using System.Text;
using System.Text.Json.Serialization;
using Jiaowu.Api.Domain.Identity;
using Jiaowu.Api.Infrastructure.BackgroundJobs;
using Jiaowu.Api.Infrastructure.Configuration;
using Jiaowu.Api.Infrastructure.Auth;
using Jiaowu.Api.Infrastructure.Caching;
using Jiaowu.Api.Infrastructure.Exams;
using Jiaowu.Api.Infrastructure.Middleware;
using Jiaowu.Api.Infrastructure.Observability;
using Jiaowu.Api.Infrastructure.OfficialDocuments;
using Jiaowu.Api.Infrastructure.Operations;
using Jiaowu.Api.Infrastructure.Persistence;
using Jiaowu.Api.Infrastructure.Scheduling;
using Jiaowu.Api.Infrastructure.Timetables;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.AspNetCore.RateLimiting;
using Microsoft.Data.Sqlite;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Caching.Distributed;
using Microsoft.IdentityModel.Tokens;
using Microsoft.OpenApi.Models;
using OpenTelemetry.Metrics;
using OpenTelemetry.Resources;
using OpenTelemetry.Trace;
using System.Threading.RateLimiting;

EnvironmentFile.Load();

var migrateOnly = args.Contains("--migrate-only", StringComparer.OrdinalIgnoreCase);
var seedDemoData = args.Contains("--seed-demo-data", StringComparer.OrdinalIgnoreCase);
var confirmProductionDemoData = args.Contains(
    "--confirm-production-demo-data",
    StringComparer.OrdinalIgnoreCase);

if (migrateOnly && seedDemoData)
{
    Console.Error.WriteLine(
        "--migrate-only 与 --seed-demo-data 不能同时使用。请先迁移，再单独插入演示数据。");
    Environment.ExitCode = 2;
    return;
}

if (seedDemoData && !confirmProductionDemoData)
{
    Console.Error.WriteLine(
        "插入生产演示数据必须同时传入 --confirm-production-demo-data。");
    Environment.ExitCode = 2;
    return;
}

if (confirmProductionDemoData && !seedDemoData)
{
    Console.Error.WriteLine(
        "--confirm-production-demo-data 只能与 --seed-demo-data 同时使用。");
    Environment.ExitCode = 2;
    return;
}

var builder = WebApplication.CreateBuilder(args);

if (seedDemoData && builder.Environment.IsDevelopment())
{
    Console.Error.WriteLine(
        "--seed-demo-data 仅用于独立的非 Development 演示环境数据库。");
    Environment.ExitCode = 2;
    return;
}

var databaseOptions = builder.Configuration
    .GetSection(DatabaseOptions.SectionName)
    .Get<DatabaseOptions>() ?? new DatabaseOptions();
var cacheOptions = builder.Configuration
    .GetSection(AppCacheOptions.SectionName)
    .Get<AppCacheOptions>() ?? new AppCacheOptions();
var officialDocumentOptions = builder.Configuration
    .GetSection(OfficialDocumentOptions.SectionName)
    .Get<OfficialDocumentOptions>() ?? new OfficialDocumentOptions();
var backgroundJobOptions = builder.Configuration
    .GetSection(BackgroundJobOptions.SectionName)
    .Get<BackgroundJobOptions>() ?? new BackgroundJobOptions();
var operationsOptions = builder.Configuration
    .GetSection(OperationsOptions.SectionName)
    .Get<OperationsOptions>() ?? new OperationsOptions();
var observabilityOptions = builder.Configuration
    .GetSection(ObservabilityOptions.SectionName)
    .Get<ObservabilityOptions>() ?? new ObservabilityOptions();
var performanceReportingOptions = builder.Configuration
    .GetSection(PerformanceReportingOptions.SectionName)
    .Get<PerformanceReportingOptions>() ?? new PerformanceReportingOptions();
var rabbitMqOptions = builder.Configuration
    .GetSection(RabbitMqOptions.SectionName)
    .Get<RabbitMqOptions>() ?? new RabbitMqOptions();
var ssoOptions = builder.Configuration
    .GetSection(SsoOptions.SectionName)
    .Get<SsoOptions>() ?? new SsoOptions();

if (ssoOptions.Enabled &&
    (string.IsNullOrWhiteSpace(ssoOptions.ClientId) ||
     !Uri.TryCreate(ssoOptions.Authority, UriKind.Absolute, out var ssoAuthority) ||
     ssoAuthority.Scheme is not ("http" or "https") ||
     (ssoOptions.RequireHttpsMetadata && ssoAuthority.Scheme != "https") ||
     string.IsNullOrWhiteSpace(ssoOptions.UserNameClaim) ||
     (!string.IsNullOrWhiteSpace(ssoOptions.FrontendBaseUrl) &&
      (!Uri.TryCreate(ssoOptions.FrontendBaseUrl, UriKind.Absolute, out var frontendBaseUrl) ||
       frontendBaseUrl.Scheme is not ("http" or "https")))))
{
    throw new InvalidOperationException(
        "启用 Sso 时必须配置有效的 Authority、ClientId、UserNameClaim 和 FrontendBaseUrl；生产元数据地址必须使用 HTTPS。");
}

if (string.IsNullOrWhiteSpace(officialDocumentOptions.InstitutionName) ||
    string.IsNullOrWhiteSpace(officialDocumentOptions.IssuingOffice) ||
    string.IsNullOrWhiteSpace(officialDocumentOptions.DocumentNumberPrefix))
{
    throw new InvalidOperationException(
        "OfficialDocuments 的 InstitutionName、IssuingOffice 和 DocumentNumberPrefix 不能为空。");
}

if (databaseOptions.Provider.Equals("SQLite", StringComparison.OrdinalIgnoreCase) &&
    !builder.Environment.IsDevelopment())
{
    throw new InvalidOperationException("SQLite 仅允许在 Development 环境使用。生产环境请配置 MySql。");
}

var allowedHosts = builder.Configuration["AllowedHosts"];
if (!builder.Environment.IsDevelopment() &&
    (string.IsNullOrWhiteSpace(allowedHosts) || allowedHosts == "*"))
{
    throw new InvalidOperationException(
        "生产环境必须通过 AllowedHosts 配置明确的访问域名，不能使用通配符。");
}

if (databaseOptions.CommandTimeoutSeconds is < 5 or > 300)
{
    throw new InvalidOperationException(
        "Database:CommandTimeoutSeconds 必须在 5 到 300 秒之间。");
}

if (string.IsNullOrWhiteSpace(observabilityOptions.ServiceName) ||
    observabilityOptions.ServiceName.Length > 100 ||
    observabilityOptions.SlowQueryThresholdMilliseconds is < 1 or > 60000 ||
    observabilityOptions.MaximumSqlTextLength is < 256 or > 20000)
{
    throw new InvalidOperationException(
        "Observability 服务名、慢查询阈值或 SQL 文本长度超出允许范围。");
}

if (performanceReportingOptions.CacheSeconds is < 5 or > 300 ||
    performanceReportingOptions.TimeoutSeconds is < 1 or > 60 ||
    performanceReportingOptions.BearerToken.Length > 8000 ||
    !PerformanceReportingOptions.IsMetricOrLabelName(
        performanceReportingOptions.ServiceLabel) ||
    !PerformanceReportingOptions.IsMetricOrLabelName(
        performanceReportingOptions.RequestDurationMetric) ||
    !PerformanceReportingOptions.IsMetricOrLabelName(
        performanceReportingOptions.DatabaseDurationMetric) ||
    !PerformanceReportingOptions.IsMetricOrLabelName(
        performanceReportingOptions.SlowDatabaseMetric) ||
    !PerformanceReportingOptions.IsMetricOrLabelName(
        performanceReportingOptions.FailedDatabaseMetric) ||
    (performanceReportingOptions.Enabled &&
     !IsHttpUrl(performanceReportingOptions.PrometheusBaseUrl)) ||
    (!string.IsNullOrWhiteSpace(performanceReportingOptions.GrafanaBaseUrl) &&
     !IsHttpUrl(performanceReportingOptions.GrafanaBaseUrl)))
{
    throw new InvalidOperationException(
        "PerformanceReporting 数据源、超时、缓存或指标名称配置无效。");
}

var otlpEndpoint = builder.Configuration["OTEL_EXPORTER_OTLP_ENDPOINT"];
if (!string.IsNullOrWhiteSpace(otlpEndpoint) &&
    (!Uri.TryCreate(otlpEndpoint, UriKind.Absolute, out var parsedOtlpEndpoint) ||
     parsedOtlpEndpoint.Scheme is not ("http" or "https")))
{
    throw new InvalidOperationException(
        "OTEL_EXPORTER_OTLP_ENDPOINT 必须是有效的 HTTP 或 HTTPS 绝对地址。");
}

if (cacheOptions.ReferenceExpirationMinutes is < 1 or > 1440 ||
    cacheOptions.TimetableExpirationMinutes is < 1 or > 1440 ||
    cacheOptions.AnalyticsExpirationMinutes is < 1 or > 1440 ||
    cacheOptions.ReferenceLocalExpirationSeconds is < 1 or > 3600 ||
    cacheOptions.TimetableLocalExpirationSeconds is < 1 or > 3600 ||
    cacheOptions.AnalyticsLocalExpirationSeconds is < 1 or > 3600 ||
    cacheOptions.MaximumPayloadKilobytes is < 64 or > 16384 ||
    cacheOptions.ReferenceLocalExpirationSeconds >
        cacheOptions.ReferenceExpirationMinutes * 60 ||
    cacheOptions.TimetableLocalExpirationSeconds >
        cacheOptions.TimetableExpirationMinutes * 60 ||
    cacheOptions.AnalyticsLocalExpirationSeconds >
        cacheOptions.AnalyticsExpirationMinutes * 60 ||
    string.IsNullOrWhiteSpace(cacheOptions.KeyPrefix) ||
    cacheOptions.KeyPrefix.Length > 100)
{
    throw new InvalidOperationException(
        "Cache 缓存时间或 MaximumPayloadKilobytes 超出允许范围。");
}

if (!backgroundJobOptions.Transport.Equals(
        "InMemory",
        StringComparison.OrdinalIgnoreCase) &&
    !backgroundJobOptions.UsesRabbitMq)
{
    throw new InvalidOperationException(
        "BackgroundJobs:Transport 仅支持 InMemory 或 RabbitMq。");
}
if (backgroundJobOptions.PollIntervalMilliseconds is < 100 or > 30000 ||
    backgroundJobOptions.LeaseSeconds is < 30 or > 3600 ||
    backgroundJobOptions.PrefetchCount is < 1 or > 100 ||
    backgroundJobOptions.AutomaticScheduleConcurrency is < 1 or > 16 ||
    backgroundJobOptions.SchedulePublishConcurrency is < 1 or > 16 ||
    backgroundJobOptions.MakeupExamAutoConcurrency is < 1 or > 16 ||
    backgroundJobOptions.ExamArrangementConcurrency is < 1 or > 16 ||
    backgroundJobOptions.ExamSignInExportConcurrency is < 1 or > 16 ||
    backgroundJobOptions.ExamPublishConcurrency is < 1 or > 16 ||
    backgroundJobOptions.ProcessingAttemptLimit is < 1 or > 100 ||
    backgroundJobOptions.MaintenanceIntervalSeconds is < 10 or > 3600 ||
    backgroundJobOptions.CompletedRetentionDays is < 1 or > 3650 ||
    backgroundJobOptions.CleanupBatchSize is < 10 or > 5000 ||
    string.IsNullOrWhiteSpace(backgroundJobOptions.Exchange) ||
    string.IsNullOrWhiteSpace(backgroundJobOptions.QueuePrefix))
{
    throw new InvalidOperationException("BackgroundJobs 配置超出允许范围。");
}
if (backgroundJobOptions.UsesRabbitMq &&
    (string.IsNullOrWhiteSpace(rabbitMqOptions.HostName) ||
     rabbitMqOptions.Port is < 1 or > 65535 ||
     string.IsNullOrWhiteSpace(rabbitMqOptions.UserName) ||
     string.IsNullOrWhiteSpace(rabbitMqOptions.Password) ||
     string.IsNullOrWhiteSpace(rabbitMqOptions.VirtualHost)))
{
    throw new InvalidOperationException("RabbitMq 连接配置不完整。");
}
if (backgroundJobOptions.UsesRabbitMq &&
    !builder.Environment.IsDevelopment() &&
    (rabbitMqOptions.UserName.Equals("guest", StringComparison.OrdinalIgnoreCase) ||
     rabbitMqOptions.Password == "guest"))
{
    throw new InvalidOperationException(
        "生产环境启用 RabbitMQ 时不能使用默认 guest 凭据。");
}

if (string.IsNullOrWhiteSpace(operationsOptions.BackupDirectory) ||
    operationsOptions.BackupWarningHours is < 1 or > 8760 ||
    operationsOptions.ToolTimeoutMinutes is < 1 or > 240 ||
    string.IsNullOrWhiteSpace(operationsOptions.MySqlDumpPath) ||
    string.IsNullOrWhiteSpace(operationsOptions.MySqlClientPath) ||
    operationsOptions.MySqlAdditionalArguments.Length > 20 ||
    operationsOptions.MySqlAdditionalArguments.Any(argument =>
        string.IsNullOrWhiteSpace(argument) ||
        argument.Length > 300 ||
        !argument.StartsWith("--", StringComparison.Ordinal)))
{
    throw new InvalidOperationException("Operations 运维与备份配置超出允许范围。");
}

builder.Services.AddSingleton(databaseOptions);
builder.Services.AddSingleton(cacheOptions);
builder.Services.AddSingleton(officialDocumentOptions);
builder.Services.AddSingleton(backgroundJobOptions);
builder.Services.AddSingleton(operationsOptions);
builder.Services.AddSingleton(observabilityOptions);
builder.Services.AddSingleton(performanceReportingOptions);
builder.Services.AddSingleton(rabbitMqOptions);
builder.Services.AddSingleton<DatabaseCommandTelemetryInterceptor>();
builder.Services.AddMemoryCache();
builder.Services.AddHttpClient<PerformanceReportService>((services, client) =>
{
    var reporting = services.GetRequiredService<PerformanceReportingOptions>();
    client.Timeout = TimeSpan.FromSeconds(reporting.TimeoutSeconds);
});
builder.Services.Configure<OfficialDocumentOptions>(
    builder.Configuration.GetSection(OfficialDocumentOptions.SectionName));
builder.Services.AddDbContextPool<AppDbContext>((services, options) =>
{
    options.AddInterceptors(
        services.GetRequiredService<DatabaseCommandTelemetryInterceptor>());

    if (databaseOptions.Provider.Equals("SQLite", StringComparison.OrdinalIgnoreCase))
    {
        var sqliteConnectionString = builder.Configuration.GetConnectionString("SQLite")
            ?? throw new InvalidOperationException("缺少 ConnectionStrings:SQLite。");
        var sqliteBuilder = new SqliteConnectionStringBuilder(sqliteConnectionString);
        if (!Path.IsPathRooted(sqliteBuilder.DataSource))
        {
            sqliteBuilder.DataSource = Path.GetFullPath(
                sqliteBuilder.DataSource,
                builder.Environment.ContentRootPath);
        }
        Directory.CreateDirectory(
            Path.GetDirectoryName(sqliteBuilder.DataSource)
            ?? builder.Environment.ContentRootPath);
        options.UseSqlite(sqliteBuilder.ConnectionString);
        return;
    }

    if (!databaseOptions.Provider.Equals("MySql", StringComparison.OrdinalIgnoreCase))
    {
        throw new InvalidOperationException(
            $"不支持数据库 Provider '{databaseOptions.Provider}'，可选值为 SQLite、MySql。");
    }

    var connectionString = builder.Configuration.GetConnectionString("MySql");
    if (string.IsNullOrWhiteSpace(connectionString))
    {
        throw new InvalidOperationException(
            "缺少 MySQL 连接串。请通过 ConnectionStrings__MySql 环境变量配置。");
    }
    options.UseMySQL(
        MySqlConnectionStringPolicy.ForApplication(connectionString),
        mySqlOptions =>
        {
            mySqlOptions.CommandTimeout(databaseOptions.CommandTimeoutSeconds);
            mySqlOptions.EnableRetryOnFailure(
                maxRetryCount: 5,
                maxRetryDelay: TimeSpan.FromSeconds(10),
                errorNumbersToAdd: null);
        });
});

if (observabilityOptions.Enabled &&
    !string.IsNullOrWhiteSpace(otlpEndpoint))
{
    builder.Services
        .AddOpenTelemetry()
        .ConfigureResource(resource =>
            resource.AddService(observabilityOptions.ServiceName))
        .WithMetrics(metrics => metrics
            .AddAspNetCoreInstrumentation()
            .AddHttpClientInstrumentation()
            .AddRuntimeInstrumentation()
            .AddMeter(DatabaseCommandTelemetryInterceptor.MeterName))
        .WithTracing(tracing => tracing
            .AddAspNetCoreInstrumentation(options =>
                options.Filter = context =>
                    !context.Request.Path.StartsWithSegments("/health/live"))
            .AddHttpClientInstrumentation()
            .AddSource(DatabaseCommandTelemetryInterceptor.ActivitySourceName))
        .WithMetrics(metrics => metrics.AddOtlpExporter())
        .WithTracing(tracing => tracing.AddOtlpExporter());
}

var redisConnectionString = builder.Configuration.GetConnectionString("Redis");
if (cacheOptions.Enabled && !string.IsNullOrWhiteSpace(redisConnectionString))
{
    builder.Services.AddStackExchangeRedisCache(options =>
        options.Configuration = redisConnectionString);
}
else
{
    builder.Services.AddDistributedMemoryCache();
}
builder.Services.AddHybridCache(options =>
{
    options.MaximumKeyLength = 512;
    options.MaximumPayloadBytes = cacheOptions.MaximumPayloadKilobytes * 1024;
});
builder.Services.AddSingleton<IAppCache, HybridAppCache>();

builder.Services
    .AddIdentityCore<ApplicationUser>(options =>
    {
        options.Password.RequiredLength = 8;
        options.Password.RequireDigit = true;
        options.Password.RequireLowercase = true;
        options.Password.RequireUppercase = true;
        options.Password.RequireNonAlphanumeric = true;
        options.User.RequireUniqueEmail = false;
        options.Lockout.MaxFailedAccessAttempts = 5;
        options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(15);
    })
    .AddRoles<ApplicationRole>()
    .AddEntityFrameworkStores<AppDbContext>();

var jwtOptions = builder.Configuration.GetSection(JwtOptions.SectionName).Get<JwtOptions>()
    ?? throw new InvalidOperationException("缺少 Jwt 配置。");
if (Encoding.UTF8.GetByteCount(jwtOptions.Key) < 32 ||
    jwtOptions.Key.Contains("REPLACE", StringComparison.OrdinalIgnoreCase))
{
    throw new InvalidOperationException(
        "Jwt:Key 必须配置为至少 32 字节的随机生产密钥，不能使用示例值。");
}

builder.Services.Configure<JwtOptions>(
    builder.Configuration.GetSection(JwtOptions.SectionName));
builder.Services.Configure<SsoOptions>(
    builder.Configuration.GetSection(SsoOptions.SectionName));
builder.Services.AddHttpContextAccessor();
builder.Services.AddScoped<ITokenService, TokenService>();
builder.Services.AddScoped<ICurrentUserDataScope, CurrentUserDataScope>();
builder.Services.AddScoped<DatabaseInitializer>();
builder.Services.AddScoped<DemoDataSeeder>();
builder.Services.AddScoped<DevelopmentSqliteMigrator>();
builder.Services.AddScoped<TimetableDataService>();
builder.Services.AddScoped<AutomaticScheduleGenerator>();
builder.Services.AddScoped<PersonalCalendarService>();
builder.Services.AddScoped<ClassroomReservationAvailabilityService>();
builder.Services.AddScoped<AutomaticScheduleJobProcessor>();
builder.Services.AddScoped<SchedulePlanPublisher>();
builder.Services.AddScoped<SchedulePublishJobProcessor>();
builder.Services.AddHostedService<WarningCheckWorker>();
builder.Services.AddScoped<ExamArrangementService>();
builder.Services.AddScoped<MakeupExamEligibilityService>();
builder.Services.AddScoped<MakeupExamArrangementService>();
builder.Services.AddScoped<MakeupExamAutoJobProcessor>();
builder.Services.AddScoped<ExamArrangementJobProcessor>();
builder.Services.AddScoped<ExamSignInExportJobProcessor>();
builder.Services.AddScoped<ExamPublishJobProcessor>();
builder.Services.AddSingleton<BackgroundJobTelemetry>();
builder.Services.AddScoped<BackgroundJobMonitoringService>();
builder.Services.AddScoped<OperationalHealthService>();
builder.Services.AddSingleton<DatabaseBackupService>();
builder.Services.AddSingleton<BackgroundJobRunner>();
if (backgroundJobOptions.UsesRabbitMq)
{
    builder.Services.AddSingleton<
        IBackgroundJobTransport,
        RabbitMqBackgroundJobTransport>();
    builder.Services.AddHostedService<RabbitMqBackgroundJobWorker>();
}
else
{
    builder.Services.AddSingleton<InMemoryBackgroundJobTransport>();
    builder.Services.AddSingleton<IBackgroundJobTransport>(services =>
        services.GetRequiredService<InMemoryBackgroundJobTransport>());
    builder.Services.AddHostedService<InMemoryBackgroundJobWorker>();
}
builder.Services.AddHostedService<BackgroundJobOutboxPublisher>();
builder.Services.AddSingleton<IOfficialDocumentPdfGenerator, OfficialDocumentPdfGenerator>();
builder.Services.AddScoped<OfficialDocumentService>();

var authentication = builder.Services
    .AddAuthentication(options =>
    {
        options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    })
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = jwtOptions.Issuer,
            ValidAudience = jwtOptions.Audience,
            IssuerSigningKey = new SymmetricSecurityKey(
                Encoding.UTF8.GetBytes(jwtOptions.Key)),
            ClockSkew = TimeSpan.FromMinutes(1)
        };
    })
    .AddCookie(SsoAuthSchemes.ExternalCookie, options =>
    {
        options.Cookie.Name = "__Host-jiaowu-sso";
        options.Cookie.HttpOnly = true;
        options.Cookie.SameSite = SameSiteMode.Lax;
        options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
        options.ExpireTimeSpan = TimeSpan.FromMinutes(5);
    });
if (ssoOptions.Enabled)
{
    authentication.AddOpenIdConnect(SsoAuthSchemes.Keycloak, options =>
    {
        options.Authority = ssoOptions.Authority.TrimEnd('/');
        options.ClientId = ssoOptions.ClientId;
        options.ClientSecret = ssoOptions.ClientSecret;
        options.SignInScheme = SsoAuthSchemes.ExternalCookie;
        options.ResponseType = "code";
        options.UsePkce = true;
        options.SaveTokens = false;
        options.RequireHttpsMetadata = ssoOptions.RequireHttpsMetadata;
        options.CallbackPath = "/signin-keycloak";
        options.GetClaimsFromUserInfoEndpoint = true;
        options.MapInboundClaims = false;
        options.ClaimActions.MapUniqueJsonKey(
            ssoOptions.UserNameClaim,
            ssoOptions.UserNameClaim);
        options.TokenValidationParameters.NameClaimType = ssoOptions.UserNameClaim;
        options.Events.OnRemoteFailure = context =>
        {
            context.HandleResponse();
            var loginUrl = string.IsNullOrWhiteSpace(ssoOptions.FrontendBaseUrl)
                ? "/login"
                : ssoOptions.FrontendBaseUrl.TrimEnd('/') + "/login";
            context.Response.Redirect(loginUrl + "?ssoError=authentication_failed");
            return Task.CompletedTask;
        };
    });
}
builder.Services.AddAuthorization();
builder.Services.AddRateLimiter(options =>
{
    options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
    options.AddPolicy("public-auth", context =>
        RateLimitPartition.GetFixedWindowLimiter(
            context.Connection.RemoteIpAddress?.ToString() ?? "unknown",
            _ => new FixedWindowRateLimiterOptions
            {
                PermitLimit = 10,
                Window = TimeSpan.FromMinutes(5),
                QueueLimit = 0,
                AutoReplenishment = true
            }));
    options.AddPolicy("official-verification", context =>
        RateLimitPartition.GetFixedWindowLimiter(
            context.Connection.RemoteIpAddress?.ToString() ?? "unknown",
            _ => new FixedWindowRateLimiterOptions
            {
                PermitLimit = 30,
                Window = TimeSpan.FromMinutes(1),
                QueueLimit = 0,
                AutoReplenishment = true
            }));
    options.AddPolicy("app-updates", context =>
        RateLimitPartition.GetFixedWindowLimiter(
            context.Connection.RemoteIpAddress?.ToString() ?? "unknown",
            _ => new FixedWindowRateLimiterOptions
            {
                PermitLimit = 120,
                Window = TimeSpan.FromMinutes(1),
                QueueLimit = 0,
                AutoReplenishment = true
            }));
});

builder.Services.AddCors(options =>
{
    options.AddPolicy("Web", policy =>
    {
        var origins = builder.Configuration.GetSection("Cors:Origins").Get<string[]>()
            ?? [];
        if (origins.Length > 0)
        {
            policy.WithOrigins(origins)
                .AllowAnyHeader()
                .AllowAnyMethod();
        }
    });
});

builder.Services.AddResponseCompression(options => options.EnableForHttps = true);
builder.Services.AddProblemDetails();
builder.Services.AddExceptionHandler(options =>
{
    options.ExceptionHandler = async context =>
    {
        var exception = context.Features
            .Get<Microsoft.AspNetCore.Diagnostics.IExceptionHandlerFeature>()?.Error;
        var isConstraintConflict = exception is DbUpdateException;
        var statusCode = isConstraintConflict
            ? StatusCodes.Status409Conflict
            : StatusCodes.Status500InternalServerError;
        context.Response.StatusCode = statusCode;
        await Results.Problem(
                title: isConstraintConflict ? "数据约束冲突" : "服务器处理请求时发生错误",
                detail: isConstraintConflict
                    ? "编码可能已存在，或该数据正在被其他业务引用。"
                    : builder.Environment.IsDevelopment()
                        ? exception?.Message
                        : "请稍后重试，并联系系统管理员查看日志。",
                statusCode: statusCode)
            .ExecuteAsync(context);
    };
});

builder.Services.AddControllers()
    .AddJsonOptions(options =>
        options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter()));
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen(options =>
{
    options.SwaggerDoc("v1", new OpenApiInfo
    {
        Title = "大学教务管理系统 API",
        Version = "v1"
    });
    options.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
    {
        Name = "Authorization",
        Type = SecuritySchemeType.Http,
        Scheme = "bearer",
        BearerFormat = "JWT",
        In = ParameterLocation.Header
    });
    options.AddSecurityRequirement(new OpenApiSecurityRequirement
    {
        [
            new OpenApiSecurityScheme
            {
                Reference = new OpenApiReference
                {
                    Type = ReferenceType.SecurityScheme,
                    Id = "Bearer"
                }
            }
        ] = []
    });
});

var app = builder.Build();

app.UseExceptionHandler();
app.UseResponseCompression();
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.UseDefaultFiles();
app.UseStaticFiles(new StaticFileOptions
{
    OnPrepareResponse = context =>
    {
        if (context.Context.Request.Path.StartsWithSegments("/assets"))
        {
            context.Context.Response.Headers.CacheControl =
                "public,max-age=31536000,immutable";
        }
        else if (string.Equals(
                     Path.GetExtension(context.File.Name),
                     ".html",
                     StringComparison.OrdinalIgnoreCase))
        {
            context.Context.Response.Headers.CacheControl = "no-cache,no-store";
        }
    }
});
app.UseCors("Web");
app.UseRateLimiter();
app.UseAuthentication();
app.UseAuthorization();
app.UseMiddleware<AuditMiddleware>();
app.MapControllers();
app.MapGet("/health/live", () => Results.Ok(new { Status = "healthy" }))
    .AllowAnonymous();
app.MapGet("/health", CheckDatabaseHealthAsync).AllowAnonymous();
app.MapGet("/health/ready", CheckDatabaseHealthAsync).AllowAnonymous();
app.MapGet("/health/cache", CheckCacheHealthAsync).AllowAnonymous();
app.MapGet("/health/messaging", CheckMessagingHealthAsync).AllowAnonymous();
app.MapFallback(async context =>
{
    if (context.Request.Path.StartsWithSegments("/api") ||
        context.Request.Path.StartsWithSegments("/health") ||
        context.Request.Path.StartsWithSegments("/swagger"))
    {
        context.Response.StatusCode = StatusCodes.Status404NotFound;
        return;
    }

    var webRoot = app.Environment.WebRootPath
        ?? Path.Combine(app.Environment.ContentRootPath, "wwwroot");
    var indexPath = Path.Combine(webRoot, "index.html");
    if (!File.Exists(indexPath))
    {
        context.Response.StatusCode = StatusCodes.Status404NotFound;
        return;
    }

    context.Response.Headers.CacheControl = "no-cache,no-store";
    context.Response.ContentType = "text/html; charset=utf-8";
    await context.Response.SendFileAsync(indexPath);
});

using (var scope = app.Services.CreateScope())
{
    await scope.ServiceProvider.GetRequiredService<DatabaseInitializer>()
        .InitializeAsync(migrateOnly);

    if (seedDemoData)
    {
        await scope.ServiceProvider.GetRequiredService<DemoDataSeeder>()
            .SeedAsync();
    }
}

if (migrateOnly || seedDemoData)
{
    return;
}

app.Run();

static async Task<IResult> CheckDatabaseHealthAsync(
    AppDbContext db,
    CancellationToken cancellationToken)
{
    try
    {
        return await db.Database.CanConnectAsync(cancellationToken)
            ? Results.Ok(new { Status = "healthy" })
            : Results.Json(
                new { Status = "unhealthy" },
                statusCode: StatusCodes.Status503ServiceUnavailable);
    }
    catch
    {
        return Results.Json(
            new { Status = "unhealthy" },
            statusCode: StatusCodes.Status503ServiceUnavailable);
    }
}

static async Task<IResult> CheckCacheHealthAsync(
    IServiceProvider services,
    CancellationToken cancellationToken)
{
    var distributedCache = services.GetService<IDistributedCache>();
    if (distributedCache is null)
        return Results.Ok(new { Status = "disabled", Backend = "memory" });

    try
    {
        await distributedCache.GetAsync(
            "jiaowu:health:probe",
            cancellationToken);
        return Results.Ok(new { Status = "healthy", Backend = "redis" });
    }
    catch
    {
        return Results.Json(
            new { Status = "unhealthy", Backend = "redis" },
            statusCode: StatusCodes.Status503ServiceUnavailable);
    }
}

static async Task<IResult> CheckMessagingHealthAsync(
    IBackgroundJobTransport transport,
    BackgroundJobMonitoringService monitoring,
    CancellationToken cancellationToken)
{
    var healthy = await transport.CheckHealthAsync(cancellationToken);
    var backend = transport.IsDurable ? "rabbitmq" : "memory";
    try
    {
        var backlog = await monitoring.GetSnapshotAsync(cancellationToken);
        return healthy
            ? Results.Ok(new
            {
                Status = "healthy",
                Backend = backend,
                Backlog = backlog
            })
            : Results.Json(
                new
                {
                    Status = "unhealthy",
                    Backend = backend,
                    Backlog = backlog
                },
                statusCode: StatusCodes.Status503ServiceUnavailable);
    }
    catch
    {
        return Results.Json(
            new
            {
                Status = "unhealthy",
                Backend = backend,
                Backlog = (object?)null
            },
            statusCode: StatusCodes.Status503ServiceUnavailable);
    }
}

static bool IsHttpUrl(string value) =>
    Uri.TryCreate(value, UriKind.Absolute, out var uri) &&
    uri.Scheme is "http" or "https";

public partial class Program;