[string]any{
				dao.SysUserRole.Columns().TenantId: req.TenantId,
				dao.SysUserRole.Columns().UserId:   userId,
				dao.SysUserRole.Columns().RoleId:   roleId,
			})
		}
		_, err = dao.SysUserRole.Ctx(ctx).Data(d).Insert()
		if err != nil {
			return nil, err
		}
	}
	// 新增用户岗位
	if len(req.PostIds) > 0 {
		d = make([]map[string]any, 0)
		for _, postId := range req.PostIds {
			d = append(d, map[string]any{
				dao.SysUserPost.Columns().TenantId: req.TenantId,
				dao.SysUserPost.Columns().UserId:   userId,
				dao.SysUserPost.Columns().PostId:   postId,
			})
		}
		_, err = dao.SysUserPost.Ctx(ctx).Data(d).Insert()
		if err != nil {
			return nil, err
		}
	}
	return data, nil
}

func (l *sSysUser) Profile(ctx context.Context) (user *model.UserProfileModel, err error) {

	u, err := l.GetUserById(ctx, contexts.GetUserId(ctx))
	if err != nil {
		return nil, err
	}
	companyInfo := service.SysDept().GetParentCompanyInfo(ctx, u.DeptId)
	return &model.UserProfileModel{
		SysUserViewModel: *u,
		CompanyInfo: &model.SysDeptMiniModel{
			DeptId:   companyInfo.DeptId,
			DeptName: companyInfo.DeptName,
			ParentId: companyInfo.ParentId,
		},
	}, nil
}

func (l *sSysUser) UpdateCurrentUser(ctx context.Context, req *model.UpdateCurrentUserModel) (user *model.SysUserViewModel, err error) {
	userId := contexts.GetUserId(ctx)
	_, err = l.Model(ctx).Where(dao.SysUser.Columns().UserId, userId).Data(req).OmitEmpty().Update()
	if err != nil {
		return nil, err
	}
	user, err = l.GetUserById(ctx, userId)
	if err != nil {
		return nil, err
	}
	event.EventsInstance().Emit(ctx, consts.EventKeyUserUpdate, userId)
	return user, nil
}

func (l *sSysUser) UpdateCurrentUserPassword(ctx context.Context, req *model.UpdateCurrentUserPasswordModel) (err error) {
	userId := contexts.GetUserId(ctx)
	var user *entity.SysUser
	err = l.Model(ctx).Where(dao.SysUser.Columns().UserId, userId).Scan(&user)
	if err != nil {
		return err
	}
	if user == nil {
		return gerror.NewCode(consts.CodeUserNotFound, "用户不存在")
	}

	oldPassword := utility.PasswordEncrypt(req.OldPassword, user.Salt)
	if oldPassword != user.Password {
		return gerror.NewCode(consts.CodeUserPasswordError, "旧密码错误")
	}
	salt := utility.RandomString(5)
	password := utility.PasswordEncrypt(req.NewPassword, salt)
	_, err = l.Model(ctx).Where(dao.SysUser.Columns().UserId, userId).Data(map[string]any{
		dao.SysUser.Columns().Password:       password,
		dao.SysUser.Columns().Salt:           salt,
		dao.SysUser.Columns().IsInitPassword: 0,
		dao.SysUser.Columns().UpdatedBy:      userId,
		dao.SysUser.Columns().UpdatedAt:      gtime.Now(),
	}).Update()
	if err != nil {
		return err
	}
	return nil
}

func (l *sSysUser) SendCurrentUserEmailCode(ctx context.Context, req *model.SendCurrentUserEmailCodeModel) (err error) {
	email := strings.TrimSpace(req.Email)
	if err = validateUserEmail(email); err != nil {
		return err
	}
	if err = verifyIdentityCaptcha(ctx, req.CaptchaID, req.CaptchaValue); err != nil {
		return err
	}
	user, err := currentEntityUser(ctx)
	if err != nil {
		return err
	}
	if strings.EqualFold(strings.TrimSpace(user.Email), email) {
		return gerror.New("新邮箱不能与当前邮箱相同")
	}
	if err = ensureEmailAvailable(ctx, user, email); err != nil {
		return err
	}
	code, err := GenerateMfaCode(ctx)
	if err != nil {
		return err
	}
	if err = setUserBindCode(ctx, userBindEmailCodeType, user.UserId, email, code); err != nil {
		return gerror.Wrap(err, "保存邮箱验证码失败，请稍后重试")
	}
	return sendUserEmailCode(ctx, email, code)
}

func (l *sSysUser) UpdateCurrentUserEmail(ctx context.Context, req *model.UpdateCurrentUserEmailModel) (err error) {
	email := strings.TrimSpace(req.Email)
	if err = validateUserEmail(email); err != nil {
		return err
	}
	user, err := currentEntityUser(ctx)
	if err != nil {
		return err
	}
	if err = verifyUserBindCode(ctx, userBindEmailCodeType, user.UserId, email, req.Code); err != nil {
		return err
	}
	if err = ensureEmailAvailable(ctx, user, email); err != nil {
		return err
	}
	_, err = dao.SysUser.Ctx(ctx).
		Where(dao.SysUser.Columns().UserId, user.UserId).
		Where(dao.SysUser.Columns().TenantId, user.TenantId).
		Data(g.Map{
			dao.SysUser.Columns().Email:     email,
			dao.SysUser.Columns().UpdatedBy: user.UserId,
			dao.SysUser.Columns().UpdatedAt: gtime.Now(),
		}).
		Update()
	if err != nil {
		return gerror.Wrap(err, "修改邮箱失败，请稍后重试")
	}
	_ = deleteUserBindCode(ctx, userBindEmailCodeType, user.UserId, email)
	event.EventsInstance().Emit(ctx, consts.EventKeyUserUpdate, user.UserId)
	return nil
}

func (l *sSysUser) SendCurrentUserPhoneCode(ctx context.Context, req *model.SendCurrentUserPhoneCodeModel) (err error) {
	phone := strings.TrimSpace(req.Phonenumber)
	if err = validateUserPhone(phone); err != nil {
		return err
	}
	if err = verifyIdentityCaptcha(ctx, req.CaptchaID, req.CaptchaValue); err != nil {
		return err
	}
	user, err := currentEntityUser(ctx)
	if err != nil {
		return err
	}
	if strings.TrimSpace(user.Phonenumber) == phone {
		return gerror.New("新手机号不能与当前手机号相同")
	}
	if err = ensurePhoneAvailable(ctx, user, phone); err != nil {
		return err
	}
	code, err := GenerateMfaCode(ctx)
	if err != nil {
		return err
	}
	if err = setUserBindCode(ctx, userBindPhoneCodeType, user.UserId, phone, code); err != nil {
		return gerror.Wrap(err, "保存手机验证码失败，请稍后重试")
	}
	return sendUserPhoneCode(ctx, phone, code)
}

func (l *sSysUser) UpdateCurrentUserPhone(ctx context.Context, req *model.UpdateCurrentUserPhoneModel) (err error) {
	phone := strings.TrimSpace(req.Phonenumber)
	if err = validateUserPhone(phone); err != nil {
		return err
	}
	user, err := currentEntityUser(ctx)
	if err != nil {
		return err
	}
	if err = verifyUserBindCode(ctx, userBindPhoneCodeType, user.UserId, phone, req.Code); err != nil {
		return err
	}
	if err = ensurePhoneAvailable(ctx, user, phone); err != nil {
		return err
	}
	_, err = dao.SysUser.Ctx(ctx).
		Where(dao.SysUser.Columns().UserId, user.UserId).
		Where(dao.SysUser.Columns().TenantId, user.TenantId).
		Data(g.Map{
			dao.SysUser.Columns().Phonenumber: phone,
			dao.SysUser.Columns().UpdatedBy:   user.UserId,
			dao.SysUser.Columns().UpdatedAt:   gtime.Now(),
		}).
		Update()
	if err != nil {
		return gerror.Wrap(err, "修改手机号失败，请稍后重试")
	}
	_ = deleteUserBindCode(ctx, userBindPhoneCodeType, user.UserId, phone)
	event.EventsInstance().Emit(ctx, consts.EventKeyUserUpdate, user.UserId)
	return nil
}

func (l *sSysUser) UpdateUser(ctx context.Context, req *model.SysUserUpdateModel) (err error) {
	currUserId := contexts.GetUserId(ctx)
	var existsUser *entity.SysUser
	if err = l.Model(ctx).Where(dao.SysUser.Columns().UserId, req.UserId).Scan(&existsUser); err != nil {
		return err
	}
	if existsUser == nil {
		return gerror.NewCode(consts.CodeUserNotFound, "用户不存在")
	}
	tenantId := existsUser.TenantId
	existingRoles, err := l.GetUserRoleIds(ctx, req.UserId)
	if err != nil {
		return err
	}
	deptID := existsUser.DeptId
	if req.DeptId != nil && *req.DeptId != deptID {
		deptID = *req.DeptId
		existingRoles = nil
	}
	if err := rolepolicy.ValidateUserRoleAssignment(ctx, tenantId, deptID, req.RoleIds, existingRoles); err != nil {
		return err
	}
	req.UpdatedAt = gtime.Now()
	req.UpdatedBy = &currUserId
	_, err = l.Model(ctx).Where(dao.SysUser.Columns().UserId, req.UserId).Data(req).OmitNil().Update()
	if err != nil {
		return err
	}
	// 用户角色
	urList := make([]*entity.SysUserRole, 0)
	err = dao.SysUserRole.Ctx(ctx).Where(dao.SysUserRole.Columns().TenantId, tenantId).Where(dao.SysUserRole.Columns().UserId, req.UserId).Scan(&urList)
	if err != nil {
		return err
	}
	// 计算删除和新增的角色
	delRoleIds := make([]int64, 0)
	addRoleIds := make([]int64, 0)
	hasRoleId := false
	for _, ur := range urList {
		hasRoleId = false
		for _, roleId := range req.RoleIds {
			if ur.RoleId == roleId {
				hasRoleId = true
				break
			}
		}
		if !hasRoleId {
			delRoleIds = append(delRoleIds, ur.RoleId)
		}
	}
	for _, roleId := range req.RoleIds {
		hasRoleId = false
		for _, ur := range urList {
			if ur.RoleId == roleId {
				hasRoleId = true
				break
			}
		}
		if !hasRoleId {
			addRoleIds = append(addRoleIds, roleId)
		}
	}
	// 删除多余的角色
	if len(delRoleIds) > 0 {
		_, err = dao.SysUserRole.Ctx(ctx).Where(dao.SysUserRole.Columns().TenantId, tenantId).Where(dao.SysUserRole.Columns().UserId, req.UserId).WhereIn(dao.SysUserRole.Columns().RoleId, delRoleIds).Delete()
		if err != nil {
			return err
		}
	}
	// 新增角色
	d := make([]map[string]any, 0)
	if len(addRoleIds) > 0 {
		for _, roleId := range addRoleIds {
			d = append(d, map[string]any{
				dao.SysUserRole.Columns().TenantId: tenantId,
				dao.SysUserRole.Columns().UserId:   req.UserId,
				dao.SysUserRole.Columns().RoleId:   roleId,
			})
		}
		_, err = dao.SysUserRole.Ctx(ctx).Data(d).Insert()
		if err != nil {
			return err
		}
	}
	// 查询用户岗位
	upList := make([]*entity.SysUserPost, 0)
	err = dao.SysUserPost.Ctx(ctx).Where(dao.SysUserPost.Columns().TenantId, tenantId).Where(dao.SysUserPost.Columns().UserId, req.UserId).Scan(&upList)
	if err != nil {
		return err
	}
	// 计算删除和新增的岗位
	delPostIds := make([]int64, 0)
	addPostIds := make([]int64, 0)
	hasPostId := false
	for _, up := range upList {
		hasPostId = false
		for _, postId := range req.PostIds {
			if up.PostId == postId {
				hasPostId = true
				break
			}
		}
		if !hasPostId {
			delPostIds = append(delPostIds, up.PostId)
		}
	}
	for _, postId := range req.PostIds {
		hasPostId = false
		for _, up := range upList {
			if up.PostId == postId {
				hasPostId = true
				break
			}
		}
		if !hasPostId {
			addPostIds = append(addPostIds, postId)
		}
	}
	// 删除多余岗位
	if len(delPostIds) > 0 {
		_, err = dao.SysUserPost.Ctx(ctx).Where(dao.SysUserPost.Columns().TenantId, tenantId).Where(dao.SysUserPost.Columns().UserId, req.UserId).WhereIn(dao.SysUserPost.Columns().PostId, delPostIds).Delete()
		if err != nil {
			return err
		}
	}
	// 新增岗位
	d = make([]map[string]any, 0)
	if len(addPostIds) > 0 {
		for _, postId := range addPostIds {
			d = append(d, map[string]any{
				dao.SysUserPost.Columns().TenantId: tenantId,
				dao.SysUserPost.Columns().UserId:   req.UserId,
				dao.SysUserPost.Columns().PostId:   postId,
			})
		}
		_, err = dao.SysUserPost.Ctx(ctx).Data(d).Insert()
		if err != nil {
			return err
		}
	}

	event.EventsInstance().Emit(ctx, consts.EventKeyUserUpdate, req.UserId)
	return nil
}

func (l *sSysUser) DeleteUser(ctx context.Context, userIds []int64) (err error) {
	if len(userIds) == 0 {
		g.Log().Warningf(ctx, "sSysUser.DeleteUser 用户ID列表不能为空. userIds: %v", userIds)
		return errors.New("用户ID列表不能为空")
	}
	currUserId := contexts.GetUserId(ctx)
	if slices.Contains(userIds, 1) {
		g.Log().Warningf(ctx, "sSysUser.DeleteUser 不能删除超级管理员. userIds: %v", userIds)
		return errors.New("不能删除超级管理员")
	}
	if slices.Contains(userIds, currUserId) {
		g.Log().Warningf(ctx, "sSysUser.DeleteUser 不能删除当前用户. userIds: %v, currUserId: %d", userIds, currUserId)
		return errors.New("不能删除当前用户")
	}
	isAdminUserIds, err := service.SysTenant().IsTenantAdmin(ctx, userIds)
	if err != nil {
		g.Log().Errorf(ctx, "sSysUser.DeleteUser IsTenantAdmin err: %v, userIds: %v", err, userIds)
		return err
	}
	if len(isAdminUserIds) > 0 {
		g.Log().Warningf(ctx, "sSysUser.DeleteUser 不能删除租户管理员. isAdminUserIds: %v, userIds: %v", isAdminUserIds, userIds)
		return errors.New(fmt.Sprintf("不能删除租户管理员ID: %v", isAdminUserIds))
	}

	_, err = l.Model(ctx).WhereIn(dao.SysUser.Columns().UserId, userIds).Data(map[string]any{
		dao.SysUser.Columns().DeletedAt: gtime.Now(),
		dao.SysUser.Columns().DeletedBy: currUserId,
	}).OmitEmpty().Update()
	if err != nil {
		g.Log().Errorf(ctx, "sSysUser.DeleteUser Update err: %v, userIds: %v", err, userIds)
		return err
	}

	// 删除用户绑定关系
	_, err = dao.SysSocial.Ctx(ctx).WhereIn(dao.SysSocial.Columns().UserId, userIds).Delete()
	if err != nil {
		g.Log().Errorf(ctx, "sSysUser.DeleteUser SysSocial.Ctx(ctx).Delete err: %v, userIds: %v", err, userIds)
		return err
	}

	event.EventsInstance().Emit(ctx, consts.EventKeyUserDelete, userIds)
	return nil
}

func (l *sSysUser) ResetPassword(ctx context.Context, userId int64, password string) (err error) {
	currUserId := contexts.GetUserId(ctx)
	salt := utility.RandomString(5)
	password = utility.PasswordEncrypt(password, salt)
	_, err = l.Model(ctx).Where(dao.SysUser.Columns().UserId, userId).Data(map[string]any{
		dao.SysUser.Columns().Password:       password,
		dao.SysUser.Columns().Salt:           salt,
		dao.SysUser.Columns().IsInitPassword: 1,
		dao.SysUser.Columns().UpdatedBy:      currUserId,
		dao.SysUser.Columns().UpdatedAt:      gtime.Now(),
	}).OmitEmpty().Update()
	if err != nil {
		return err
	}
	event.EventsInstance().Emit(ctx, consts.EventKeyUserUpdate, userId)
	return nil
}

func (l *sSysUser) UpdateLoginInfo(ctx context.Context, userId int64, loginIp string) (err error) {
	_, err = dao.SysUser.Ctx(ctx).Where(dao.SysUser.Columns().UserId, userId).Data(map[string]any{
		dao.SysUser.Columns().LoginIp:   loginIp,
		dao.SysUser.Columns().LoginDate: gtime.Now(),
	}).Update()
	if err != nil {
		g.Log().Errorf(ctx, "sSysUser.UpdateLoginInfo err: %v, userId: %d, loginIp: %s", err, userId, loginIp)
		return err
	}
	return nil
}

// 获取用户角色ID列表
func (l *sSysUser) GetUserRoleIds(ctx context.Context, userId int64) (roleIds []int64, err error) {
	urList := make([]*entity.SysUserRole, 0)
	tenantId := contexts.GetTenantId(ctx)
	db := dao.SysUserRole.Ctx(ctx).Master().Where(dao.SysUserRole.Columns().UserId, userId)
	if tenantId != "" {
		db = db.Where(dao.SysUserRole.Columns().TenantId, tenantId)
	}
	err = db.Scan(&urList)
	if err != nil {
		return nil, err
	}
	for _, ur := range urList {
		roleIds = append(roleIds, ur.RoleId)
	}
	return roleIds, nil
}

// 获取用户岗位ID列表
func (l *sSysUser) GetUserPostIds(ctx context.Context, userId int64) (postIds []int64, err error) {
	upList := make([]*entity.SysUserPost, 0)
	tenantId := contexts.GetTenantId(ctx)
	db := dao.SysUserPost.Ctx(ctx).Where(dao.SysUserPost.Columns().UserId, userId)
	if tenantId != "" {
		db = db.Where(dao.SysUserPost.Columns().TenantId, tenantId)
	}
	err = db.Scan(&upList)
	if err != nil {
		return nil, err
	}
	for _, up := range upList {
		postIds = append(postIds, up.PostId)
	}
	return postIds, nil
}

func (l *sSysUser) Register(ctx context.Context, param *model.SysUserRegisterModel) (err error) {
	// 验证验证码
	err = service.SysCaptcha().VerifyCaptcha(ctx, param.CaptchaID, param.CaptchaValue)
	if err != nil {
		return err
	}

	// 检查是否开启用户注册功能
	registerConfig := &model.SysConfigViewModel{}
	mod := g.DB().Model(dao.SysConfig.Table())
	mod = mod.Where(dao.SysConfig.Columns().ConfigKey, "sys.account.registerUser")
	mod = mod.Where(dao.SysConfig.Columns().TenantId, param.TenantId)
	err = mod.Scan(&registerConfig)
	if err != nil {
		return gerror.New("请联系管理员开启用户注册功能")
	}
	if registerConfig == nil || registerConfig.ConfigValue != "true" {
		return gerror.New("请联系管理员开启用户注册功能")
	}

	// 获取租户信息
	tenant, err := service.SysTenant().View(ctx, &model.SysTenantViewParam{
		TenantId: param.TenantId,
	})
	if err != nil {
		return err
	}
	if tenant == nil {
		return gerror.New("租户无效")
	}

	// 获取租户的默认注册组织ID
	config := &model.SysConfigViewModel{}
	mod = g.DB().Model(dao.SysConfig.Table())
	mod = mod.Where(dao.SysConfig.Columns().ConfigKey, consts.ConfigKeyTenantDefaultRegisterDeptId)
	mod = mod.Where(dao.SysConfig.Columns().TenantId, param.TenantId)
	err = mod.Scan(&config)
	if err != nil {
		return gerror.New("该租户不允许自主注册")
	}
	if config == nil || config.ConfigValue == "" {
		return gerror.New("该租户不允许自主注册")
	}

	// 验证用户名是否存在
	mod1 := g.DB().Model(dao.SysUser.Table())
	mod1 = mod1.Where(dao.SysUser.Columns().UserName, param.UserName)
	mod1 = mod1.Where(dao.SysUser.Columns().TenantId, param.TenantId)
	total, err := mod1.Count()
	if err != nil {
		return err
	}
	if total > 0 {
		return gerror.New("用户名已存在")
	}
	// 随机生成5位字符
	salt := utility.RandomString(5)
	password := utility.PasswordEncrypt(param.Password, salt)

	newUser := &entity.SysUser{
		UserName:  param.UserName,
		NickName:  "",
		UserType:  consts.SysUserTypeSys,
		Password:  password,
		Salt:      salt,
		TenantId:  param.TenantId,
		DeptId:    gconv.Int64(config.ConfigValue),
		Status:    consts.SysDeptStatusNormal,
		CreatedBy: 0,
		CreatedAt: gtime.Now(),
		UpdatedBy: 0,
		UpdatedAt: gtime.Now(),
	}

	userId, err := l.Model(ctx).Data(newUser).InsertAndGetId()
	if err != nil {
		return err
	}

	//配置角色
	// 新增用户角色
	mod = g.DB().Model(dao.SysConfig.Table())
	mod = mod.Where(dao.SysConfig.Columns().ConfigKey, consts.ConfigKeyTenantDefaultRegisterRoleId)
	mod = mod.Where(dao.SysConfig.Columns().TenantId, param.TenantId)
	err = mod.Scan(&config)
	if err != nil {
		g.Log().Error(ctx, "获取租户的默认角色失败", err)
	}
	if config != nil && config.ConfigValue != "" {
		roleId := gconv.Int64(config.ConfigValue)
		d := map[string]any{
			dao.SysUserRole.Columns().TenantId: param.TenantId,
			dao.SysUserRole.Columns().UserId:   userId,
			dao.SysUserRole.Columns().RoleId:   roleId,
		}
		_, err = dao.SysUserRole.Ctx(ctx).Data(d).Insert()
		if err != nil {
			g.Log().Error(ctx, "获取租户的默认角色失败", err)
		}
	}
	return nil
}

// Status 更新用户状态
func (l *sSysUser) Status(ctx context.Context, param *model.SysUserStatusParam) (err error) {
	_, err = l.Model(ctx).Where(dao.SysUser.Columns().UserId, param.UserId).Data(map[string]any{
		dao.SysUser.Columns().Status: param.Status,
	}).OmitEmpty().Update()
	if err != nil {
		return err
	}
	return nil
}

// 批量查询用户迷你信息
func (l *sSysUser) BatchGetUserMiniInfo(ctx context.Context, userIds []int64) (users []*model.SysUserMiniModel, err error) {
	err = dao.SysUser.Ctx(ctx).WhereIn(dao.SysUser.Columns().UserId, userIds).Scan(&users)
	if err != nil {
		return nil, err
	}
	return users, nil
}

// 登录时查看是否开启mfa验证
func (l *sSysUser) IsMfaEnabled(ctx context.Context) (mfaEnabledModel model.SysUserMfaEnabledModel, err error) {
	userId := contexts.GetUserId(ctx)
	// 查询用户是否开启MFA验证
	err = dao.SysUser.Ctx(ctx).Where(dao.SysUser.Columns().UserId, userId).Scan(&mfaEnabledModel)
	if err != nil {
		return model.SysUserMfaEnabledModel{}, err
	}
	return mfaEnabledModel, nil
}

// 是否开启 mfa验证
func (l *sSysUser) SetMfaEnabled(ctx context.Context) (uuid string, err error) {
	// 检查用户是否存在
	user := &model.SysUserViewModel{}
	userId := contexts.GetUserId(ctx)
	err = dao.SysUser.Ctx(ctx).Where(dao.SysUser.Columns().UserId, userId).Scan(&user)
	if err != nil {
		return "", err
	}
	// 检查用户邮箱是否匹配
	if user.Email == "" {
		return "", gerror.New("邮箱不能为空,请先去个人中心,绑定邮箱再开启mfa验证")
	}
	uuid = uuid32.S()
	//给用户发邮件验证码
	code, err := GenerateMfaCode(ctx)
	// 存储验证码到缓存
	err = bcache.SetUserMfaCode(ctx, uuid, code)
	if err != nil {
		return "", err
	}
	g.Log().Info(ctx, "生成mfa验证码", code)

	return uuid, nil
}

// mfa验证
func (l *sSysUser) MfaVerify(ctx context.Context, param *model.SysUserIsMfaEnabledModel) (err error) {
	g.Log().Info(ctx, "mfa验证", param)
	userId := contexts.GetUserId(ctx)
	// 检查验证码是否匹配
	code, err := bcache.GetUserMfaCode(ctx, param.Uuid)
	if err != nil {
		return err
	}
	if code != param.Code {
		return gerror.New("验证码错误")
	}
	// 删除验证码缓存
	err = bcache.DeleteUserMfaCode(ctx, param.Uuid)
	if err != nil {
		return err
	}
	// 使用前端传过来的参数更新mfa状态
	_, err = l.Model(ctx).Where(dao.SysUser.Columns().UserId, userId).Data(map[string]any{
		dao.SysUser.Columns().MfaEnabled: param.MfaEnabled,
	}).Update()
	g.Log().Info(ctx, "mfa验证成功")
	return nil
}

func currentEntityUser(ctx context.Context) (user *entity.SysUser, err error) {
	userId := contexts.GetUserId(ctx)
	if userId <= 0 {
		return nil, gerror.New("当前用户无效")
	}
	mod := dao.SysUser.Ctx(ctx).Where(dao.SysUser.Columns().UserId, userId)
	if tenantId := contexts.GetTenantId(ctx); tenantId != "" {
		mod = mod.Where(dao.SysUser.Columns().TenantId, tenantId)
	}
	if err = mod.Scan(&user); err != nil {
		return nil, err
	}
	if user == nil {
		return nil, gerror.NewCode(consts.CodeUserNotFound, "用户不存在")
	}
	return user, nil
}

func verifyIdentityCaptcha(ctx context.Context, captchaId string, captchaValue string) error {
	if strings.TrimSpace(captchaId) == "" || strings.TrimSpace(captchaValue) == "" {
		return gerror.New("身份验证码不能为空")
	}
	return service.SysCaptcha().VerifyCaptcha(ctx, captchaId, captchaValue)
}

func sendUserEmailCode(ctx context.Context, email string, code string) error {
	var cfg model.UserCodeEmailSenderConfig
	if v, err := g.Cfg().Get(ctx, "register.email"); err == nil && !v.IsNil() {
		_ = v.Scan(&cfg)
	}
	if cfg.Url != "" {
		return callUserCodeHTTP(ctx, cfg.UserCodeHttpSenderConfig, email, code)
	}
	if cfg.Host != "" {
		return sendUserCodeBySMTP(ctx, cfg, email, code)
	}
	g.Log().Infof(ctx, "user email bind code, email: %s, code: %s", email, code)
	return nil
}

func sendUserPhoneCode(ctx context.Context, phone string, code string) error {
	sent, err := smsgateway.Send(ctx, smsgateway.Request{
		Scene:       smsgateway.SceneBindPhone,
		PhoneNumber: phone,
		MsgContent:  code,
	})
	if err != nil {
		return err
	}
	if !sent {
		// 短信网关未启用（例如开发环境尚未部署 iotlcm-sms）时打印验证码，便于本地联调。
		g.Log().Infof(ctx, "user phone bind code, phone: %s, code: %s", phone, code)
	}
	return nil
}

func callUserCodeHTTP(ctx context.Context, cfg model.UserCodeHttpSenderConfig, contact string, code string) error {
	method := strings.ToUpper(strings.TrimSpace(cfg.Method))
	if method == "" {
		method = "POST"
	}
	successStatus := cfg.SuccessStatus
	if successStatus <= 0 {
		successStatus = 200
	}
	body := renderUserCodeTemplate(cfg.BodyTemplate, contact, code)
	if body == "" {
		bodyBytes, _ := json.Marshal(g.Map{
			"contact": contact,
			"code":    code,
		})
		body = string(bodyBytes)
	}
	headers := cfg.Headers
	if headers == nil {
		headers = map[string]string{}
	}
	if _, ok := headers["Content-Type"]; !ok {
		headers["Content-Type"] = "application/json"
	}
	resp, err := g.Client().Timeout(utility.ExternalRequestTimeout(cfg.Timeout)).SetHeaderMap(headers).DoRequest(ctx, method, cfg.Url, body)
	if err != nil {
		return gerror.Wrap(err, "发送验证码失败，请稍后重试")
	}
	defer resp.Close()
	if resp.StatusCode != successStatus {
		return gerror.Newf("发送验证码失败，服务响应状态码：%d", resp.StatusCode)
	}
	return nil
}

func sendUserCodeBySMTP(ctx context.Context, cfg model.UserCodeEmailSenderConfig, email string, code string) error {
	if cfg.Port <= 0 {
		cfg.Port = 25
	}
	if cfg.From == "" {
		cfg.From = cfg.Username
	}
	addr := net.JoinHostPort(cfg.Host, gconv.String(cfg.Port))
	auth := smtp.PlainAuth("", cfg.Username, cfg.Password, cfg.Host)
	msg := buildUserCodeEmailMessage(cfg, email, code)
	err := utility.SendSMTP(ctx, utility.SMTPOptions{
		Address: addr,
		Host:    cfg.Host,
		Auth:    auth,
		From:    cfg.From,
		To:      []string{email},
		Data:    msg,
		SSL:     cfg.SSL,
		Timeout: utility.ExternalRequestTimeout(cfg.Timeout),
	})
	if err != nil {
		g.Log().Errorf(ctx, "send user email code failed, email: %s, err: %+v", email, err)
		return gerror.New("发送邮箱验证码失败，请稍后重试")
	}
	return nil
}

func buildUserCodeEmailMessage(cfg model.UserCodeEmailSenderConfig, email string, code string) []byte {
	subject := cfg.Subject
	if subject == "" {
		subject = "邮箱验证码"
	}
	body := renderUserCodeTemplate(cfg.BodyTemplate, email, code)
	if body == "" {
		body = fmt.Sprintf("您的验证码是：%s，5分钟内有效。", code)
	}
	from := cfg.From
	if cfg.FromName != "" {
		from = mime.QEncoding.Encode("UTF-8", cfg.FromName) + " <" + cfg.From + ">"
	}
	message := strings.Builder{}
	message.WriteString("From: " + from + "\r\n")
	message.WriteString("To: " + email + "\r\n")
	message.WriteString("Subject: " + mime.QEncoding.Encode("UTF-8", subject) + "\r\n")
	message.WriteString("MIME-Version: 1.0\r\n")
	message.WriteString("Content-Type: text/html; charset=UTF-8\r\n")
	message.WriteString("\r\n")
	message.WriteString(body)
	return []byte(message.String())
}

func renderUserCodeTemplate(template string, contact string, code string) string {
	if template == "" {
		return ""
	}
	replacer := strings.NewReplacer(
		"{contact}", contact,
		"{{contact}}", contact,
		"{email}", contact,
		"{{email}}", contact,
		"{phone}", contact,
		"{{phone}}", contact,
		"{code}", code,
		"{{code}}", code,
	)
	return replacer.Replace(template)
}

func ensureEmailAvailable(ctx context.Context, current *entity.SysUser, email string) error {
	count, err := dao.SysUser.Ctx(ctx).
		Where(dao.SysUser.Columns().TenantId, current.TenantId).
		Where(dao.SysUser.Columns().Email, email).
		WhereNot(dao.SysUser.Columns().UserId, current.UserId).
		Count()
	if err != nil {
		return err
	}
	if count > 0 {
		return gerror.New("邮箱已被使用")
	}
	return nil
}

func ensurePhoneAvailable(ctx context.Context, current *entity.SysUser, phone string) error {
	count, err := dao.SysUser.Ctx(ctx).
		Where(dao.SysUser.Columns().TenantId, current.TenantId).
		Where(dao.SysUser.Columns().Phonenumber, phone).
		WhereNot(dao.SysUser.Columns().UserId, current.UserId).
		Count()
	if err != nil {
		return err
	}
	if count > 0 {
		return gerror.New("手机号已被使用")
	}
	return nil
}

func validateUserEmail(email string) error {
	if email == "" {
		return gerror.New("邮箱不能为空")
	}
	if ok, _ := regexp.MatchString(`^[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}$`, email); !ok {
		return gerror.New("邮箱格式不正确")
	}
	return nil
}

func validateUserPhone(phone string) error {
	if phone == "" {
		return gerror.New("手机号不能为空")
	}
	if ok, _ := regexp.MatchString(`^1[3-9]\d{9}$`, phone); !ok {
		return gerror.New("手机号格式不正确")
	}
	return nil
}

func userBindCodeKey(codeType string, userId int64, contact string) string {
	return fmt.Sprintf("user:profile:%s:%d:%s", codeType, userId, strings.TrimSpace(contact))
}

func setUserBindCode(ctx context.Context, codeType string, userId int64, contact string, code string) error {
	_, err := g.Redis().Do(ctx, "SETEX", userBindCodeKey(codeType, userId, contact), userBindCodeTTLSeconds, code)
	return err
}

func getUserBindCode(ctx context.Context, codeType string, userId int64, contact string) (string, error) {
	value, err := g.Redis().Get(ctx, userBindCodeKey(codeType, userId, contact))
	if err != nil {
		return "", err
	}
	if value.IsNil() {
		return "", nil
	}
	return value.String(), nil
}

func deleteUserBindCode(ctx context.Context, codeType string, userId int64, contact string) error {
	_, err := g.Redis().Del(ctx, userBindCodeKey(codeType, userId, contact))
	return err
}

func verifyUserBindCode(ctx context.Context, codeType string, userId int64, contact string, code string) error {
	code = strings.TrimSpace(code)
	if code == "" {
		return gerror.New("验证码不能为空")
	}
	cacheCode, err := getUserBindCode(ctx, codeType, userId, contact)
	if err != nil {
		return gerror.Wrap(err, "获取验证码失败，请稍后重试")
	}
	if cacheCode == "" {
		return gerror.New("验证码已失效")
	}
	if cacheCode != code {
		return gerror.New("验证码错误")
	}
	return nil
}

// GenerateMfaCode 生成 6 位数字验证码。
// 使用 crypto/rand 均匀随机并保留前导零；旧实现（Unix 时间戳取模）可被预测，
// 验证码又用于登录等未鉴权场景，属可枚举凭据，必须随机。
func GenerateMfaCode(ctx context.Context) (code string, err error) {
	n, err := rand.Int(rand.Reader, big.NewInt(1000000))
	if err != nil {
		return "", gerror.Wrap(err, "生成验证码失败，请稍后重试")
	}
	return fmt.Sprintf("%06d", n.Int64()), nil
}