package aws

import (
	"context"
	"encoding/json"
	"fmt"
	"io"
	"os"
	"strconv"
	"sync"
	"time"

	"github.com/aws/aws-sdk-go-v2/aws"
	"github.com/aws/aws-sdk-go-v2/config"
	"github.com/aws/aws-sdk-go-v2/credentials"
	"github.com/aws/aws-sdk-go-v2/service/identitystore"
	"github.com/aws/aws-sdk-go-v2/service/identitystore/document"
	"github.com/aws/aws-sdk-go-v2/service/identitystore/types"
	"github.com/aws/aws-sdk-go-v2/service/ssoadmin"
	stypes "github.com/aws/aws-sdk-go-v2/service/ssoadmin/types"
	"github.com/spf13/viper"
	"google.golang.org/api/option"
	"google.golang.org/api/storage/v1"

	"github.com/pingcap-inc/pchub/internal/apiserver/store"
	modelv1 "github.com/pingcap-inc/pchub/model/v1"
	"github.com/pingcap-inc/pchub/pkg/errors"
	"github.com/pingcap-inc/pchub/pkg/log"
)

// Provider AWS云平台提供者
type Provider struct {
	config    *Config
	accountID string
	store     store.Factory
}

// Config AWS配置
type Config struct {
	AccessKeyID     string `mapstructure:"access_key_id"`
	SecretAccessKey string `mapstructure:"secret_access_key"`
	SessionToken    string `mapstructure:"session_token"`
	Region          string `mapstructure:"region"`
	InstanceArn     string `mapstructure:"instance_arn"`
	IdentityStoreId string `mapstructure:"identity_store_id"`
	UseGCSTokens    bool   `mapstructure:"use_gcs_tokens"`
	ServiceAccount  string `mapstructure:"service_account_file"`
}

// AWSToken AWS Token结构
type AWSToken struct {
	AccessKeyId     string    `json:"accessKeyId"`
	SecretAccessKey string    `json:"secretAccessKey"`
	SessionToken    string    `json:"sessionToken"`
	Expiration      time.Time `json:"expiration"`
}

// Constants for AWS configuration
const (
	Region          = "ap-northeast-1"
	InstanceArn     = "arn:aws:sso:::instance/ssoins-7758e707bb6ea352"
	IdentityStoreId = "d-95670a3c83"
)

// NewProvider 创建AWS提供者
func NewProvider() (*Provider, error) {
	return NewProviderWithStore(nil)
}

// NewProviderWithStore 创建带有store的AWS提供者
func NewProviderWithStore(storeFactory store.Factory) (*Provider, error) {
	config := &Config{}

	// 设置默认值
	if config.Region == "" {
		config.Region = "ap-northeast-1"
	}
	if config.InstanceArn == "" {
		config.InstanceArn = "arn:aws:sso:::instance/ssoins-7758e707bb6ea352"
	}
	if config.IdentityStoreId == "" {
		config.IdentityStoreId = "d-95670a3c83"
	}
	if config.ServiceAccount == "" {
		config.ServiceAccount = viper.GetString("gcp.service_account_file")
	}

	return &Provider{
		config: config,
		store:  storeFactory,
	}, nil
}

// Validate 验证配置
func (c *Config) Validate() error {
	return nil
}

// GetProviderName 获取平台名称
func (p *Provider) GetProviderName() string {
	return "Amazon Web Services"
}

// ValidateConfig 验证配置
func (p *Provider) ValidateConfig() error {
	return p.config.Validate()
}

// SyncUserRoles 同步用户角色
func (p *Provider) SyncUserRoles(ctx context.Context, roles []*modelv1.RoleMembers, cloudResource *modelv1.CloudResource, optionType int) error {
	log.L(ctx).Infof("Starting AWS role sync for account: %s, operation: %d", p.accountID, optionType)

	// 验证输入参数
	if err := p.validateInputs(roles, cloudResource); err != nil {
		return fmt.Errorf("validation failed: %w", err)
	}

	// 获取AWS客户端
	ssoClient, identityClient, err := p.getAWSClients(ctx)
	if err != nil {
		return fmt.Errorf("failed to get AWS clients: %w", err)
	}

	// 根据操作类型执行相应操作
	switch optionType {
	case modelv1.Add:
		return p.addUserRoles(ctx, roles, cloudResource, ssoClient, identityClient)
	case modelv1.Delete:
		return p.deleteUserRoles(ctx, roles, cloudResource, ssoClient, identityClient)
	case modelv1.DeleteAll:
		return p.deleteAllUserRoles(ctx, roles, cloudResource, ssoClient, identityClient)
	default:
		return fmt.Errorf("unsupported operation type: %d", optionType)
	}
}

// validateInputs 验证输入参数
func (p *Provider) validateInputs(roles []*modelv1.RoleMembers, cloudResource *modelv1.CloudResource) error {
	if len(roles) == 0 {
		return errors.New("roles cannot be empty")
	}

	if cloudResource == nil {
		return errors.New("cloud resource cannot be nil")
	}

	if cloudResource.CloudInsID == "" {
		return errors.New("cloud instance ID cannot be empty")
	}

	// 验证角色是否被允许
	for _, roleGroup := range roles {
		if roleGroup.Role == nil {
			return errors.New("role cannot be nil")
		}
		if roleGroup.Role.NameInProvider == "" {
			return errors.New("role name in provider cannot be empty")
		}
		// 检查角色是否在允许列表中（如果有定义的话）
		if modelv1.AWSAllowedRoles != nil {
			if _, ok := modelv1.AWSAllowedRoles[roleGroup.Role.NameInProvider]; !ok {
				return fmt.Errorf("role %s is not allowed in AWS", roleGroup.Role.NameInProvider)
			}
		}
	}

	return nil
}

// addUserRoles 添加用户角色
func (p *Provider) addUserRoles(ctx context.Context, roles []*modelv1.RoleMembers, cloudResource *modelv1.CloudResource, ssoClient *ssoadmin.Client, identityClient *identitystore.Client) error {
	log.L(ctx).Info("Adding user roles to AWS")

	var lastError error
	successCount := 0

	for _, roleGroup := range roles {
		if err := p.processRoleGroup(ctx, roleGroup, cloudResource, ssoClient, identityClient, true); err != nil {
			log.L(ctx).Warnf("Failed to add role %s: %v", roleGroup.Role.Name, err)
			lastError = err
		} else {
			successCount++
			log.L(ctx).Infof("Successfully added role %s", roleGroup.Role.Name)
		}
	}

	log.L(ctx).Infof("Added %d out of %d role groups", successCount, len(roles))

	// 如果所有操作都失败，返回最后一个错误
	if successCount == 0 && lastError != nil {
		return fmt.Errorf("failed to add any roles: %w", lastError)
	}

	return nil
}

// deleteUserRoles 删除用户角色
func (p *Provider) deleteUserRoles(ctx context.Context, roles []*modelv1.RoleMembers, cloudResource *modelv1.CloudResource, ssoClient *ssoadmin.Client, identityClient *identitystore.Client) error {
	log.L(ctx).Info("Deleting user roles from AWS")

	var lastError error
	successCount := 0

	for _, roleGroup := range roles {
		if err := p.processRoleGroup(ctx, roleGroup, cloudResource, ssoClient, identityClient, false); err != nil {
			log.L(ctx).Warnf("Failed to delete role %s: %v", roleGroup.Role.Name, err)
			lastError = err
		} else {
			successCount++
			log.L(ctx).Infof("Successfully deleted role %s", roleGroup.Role.Name)
		}
	}

	log.L(ctx).Infof("Deleted %d out of %d role groups", successCount, len(roles))

	// 如果所有操作都失败，返回最后一个错误
	if successCount == 0 && lastError != nil {
		return fmt.Errorf("failed to delete any roles: %w", lastError)
	}

	return nil
}

// deleteAllUserRoles 删除所有用户角色
func (p *Provider) deleteAllUserRoles(ctx context.Context, roles []*modelv1.RoleMembers, cloudResource *modelv1.CloudResource, ssoClient *ssoadmin.Client, identityClient *identitystore.Client) error {
	log.L(ctx).Info("Deleting all user roles from AWS")

	// 收集所有用户的邮箱
	var allEmails []string
	emailSet := make(map[string]bool)

	for _, roleGroup := range roles {
		for _, member := range roleGroup.Members {
			if !emailSet[member.Email] {
				allEmails = append(allEmails, member.Email)
				emailSet[member.Email] = true
			}
		}
	}

	if len(allEmails) == 0 {
		log.L(ctx).Warn("No users found to delete roles for")
		return nil
	}

	// 获取AWS用户IDs
	awsUserIds, err := p.getAWSUserIds(ctx, identityClient, allEmails)
	if err != nil {
		return fmt.Errorf("failed to get AWS user IDs: %w", err)
	}

	if len(awsUserIds) == 0 {
		log.L(ctx).Warn("No AWS user IDs found")
		return nil
	}

	// 如果定义了允许的角色列表，删除这些角色
	if modelv1.AWSAllowedRoles != nil {
		return p.deleteSpecificRoles(ctx, awsUserIds, cloudResource, ssoClient)
	}

	// 否则删除当前角色组中的角色
	return p.deleteCurrentRoles(ctx, roles, awsUserIds, cloudResource, ssoClient)
}

// deleteSpecificRoles 删除特定的角色
func (p *Provider) deleteSpecificRoles(ctx context.Context, awsUserIds []string, cloudResource *modelv1.CloudResource, ssoClient *ssoadmin.Client) error {
	var lastError error
	successCount := 0
	totalOperations := len(modelv1.AWSAllowedRoles) * len(awsUserIds)

	for roleArn := range modelv1.AWSAllowedRoles {
		for _, userId := range awsUserIds {
			if err := p.manageAccountAssignment(ctx, ssoClient, userId, roleArn, cloudResource.CloudInsID, false); err != nil {
				log.L(ctx).Warnf("Failed to remove role %s from user %s: %v", roleArn, userId, err)
				lastError = err
			} else {
				successCount++
				log.L(ctx).Debugf("Successfully removed role %s from user %s", roleArn, userId)
			}
		}
	}

	log.L(ctx).Infof("Removed %d out of %d role assignments", successCount, totalOperations)

	// 如果所有操作都失败，返回最后一个错误
	if successCount == 0 && lastError != nil {
		return fmt.Errorf("failed to remove any role assignments: %w", lastError)
	}

	return nil
}

// deleteCurrentRoles 删除当前角色组中的角色
func (p *Provider) deleteCurrentRoles(ctx context.Context, roles []*modelv1.RoleMembers, awsUserIds []string, cloudResource *modelv1.CloudResource, ssoClient *ssoadmin.Client) error {
	var lastError error
	successCount := 0
	totalOperations := 0

	for _, roleGroup := range roles {
		for _, userId := range awsUserIds {
			totalOperations++
			if err := p.manageAccountAssignment(ctx, ssoClient, userId, roleGroup.Role.NameInProvider, cloudResource.CloudInsID, false); err != nil {
				log.L(ctx).Warnf("Failed to remove role %s from user %s: %v", roleGroup.Role.NameInProvider, userId, err)
				lastError = err
			} else {
				successCount++
				log.L(ctx).Debugf("Successfully removed role %s from user %s", roleGroup.Role.NameInProvider, userId)
			}
		}
	}

	log.L(ctx).Infof("Removed %d out of %d role assignments", successCount, totalOperations)

	// 如果所有操作都失败，返回最后一个错误
	if successCount == 0 && lastError != nil {
		return fmt.Errorf("failed to remove any role assignments: %w", lastError)
	}

	return nil
}

// processRoleGroup 处理角色组
func (p *Provider) processRoleGroup(ctx context.Context, roleGroup *modelv1.RoleMembers, cloudResource *modelv1.CloudResource, ssoClient *ssoadmin.Client, identityClient *identitystore.Client, isAdd bool) error {
	if len(roleGroup.Members) == 0 {
		log.L(ctx).Warnf("No members found for role %s", roleGroup.Role.Name)
		return nil
	}

	// 提取邮箱
	emails := p.extractEmails(roleGroup.Members)

	// 获取AWS用户IDs
	awsUserIds, err := p.getAWSUserIds(ctx, identityClient, emails)
	if err != nil {
		return fmt.Errorf("failed to get AWS user IDs: %w", err)
	}

	if len(awsUserIds) == 0 {
		return fmt.Errorf("no AWS user IDs found for role %s", roleGroup.Role.Name)
	}

	// 为每个用户分配或删除角色
	var lastError error
	successCount := 0

	for _, userId := range awsUserIds {
		if err := p.manageAccountAssignment(ctx, ssoClient, userId, roleGroup.Role.NameInProvider, cloudResource.CloudInsID, isAdd); err != nil {
			log.L(ctx).Warnf("Failed to manage assignment for user %s: %v", userId, err)
			lastError = err
		} else {
			successCount++
		}
	}

	log.L(ctx).Infof("Processed %d out of %d users for role %s", successCount, len(awsUserIds), roleGroup.Role.Name)

	// 如果所有操作都失败，返回最后一个错误
	if successCount == 0 && lastError != nil {
		return fmt.Errorf("failed to process any users for role %s: %w", roleGroup.Role.Name, lastError)
	}

	return nil
}

// extractEmails 提取邮箱列表
func (p *Provider) extractEmails(members []*modelv1.User) []string {
	emails := make([]string, 0, len(members))
	for _, member := range members {
		if member.Email != "" {
			emails = append(emails, member.Email)
		}
	}
	return emails
}

// getAWSClients 获取AWS客户端
func (p *Provider) getAWSClients(ctx context.Context) (*ssoadmin.Client, *identitystore.Client, error) {
	// 获取AWS Token
	token, err := p.getAWSToken(ctx)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to get AWS token: %w", err)
	}

	// 创建AWS配置
	cfg, err := config.LoadDefaultConfig(ctx,
		config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(
			token.AccessKeyId,
			token.SecretAccessKey,
			token.SessionToken,
		)),
		config.WithRegion(p.config.Region),
	)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to load AWS config: %w", err)
	}

	// 创建服务客户端
	identityClient := identitystore.NewFromConfig(cfg)
	ssoClient := ssoadmin.NewFromConfig(cfg)

	return ssoClient, identityClient, nil
}

// getAWSToken 获取AWS Token
func (p *Provider) getAWSToken(ctx context.Context) (*AWSToken, error) {
	return p.getAWSTokenFromGCS(ctx)
}

// getAWSTokenFromGCS 从GCS获取AWS Token
func (p *Provider) getAWSTokenFromGCS(ctx context.Context) (*AWSToken, error) {
	// 验证服务账户文件
	if _, err := os.Stat(p.config.ServiceAccount); os.IsNotExist(err) {
		return nil, fmt.Errorf("service account file does not exist: %s", p.config.ServiceAccount)
	}

	// 创建存储服务客户端
	storageSrv, err := storage.NewService(ctx, option.WithCredentialsFile(p.config.ServiceAccount))
	if err != nil {
		return nil, fmt.Errorf("failed to create storage service: %w", err)
	}

	// 下载token文件
	download, err := storageSrv.Objects.Get("aws_data_cloud", "aws-token.json").Download()
	if err != nil {
		return nil, fmt.Errorf("failed to download AWS token from GCS: %w", err)
	}
	defer download.Body.Close()

	// 读取token内容
	body, err := io.ReadAll(download.Body)
	if err != nil {
		return nil, fmt.Errorf("failed to read AWS token: %w", err)
	}

	// 解析token
	var token AWSToken
	if err := json.Unmarshal(body, &token); err != nil {
		return nil, fmt.Errorf("failed to unmarshal AWS token: %w", err)
	}

	// 验证token内容
	if token.AccessKeyId == "" || token.SecretAccessKey == "" {
		return nil, errors.New("invalid AWS token: missing required fields")
	}

	// 检查token是否过期
	if !token.Expiration.IsZero() && time.Now().After(token.Expiration) {
		return nil, errors.New("AWS token has expired")
	}

	return &token, nil
}

// GetProviderMembers 获取提供者成员信息
func (p *Provider) GetProviderMembers(ctx context.Context, provider string) ([]modelv1.ResourceMemberAccess, []uint64, error) {
	if p.store == nil {
		return nil, nil, errors.New("store not initialized")
	}

	// 先同步用户
	err := p.SyncUsers(ctx)
	if err != nil {
		log.L(ctx).Warnf("Failed to sync AWS users: %v", err)
	}

	projs, err := p.store.CloudResource().ListByProvider(ctx, "AWS")
	if err != nil {
		return nil, nil, err
	}
	users, err := p.store.User().Gets(ctx)
	if err != nil {
		return nil, nil, err
	}
	roles, err := p.store.CloudMemberRole().ListByPro(ctx, "AWS")
	if err != nil {
		return nil, nil, err
	}

	// 构建用户映射表
	uMap := make(map[string]*modelv1.User)
	rIDs := make([]uint64, 0, len(roles))
	for _, u := range users {
		uMap[u.AwsPID] = u
	}
	for _, r := range roles {
		rIDs = append(rIDs, r.ID)
	}

	ssoClient, _, err := p.getAWSClients(ctx)
	if err != nil {
		return nil, nil, err
	}

	// 使用并发处理逻辑
	ch := make(chan int, 8)
	wg := sync.WaitGroup{}
	membersChan := make(chan []modelv1.ResourceMemberAccess, len(projs))

	for _, proj := range projs {
		wg.Add(1)
		ch <- 1
		go func(pr *modelv1.CloudResource) {
			defer func() {
				<-ch
				wg.Done()
			}()

			// 获取项目的所有成员分配
			projectMembers := p.syncProjectRoleAssignments(ctx, ssoClient, pr, roles, uMap)
			membersChan <- projectMembers
		}(proj)
	}

	// 收集所有结果
	go func() {
		wg.Wait()
		close(membersChan)
	}()

	var members []modelv1.ResourceMemberAccess
	for projectMembers := range membersChan {
		members = append(members, projectMembers...)
	}

	return members, rIDs, nil
}

// SyncUsers 同步用户到数据库
func (p *Provider) SyncUsers(ctx context.Context) error {
	if p.store == nil {
		return errors.New("store not initialized")
	}

	_, identityClient, err := p.getAWSClients(ctx)
	if err != nil {
		return err
	}

	var nextToken *string
	awsUsers := make([]types.User, 0)
	for {
		do, err := identityClient.ListUsers(ctx,
			&identitystore.ListUsersInput{
				IdentityStoreId: aws.String(IdentityStoreId),
				MaxResults:      aws.Int32(100),
				NextToken:       nextToken,
			},
		)
		if err != nil {
			log.L(ctx).Errorf("get aws user failed:%s", err.Error())
			return err
		}
		awsUsers = append(awsUsers, do.Users...)
		if do.NextToken == nil {
			break
		}
		nextToken = do.NextToken
	}

	auMap := make(map[string]types.User)
	uUpdate := make([]*modelv1.User, 0)
	for _, u := range awsUsers {
		auMap[*u.UserName] = u
	}
	users, err := p.store.User().Gets(ctx)
	if err != nil {
		log.L(ctx).Errorf("get user failed:%s", err.Error())
		return err
	}
	for _, u := range users {
		if _, ok := auMap[u.Email]; ok {
			if u.AwsPID != *auMap[u.Email].UserId {
				u.AwsPID = *auMap[u.Email].UserId
				uUpdate = append(uUpdate, u)
			}
		}
	}
	err = p.store.User().BatchSave(ctx, nil, uUpdate)
	if err != nil {
		log.L(ctx).Errorf("update aws user failed:%s", err.Error())
		return err
	}
	log.L(ctx).Info("sync aws user to db success")
	return nil
}

// SyncMembers 同步成员信息到数据库
func (p *Provider) SyncMembers(ctx context.Context) error {
	if p.store == nil {
		return errors.New("store not initialized")
	}

	members, rIDs, err := p.GetProviderMembers(ctx, "AWS")
	if err != nil {
		return err
	}

	membersInDB, err := p.store.ResourceMemberAccess().ListByRIDs(ctx, rIDs)
	if err != nil {
		return err
	}

	add, del := p.diff(membersInDB, members)
	err = p.store.ResourceMemberAccess().SyncToDB(ctx, add, del)
	if err != nil {
		return err
	}

	log.L(ctx).Infof("sync aws member to db success, added: %d, deleted: %d", len(add), len(del))
	return nil
}

// AWSTokenResult AWS Token结果结构（避免循环依赖）
type AWSTokenResult struct {
	AccessKeyId     string `json:"accessKeyId"`
	SecretAccessKey string `json:"secretAccessKey"`
	SessionToken    string `json:"sessionToken"`
	Expiration      string `json:"expiration"`
}

// GetAWSToken 获取AWS Token（公开方法）
func (p *Provider) GetAWSToken(ctx context.Context) (*AWSTokenResult, error) {
	token, err := p.getAWSToken(ctx)
	if err != nil {
		return nil, err
	}
	return &AWSTokenResult{
		AccessKeyId:     token.AccessKeyId,
		SecretAccessKey: token.SecretAccessKey,
		SessionToken:    token.SessionToken,
		Expiration:      token.Expiration.Format(time.RFC3339),
	}, nil
}

// GetAWSClients 获取AWS客户端（公开方法）
func (p *Provider) GetAWSClients(ctx context.Context) (*ssoadmin.Client, *identitystore.Client, error) {
	return p.getAWSClients(ctx)
}

// syncProjectRoleAssignments 同步项目角色分配
func (p *Provider) syncProjectRoleAssignments(ctx context.Context, ssoClient *ssoadmin.Client,
	project *modelv1.CloudResource, roles []*modelv1.CloudMemberRole, uMap map[string]*modelv1.User) []modelv1.ResourceMemberAccess {

	var projectMembers []modelv1.ResourceMemberAccess

	for _, role := range roles {
		members, err := p.getAllAccountAssignments(ctx, ssoClient, project.CloudInsID, role.NameInProvider)
		if err != nil {
			log.L(ctx).Warnf("failed to get assignments for project %s role %s: %v", project.Name, role.NameInProvider, err)
			continue
		}

		for _, assignment := range members {
			if assignment.PrincipalType != stypes.PrincipalTypeUser {
				continue
			}

			if user, ok := uMap[*assignment.PrincipalId]; ok {
				projectMembers = append(projectMembers, modelv1.ResourceMemberAccess{
					CreatedAt:    time.Now(),
					MemberLarkID: user.LarkUserID,
					ResourceID:   project.ID,
					RoleID:       role.ID,
				})
			}
		}
	}

	return projectMembers
}

// getAllAccountAssignments 获取指定账户和权限集的所有分配关系
func (p *Provider) getAllAccountAssignments(ctx context.Context, ssoClient *ssoadmin.Client,
	accountId, permissionSetArn string) ([]stypes.AccountAssignment, error) {

	var allAssignments []stypes.AccountAssignment
	var nextToken *string

	for {
		do, err := ssoClient.ListAccountAssignments(ctx, &ssoadmin.ListAccountAssignmentsInput{
			AccountId:        aws.String(accountId),
			PermissionSetArn: aws.String(permissionSetArn),
			InstanceArn:      aws.String(InstanceArn),
			NextToken:        nextToken,
		})
		if err != nil {
			return nil, err
		}

		allAssignments = append(allAssignments, do.AccountAssignments...)

		if do.NextToken == nil {
			break
		}
		nextToken = do.NextToken
	}

	return allAssignments, nil
}

// diff 比较成员差异
func (p *Provider) diff(membersInDB, membersInCd []modelv1.ResourceMemberAccess) ([]modelv1.ResourceMemberAccess, []modelv1.ResourceMemberAccess) {
	var add []modelv1.ResourceMemberAccess
	var del []modelv1.ResourceMemberAccess
	dbMap := make(map[string]modelv1.ResourceMemberAccess)
	for _, m := range membersInDB {
		uniqueCode := m.MemberLarkID + strconv.FormatUint(m.RoleID, 10) + strconv.FormatUint(m.ResourceID, 10)
		dbMap[uniqueCode] = m
	}
	for _, m := range membersInCd {
		uniqueCode := m.MemberLarkID + strconv.FormatUint(m.RoleID, 10) + strconv.FormatUint(m.ResourceID, 10)
		if _, ok := dbMap[uniqueCode]; !ok {
			m.TimeTag = time.Unix(0, 0).Unix()
			add = append(add, m)
		} else {
			dbMap[uniqueCode] = modelv1.ResourceMemberAccess{
				RequestNote: "exist",
			}
		}
	}
	for _, m := range membersInDB {
		uniqueCode := m.MemberLarkID + strconv.FormatUint(m.RoleID, 10) + strconv.FormatUint(m.ResourceID, 10)
		if dbMap[uniqueCode].RequestNote != "exist" {
			m.TimeTag = time.Now().Unix()
			del = append(del, m)
		}
	}

	return add, del
}

// getAWSUserIds 获取AWS用户IDs
func (p *Provider) getAWSUserIds(ctx context.Context, client *identitystore.Client, emails []string) ([]string, error) {
	if len(emails) == 0 {
		return nil, errors.New("email list is empty")
	}

	userIds := make([]string, 0, len(emails))
	userName := "userName"

	for _, email := range emails {
		if email == "" {
			log.L(ctx).Warn("Empty email found, skipping")
			continue
		}

		docValue := document.NewLazyDocument(email)
		response, err := client.GetUserId(ctx, &identitystore.GetUserIdInput{
			IdentityStoreId: aws.String(p.config.IdentityStoreId),
			AlternateIdentifier: &types.AlternateIdentifierMemberUniqueAttribute{
				Value: types.UniqueAttribute{
					AttributePath:  &userName,
					AttributeValue: docValue,
				},
			},
		})

		if err != nil {
			log.L(ctx).Warnf("Failed to get user ID for email %s: %v", email, err)
			continue
		}

		if response.UserId != nil && *response.UserId != "" {
			userIds = append(userIds, *response.UserId)
			log.L(ctx).Debugf("Found AWS user ID %s for email %s", *response.UserId, email)
		}
	}

	if len(userIds) == 0 {
		return nil, fmt.Errorf("no AWS user IDs found for any of the %d emails", len(emails))
	}

	log.L(ctx).Infof("Found %d AWS user IDs out of %d emails", len(userIds), len(emails))
	return userIds, nil
}

// manageAccountAssignment 管理账户分配（添加或删除）
func (p *Provider) manageAccountAssignment(ctx context.Context, client *ssoadmin.Client, userId, permissionSetArn, accountId string, isAdd bool) error {
	if isAdd {
		// 创建账户分配
		_, err := client.CreateAccountAssignment(ctx, &ssoadmin.CreateAccountAssignmentInput{
			InstanceArn:      aws.String(p.config.InstanceArn),
			PermissionSetArn: aws.String(permissionSetArn),
			PrincipalId:      aws.String(userId),
			PrincipalType:    stypes.PrincipalTypeUser,
			TargetId:         aws.String(accountId),
			TargetType:       stypes.TargetTypeAwsAccount,
		})
		if err != nil {
			return fmt.Errorf("failed to create account assignment: %w", err)
		}
		log.L(ctx).Debugf("Created account assignment for user %s with permission set %s", userId, permissionSetArn)
	} else {
		// 删除账户分配
		_, err := client.DeleteAccountAssignment(ctx, &ssoadmin.DeleteAccountAssignmentInput{
			InstanceArn:      aws.String(p.config.InstanceArn),
			PermissionSetArn: aws.String(permissionSetArn),
			PrincipalId:      aws.String(userId),
			PrincipalType:    stypes.PrincipalTypeUser,
			TargetId:         aws.String(accountId),
			TargetType:       stypes.TargetTypeAwsAccount,
		})
		if err != nil {
			return fmt.Errorf("failed to delete account assignment: %w", err)
		}
		log.L(ctx).Debugf("Deleted account assignment for user %s with permission set %s", userId, permissionSetArn)
	}

	return nil
}