const express = require('express');
const jwt = require('jsonwebtoken');
const db = require('../db');
const getDb = require('../db').getDb;
const { authMiddleware, adminOnly, SECRET } = require('../middleware/auth');
const { resolveCaptcha } = require('./auth');
const locks = require('../lib/locks');
const { authorAvatar } = require('../lib/avatar');
const { attachAuthor } = require('../lib/author');

const router = express.Router();

// 论坛游客可见开关：forum_guest_visible='1'（默认）游客可浏览论坛；
// '0'（私密模式）时所有读接口要求登录（401），发帖/回复始终需登录。
// 与 ssr.js forumSSR 的 404 门禁联动（SEO 权衡：私密模式下论坛详情页不再对外索引）。
function requireGuestVisible(req, res, next) {
  if (db.getSetting('forum_guest_visible') === '1') return next();
  return authMiddleware(req, res, next);
}

// 可选鉴权：有效 token 解析出 req.user（用于 [lock:] viewer 判定与作者/管理员识别），
// 匿名/无效 token 直接放行。公共模式下详情页读接口需要它（requireGuestVisible 不解析 token）。
function optionalAuth(req, res, next) {
  const header = req.headers.authorization;
  if (header && header.startsWith('Bearer ')) {
    try { req.user = jwt.verify(header.slice(7), SECRET); } catch { /* 无效 token 按匿名 */ }
  }
  next();
}

// ── 版主权限 ────────────────────────────────────
// admin 恒为版主；非 admin 查 forum_moderators 归属表
function isModerator(userId, categoryId) {
  if (!userId) return false;
  const u = db.get('SELECT role FROM users WHERE id = ?', [userId]);
  if (u && u.role === 'admin') return true;
  return !!db.get('SELECT 1 FROM forum_moderators WHERE category_id = ? AND user_id = ?', [categoryId, userId]);
}

// 站长 = username 'admin' 的账号（超级管理员）。
// 站长发的帖子是"站长帖"：任何人（本版版主/其他 admin）都无权删改/置顶/加精，仅站长本人可操作。
function isOwnerPost(post) {
  const author = db.get('SELECT username FROM users WHERE id = ?', [post.author_id]);
  return author && author.username === 'admin';
}

// pin/essence 用：admin/版主（作者不含）——站长帖仅站长本人可操作
function moderatorPostGuard(req, res, next) {
  const post = db.get('SELECT * FROM forum_posts WHERE id = ?', [req.params.id]);
  if (!post) return res.status(404).json({ error: '帖子不存在' });
  // 站长帖保护：仅站长本人可置顶/加精，版主/其他 admin 一律无权操作站长帖子
  if (isOwnerPost(post) && req.user.id !== post.author_id)
    return res.status(403).json({ error: '无权限' });
  if (!isModerator(req.user.id, post.category_id)) return res.status(403).json({ error: '无权限' });
  req.post = post;
  next();
}

// DELETE/编辑帖子用：作者/admin/版主——站长帖仅站长本人可删改
function authorOrModeratorGuard(req, res, next) {
  const post = db.get('SELECT * FROM forum_posts WHERE id = ?', [req.params.id]);
  if (!post) return res.status(404).json({ error: '帖子不存在' });
  // 站长帖保护：仅站长本人可删改，版主/其他 admin 一律无权
  if (isOwnerPost(post) && req.user.id !== post.author_id)
    return res.status(403).json({ error: '无权限' });
  if (post.author_id !== req.user.id && !isModerator(req.user.id, post.category_id))
    return res.status(403).json({ error: '无权限' });
  req.post = post;
  next();
}

// DELETE 回复用：回复作者/admin/所属帖版主。
// 站长保护只针对帖子本体：站长帖里的回复按回复作者判定（独立于帖子作者），
// 回复作者是站长时才仅站长本人可删，否则按原逻辑（回复作者/版主/admin）——不查帖子作者，勿误伤。
function replyAuthorOrModeratorGuard(req, res, next) {
  const reply = db.get('SELECT * FROM forum_replies WHERE id = ?', [req.params.id]);
  if (!reply) return res.status(404).json({ error: '回复不存在' });
  // 回复作者是站长：仅站长本人可删除该回复（站长保护延伸到站长发的回复本体）
  if (isOwnerPost(reply) && req.user.id !== reply.author_id)
    return res.status(403).json({ error: '无权限' });
  const post = db.get('SELECT category_id FROM forum_posts WHERE id = ?', [reply.post_id]);
  const categoryId = post ? post.category_id : 0;
  if (reply.author_id !== req.user.id && !isModerator(req.user.id, categoryId))
    return res.status(403).json({ error: '无权限' });
  req.reply = reply;
  next();
}

// 公告编辑用：admin/版主
function categoryModeratorGuard(req, res, next) {
  const cat = db.get('SELECT * FROM forum_categories WHERE id = ?', [req.params.id]);
  if (!cat) return res.status(404).json({ error: '分类不存在' });
  if (!isModerator(req.user.id, cat.id)) return res.status(403).json({ error: '无权限' });
  req.category = cat;
  next();
}

// ── 版块级禁言 ──────────────────────────────────
// 检查用户是否在禁言期：命中返回禁言行（muted_until 为 NULL 表示永久），否则 null。
// admin 豁免（管理员不受禁言）；版主不豁免——版主互禁设计下版主不会被禁言，但保险起见同样检查
function isMuted(userId, categoryId) {
  if (!userId || !categoryId) return null;
  const u = db.get('SELECT role FROM users WHERE id = ?', [userId]);
  if (u && u.role === 'admin') return null;
  return db.get(
    `SELECT muted_until FROM forum_mutes
     WHERE category_id = ? AND user_id = ? AND (muted_until IS NULL OR muted_until > datetime('now'))`,
    [categoryId, userId]) || null;
}

// 禁言管理权限：category_id 来自 query（GET）或 body（PUT/DELETE），仅本版版主/admin
function muteCategoryGuard(req, res, next) {
  const catId = Number(req.query.category_id || (req.body && req.body.category_id));
  if (!catId) return res.status(400).json({ error: '缺少 category_id' });
  const cat = db.get('SELECT id FROM forum_categories WHERE id = ?', [catId]);
  if (!cat) return res.status(404).json({ error: '分类不存在' });
  if (!isModerator(req.user.id, catId)) return res.status(403).json({ error: '无权限' });
  req.muteCategoryId = catId;
  next();
}

// DB 的 'YYYY-MM-DD HH:MM:SS'（UTC）转 ISO 8601 输出
function toIso(s) {
  return s ? String(s).replace(' ', 'T') : null;
}

// 禁言拦截（发帖/回复共用）：命中返回 403 响应，未命中继续
function assertNotMuted(req, res, categoryId) {
  const m = isMuted(req.user.id, categoryId);
  if (!m) return true;
  res.status(403).json({
    error: '你已被本版块禁言' + (m.muted_until ? '至 ' + toIso(m.muted_until) : '（永久）')
  });
  return false;
}

// 版块聚合字段：帖子数 / 今日新帖 / 最后回复时间 / 版主（逗号分隔用户名）
const CAT_AGG_SELECT = `fc.*,
  (SELECT COUNT(*) FROM forum_posts fp WHERE fp.category_id = fc.id) AS post_count,
  (SELECT COUNT(*) FROM forum_posts fp WHERE fp.category_id = fc.id AND date(fp.created_at) = date('now')) AS today_count,
  (SELECT MAX(fp.updated_at) FROM forum_posts fp WHERE fp.category_id = fc.id) AS last_post_at,
  COALESCE((SELECT group_concat(u.username, ',') FROM forum_moderators fm LEFT JOIN users u ON fm.user_id = u.id WHERE fm.category_id = fc.id), '') AS moderators`;

router.get('/categories', requireGuestVisible, (req, res) => {
  res.json(db.all(`SELECT ${CAT_AGG_SELECT} FROM forum_categories fc ORDER BY fc.sort_order ASC`));
});

// 单版块详情（含聚合，供版块页 L2 头部）
router.get('/categories/:id', requireGuestVisible, (req, res) => {
  const cat = db.get(`SELECT ${CAT_AGG_SELECT} FROM forum_categories fc WHERE fc.id = ?`, [req.params.id]);
  if (!cat) return res.status(404).json({ error: '分类不存在' });
  res.json(cat);
});

// H4：分类增删改仅限管理员（原仅 authMiddleware，任意登录用户可越权）
router.post('/categories', authMiddleware, adminOnly, (req, res) => {
  try {
    const { name, description, sort_order, announcement, sub_categories, icon, icon_color, feed_enabled } = req.body;
    if (!name) return res.status(400).json({ error: '名称不能为空' });
    const existing = db.get('SELECT id FROM forum_categories WHERE name = ?', [name]);
    if (existing) return res.status(400).json({ error: '分类已存在' });
    const sc = Array.isArray(sub_categories) ? sub_categories.join(',') : (sub_categories || '');
    const id = db.run('INSERT INTO forum_categories (name, description, sort_order, announcement, sub_categories, icon, icon_color, feed_enabled) VALUES (?, ?, ?, ?, ?, ?, ?, ?)',
      [name, description || '', sort_order || 0, announcement || '', sc, icon || '', icon_color || '', feed_enabled !== undefined ? (feed_enabled ? 1 : 0) : 1]);
    res.json(db.get('SELECT * FROM forum_categories WHERE id = ?', [id]));
  } catch (e) { console.error('Create category error:', e.message); res.status(500).json({ error: '操作失败' }); }
});

router.put('/categories/:id', authMiddleware, adminOnly, (req, res) => {
  try {
    const { name, description, sort_order, announcement, sub_categories, icon, icon_color, feed_enabled } = req.body;
    const existing = db.get('SELECT id, feed_enabled FROM forum_categories WHERE id = ?', [req.params.id]);
    if (!existing) return res.status(404).json({ error: '分类不存在' });
    const sc = Array.isArray(sub_categories) ? sub_categories.join(',') : (sub_categories || '');
    db.run('UPDATE forum_categories SET name=?, description=?, sort_order=?, announcement=?, sub_categories=?, icon=?, icon_color=?, feed_enabled=? WHERE id=?',
      [name || '', description || '', sort_order || 0, announcement || '', sc, icon || '', icon_color || '',
       feed_enabled !== undefined ? (feed_enabled ? 1 : 0) : (existing.feed_enabled || 1), req.params.id]);
    const updated = db.get('SELECT * FROM forum_categories WHERE id = ?', [req.params.id]);
    if (!updated) return res.status(500).json({ error: '更新后读取失败' });
    res.json(updated);
  } catch (e) { console.error('Update category error:', e.message); res.status(500).json({ error: '操作失败' }); }
});

// 版主列表设置（仅管理员）：事务内 DELETE 全部 + 校验用户存在后循环 INSERT
router.put('/categories/:id/moderators', authMiddleware, adminOnly, (req, res) => {
  try {
    const existing = db.get('SELECT id FROM forum_categories WHERE id = ?', [req.params.id]);
    if (!existing) return res.status(404).json({ error: '分类不存在' });
    const raw = Array.isArray(req.body.user_ids) ? req.body.user_ids : [];
    const ids = raw.map(Number).filter(n => Number.isInteger(n) && n > 0);
    // 用原生 prepared 语句执行：db.run 会吞异常，事务内必须让 FK/校验错误真正抛出并回滚
    getDb().transaction(() => {
      getDb().prepare('DELETE FROM forum_moderators WHERE category_id = ?').run(req.params.id);
      for (const uid of ids) {
        const u = db.get('SELECT id FROM users WHERE id = ?', [uid]);
        if (!u) throw new Error('用户不存在: ' + uid);
        getDb().prepare('INSERT INTO forum_moderators (category_id, user_id) VALUES (?, ?)').run(req.params.id, uid);
      }
    })();
    res.json({ message: '保存成功', user_ids: ids });
  } catch (e) {
    console.error('Update moderators error:', e.message);
    res.status(400).json({ error: e.message });
  }
});

// 公告编辑（admin/版主）
router.put('/categories/:id/announcement', authMiddleware, categoryModeratorGuard, (req, res) => {
  const announcement = String(req.body.announcement || '');
  db.run('UPDATE forum_categories SET announcement = ? WHERE id = ?', [announcement, req.params.id]);
  res.json({ message: '公告已更新', announcement });
});

// 版块 profile 编辑（admin/版主）：名称/描述/图标/图标底色——部分更新，只改提供的字段。
// 独立接口不放开通用 PUT /categories（admin 全量）：防版主越权改 sort_order/公告/子版块等。
router.put('/categories/:id/profile', authMiddleware, categoryModeratorGuard, (req, res) => {
  try {
    const updates = {};
    // name：非空字符串，≤50
    if (req.body.name !== undefined) {
      const name = String(req.body.name).trim();
      if (!name) return res.status(400).json({ error: '名称不能为空' });
      if (name.length > 50) return res.status(400).json({ error: '名称不能超过 50 个字符' });
      updates.name = name;
    }
    // description：≤500
    if (req.body.description !== undefined) {
      const desc = String(req.body.description || '');
      if (desc.length > 500) return res.status(400).json({ error: '描述不能超过 500 个字符' });
      updates.description = desc;
    }
    // icon：≤100，emoji 或 http(s) 图片 URL 或 /uploads/ 相对路径（本站上传的图标）
    if (req.body.icon !== undefined) {
      const icon = String(req.body.icon || '').trim();
      if (icon.length > 100) return res.status(400).json({ error: '图标不能超过 100 个字符' });
      if (icon && !/^(https?:\/\/|\/uploads\/|[\u{1F000}-\u{1FAFF}\u{1F1E6}-\u{1F1FF}\u{2600}-\u{27BF}\u{2B00}-\u{2BFF}\u{2190}-\u{21FF}])/u.test(icon)) {
        return res.status(400).json({ error: '图标需为 emoji 或 http(s) 图片 URL' });
      }
      updates.icon = icon;
    }
    // icon_color：空字符串清空，或 #hex（3/6 位）
    if (req.body.icon_color !== undefined) {
      const color = String(req.body.icon_color || '').trim();
      if (color && !/^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/.test(color)) {
        return res.status(400).json({ error: '图标底色需为 #hex 色值' });
      }
      updates.icon_color = color;
    }
    // feed_enabled：版块级 RSS 开关（后台 RSS 管理页用），'1'/'0'
    if (req.body.feed_enabled !== undefined) {
      const fe = String(req.body.feed_enabled);
      if (fe !== '0' && fe !== '1') return res.status(400).json({ error: 'feed_enabled 需为 0 或 1' });
      updates.feed_enabled = fe;
    }
    if (!Object.keys(updates).length) return res.status(400).json({ error: '没有可更新的字段' });

    const cols = Object.keys(updates).map(k => k + ' = ?').join(', ');
    db.run(`UPDATE forum_categories SET ${cols} WHERE id = ?`, [...Object.values(updates), req.params.id]);
    const cat = db.get(`SELECT ${CAT_AGG_SELECT} FROM forum_categories fc WHERE fc.id = ?`, [req.params.id]);
    if (!cat) return res.status(500).json({ error: '更新后读取失败' });
    res.json({
      message: '版块信息已更新',
      category: { id: cat.id, name: cat.name, description: cat.description, icon: cat.icon || '', icon_color: cat.icon_color || '', feed_enabled: cat.feed_enabled }
    });
  } catch (e) {
    console.error('Update category profile error:', e.message);
    res.status(500).json({ error: '操作失败' });
  }
});

// 删除分类（仅管理员）：FK 约束下必须先删依赖行——事务内删 replies→posts→moderators→category。
// 之前直接 DELETE category 在 foreign_keys=ON 时 FK 报错被 db.run 吞掉，造成"删除成功"假象。
router.delete('/categories/:id', authMiddleware, adminOnly, (req, res) => {
  const existing = db.get('SELECT id FROM forum_categories WHERE id = ?', [req.params.id]);
  if (!existing) return res.status(404).json({ error: '分类不存在' });
  try {
    getDb().transaction(() => {
      getDb().prepare('DELETE FROM forum_replies WHERE post_id IN (SELECT id FROM forum_posts WHERE category_id = ?)').run(req.params.id);
      getDb().prepare('DELETE FROM forum_posts WHERE category_id = ?').run(req.params.id);
      getDb().prepare('DELETE FROM forum_moderators WHERE category_id = ?').run(req.params.id);
      getDb().prepare('DELETE FROM forum_categories WHERE id = ?').run(req.params.id);
    })();
    res.json({ message: '删除成功' });
  } catch (e) {
    console.error('Delete category error:', e.message);
    res.status(500).json({ error: '操作失败' });
  }
});

// 我管理的版块列表（供版主管理页）：返回版块详情数组，admin 返回全部版块
router.get('/moderated', authMiddleware, (req, res) => {
  const u = db.get('SELECT role FROM users WHERE id = ?', [req.user.id]);
  const isAdmin = u && u.role === 'admin';
  const rows = isAdmin
    ? db.all(`SELECT ${CAT_AGG_SELECT} FROM forum_categories fc ORDER BY fc.sort_order ASC`)
    : db.all(`SELECT ${CAT_AGG_SELECT} FROM forum_categories fc
              JOIN forum_moderators fm ON fm.category_id = fc.id
              WHERE fm.user_id = ? ORDER BY fc.sort_order ASC`, [req.user.id]);
  const categories = rows.map(r => ({
    id: r.id, name: r.name, icon: r.icon || '', icon_color: r.icon_color || '',
    post_count: r.post_count || 0, announcement: r.announcement || '',
    moderators: r.moderators || ''
  }));
  // category_ids 保留兼容旧调用
  res.json({ category_ids: categories.map(c => c.id), categories });
});

// ── 禁言 API（均需登录；管理操作仅本版版主/admin）──────────────────

// 检查当前用户是否被禁言（前台发帖提示用）
router.get('/mutes/check', requireGuestVisible, authMiddleware, (req, res) => {
  const catId = Number(req.query.category_id);
  if (!catId) return res.status(400).json({ error: '缺少 category_id' });
  const cat = db.get('SELECT id FROM forum_categories WHERE id = ?', [catId]);
  if (!cat) return res.status(404).json({ error: '分类不存在' });
  const row = db.get(
    `SELECT muted_until FROM forum_mutes
     WHERE category_id = ? AND user_id = ? AND (muted_until IS NULL OR muted_until > datetime('now'))`,
    [catId, req.user.id]);
  if (!row) return res.json({ muted: false });
  res.json({ muted: true, permanent: !row.muted_until, muted_until: toIso(row.muted_until) });
});

// 本版禁言列表（只回未过期，顺手清理过期行）
router.get('/mutes', requireGuestVisible, authMiddleware, muteCategoryGuard, (req, res) => {
  const catId = req.muteCategoryId;
  getDb().prepare("DELETE FROM forum_mutes WHERE category_id = ? AND muted_until IS NOT NULL AND muted_until <= datetime('now')").run(catId);
  const rows = db.all(
    `SELECT fm.user_id, u.username, u.avatar, u.qq, fm.muted_until, fm.created_at
     FROM forum_mutes fm LEFT JOIN users u ON fm.user_id = u.id
     WHERE fm.category_id = ? AND (fm.muted_until IS NULL OR fm.muted_until > datetime('now'))
     ORDER BY fm.created_at DESC`, [catId]);
  res.json(rows.map(r => ({
    user_id: r.user_id, username: r.username || '已注销用户',
    author_avatar: authorAvatar(r),
    permanent: !r.muted_until, muted_until: toIso(r.muted_until), created_at: toIso(r.created_at)
  })));
});

// 添加/更新禁言（duration: 1|7|30|'forever'；存在则 UPDATE 否则 INSERT）
router.put('/mutes', requireGuestVisible, authMiddleware, muteCategoryGuard, (req, res) => {
  try {
    const catId = req.muteCategoryId;
    let uid = Number(req.body.user_id);
    // 前端按用户名禁言：user_id 缺失时按 username 解析（版主无 /api/auth/users 权限）
    if (!uid && req.body.username) {
      const byName = db.get('SELECT id, role FROM users WHERE username = ?', [String(req.body.username).trim()]);
      if (!byName) return res.status(404).json({ error: '用户不存在' });
      uid = byName.id;
    }
    if (!uid) return res.status(400).json({ error: '缺少 user_id' });
    // 目标用户必须存在
    const target = db.get('SELECT id, role FROM users WHERE id = ?', [uid]);
    if (!target) return res.status(404).json({ error: '用户不存在' });
    // 不能禁言 admin
    if (target.role === 'admin') return res.status(400).json({ error: '不能禁言管理员' });
    // 不能禁言本版版主（版主互不禁）
    if (db.get('SELECT 1 FROM forum_moderators WHERE category_id = ? AND user_id = ?', [catId, uid]))
      return res.status(400).json({ error: '不能禁言本版版主' });
    // 计算到期时间（muted_until 为 NULL = 永久）
    let mutedUntil = null;
    const durStr = String(req.body.duration);
    if (durStr === 'forever') {
      mutedUntil = null;
    } else if (durStr === '1' || durStr === '7' || durStr === '30') {
      mutedUntil = db.get(`SELECT datetime('now', '+${durStr} day') AS t`).t;
    } else {
      return res.status(400).json({ error: '无效的禁言时长' });
    }
    const existing = db.get('SELECT 1 FROM forum_mutes WHERE category_id = ? AND user_id = ?', [catId, uid]);
    if (existing) {
      db.run('UPDATE forum_mutes SET muted_until = ?, created_by = ? WHERE category_id = ? AND user_id = ?',
        [mutedUntil, req.user.id, catId, uid]);
    } else {
      db.run('INSERT INTO forum_mutes (category_id, user_id, muted_until, created_by) VALUES (?, ?, ?, ?)',
        [catId, uid, mutedUntil, req.user.id]);
    }
    res.json({ message: '已禁言', user_id: uid, permanent: !mutedUntil, muted_until: toIso(mutedUntil) });
  } catch (e) {
    console.error('Mute user error:', e.message);
    res.status(500).json({ error: '操作失败' });
  }
});

// 解除禁言
router.delete('/mutes', requireGuestVisible, authMiddleware, muteCategoryGuard, (req, res) => {
  try {
    const catId = req.muteCategoryId;
    const uid = Number(req.body.user_id);
    if (!uid) return res.status(400).json({ error: '缺少 user_id' });
    const existing = db.get('SELECT 1 FROM forum_mutes WHERE category_id = ? AND user_id = ?', [catId, uid]);
    if (!existing) return res.status(404).json({ error: '该用户不在禁言名单中' });
    db.run('DELETE FROM forum_mutes WHERE category_id = ? AND user_id = ?', [catId, uid]);
    res.json({ message: '已解除禁言', user_id: uid });
  } catch (e) {
    console.error('Unmute error:', e.message);
    res.status(500).json({ error: '操作失败' });
  }
});

// 帖子列表：置顶优先；支持分页 / 子版块过滤 / 标题搜索。
// 兼容策略：无 page 参数返回数组（老调用不破坏），带 page 返回 {list,total,page,pageSize,totalPages}
// [lock:] 真锁：按 viewer 视角剥离单篇帖子，返回带 locks/unlocked/viewer 字段的 post。
// 列表与详情共用——未解锁块内容（含 [image:]/[file:] 附件标签）一律不进 API 响应。
function applyLocks(post, req) {
  if (!post) return post;
  const viewer = {
    userId: req.user ? req.user.id : null,
    isAdmin: !!(req.user && req.user.role === 'admin'),
    isAuthor: !!(req.user && req.user.id === post.author_id),
    hasCommented: false,
  };
  if (req.user) {
    viewer.hasCommented = !!db.get(
      'SELECT 1 x FROM forum_replies WHERE post_id = ? AND author_id = ?', [post.id, req.user.id]);
  }
  const locksMeta = (() => { try { return JSON.parse(post.locks || '[]'); } catch { return []; } })();
  const blocks = locks.parseLocks(post.content).blocks;
  const { stripped, unlocked } = locks.stripLocks(post.content, { locksMeta, viewer });
  post.content = stripped;
  const lockMetaList = blocks.map(b => ({ index: b.index, type: b.type })); // 不含 hash
  // 附件真锁：对已解锁索引签发附件 token，前端用它加载块内 [image:]/[file:] 附件
  lockMetaList.forEach(m => {
    if (unlocked.includes(m.index)) m.token = locks.makeLockToken('forum', post.id, m.index);
  });
  post.locks = lockMetaList;
  post.unlocked = unlocked;
  post.viewer = { loggedIn: !!req.user, isAdmin: viewer.isAdmin, isAuthor: viewer.isAuthor, hasCommented: viewer.hasCommented };
  return post;
}

// 帖子列表：置顶优先；支持分页 / 子版块过滤 / 标题搜索。
// 兼容策略：无 page 参数返回数组（老调用不破坏），带 page 返回 {list,total,page,pageSize,totalPages}
router.get('/posts', requireGuestVisible, optionalAuth, (req, res) => {
  const { category_id, sub_category, q } = req.query;
  const where = [];
  const params = [];
  if (category_id) { where.push('fp.category_id = ?'); params.push(category_id); }
  if (sub_category) { where.push('fp.sub_category = ?'); params.push(sub_category); }
  if (q) { where.push('fp.title LIKE ?'); params.push('%' + q + '%'); }
  const whereSql = where.length ? 'WHERE ' + where.join(' AND ') : '';
  const baseSql = `SELECT fp.*, u.username as author_name, u.avatar, u.qq, u.nickname AS author_nickname, u.title AS author_title, u.title_color AS author_title_color, u.role AS author_role,
      CASE WHEN u.qq IS NOT NULL AND trim(u.qq) <> '' THEN ''
           WHEN u.email GLOB '[0-9]*@qq.com' THEN substr(u.email, 1, instr(u.email, '@') - 1)
           ELSE '' END AS qq_from_email,
      (SELECT COUNT(*) FROM forum_replies WHERE post_id = fp.id) as reply_count
      FROM forum_posts fp LEFT JOIN users u ON fp.author_id = u.id
      ${whereSql}`;

  if (req.query.page === undefined) {
    const rows = db.all(baseSql + ' ORDER BY fp.is_pinned DESC, fp.created_at DESC', params);
    rows.forEach(p => { applyLocks(p, req); attachAuthor(p); });
    return res.json(rows);
  }
  const page = parseInt(req.query.page) || 1;
  const pageSize = Math.min(Math.max(parseInt(req.query.pageSize) || 20, 1), 100);
  const total = (db.get(`SELECT COUNT(*) as c FROM forum_posts fp ${whereSql}`, params) || {}).c || 0;
  const list = db.all(baseSql + ' ORDER BY fp.is_pinned DESC, fp.created_at DESC LIMIT ? OFFSET ?',
    [...params, pageSize, (page - 1) * pageSize]);
  list.forEach(p => applyLocks(p, req));
  // 作者头像（自传 > QQ > RainID）
  list.forEach(p => { attachAuthor(p); });
  res.json({ list, total, page, pageSize, totalPages: Math.ceil(total / pageSize) });
});

// 详情（含 replies）：同样受游客可见开关门禁
router.get('/posts/:id', requireGuestVisible, optionalAuth, (req, res) => {
  const post = db.get(
    `SELECT fp.*, u.username as author_name, u.avatar, u.qq, u.nickname AS author_nickname, u.title AS author_title, u.title_color AS author_title_color, u.role AS author_role,
       CASE WHEN u.qq IS NOT NULL AND trim(u.qq) <> '' THEN ''
            WHEN u.email GLOB '[0-9]*@qq.com' THEN substr(u.email, 1, instr(u.email, '@') - 1)
            ELSE '' END AS qq_from_email,
       fc.name as category_name
     FROM forum_posts fp LEFT JOIN users u ON fp.author_id = u.id
     LEFT JOIN forum_categories fc ON fp.category_id = fc.id
     WHERE fp.id = ?`, [req.params.id]);
  if (!post) return res.status(404).json({ error: '帖子不存在' });
  const replies = db.all(
    `SELECT fr.*, u.username as author_name, u.avatar, u.qq, u.nickname AS author_nickname, u.title AS author_title, u.title_color AS author_title_color, u.role AS author_role,
       CASE WHEN u.qq IS NOT NULL AND trim(u.qq) <> '' THEN ''
            WHEN u.email GLOB '[0-9]*@qq.com' THEN substr(u.email, 1, instr(u.email, '@') - 1)
            ELSE '' END AS qq_from_email
     FROM forum_replies fr LEFT JOIN users u ON fr.author_id = u.id
     WHERE fr.post_id = ? ORDER BY fr.created_at ASC`, [req.params.id]);
  // 楼层后端算：楼主=1，replies[i].floor=i+2——删除回复后不错位（前端自增序号会错位）
  replies.forEach((r, i) => { r.floor = i + 2; });
  // [lock:] 真锁：按 viewer 视角剥离，未解锁块内容不进响应
  applyLocks(post, req);
  // 作者/回复头像（自传 > QQ > RainID）
  attachAuthor(post);
  replies.forEach(r => { attachAuthor(r); });
  res.json({ post, replies });
});

// 帖子编辑：作者本人/本版版主/admin（authorOrModeratorGuard 已覆盖"作者"场景），
// 任何时间不设时限。部分更新（title?/content?/sub_category?/use_markdown?），标题/正文必填其一。
// 不校验验证码（编辑非发帖）；回复不可编辑（无对应接口）。
router.put('/posts/:id', authMiddleware, authorOrModeratorGuard, (req, res) => {
  try {
    const updates = {};
    // title：非空且 ≤100
    if (req.body.title !== undefined) {
      const title = String(req.body.title).trim();
      if (!title) return res.status(400).json({ error: '标题不能为空' });
      if (title.length > 100) return res.status(400).json({ error: '标题不能超过 100 个字符' });
      updates.title = title;
    }
    // content：非空
    if (req.body.content !== undefined) {
      const content = String(req.body.content || '');
      if (!content.trim()) return res.status(400).json({ error: '内容不能为空' });
      updates.content = content;
      // 内容变更时同步锁定元数据（[lock:] 块索引/密码 hash 与正文保持一致）
      updates.locks = locks.saveLocks(content);
    }
    // sub_category：允许空字符串（清空子版块）
    if (req.body.sub_category !== undefined) {
      updates.sub_category = String(req.body.sub_category || '');
    }
    // use_markdown：0/1
    if (req.body.use_markdown !== undefined) {
      updates.use_markdown = req.body.use_markdown ? 1 : 0;
    }
    if (!Object.keys(updates).length) return res.status(400).json({ error: '没有可更新的字段' });

    const cols = Object.keys(updates).map(k => k + ' = ?').join(', ');
    // 成功编辑：刷新 updated_at + edit_count 自增（前端展示「已更新 x 次」）
    db.run(`UPDATE forum_posts SET ${cols}, updated_at = datetime('now'), edit_count = edit_count + 1 WHERE id = ?`,
      [...Object.values(updates), req.params.id]);
    const post = db.get(
      `SELECT fp.*, u.username as author_name, u.avatar, u.qq, u.nickname AS author_nickname, u.title AS author_title, u.title_color AS author_title_color, u.role AS author_role,
         CASE WHEN u.qq IS NOT NULL AND trim(u.qq) <> '' THEN ''
              WHEN u.email GLOB '[0-9]*@qq.com' THEN substr(u.email, 1, instr(u.email, '@') - 1)
              ELSE '' END AS qq_from_email,
         fc.name as category_name
       FROM forum_posts fp LEFT JOIN users u ON fp.author_id = u.id
       LEFT JOIN forum_categories fc ON fp.category_id = fc.id
       WHERE fp.id = ?`, [req.params.id]);
    if (!post) return res.status(500).json({ error: '更新后读取失败' });
    attachAuthor(post);
    res.json(post);
  } catch (e) {
    console.error('Edit post error:', e.message);
    res.status(500).json({ error: '操作失败' });
  }
});

router.post('/posts', authMiddleware, async (req, res) => {
  const { category_id, title, content, use_markdown, sub_category } = req.body;
  if (!title || !content) return res.status(400).json({ error: '标题和内容不能为空' });
  // 禁言拦截：本版块被禁言期间禁止发帖（admin 豁免）
  if (category_id && !assertNotMuted(req, res, category_id)) return;
  // 服务端强制验证码校验：内置 proof 或第三方 token 任一通过即可
  if (!(await resolveCaptcha(req, 'forum'))) {
    return res.status(400).json({ error: '请先完成验证码验证' });
  }
  const id = db.run(
    'INSERT INTO forum_posts (category_id, title, content, author_id, use_markdown, sub_category, locks) VALUES (?, ?, ?, ?, ?, ?, ?)',
    [category_id, title, content, req.user.id, use_markdown !== undefined ? (use_markdown ? 1 : 0) : 1, sub_category || '', locks.saveLocks(content)]);
  const post = db.get(
    `SELECT fp.*, u.username as author_name, u.avatar, u.qq, u.nickname AS author_nickname, u.title AS author_title, u.title_color AS author_title_color, u.role AS author_role,
       CASE WHEN u.qq IS NOT NULL AND trim(u.qq) <> '' THEN ''
            WHEN u.email GLOB '[0-9]*@qq.com' THEN substr(u.email, 1, instr(u.email, '@') - 1)
            ELSE '' END AS qq_from_email
     FROM forum_posts fp LEFT JOIN users u ON fp.author_id = u.id
     WHERE fp.id = ?`, [id]);
  attachAuthor(post);
  res.json(post);
});

router.post('/posts/:id/replies', authMiddleware, (req, res) => {
  const { content } = req.body;
  if (!content) return res.status(400).json({ error: '回复内容不能为空' });
  const post = db.get('SELECT id, category_id FROM forum_posts WHERE id = ?', [req.params.id]);
  if (!post) return res.status(404).json({ error: '帖子不存在' });
  // 禁言拦截：本版块被禁言期间禁止回复（admin 豁免）
  if (!assertNotMuted(req, res, post.category_id)) return;
  const id = db.run(
    'INSERT INTO forum_replies (post_id, content, author_id) VALUES (?, ?, ?)',
    [req.params.id, content, req.user.id]);
  // 修 bug：回复后应刷新帖子 updated_at（否则版块"最后回复时间"不随回复更新）
  db.run("UPDATE forum_posts SET updated_at = datetime('now') WHERE id = ?", [req.params.id]);
  const reply = db.get(
    `SELECT fr.*, u.username as author_name, u.avatar, u.qq, u.nickname AS author_nickname, u.title AS author_title, u.title_color AS author_title_color, u.role AS author_role,
       CASE WHEN u.qq IS NOT NULL AND trim(u.qq) <> '' THEN ''
            WHEN u.email GLOB '[0-9]*@qq.com' THEN substr(u.email, 1, instr(u.email, '@') - 1)
            ELSE '' END AS qq_from_email
     FROM forum_replies fr LEFT JOIN users u ON fr.author_id = u.id WHERE fr.id = ?`, [id]);
  attachAuthor(reply);
  res.json(reply);
});

// [lock:] 解锁：返回块内原文（含 [image:]/[file:] 标签，前端自行渲染）。
// login 块需登录；reply 块需已回复（含本版任何回复）；password 块 bcrypt 校验，
// 失败统一 401（不区分密码错/块不存在）；admin/作者恒可解锁。
router.post('/posts/:id/locks/:index/unlock', authMiddleware, locks.unlockLimiter, (req, res) => {
  const post = db.get('SELECT id, author_id, content, locks FROM forum_posts WHERE id = ?', [req.params.id]);
  if (!post) return res.status(404).json({ error: '帖子不存在' });
  const index = parseInt(req.params.index);
  if (!Number.isInteger(index) || index < 0) return res.status(401).json({ error: '解锁失败' });
  const locksMeta = (() => { try { return JSON.parse(post.locks || '[]'); } catch { return []; } })();
  const hasReplied = !!db.get(
    'SELECT 1 x FROM forum_replies WHERE post_id = ? AND author_id = ?', [post.id, req.user.id]);
  const result = locks.verifyUnlock({
    blocks: locks.parseLocks(post.content).blocks,
    locksMeta,
    index,
    password: req.body.password,
    viewer: { userId: req.user.id, isAdmin: req.user.role === 'admin', isAuthor: req.user.id === post.author_id },
    replyQualified: hasReplied,
  });
  if (!result.ok) {
    return res.status(result.status).json({ error: result.status === 403 ? '回复后解锁' : '解锁失败' });
  }
  // 附件真锁：随解锁内容一并签发附件 token（前端据此加载块内附件）
  res.json({ ok: true, content: result.inner, lockToken: locks.makeLockToken('forum', post.id, index) });
});

// 置顶 / 取消置顶（admin/版主）
router.put('/posts/:id/pin', authMiddleware, moderatorPostGuard, (req, res) => {
  const pinned = req.body.pinned ? 1 : 0;
  db.run('UPDATE forum_posts SET is_pinned = ? WHERE id = ?', [pinned, req.params.id]);
  res.json({ message: pinned ? '已置顶' : '已取消置顶', is_pinned: pinned });
});

// 加精 / 取消加精（admin/版主）
router.put('/posts/:id/essence', authMiddleware, moderatorPostGuard, (req, res) => {
  const essence = req.body.essence ? 1 : 0;
  db.run('UPDATE forum_posts SET is_essence = ? WHERE id = ?', [essence, req.params.id]);
  res.json({ message: essence ? '已加精' : '已取消加精', is_essence: essence });
});

router.delete('/posts/:id', authMiddleware, authorOrModeratorGuard, (req, res) => {
  getDb().transaction(() => {
    getDb().prepare('DELETE FROM forum_replies WHERE post_id = ?').run(req.params.id);
    getDb().prepare('DELETE FROM forum_posts WHERE id = ?').run(req.params.id);
  })();
  res.json({ message: '删除成功' });
});

router.delete('/replies/:id', authMiddleware, replyAuthorOrModeratorGuard, (req, res) => {
  db.run('DELETE FROM forum_replies WHERE id = ?', [req.params.id]);
  res.json({ message: '删除成功' });
});

module.exports = router;