/**
 * Permissions & Security domain schemas.
 * Section keys must stay aligned with the router and PHP schema provider.
 */

/**
 * User type options shared by the upload limit repeaters.
 * Mirrors AKSRT\Attachment\UploadLimits::user_type_options() (levels 2-10, VIP 1-2).
 */
const uploadUserTypeOptions = [
  { label: '最小默认值（所有人）', value: 'default' },
  { label: '已登录用户', value: 'logged' },
  ...[2, 3, 4, 5, 6, 7, 8, 9, 10].map((level) => ({ label: `等级达到 ${level} 级`, value: `level_${level}` })),
  { label: 'VIP1 会员', value: 'vip_1' },
  { label: 'VIP2 会员', value: 'vip_2' },
  { label: '已认证用户', value: 'auth' },
  { label: '超级管理员', value: 'admin' },
]

const uploadMimeUserTypeOptions = [
  { label: '所有用户', value: 'all' },
  ...uploadUserTypeOptions,
]

const uploadSizeFields = [
  { key: 'type', label: '用户类型', type: 'select', default: 'logged', options: uploadUserTypeOptions },
  { key: 'val', label: '可上传大小', type: 'number', default: 30, min: 1, max: 2048, unit: 'M' },
]

export const permissionsSchemas = {
  /**
   * Login / captcha / access guard settings
   */
  login: {
    key: 'permissions.login',
    title: '人机验证',
    icon: 'fa fas fa-shield-alt',
    description: '配置云验证码服务商，并选择需要强制人机验证的前端场景。',
    defaults: {
      enabled: false,
      active_provider: '',
      enabled_scenarios: [],
      tencent: {},
      aliyun: {},
      cloudflare: {},
      geetest: {},
    },
    groups: [
      {
        key: 'basic',
        title: '基础设置',
        icon: 'fa fas fa-cog',
        fields: [
          { key: 'enabled', label: '启用人机验证', type: 'switch', help: '总开关：关闭后所有场景均不验证' },
          {
            key: 'active_provider',
            label: '当前服务商',
            type: 'radio',
            buttonStyle: false,
            options: [
              { label: '关闭', value: '' },
              { label: '腾讯云 Captcha', value: 'tencent' },
              { label: '阿里云 CAPTCHA 2.0', value: 'aliyun' },
              { label: 'Cloudflare Turnstile', value: 'cloudflare' },
              { label: '极验 GeeTest', value: 'geetest' },
            ],
            dependsOn: { key: 'enabled', value: true },
          },
          {
            key: 'enabled_scenarios',
            label: '启用场景',
            type: 'checkbox',
            help: '勾选 = 该场景需要人机验证。取消勾选则该场景放行。',
            dependsOn: { key: 'enabled', value: true },
            options: [
              { label: '发表评论', value: 'comment' },
              { label: '用户登录', value: 'login' },
              { label: '用户注册', value: 'register' },
              { label: '绑定第三方', value: 'bind' },
              { label: '绑定手机', value: 'bind_phone' },
              { label: '找回密码', value: 'lostpassword' },
              { label: '修改密码', value: 'change_password' },
              { label: '更改邮箱', value: 'change_email' },
              { label: '资源下载', value: 'download' },
              { label: '每日签到', value: 'signin' },
              { label: '前台投稿', value: 'front_submit' },
              { label: '打赏用户', value: 'tip_user' },
            ],
          },
        ],
      },
      {
        key: 'providers',
        title: '服务商配置',
        icon: 'fa fas fa-server',
        description: '切换标签页填写各服务商配置；实际启用的服务商由“当前服务商”决定。',
        dependsOn: { key: 'enabled', value: true },
        fields: [
          { key: 'tencent', label: '腾讯云配置', type: 'custom', default: { secret_id: '', secret_key: '', app_id: '', app_secret_key: '' }, secretFields: ['secret_key', 'app_secret_key'] },
          { key: 'aliyun', label: '阿里云配置', type: 'custom', default: { region: 'cn', prefix: '', scene_id: '', access_key_id: '', access_key_secret: '' }, secretFields: ['access_key_secret'] },
          { key: 'cloudflare', label: 'Cloudflare 配置', type: 'custom', default: { site_key: '', secret_key: '', theme: 'auto', size: 'normal' }, secretFields: ['secret_key'] },
          { key: 'geetest', label: '极验配置', type: 'custom', default: { captcha_id: '', captcha_key: '', product: 'bind' }, secretFields: ['captcha_key'] },
        ],
      },
    ],
  },

  /**
   * Capability matrix metadata contract.
   * The live page is still orchestration-heavy custom UI for now.
   */
  capabilities: {
    key: 'permissions.capabilities',
    title: '基本权限',
    icon: 'fa fas fa-user',
    description: '统一管理用户、投稿和评论的角色权限。',
    defaults: {},
    groups: [],
  },

  /**
   * Moderation settings
   */
  moderation: {
    key: 'permissions.moderation',
    title: '评论审核',
    icon: 'fa fas fa-gavel',
    description: '管理评论审核、反垃圾、限流与拦截配置。',
    defaults: {
      enabled: false,
      akismet_enabled: false,
      akismet_site_url: '',
      akismet_blog_lang: 'zh-CN',
      akismet_api_key: '',
      ai_enabled: false,
      ai_moderate_comments: true,
      ai_moderate_background: true,
      auto_approve_low_risk: false,
      auto_reject_high_risk: false,
      low_risk_max_score: 35,
      high_risk_min_score: 80,
      blocked_keywords: '',
      rate_limit_enabled: false,
      rate_limit_min_interval: 8,
      rate_limit_max_per_hour: 15,
      geoip_enabled: false,
      geoip_block_countries: [],
    },
    groups: [
      {
        key: 'basic',
        title: '审核总开关',
        icon: 'fa fas fa-power-off',
        fields: [
          { key: 'enabled', label: '启用审核系统', type: 'switch', help: '关闭后评论将不经过主题审核链路。' },
        ],
      },
      {
        key: 'akismet',
        title: 'Akismet',
        icon: 'fa fas fa-filter',
        fields: [
          { key: 'akismet_enabled', label: '启用 Akismet', type: 'switch', dependsOn: { key: 'enabled', value: true } },
          { key: 'akismet_site_url', label: 'Site URL', type: 'input', placeholder: 'https://your-site.com', dependsOn: { key: 'akismet_enabled', value: true } },
          { key: 'akismet_blog_lang', label: '博客语言', type: 'input', placeholder: 'zh-CN', dependsOn: { key: 'akismet_enabled', value: true } },
          { key: 'akismet_api_key', label: 'API Key', type: 'input', inputType: 'password', placeholder: 'Akismet API Key', dependsOn: { key: 'akismet_enabled', value: true } },
        ],
      },
      {
        key: 'ai',
        title: 'AI 审核',
        icon: 'fa fab fa-android',
        fields: [
          { key: 'ai_enabled', label: '启用 AI 审核', type: 'switch', dependsOn: { key: 'enabled', value: true } },
          { key: 'ai_api_hint', label: '审核 API 配置', type: 'notice', alertType: 'info', alertContent: 'API 接入（百度/阿里云等）在「扩展 → API内容审核」中统一配置，此处仅控制审核范围和策略。', dependsOn: { key: 'ai_enabled', value: true } },
          { key: 'ai_moderate_comments', label: '用户评论', type: 'switch', dependsOn: { key: 'ai_enabled', value: true } },
          { key: 'ai_moderate_background', label: '用户资料背景', type: 'switch', dependsOn: { key: 'ai_enabled', value: true } },
          { key: 'auto_approve_low_risk', label: '低风险自动通过', type: 'switch', dependsOn: { key: 'ai_enabled', value: true } },
          { key: 'auto_reject_high_risk', label: '高风险自动拒绝', type: 'switch', dependsOn: { key: 'ai_enabled', value: true } },
          { key: 'low_risk_max_score', label: '低风险上限', type: 'number', min: 0, max: 100, dependsOn: { key: 'ai_enabled', value: true } },
          { key: 'high_risk_min_score', label: '高风险下限', type: 'number', min: 0, max: 100, dependsOn: { key: 'ai_enabled', value: true } },
        ],
      },
      {
        key: 'keywords',
        title: '关键词拦截',
        icon: 'fa fas fa-ban',
        fields: [
          { key: 'blocked_keywords', label: '屏蔽关键词列表', type: 'textarea', rows: 4, placeholder: '每行一个关键词，也支持 /regex/i 格式。命中后会进入待审核并记录原因。', dependsOn: { key: 'enabled', value: true } },
        ],
      },
      {
        key: 'rate-limit',
        title: '频率限制',
        icon: 'fa fas fa-clock',
        fields: [
          { key: 'rate_limit_enabled', label: '启用频率限制', type: 'switch', dependsOn: { key: 'enabled', value: true } },
          { key: 'rate_limit_min_interval', label: '最小间隔（秒）', type: 'number', min: 1, max: 300, dependsOn: { key: 'rate_limit_enabled', value: true } },
          { key: 'rate_limit_max_per_hour', label: '每小时上限', type: 'number', min: 1, max: 200, dependsOn: { key: 'rate_limit_enabled', value: true } },
        ],
      },
      {
        key: 'geoip',
        title: 'GeoIP 拦截',
        icon: 'fa fas fa-globe',
        fields: [
          { key: 'geoip_enabled', label: '启用 GeoIP 拦截', type: 'switch', dependsOn: { key: 'enabled', value: true } },
          { key: 'geoip_hint', label: 'IP 数据源', type: 'notice', alertType: 'info', alertContent: '复用「扩展 → IP归属地」中配置的数据源和 API Key。', dependsOn: { key: 'geoip_enabled', value: true } },
          { key: 'geoip_block_countries', label: '屏蔽国家/地区', type: 'custom', dependsOn: { key: 'geoip_enabled', value: true } },
        ],
      },
    ],
  },

  /**
   * Attachment / upload governance
   */
  attachment: {
  key: 'permissions.attachment',
  title: '附件配置',
  icon: 'fa fas fa-paperclip',
  description: '统一管理上传大小、上传格式与上传行为；准入权限请在“基本权限”中配置。',
  defaults: {
    upload_img_size: [
      { type: 'default', val: 5 },
      { type: 'admin', val: 20 },
    ],
    image_upload_multiple: 6,
    upload_video_size: [
      { type: 'default', val: 30 },
      { type: 'admin', val: 2048 },
    ],
    upload_file_size: [
      { type: 'default', val: 30 },
      { type: 'admin', val: 2048 },
    ],
    upload_file_mimes: [
      { type: 'admin', pattern: 'allow', val: 'svg=image/svg+xml' },
      { type: 'all', pattern: 'allow', val: '' },
    ],
  },
  groups: [
    {
      key: 'size-limits',
      title: '上传大小限制',
      icon: 'fa fas fa-weight-hanging',
      description: '设置上传大小，请考虑服务器负荷、硬盘，以及服务器最大能支持的范围。实际上传大小取「主题限制」与「PHP 环境限制」的较小值，超过 PHP 环境限制时请调整 php.ini 的 upload_max_filesize 与 post_max_size。',
      fields: [
        {
          key: 'upload_img_size',
          label: '前端图片上传限制',
          type: 'repeater',
          min: 1,
          addText: '添加细分用户权限',
          help: '投稿、评论、头像与资料卡背景图等前端场景允许上传的最大图片大小（单位 MB）。同一个用户满足多个条件则取最大值，「最小默认值」为所有人兜底。',
          fields: uploadSizeFields.map((field) => ({ ...field, default: field.key === 'val' ? 5 : field.default })),
        },
        { key: 'image_upload_multiple', label: '图片批量上传最大数量', type: 'number', min: 0, max: 100, unit: '张', help: '前端投稿、评论上传图片允许的单次批量上传数量（为 0 则不限制，为 1 则不能批量上传）。' },
        {
          key: 'upload_video_size',
          label: '前端视频上传限制',
          type: 'repeater',
          min: 1,
          addText: '添加细分用户权限',
          help: '前端允许上传的最大视频大小（单位 MB）。同一个用户满足多个条件则取最大值，必须包含最低默认值。',
          fields: uploadSizeFields,
        },
        {
          key: 'upload_file_size',
          label: '前端文件上传大小限制',
          type: 'repeater',
          min: 1,
          addText: '添加细分用户权限',
          help: '前端允许上传的其他文件（不含视频和图片，建议大于视频图片）最大大小（单位 MB）。同一个用户满足多个条件则取最大值，必须包含最低默认值。',
          fields: uploadSizeFields,
        },
      ],
    },
    {
      key: 'mime-limits',
      title: '上传格式限制',
      icon: 'fa fas fa-file-code',
      fields: [
        {
          key: 'mime_limit_notice',
          label: '安全提示',
          type: 'notice',
          alertType: 'warning',
          alertContent: '请添加文件的扩展名和 MIME 类型，用英文逗号分割。格式示例：mp3=audio/mpeg,jpg=image/jpeg。禁止的优先级大于允许。郑重提示：请勿允许上传 php、sh、exe 等可执行文件，会极大增加服务器被入侵攻击的风险。',
        },
        {
          key: 'upload_file_mimes',
          label: '前端上传文件格式限制',
          type: 'repeater',
          min: 1,
          addText: '添加细分用户权限',
          help: '根据不同的用户类型，添加额外允许或禁止上传的文件格式（禁止的优先级大于允许）。',
          fields: [
            { key: 'type', label: '用户类型', type: 'select', default: 'all', options: uploadMimeUserTypeOptions },
            {
              key: 'pattern',
              label: '规则',
              type: 'select',
              default: 'allow',
              options: [
                { label: '允许', value: 'allow' },
                { label: '禁止', value: 'prohibit' },
              ],
            },
            { key: 'val', label: '格式', type: 'textarea', default: '', rows: 1, placeholder: '如：svg=image/svg+xml,mp3=audio/mpeg' },
          ],
        },
      ],
    },
  ],
},

};