using PostFundManagement.Application.Abstractions.Services;
using PostFundManagement.Application.Extensions;
using PostFundManagement.Application.Services.Users;
using PostFundManagement.Domain;
using PostFundManagement.Domain.Models;
using PostFundManagement.Domain.Models.Security;
using Role = PostFundManagement.Domain.Models.Security.Role;

namespace PostFundManagement.Application.Mcp;

/// <summary>
/// MCP tools proxying Identity & User Administration Services (RBAC Roles, Claims, Account Provisioning).
/// </summary>
[McpServerToolType]
public class UsersMcpTools(IUserService service)
{
    [McpServerTool(Name = "users_get_users", Title = "Get User Directory", ReadOnly = true)]
    [Description("Retrieves a paginated and filtered list of user accounts across tenant partitions.")]
    public async Task<Records<User[]>> GetUsersAsync([Description("User search and filtering parameters")] UserFilterRequest filter, [Description("Page index (1-based)")] int page = 1, [Description("Page size (1-100)")] int pageSize = 50, CancellationToken cancellationToken = default) =>
        (await service.GetUsersAsync(new Pagination(page, pageSize), filter, cancellationToken)).ToMcpResult();

    [McpServerTool(Name = "users_get_user", Title = "Get User by ID", ReadOnly = true)]
    [Description("Retrieves account profile and security claims for a specific user.")]
    public async Task<Records<User>> GetUserAsync([Description("Target user identifier")] Guid userId, CancellationToken cancellationToken = default) =>
        (await service.GetUserAsync(userId, cancellationToken)).ToMcpResult();

    [McpServerTool(Name = "users_create_user", Title = "Create User Account", Destructive = false)]
    [Description("Provisions a new user account within a tenant organization.")]
    public async Task<McpToolResult> CreateUserAsync([Description("Tenant hash identifier")] string tenantIdHash, [Description("Hashed ID number or passport")] string idNumberHash, [Description("User account creation parameters")] CreateUserRequest request, [Description("Optional acting user ID; defaults to System user if omitted")] Guid? userId = null, CancellationToken cancellationToken = default) =>
        (await service.CreateUserAsync(tenantIdHash, idNumberHash, request, userId ?? SystemUser, cancellationToken)).ToMcpResult();

    [McpServerTool(Name = "users_update_status", Title = "Update User Account Status", Destructive = false)]
    [Description("Updates active, suspended, or archived state of a user account.")]
    public async Task<McpToolResult> UpdateUserStatusAsync([Description("Target user identifier")] Guid userId, [Description("New activity status")] ActivityStatus status, CancellationToken cancellationToken = default) =>
        (await service.UpdateUserStatusAsync(userId, status, cancellationToken)).ToMcpResult();

    [McpServerTool(Name = "users_get_system_roles", Title = "Get System Roles", ReadOnly = true)]
    [Description("Retrieves system-wide security and governance roles.")]
    public async Task<Records<Role[]>> GetSystemRolesAsync([Description("Optional acting user ID; defaults to System user if omitted")] Guid? userId = null, CancellationToken cancellationToken = default) =>
        (await service.GetSystemRolesAsync(userId ?? SystemUser, cancellationToken)).ToMcpResult();

    [McpServerTool(Name = "users_get_user_roles", Title = "Get User Roles", ReadOnly = true)]
    [Description("Retrieves assigned RBAC roles for a specific user.")]
    public async Task<Records<Role[]>> GetUserRolesAsync([Description("Target user identifier")] Guid targetUserId, [Description("Optional acting user ID; defaults to System user if omitted")] Guid? userId = null, CancellationToken cancellationToken = default) =>
        (await service.GetUserRolesAsync(targetUserId, userId ?? SystemUser, cancellationToken)).ToMcpResult();

    [McpServerTool(Name = "users_add_role", Title = "Assign Role to User", Destructive = false)]
    [Description("Assigns a security role to a user account.")]
    public async Task<McpToolResult> AddUserRoleAsync([Description("Target user identifier")] Guid targetUserId, [Description("Role identifier to assign")] Guid roleId, [Description("Optional acting user ID; defaults to System user if omitted")] Guid? userId = null, CancellationToken cancellationToken = default) =>
        (await service.AddUserRoleAsync(targetUserId, roleId, userId ?? SystemUser, cancellationToken)).ToMcpResult();

    [McpServerTool(Name = "users_delete_role", Title = "Revoke Role from User", Destructive = false)]
    [Description("Revokes an assigned security role from a user account.")]
    public async Task<McpToolResult> DeleteUserRoleAsync([Description("Target user identifier")] Guid targetUserId, [Description("Role identifier to revoke")] Guid roleId, [Description("Optional acting user ID; defaults to System user if omitted")] Guid? userId = null, CancellationToken cancellationToken = default) =>
        (await service.DeleteUserRoleAsync(targetUserId, roleId, userId ?? SystemUser, cancellationToken)).ToMcpResult();

    [McpServerTool(Name = "users_get_user_claims", Title = "Get User Claims", ReadOnly = true)]
    [Description("Retrieves specific identity and authorization claims associated with a user.")]
    public async Task<Records<Domain.Models.Security.Claim[]>> GetUserClaimsAsync([Description("Target user identifier")] Guid targetUserId, [Description("Optional acting user ID; defaults to System user if omitted")] Guid? userId = null, CancellationToken cancellationToken = default) =>
        (await service.GetUserClaimsAsync(targetUserId, userId ?? SystemUser, cancellationToken)).ToMcpResult();

    [McpServerTool(Name = "users_set_lockout", Title = "Set User Lockout", Destructive = false)]
    [Description("Locks or unlocks a user account from authenticating into the platform.")]
    public async Task<McpToolResult> SetUserLockoutAsync([Description("Target user identifier")] Guid targetUserId, [Description("True to lockout/disable account, false to re-enable")] bool disable, [Description("Optional acting user ID; defaults to System user if omitted")] Guid? userId = null, CancellationToken cancellationToken = default) =>
        (await service.SetUserLockoutAsync(targetUserId, userId ?? SystemUser, disable, cancellationToken)).ToMcpResult();
}