// app/middleware/tenant_context_middleware.ts
export default class TenantContextMiddleware {
  async handle({ auth, response }: HttpContext, next: NextFn) {
    try {
      // Get organization ID from authenticated user
      const organizationId = auth.user?.organization_id
      
      if (!organizationId) {
        // Handle users without organization (super admins)
        return await next()
      }
      
      // Set PostgreSQL session variable for RLS
      await db.rawQuery('SELECT set_current_organization(?)', [organizationId])
      
      // Continue with request - all queries now filtered by tenant
      return await next()
      
    } catch (error) {
      return response.status(500).json({
        error: 'Failed to set tenant context'
      })
    }
  }
}

// app/models/hotel.ts
export default class Hotel extends BaseModel {
  @column()
  declare organization_id: number
  
  @belongsTo(() => Organization)
  declare organization: BelongsTo<typeof Organization>
  
  // Automatic tenant filtering in queries
  static boot() {
    super.boot()
    
    this.addGlobalScope('tenant', (query) => {
      const organizationId = getCurrentOrganizationId()
      if (organizationId) {
        query.where('organization_id', organizationId)
      }
    })
  }
}

// app/services/reservation_service.ts
export class ReservationService {
  constructor(private organizationId: number) {}
  
  async createReservation(data: CreateReservationData) {
    // Ensure all created records belong to current tenant
    const reservation = await Reservation.create({
      ...data,
      organization_id: this.organizationId
    })
    
    return reservation
  }
  
  async findAvailableRooms(hotelId: number, dates: DateRange) {
    // Queries automatically filtered by RLS
    return Room.query()
      .where('hotel_id', hotelId)
      .where('status', 'available')
      // organization_id filter applied by RLS
  }
}

// app/controllers/hotels_controller.ts
export default class HotelsController {
  async show({ params, auth, response }: HttpContext) {
    const hotel = await Hotel.find(params.id)
    
    if (!hotel) {
      return response.notFound({ message: 'Hotel not found' })
    }
    
    // Additional validation (RLS already filters, but explicit check for clarity)
    if (hotel.organization_id !== auth.user!.organization_id) {
      return response.forbidden({ message: 'Access denied' })
    }
    
    return hotel
  }
}

// Multiple layers of tenant validation
class SecureService {
  async getData(id: number, user: User) {
    // Layer 1: Application-level check
    if (!user.organization_id) {
      throw new UnauthorizedException('No organization access')
    }
    
    // Layer 2: Explicit tenant filtering
    const data = await Model.query()
      .where('id', id)
      .where('organization_id', user.organization_id)
      .first()
    
    // Layer 3: RLS provides additional protection
    return data
  }
}

// Track all tenant-related operations
export class AuditService {
  async logTenantAccess(user: User, resource: string, action: string) {
    await AuditLog.create({
      user_id: user.id,
      organization_id: user.organization_id,
      resource,
      action,
      ip_address: request.ip(),
      user_agent: request.header('user-agent'),
      timestamp: DateTime.now()
    })
  }
}

// Validate tenant-specific constraints
export class TenantValidator {
  static validateHotelAccess = vine.compile(
    vine.object({
      hotel_id: vine.number().exists(async (db, value, field) => {
        const hotel = await db
          .from('hotels')
          .where('id', value)
          .where('organization_id', field.meta.organizationId)
          .first()
        
        return !!hotel
      })
    })
  )
}

// Efficient tenant-aware queries
class OptimizedQueries {
  // Good: Uses composite index
  async getActiveReservations(organizationId: number) {
    return db.query()
      .from('reservations')
      .where('organization_id', organizationId)
      .where('status', 'active')
      .orderBy('check_in_date')
  }
  
  // Better: Leverages RLS (organization_id filter automatic)
  async getActiveReservationsWithRLS() {
    return Reservation.query()
      .where('status', 'active')
      .orderBy('check_in_date')
  }
}

// Cache keys include tenant context
export class TenantCache {
  private static getCacheKey(organizationId: number, key: string): string {
    return `org:${organizationId}:${key}`
  }
  
  static async get(organizationId: number, key: string) {
    const cacheKey = this.getCacheKey(organizationId, key)
    return await Redis.get(cacheKey)
  }
  
  static async set(organizationId: number, key: string, value: any, ttl = 3600) {
    const cacheKey = this.getCacheKey(organizationId, key)
    return await Redis.setex(cacheKey, ttl, JSON.stringify(value))
  }
}

// Route large tenants to dedicated resources
class TenantRouter {
  static getConnectionConfig(organizationId: number) {
    const tenant = TenantRegistry.get(organizationId)
    
    if (tenant.tier === 'enterprise') {
      return {
        database: 'enterprise_db',
        redis: 'enterprise_redis',
        queue: 'enterprise_queue'
      }
    }
    
    return {
      database: 'shared_db',
      redis: 'shared_redis',
      queue: 'shared_queue'
    }
  }
}

// Utility for managing tenant context
export class TenantContext {
  private static context = new AsyncLocalStorage<{ organizationId: number }>()
  
  static run<T>(organizationId: number, callback: () => T): T {
    return this.context.run({ organizationId }, callback)
  }
  
  static getCurrentOrganizationId(): number | null {
    return this.context.getStore()?.organizationId || null
  }
  
  static requireOrganizationId(): number {
    const orgId = this.getCurrentOrganizationId()
    if (!orgId) {
      throw new Error('No tenant context available')
    }
    return orgId
  }
}

// Usage in middleware
export default class TenantContextMiddleware {
  async handle(ctx: HttpContext, next: NextFn) {
    const organizationId = ctx.auth.user?.organization_id
    
    if (organizationId) {
      return TenantContext.run(organizationId, () => next())
    }
    
    return next()
  }
}

// Base repository with tenant awareness
export abstract class TenantAwareRepository<T extends BaseModel> {
  constructor(protected model: typeof BaseModel) {}
  
  protected getQuery() {
    const organizationId = TenantContext.getCurrentOrganizationId()
    const query = this.model.query()
    
    if (organizationId) {
      query.where('organization_id', organizationId)
    }
    
    return query
  }
  
  async findById(id: number): Promise<T | null> {
    return this.getQuery().where('id', id).first()
  }
  
  async create(data: Partial<T>): Promise<T> {
    const organizationId = TenantContext.requireOrganizationId()
    
    return this.model.create({
      ...data,
      organization_id: organizationId
    })
  }
}

// Specific repository implementation
export class HotelRepository extends TenantAwareRepository<Hotel> {
  constructor() {
    super(Hotel)
  }
  
  async findBySlug(slug: string): Promise<Hotel | null> {
    return this.getQuery().where('slug', slug).first()
  }
  
  async findActiveHotels(): Promise<Hotel[]> {
    return this.getQuery()
      .where('is_active', true)
      .where('is_deleted', false)
      .orderBy('name')
  }
}

// Tenant-specific configuration
export class TenantConfig {
  private static cache = new Map<number, any>()
  
  static async get(organizationId: number, key: string, defaultValue?: any) {
    let config = this.cache.get(organizationId)
    
    if (!config) {
      const org = await Organization.find(organizationId)
      config = org?.settings || {}
      this.cache.set(organizationId, config)
    }
    
    return config[key] ?? defaultValue
  }
  
  static async getCheckInTime(organizationId: number): Promise<string> {
    return this.get(organizationId, 'default_check_in_time', '15:00')
  }
  
  static async getOverbookingPercentage(organizationId: number): Promise<number> {
    return this.get(organizationId, 'overbooking_percentage', 0)
  }
  
  static async getSupportedLanguages(organizationId: number): Promise<string[]> {
    return this.get(organizationId, 'supported_languages', ['en'])
  }
}

// Test utilities for multi-tenant scenarios
export class TenantTestUtils {
  static async createTestOrganization(overrides = {}) {
    return Organization.create({
      name: 'Test Organization',
      slug: `test-org-${Date.now()}`,
      email: '[email protected]',
      currency: 'USD',
      timezone: 'UTC',
      settings: {
        overbooking_percentage: 5,
        default_check_in_time: '14:00',
        default_check_out_time: '11:00'
      },
      ...overrides
    })
  }
  
  static async createTestUser(organizationId: number) {
    return User.create({
      full_name: 'Test User',
      email: `test-${Date.now()}@example.com`,
      password: 'password123',
      organization_id: organizationId
    })
  }
  
  static async withTenantContext<T>(
    organizationId: number, 
    callback: () => Promise<T>
  ): Promise<T> {
    await db.rawQuery('SELECT set_current_organization(?)', [organizationId])
    try {
      return await callback()
    } finally {
      await db.rawQuery('RESET app.current_organization')
    }
  }
}

// Test tenant data isolation
test('tenant data isolation', async ({ assert }) => {
  // Create two organizations
  const org1 = await TenantTestUtils.createTestOrganization({ name: 'Org 1' })
  const org2 = await TenantTestUtils.createTestOrganization({ name: 'Org 2' })
  
  // Create hotels for each organization
  const hotel1 = await TenantTestUtils.withTenantContext(org1.id, async () => {
    return Hotel.create({
      organization_id: org1.id,
      name: 'Hotel 1',
      slug: 'hotel-1'
    })
  })
  
  const hotel2 = await TenantTestUtils.withTenantContext(org2.id, async () => {
    return Hotel.create({
      organization_id: org2.id,
      name: 'Hotel 2',
      slug: 'hotel-2'
    })
  })
  
  // Test that org1 can only see its own hotels
  const org1Hotels = await TenantTestUtils.withTenantContext(org1.id, async () => {
    return Hotel.all()
  })
  
  assert.lengthOf(org1Hotels, 1)
  assert.equal(org1Hotels[0].id, hotel1.id)
  
  // Test that org2 can only see its own hotels
  const org2Hotels = await TenantTestUtils.withTenantContext(org2.id, async () => {
    return Hotel.all()
  })
  
  assert.lengthOf(org2Hotels, 1)
  assert.equal(org2Hotels[0].id, hotel2.id)
})

// Metrics collection with tenant context
export class TenantMetrics {
  static async recordReservation(organizationId: number, hotelId: number) {
    await Metrics.increment('reservations.created', {
      organization_id: organizationId,
      hotel_id: hotelId
    })
  }
  
  static async recordRevenue(organizationId: number, amount: number, currency: string) {
    await Metrics.gauge('revenue.total', amount, {
      organization_id: organizationId,
      currency
    })
  }
  
  static async recordPerformance(organizationId: number, operation: string, duration: number) {
    await Metrics.histogram('operation.duration', duration, {
      organization_id: organizationId,
      operation
    })
  }
}

// Health checks per tenant
export class TenantHealthCheck {
  static async checkTenantHealth(organizationId: number) {
    const checks = await Promise.allSettled([
      this.checkDatabaseAccess(organizationId),
      this.checkCacheAccess(organizationId),
      this.checkBusinessRules(organizationId)
    ])
    
    return {
      organizationId,
      status: checks.every(c => c.status === 'fulfilled') ? 'healthy' : 'unhealthy',
      checks: checks.map((check, index) => ({
        name: ['database', 'cache', 'business_rules'][index],
        status: check.status,
        error: check.status === 'rejected' ? check.reason : null
      }))
    }
  }
  
  private static async checkDatabaseAccess(organizationId: number) {
    return TenantTestUtils.withTenantContext(organizationId, async () => {
      await Hotel.query().limit(1)
    })
  }
}

// Debug missing tenant context
export class TenantDebugger {
  static logMissingContext(operation: string) {
    const organizationId = TenantContext.getCurrentOrganizationId()
    
    if (!organizationId) {
      logger.warn(`Operation ${operation} executed without tenant context`, {
        stack: new Error().stack,
        timestamp: new Date().toISOString()
      })
    }
  }
}

// Monitor slow queries by tenant
export class TenantPerformanceMonitor {
  static async logSlowQuery(
    organizationId: number, 
    query: string, 
    duration: number
  ) {
    if (duration > 1000) { // Log queries > 1 second
      logger.warn('Slow query detected', {
        organization_id: organizationId,
        query,
        duration,
        timestamp: new Date().toISOString()
      })
    }
  }
}

// ✅ Good: Explicit tenant context
async function createReservation(data: ReservationData, organizationId: number) {
  return Reservation.create({
    ...data,
    organization_id: organizationId
  })
}

// ❌ Bad: Missing tenant context
async function createReservation(data: ReservationData) {
  return Reservation.create(data) // Could create orphaned records
}

// ✅ Good: Validate tenant ownership
async function updateHotel(hotelId: number, data: HotelData, user: User) {
  const hotel = await Hotel.query()
    .where('id', hotelId)
    .where('organization_id', user.organization_id)
    .firstOrFail()
  
  return hotel.merge(data).save()
}

// ❌ Bad: No tenant validation
async function updateHotel(hotelId: number, data: HotelData) {
  const hotel = await Hotel.findOrFail(hotelId)
  return hotel.merge(data).save()
}

// ✅ Good: Leverages RLS and explicit filtering
async function getHotelReservations(hotelId: number) {
  return Reservation.query()
    .where('hotel_id', hotelId)
    // organization_id filter applied by RLS
    .preload('guest')
    .orderBy('check_in_date')
}

// Ensure migrations work with existing tenant data
export default class extends BaseSchema {
  async up() {
    this.schema.alterTable('hotels', (table) => {
      // Add new column with default value
      table.string('new_field').defaultTo('default_value')
    })
    
    // Update existing records per tenant
    await this.defer(async (db) => {
      const organizations = await db.from('organizations').select('id')
      
      for (const org of organizations) {
        await db.from('hotels')
          .where('organization_id', org.id)
          .update('new_field', `tenant_${org.id}_value`)
      }
    })
  }
}