package alicloud

import (
	"context"
	"encoding/json"
	"fmt"
	"strings"

	"github.com/pingcap-inc/pchub/internal/apiserver/store"
	"github.com/pingcap-inc/pchub/internal/pkg/code"

	"github.com/spf13/viper"

	cloudsso20210515 "github.com/alibabacloud-go/cloudsso-20210515/client"
	openapi "github.com/alibabacloud-go/darabonba-openapi/v2/client"
	util "github.com/alibabacloud-go/tea-utils/v2/service"
	"github.com/alibabacloud-go/tea/tea"
	"github.com/aliyun/credentials-go/credentials"

	modelv1 "github.com/pingcap-inc/pchub/model/v1"
	"github.com/pingcap-inc/pchub/pkg/errors"
	"github.com/pingcap-inc/pchub/pkg/log"
)

// User 阿里云用户信息（内部使用）
type User struct {
	UserId      string `json:"UserId"`
	UserName    string `json:"UserName"`
	DisplayName string `json:"DisplayName"`
	Email       string `json:"Email"`
	Status      string `json:"Status"`
	CreateTime  string `json:"CreateTime"`
	UpdateTime  string `json:"UpdateTime"`
}

// AccessAssignment 访问分配信息（内部使用）
type AccessAssignment struct {
	AccessConfigurationId   string `json:"AccessConfigurationId"`
	AccessConfigurationName string `json:"AccessConfigurationName"`
	DirectoryId             string `json:"DirectoryId"`
	DirectoryName           string `json:"DirectoryName"`
	PrincipalId             string `json:"PrincipalId"`
	PrincipalName           string `json:"PrincipalName"`
	PrincipalType           string `json:"PrincipalType"`
	TargetId                string `json:"TargetId"`
	TargetName              string `json:"TargetName"`
	TargetType              string `json:"TargetType"`
	CreateTime              string `json:"CreateTime"`
}

// Provider 阿里云云平台提供者
type Provider struct {
	config         *Config
	DirectoryID    string
	cloudssoClient *cloudsso20210515.Client
	store          store.Factory
}

// Config 阿里云配置
type Config struct {
	AccessKeyID           string `mapstructure:"access_key_id"`
	AccessKeySecret       string `mapstructure:"access_key_secret"`
	Region                string `mapstructure:"region"`
	InstanceID            string `mapstructure:"instance_id"`
	RoleArn               string `mapstructure:"role_arn"`
	AccessConfigurationID string `mapstructure:"access_configuration_id"`
	DirectoryID           string `mapstructure:"directory_id"`
}

// NewProvider 创建阿里云提供者
func NewProvider() (*Provider, error) {
	return NewProviderWithStore(nil)
}

func NewProviderWithStore(storeFactory store.Factory) (*Provider, error) {
	config := &Config{}

	// 从配置中读取阿里云凭据
	config.RoleArn = viper.GetString("alicloud.role_arn")
	config.AccessKeyID = viper.GetString("alicloud.access_key_id")
	config.AccessKeySecret = viper.GetString("alicloud.access_key_secret")
	config.Region = viper.GetString("alicloud.region")
	config.InstanceID = viper.GetString("alicloud.instance_id")
	config.AccessConfigurationID = viper.GetString("alicloud.access_configuration_id")
	config.DirectoryID = viper.GetString("alicloud.directory_id")

	// 设置默认值
	if config.Region == "" {
		config.Region = "cn-shanghai"
	}

	// 验证配置
	if err := config.Validate(); err != nil {
		return nil, fmt.Errorf("invalid Alibaba Cloud config: %w", err)
	}

	provider := &Provider{
		config: config,
		store:  storeFactory,
	}

	// 初始化时获取CloudSSO客户端
	if err := provider.initCloudSSOClient(context.Background()); err != nil {
		log.L(context.Background()).Warnf("Failed to initialize CloudSSO client: %v", err)
	}

	return provider, nil
}

// ValidateConfig 验证配置
func (c *Config) Validate() error {
	if c.AccessKeyID == "" {
		return errors.New("Alibaba Cloud access_key_id is required")
	}
	if c.AccessKeySecret == "" {
		return errors.New("Alibaba Cloud access_key_secret is required")
	}
	if c.InstanceID == "" {
		return errors.New("Alibaba Cloud instance_id is required")
	}
	if c.RoleArn == "" {
		return errors.New("Alibaba Cloud role_arn is required")
	}
	return nil
}

// GetProviderName 获取平台名称
func (p *Provider) GetProviderName() string {
	return "Alibaba Cloud"
}

// ValidateConfig 验证配置
func (p *Provider) ValidateConfig() error {
	return p.config.Validate()
}

// initCloudSSOClient 初始化CloudSSO客户端
func (p *Provider) initCloudSSOClient(ctx context.Context) error {
	// 获取STS token
	stsToken, err := GenerateStsToken(ctx, p.config.AccessKeyID, p.config.AccessKeySecret)
	if err != nil {
		return fmt.Errorf("failed to generate STS token: %w", err)
	}

	// 创建STS凭据配置
	config := new(credentials.Config).
		SetType("sts").
		SetAccessKeyId(p.config.AccessKeyID).
		SetAccessKeySecret(p.config.AccessKeySecret).
		SetSecurityToken(*stsToken)

	stsCredential, err := credentials.NewCredential(config)
	if err != nil {
		return fmt.Errorf("failed to create STS credential: %w", err)
	}

	// 创建OpenAPI配置
	openapiConfig := &openapi.Config{}
	openapiConfig.Credential = stsCredential
	openapiConfig.Endpoint = tea.String(fmt.Sprintf("cloudsso.%s.aliyuncs.com", p.config.Region))

	// 创建CloudSSO客户端
	cloudssoClient, err := cloudsso20210515.NewClient(openapiConfig)
	if err != nil {
		return fmt.Errorf("failed to create CloudSSO client: %w", err)
	}

	p.cloudssoClient = cloudssoClient
	return nil
}

// getCloudSSOClient 获取CloudSSO客户端，如果未初始化则重新初始化
func (p *Provider) getCloudSSOClient(ctx context.Context) (*cloudsso20210515.Client, error) {
	if p.cloudssoClient == nil {
		if err := p.initCloudSSOClient(ctx); err != nil {
			return nil, err
		}
	}
	return p.cloudssoClient, nil
}

// SyncUserRoles 同步用户角色
func (p *Provider) SyncUserRoles(ctx context.Context, roles []*modelv1.RoleMembers, cloudResource *modelv1.CloudResource, optionType int) error {
	log.L(ctx).Infof("Starting Alibaba Cloud role sync for directory: %s", p.DirectoryID)

	// 验证角色
	if err := p.validateRoles(roles); err != nil {
		return err
	}

	switch optionType {
	case modelv1.Add:
		return p.addUserRoles(ctx, roles, cloudResource)
	case modelv1.Delete:
		return p.deleteUserRoles(ctx, roles, cloudResource)
	case modelv1.DeleteAll:
		return p.deleteAllUserRoles(ctx, roles, cloudResource)
	default:
		return errors.New("unknown option type")
	}
}

// validateRoles 验证角色
func (p *Provider) validateRoles(roles []*modelv1.RoleMembers) error {
	if len(roles) == 0 {
		return errors.New("role is empty")
	}

	for _, role := range roles {
		if role.Role == nil {
			continue
		}
		// TODO: 需要定义阿里云允许的角色列表
		// if _, ok := modelv1.AliCloudAllowedRoles[role.Role.NameInProvider]; !ok {
		// 	return fmt.Errorf("role %s is not allowed in Alibaba Cloud", role.Role.NameInProvider)
		// }
	}
	return nil
}

// addUserRoles 添加用户角色
func (p *Provider) addUserRoles(ctx context.Context, roles []*modelv1.RoleMembers, cloudResource *modelv1.CloudResource) error {
	for _, role := range roles {
		if err := p.addRoleToMembers(ctx, role, cloudResource); err != nil {
			log.L(ctx).Warnf("Failed to add role %s: %v", role.Role.Name, err)
		}
	}
	return nil
}

// addRoleToMembers 为成员添加角色
func (p *Provider) addRoleToMembers(ctx context.Context, role *modelv1.RoleMembers, cloudResource *modelv1.CloudResource) error {
	// 获取用户Principal IDs
	emails := p.extractEmails(role.Members)
	userPrincipalIDs, err := p.GetUserPrincipalIDs(ctx, emails)
	if err != nil {
		return fmt.Errorf("failed to get user Principal IDs: %w", err)
	}

	// 为每个成员分配角色
	for _, member := range role.Members {
		principalID, exists := userPrincipalIDs[member.Email]
		if !exists {
			log.L(ctx).Warnf("Alibaba Cloud Principal ID not found for user %s", member.Email)
			continue
		}

		if err := p.assignRoleToUser(ctx, principalID, role.Role.NameInProvider, cloudResource.CloudInsID, true); err != nil {
			log.L(ctx).Warnf("Failed to assign role to user %s: %v", member.Email, err)
		} else {
			log.L(ctx).Infof("Successfully assigned role %s to user %s", role.Role.Name, member.Email)
		}
	}
	return nil
}

// deleteUserRoles 删除用户角色
func (p *Provider) deleteUserRoles(ctx context.Context, roles []*modelv1.RoleMembers, cloudResource *modelv1.CloudResource) error {
	for _, role := range roles {
		if err := p.deleteRoleFromMembers(ctx, role, cloudResource); err != nil {
			log.L(ctx).Warnf("Failed to delete role %s: %v", role.Role.Name, err)
		}
	}
	return nil
}

// deleteRoleFromMembers 从成员删除角色
func (p *Provider) deleteRoleFromMembers(ctx context.Context, role *modelv1.RoleMembers, cloudResource *modelv1.CloudResource) error {
	// 获取用户Principal IDs
	emails := p.extractEmails(role.Members)
	userPrincipalIDs, err := p.GetUserPrincipalIDs(ctx, emails)
	if err != nil {
		return fmt.Errorf("failed to get user Principal IDs: %w", err)
	}

	// 为每个成员删除角色
	for _, member := range role.Members {
		principalID, exists := userPrincipalIDs[member.Email]
		if !exists {
			log.L(ctx).Warnf("Alibaba Cloud Principal ID not found for user %s", member.Email)
			continue
		}

		if err := p.assignRoleToUser(ctx, principalID, role.Role.NameInProvider, cloudResource.CloudInsID, false); err != nil {
			log.L(ctx).Warnf("Failed to remove role from user %s: %v", member.Email, err)
		} else {
			log.L(ctx).Infof("Successfully removed role %s from user %s", role.Role.Name, member.Email)
		}
	}
	return nil
}

// deleteAllUserRoles 删除所有用户角色
func (p *Provider) deleteAllUserRoles(ctx context.Context, roles []*modelv1.RoleMembers, cloudResource *modelv1.CloudResource) error {
	// 收集所有用户的邮箱
	var emails []string
	for _, role := range roles {
		for _, member := range role.Members {
			emails = append(emails, member.Email)
		}
	}

	// 获取用户Principal IDs
	userPrincipalIDs, err := p.GetUserPrincipalIDs(ctx, emails)
	if err != nil {
		return fmt.Errorf("failed to get user Principal IDs: %w", err)
	}

	// 为每个用户删除所有允许的角色
	for _, role := range roles {
		roleName := role.Role.NameInProvider
		for email, principalID := range userPrincipalIDs {
			err := p.assignRoleToUser(ctx, principalID, roleName, cloudResource.CloudInsID, false)
			if err != nil {
				log.L(ctx).Warnf("Failed to remove Alibaba Cloud role assignment for %s: %v", email, err)
			}
		}
		log.L(ctx).Infof("delete assignment %s policy success", roleName)
	}

	return nil
}

// extractEmails 提取邮箱列表
func (p *Provider) extractEmails(members []*modelv1.User) []string {
	emails := make([]string, 0, len(members))
	for _, member := range members {
		emails = append(emails, member.Email)
	}
	return emails
}

// GetUserPrincipalIDs 获取用户的Principal IDs (测试用)
func (p *Provider) GetUserPrincipalIDs(ctx context.Context, emails []string) (map[string]string, error) {
	// 获取所有用户列表
	users, err := p.ListUsers(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to list users: %w", err)
	}

	// 构建邮箱到Principal ID的映射
	emailToPrincipalID := make(map[string]string)
	for _, user := range users {
		if user.UserName != "" {
			emailToPrincipalID[user.UserName] = user.UserId
		}
	}

	// 返回请求的邮箱对应的Principal ID
	result := make(map[string]string)
	for _, email := range emails {
		if principalID, exists := emailToPrincipalID[email]; exists {
			result[email] = principalID
		} else {
			log.L(ctx).Warnf("User not found in Alibaba Cloud: %s", email)
		}
	}

	return result, nil
}

// ListUsers 列出所有用户（直接使用SDK，测试用）
func (p *Provider) ListUsers(ctx context.Context) ([]User, error) {
	client, err := p.getCloudSSOClient(ctx)
	if err != nil {
		return nil, err
	}

	var allUsers []User
	var nextToken *string

	for {
		// 构建请求
		request := &cloudsso20210515.ListUsersRequest{
			DirectoryId: tea.String(p.config.InstanceID),
			MaxResults:  tea.Int32(100),
		}
		if nextToken != nil {
			request.NextToken = nextToken
		}

		// 执行请求
		runtime := &util.RuntimeOptions{}
		response, err := client.ListUsersWithOptions(request, runtime)
		if err != nil {
			return nil, fmt.Errorf("failed to list users: %w", err)
		}

		// 转换响应
		if response.Body != nil && response.Body.Users != nil {
			for _, user := range response.Body.Users {
				allUsers = append(allUsers, User{
					UserId:      tea.StringValue(user.UserId),
					UserName:    tea.StringValue(user.UserName),
					DisplayName: tea.StringValue(user.DisplayName),
					Email:       tea.StringValue(user.Email),
					Status:      tea.StringValue(user.Status),
					CreateTime:  tea.StringValue(user.CreateTime),
					UpdateTime:  tea.StringValue(user.UpdateTime),
				})
			}
		}

		// 检查是否有更多数据
		if response.Body == nil || response.Body.NextToken == nil {
			break
		}
		nextToken = response.Body.NextToken
	}

	return allUsers, nil
}

// ListAccessAssignments 列出访问分配（直接使用SDK，测试用）
func (p *Provider) ListAccessAssignments(ctx context.Context, directoryID string) ([]map[string]interface{}, error) {
	client, err := p.getCloudSSOClient(ctx)
	if err != nil {
		return nil, err
	}

	var allAssignments []map[string]interface{}
	var nextToken *string

	for {
		// 构建请求
		request := &cloudsso20210515.ListAccessAssignmentsRequest{
			DirectoryId: tea.String(directoryID),
			MaxResults:  tea.Int32(20),
		}
		if nextToken != nil {
			request.NextToken = nextToken
		}

		// 执行请求
		runtime := &util.RuntimeOptions{}
		response, err := client.ListAccessAssignmentsWithOptions(request, runtime)
		if err != nil {
			return nil, fmt.Errorf("failed to list access assignments: %w", err)
		}

		// 转换响应
		if response.Body != nil && response.Body.AccessAssignments != nil {
			for _, assignment := range response.Body.AccessAssignments {
				assignmentMap := map[string]interface{}{
					"AccessConfigurationId":   tea.StringValue(assignment.AccessConfigurationId),
					"AccessConfigurationName": tea.StringValue(assignment.AccessConfigurationName),
					"DirectoryId":             directoryID, // 使用传入的directoryID
					"DirectoryName":           "",          // 响应中没有这个字段，设为空
					"PrincipalId":             tea.StringValue(assignment.PrincipalId),
					"PrincipalName":           tea.StringValue(assignment.PrincipalName),
					"PrincipalType":           tea.StringValue(assignment.PrincipalType),
					"TargetId":                tea.StringValue(assignment.TargetId),
					"TargetName":              tea.StringValue(assignment.TargetName),
					"TargetType":              tea.StringValue(assignment.TargetType),
					"CreateTime":              tea.StringValue(assignment.CreateTime),
				}
				allAssignments = append(allAssignments, assignmentMap)
			}
		}

		// 检查是否有更多数据
		if response.Body == nil || response.Body.NextToken == nil {
			break
		}
		nextToken = response.Body.NextToken
	}

	return allAssignments, nil
}

// assignRoleToUser 为用户分配或删除角色
func (p *Provider) assignRoleToUser(ctx context.Context, principalID, roleName, cloudID string, isAdd bool) error {
	client, err := p.getCloudSSOClient(ctx)
	if err != nil {
		return err
	}

	if isAdd {
		// 创建访问分配
		request := &cloudsso20210515.CreateAccessAssignmentRequest{
			PrincipalId:           tea.String(principalID),
			AccessConfigurationId: tea.String(roleName),
			DirectoryId:           tea.String(p.config.DirectoryID),
			PrincipalType:         tea.String("User"),
			TargetType:            tea.String("RD-Account"),
			TargetId:              tea.String(cloudID),
		}

		log.L(ctx).Infof("Creating access assignment: % v", func() string {
			b, _ := json.Marshal(request)
			return string(b)
		}())

		runtime := &util.RuntimeOptions{}
		_, err = client.CreateAccessAssignmentWithOptions(request, runtime)
		if err != nil {
			return fmt.Errorf("failed to create access assignment: %w", err)
		}
	} else {
		// 删除访问分配
		request := &cloudsso20210515.DeleteAccessAssignmentRequest{
			PrincipalId:           tea.String(principalID),
			AccessConfigurationId: tea.String(roleName),
			DirectoryId:           tea.String(p.DirectoryID),
			PrincipalType:         tea.String("User"),
			TargetType:            tea.String("RD-Account"),
			TargetId:              tea.String(cloudID),
		}

		runtime := &util.RuntimeOptions{}
		_, err = client.DeleteAccessAssignmentWithOptions(request, runtime)
		if err != nil {
			return fmt.Errorf("failed to delete access assignment: %w", err)
		}
	}

	return nil
}

// GetProviderMembers 获取提供者成员信息
func (p *Provider) GetProviderMembers(ctx context.Context, provider string) ([]modelv1.ResourceMemberAccess, []uint64, error) {
	// 阿里云SSO成员获取的简化实现
	log.L(ctx).Info("Getting AliCloud provider members (simplified implementation)")

	// 由于阿里云SSO API的复杂性，这里返回空列表
	// 实际实现需要调用阿里云CloudSSO相关API
	return []modelv1.ResourceMemberAccess{}, []uint64{}, nil
}

// SyncUsers 同步用户到数据库
func (p *Provider) SyncUsers(ctx context.Context) error {
	log.L(ctx).Info("Starting AliCloud user sync")

	if p.store == nil {
		return errors.New("store not initialized")
	}

	// 获取所有用户
	users, err := p.ListUsers(ctx)
	if err != nil {
		return fmt.Errorf("failed to list AliCloud users: %w", err)
	}

	log.L(ctx).Infof("Found %d AliCloud users", len(users))

	// 同步用户到数据库
	for _, user := range users {
		// 转换为数据库用户模型
		dbUser := &modelv1.User{
			Name:       user.DisplayName,
			Email:      user.Email,
			LarkUserID: user.UserId, // 使用UserId作为LarkUserID
		}

		// 检查用户是否已存在
		existingUser, err := p.store.User().GetByEmail(ctx, user.Email)
		if err != nil && !errors.IsCode(err, code.ErrRecordNotFound) {
			log.L(ctx).Warnf("Failed to check existing user %s: %v", user.Email, err)
			continue
		}

		if existingUser != nil {
			// 更新现有用户
			existingUser.Name = dbUser.Name
			existingUser.LarkUserID = dbUser.LarkUserID
			if err := p.store.User().Update(ctx, existingUser); err != nil {
				log.L(ctx).Warnf("Failed to update user %s: %v", user.Email, err)
			} else {
				log.L(ctx).Infof("Updated AliCloud user: %s", user.Email)
			}
		} else {
			// 创建新用户
			if _, err := p.store.User().Create(ctx, dbUser); err != nil {
				log.L(ctx).Warnf("Failed to create user %s: %v", user.Email, err)
			} else {
				log.L(ctx).Infof("Created AliCloud user: %s", user.Email)
			}
		}
	}

	log.L(ctx).Info("AliCloud user sync completed")
	return nil
}

// SyncMembers 同步成员信息到数据库
func (p *Provider) SyncMembers(ctx context.Context) error {
	log.L(ctx).Info("Starting AliCloud member sync")

	if p.store == nil {
		return errors.New("store not initialized")
	}

	// 获取访问分配信息
	assignments, err := p.ListAccessAssignments(ctx, p.config.InstanceID)
	if err != nil {
		return fmt.Errorf("failed to list access assignments: %w", err)
	}

	log.L(ctx).Infof("Found %d AliCloud access assignments", len(assignments))

	// 获取所有阿里云相关的资源ID
	alicloudResources, err := p.store.CloudResource().ListByProviderWithProd(ctx, "alicloud")
	if err != nil {
		return fmt.Errorf("failed to list AliCloud resources: %w", err)
	}

	var alicloudResourceIDs []uint64
	for _, resource := range alicloudResources {
		alicloudResourceIDs = append(alicloudResourceIDs, resource.ID)
	}

	if len(alicloudResourceIDs) == 0 {
		log.L(ctx).Info("No AliCloud resources found, skipping member sync")
		return nil
	}

	// 获取现有的阿里云资源成员访问记录
	existingAccesses, err := p.store.ResourceMemberAccess().ListByResourceIDs(ctx, alicloudResourceIDs)
	if err != nil {
		return fmt.Errorf("failed to list existing member accesses: %w", err)
	}

	log.L(ctx).Infof("Found %d existing AliCloud member access records", len(existingAccesses))

	// 预加载所有需要的数据到map中，提高查询效率

	// 1. 预加载所有cloud_resource的cloudInsID到ID的映射
	cloudResourceMap := make(map[string]uint64) // cloudInsID -> resourceID
	for _, resource := range alicloudResources {
		if resource.CloudInsID != "" {
			cloudResourceMap[resource.CloudInsID] = resource.ID
		}
	}
	log.L(ctx).Infof("Loaded %d cloud resources into map", len(cloudResourceMap))

	// 2. 预加载所有用户email到LarkUserID的映射
	allUsers, err := p.store.User().Gets(ctx)
	if err != nil {
		return fmt.Errorf("failed to load all users: %w", err)
	}
	userEmailMap := make(map[string]string) // email -> LarkUserID
	for _, user := range allUsers {
		if user.Email != "" {
			userEmailMap[strings.ToLower(user.Email)] = user.LarkUserID
		}
	}
	log.L(ctx).Infof("Loaded %d users into map", len(userEmailMap))

	// 3. 预加载阿里云角色的accessConfigName到RoleID的映射
	allRoles, err := p.store.CloudMemberRole().Gets(ctx)
	if err != nil {
		return fmt.Errorf("failed to load all roles: %w", err)
	}
	roleConfigMap := make(map[string]uint64) // accessConfigName -> roleID
	for _, role := range allRoles {
		if role.ProviderID == 8 { // 阿里云
			if role.Code != "" {
				roleConfigMap[role.Code] = role.ID
			}
			if role.Name != "" {
				roleConfigMap[role.Name] = role.ID
			}
			if role.NameInProvider != "" {
				roleConfigMap[role.NameInProvider] = role.ID
			}
		}
	}
	log.L(ctx).Infof("Loaded %d AliCloud roles into map", len(roleConfigMap))

	// 构建当前访问分配的映射
	currentAccesses := make(map[string]*modelv1.ResourceMemberAccess)

	// 处理每个访问分配
	for _, assignment := range assignments {
		principalID, _ := assignment["PrincipalId"].(string)
		principalName, _ := assignment["PrincipalName"].(string)
		accessConfigId, _ := assignment["AccessConfigurationId"].(string)
		accessConfigName, _ := assignment["AccessConfigurationName"].(string)
		targetId, _ := assignment["TargetId"].(string)

		if principalID == "" || accessConfigId == "" {
			continue
		}

		// 通过TargetId从map中获取resourceID
		resourceID, exists := cloudResourceMap[targetId]
		if !exists {
			log.L(ctx).Warnf("Cloud resource not found for cloudInsID %s, skipping access assignment", targetId)
			continue
		}

		// 通过principalName（email）从map中获取LarkID
		memberLarkID, exists := userEmailMap[strings.ToLower(principalName)]
		if !exists {
			log.L(ctx).Warnf("User not found for email %s, skipping access assignment", principalName)
			continue
		}

		// 通过accessConfigName从map中获取RoleID
		roleID, exists := roleConfigMap[accessConfigName]
		if !exists {
			log.L(ctx).Warnf("No matching role found for accessConfigName: %s in provider 8 (AliCloud)", accessConfigName)
			// 如果找不到角色，跳过这个访问分配
			continue
		}

		// 创建唯一键用于比对
		key := fmt.Sprintf("%s-%d-%d", memberLarkID, resourceID, roleID)

		// 创建资源成员访问记录
		memberAccess := &modelv1.ResourceMemberAccess{
			MemberLarkID: memberLarkID, // 通过email查找到的LarkID
			ResourceID:   resourceID,   // 目标账户ID
			RoleID:       roleID,       // 通过accessConfigName查找到的RoleID
		}

		currentAccesses[key] = memberAccess
	}

	// 比对现有记录和当前记录，进行增删改查
	existingMap := make(map[string]*modelv1.ResourceMemberAccess)
	for _, existing := range existingAccesses {
		key := fmt.Sprintf("%s-%d-%d", existing.MemberLarkID, existing.ResourceID, existing.RoleID)
		existingMap[key] = existing
	}

	// 需要新增的记录
	var toAdd []*modelv1.ResourceMemberAccess
	for key, current := range currentAccesses {
		if _, exists := existingMap[key]; !exists {
			toAdd = append(toAdd, current)
		}
	}

	// 需要删除的记录
	var toDelete []uint64
	for key, existing := range existingMap {
		if _, exists := currentAccesses[key]; !exists {
			toDelete = append(toDelete, existing.ID)
		}
	}

	// 执行新增操作
	for _, access := range toAdd {
		if _, err := p.store.ResourceMemberAccess().Create(ctx, access); err != nil {
			log.L(ctx).Warnf("Failed to create member access record: %v", err)
		} else {
			log.L(ctx).Infof("Created AliCloud member access: LarkID=%s, ResourceID=%d, RoleID=%d",
				access.MemberLarkID, access.ResourceID, access.RoleID)
		}
	}

	// 执行删除操作
	if len(toDelete) > 0 {
		if err := p.store.ResourceMemberAccess().DeleteByIDs(ctx, toDelete); err != nil {
			log.L(ctx).Warnf("Failed to delete member access records: %v", err)
		} else {
			log.L(ctx).Infof("Deleted %d AliCloud member access records", len(toDelete))
		}
	}

	log.L(ctx).Infof("AliCloud member sync completed: added %d, deleted %d records", len(toAdd), len(toDelete))
	return nil
}

// ListPermissionPoliciesInAccessConfiguration 列出访问配置中的权限策略
func (p *Provider) ListPermissionPoliciesInAccessConfiguration(ctx context.Context, accessConfigurationId string) (interface{}, error) {
	client, err := p.getCloudSSOClient(ctx)
	if err != nil {
		return nil, err
	}

	request := &cloudsso20210515.ListPermissionPoliciesInAccessConfigurationRequest{
		DirectoryId:           tea.String(p.config.InstanceID),
		AccessConfigurationId: tea.String(accessConfigurationId),
	}

	resp, err := client.ListPermissionPoliciesInAccessConfigurationWithOptions(request, &util.RuntimeOptions{})
	if err != nil {
		// 处理错误，参考用户提供的代码
		var sdkError = &tea.SDKError{}
		if t, ok := err.(*tea.SDKError); ok {
			sdkError = t
		} else {
			sdkError.Message = tea.String(err.Error())
		}

		log.L(ctx).Errorf("AliCloud API error: %s", tea.StringValue(sdkError.Message))

		// 解析诊断信息
		var data interface{}
		if sdkError.Data != nil {
			d := json.NewDecoder(strings.NewReader(tea.StringValue(sdkError.Data)))
			if decodeErr := d.Decode(&data); decodeErr == nil {
				if m, ok := data.(map[string]interface{}); ok {
					if recommend, exists := m["Recommend"]; exists {
						log.L(ctx).Infof("AliCloud API recommendation: %v", recommend)
					}
				}
			}
		}

		return nil, fmt.Errorf("failed to list permission policies: %w", err)
	}

	return resp, nil
}