import { Router, Request, Response } from 'express';
import { authenticate } from '../middlewares/authenticate';
import { authorize } from '../middlewares/authorize';
import * as PerformanceDAO from '../dao/PerformanceDAO';
import { calculateAttendanceScore, calculateLevelAndReward } from '../services/CalculationService';
import { exportPerformanceExcel } from '../services/ExportService';

const router = Router();

// All performance routes require authentication
router.use(authenticate);

// ─── 6.1 POST /api/performance/submit ────────────────────────────────────────
// Supports draft (暂存) and submit (提交) states.
// Writes performance_month, perf_item, attendance in a transaction.
// On submit, triggers async AI evaluation (non-blocking).
router.post(
  '/submit',
  authorize('employee'),
  async (req: Request, res: Response) => {
    const user = req.user!;
    const { month, status, selfScore, workSummary, items, performanceItems, attendance } = req.body;

    if (!month || !status) {
      return res.status(400).json({ code: 400, message: '月份和状态不能为空' });
    }
    if (status !== 'draft' && status !== 'submitted') {
      return res.status(400).json({ code: 400, message: '状态值无效，必须为 draft 或 submitted' });
    }

    // If submitting, check for existing submitted/completed record (idempotency guard)
    if (status === 'submitted') {
      const existing = await PerformanceDAO.findByUserAndMonth(user.userId, month);
      if (existing && (existing.status === 'submitted' || existing.status === 'completed' || existing.status === 'under_review')) {
        return res.status(400).json({ code: 400, message: '该月份绩效已提交，不可重复提交' });
      }
    }

    // Calculate attendance score if attendance data provided
    let attendanceData: PerformanceDAO.AttendanceRow | undefined;
    if (attendance) {
      const score = calculateAttendanceScore({
        leaveDays: attendance.leave ?? attendance.leave_days ?? 0,
        lateTimes: attendance.late ?? attendance.late_times ?? 0,
        lackCardTimes: attendance.lackCard ?? attendance.lack_card_times ?? 0,
      });
      attendanceData = {
        perf_id: 0, // will be set by DAO
        leave_days: attendance.leave ?? attendance.leave_days ?? 0,
        late_times: attendance.late ?? attendance.late_times ?? 0,
        absent_days: attendance.absent ?? attendance.absent_days ?? 0,
        lack_card_times: attendance.lackCard ?? attendance.lack_card_times ?? 0,
        attendance_score: score,
        remark: attendance.remark ?? null,
      };
    }

    // Convert performanceItems to items format if needed
    const itemsData = performanceItems || items;
    const formattedItems = itemsData?.map((item: any) => ({
      item_name: item.itemName || item.item_name,
      item_category: item.itemCategory || item.item_category || 'business',
      weight: item.weight,
      user_content: item.userContent || item.user_content,
      self_score: item.selfScore || item.self_score,
      evidence_url: item.evidence || item.evidence_url,
    }));

    // 计算自评总分：各项 self_score * weight 加权平均
    let calculatedSelfScore: number | undefined;
    if (formattedItems && formattedItems.length > 0) {
      let weightedSum = 0;
      let totalWeight = 0;
      for (const item of formattedItems) {
        if (item.self_score != null && item.weight != null) {
          weightedSum += Number(item.self_score) * Number(item.weight);
          totalWeight += Number(item.weight);
        }
      }
      if (totalWeight > 0) {
        calculatedSelfScore = parseFloat((weightedSum / totalWeight).toFixed(2));
      }
    }

    try {
      const perfId = await PerformanceDAO.upsert({
        userId: user.userId,
        month,
        status,
        selfScore: calculatedSelfScore,
        workSummary,
        items: formattedItems,
        attendance: attendanceData,
      });

      // Trigger async AI evaluation on submit (non-blocking)
      if (status === 'submitted') {
        triggerAIEvaluation(perfId).catch((err) => {
          console.error(`[AI] Evaluation failed for perfId=${perfId}:`, err);
        });
      }

      return res.json({ code: 200, message: status === 'draft' ? '暂存成功' : '提交成功', data: { perfId } });
    } catch (err: any) {
      // Duplicate key = already submitted
      if (err.code === 'ER_DUP_ENTRY') {
        return res.status(400).json({ code: 400, message: '该月份绩效已存在' });
      }
      console.error('[submit]', err);
      return res.status(500).json({ code: 500, message: '服务器内部错误' });
    }
  }
);

// ─── 6.2 GET /api/performance/employee/get ───────────────────────────────────
// Returns the authenticated employee's performance records.
// Supports month filter and pagination. Includes AI result, attendance, review opinion.
router.get(
  '/employee/get',
  authorize('employee'),
  async (req: Request, res: Response) => {
    const user = req.user!;
    const { month, page = '1', pageSize = '10', perfId } = req.query as Record<string, string>;

    // 如果提供了 perfId，返回单条记录详情
    if (perfId) {
      try {
        const { findDetailByPerfId } = await import('../dao/PerformanceDAO');
        const { findByPerfId: findAIByPerfId } = await import('../dao/AIResultDAO');
        
        const detail = await findDetailByPerfId(parseInt(perfId, 10));
        if (!detail || detail.performance.user_id !== user.userId) {
          return res.status(404).json({ code: 404, message: '绩效记录不存在' });
        }
        
        const aiResult = await findAIByPerfId(parseInt(perfId, 10));
        const rec = detail.performance;
        
        // 转换为驼峰格式，确保数值字段为 number 类型
        const result = {
          perfId: rec.perf_id,
          userId: rec.user_id,
          month: rec.month,
          status: rec.status,
          selfScore: rec.self_score != null ? Number(rec.self_score) : undefined,
          aiScore: rec.ai_score != null ? Number(rec.ai_score) : undefined,
          managerScore: rec.manager_score != null ? Number(rec.manager_score) : undefined,
          totalScore: rec.total_score != null ? Number(rec.total_score) : undefined,
          level: rec.level,
          rewardPunish: rec.reward_punish,
          workSummary: rec.work_summary,
          submitTime: rec.submit_time,
          reviewTime: rec.review_time,
          reviewOpinion: rec.review_opinion,
          performanceItems: detail.items?.map(item => ({
            itemId: item.item_id,
            perfId: item.perf_id,
            itemName: item.item_name,
            itemCategory: item.item_category,
            weight: Number(item.weight),
            userContent: item.user_content,
            selfScore: item.self_score != null ? Number(item.self_score) : undefined,
            aiScore: item.ai_score != null ? Number(item.ai_score) : undefined,
            aiExplanation: item.ai_explanation,
            managerScore: item.manager_score != null ? Number(item.manager_score) : undefined,
            managerExplanation: item.manager_explanation,
            evidenceUrl: item.evidence_url,
          })) ?? [],
          attendance: detail.attendance ? {
            leave: Number(detail.attendance.leave_days),
            late: Number(detail.attendance.late_times),
            absent: Number(detail.attendance.absent_days),
            lackCard: Number(detail.attendance.lack_card_times),
            attendanceScore: detail.attendance.attendance_score != null ? Number(detail.attendance.attendance_score) : undefined,
            remark: detail.attendance.remark,
          } : null,
          aiResult: aiResult ? {
            aiId: aiResult.aiId,
            perfId: aiResult.perfId,
            aiScoreDetail: aiResult.aiScoreDetail,
            aiTotalScore: aiResult.aiTotalScore,
            aiProblems: aiResult.aiProblems,
            aiSuggestions: aiResult.aiSuggestions,
            createTime: aiResult.createTime,
          } : null,
        };
        
        return res.json({
          code: 200,
          message: '查询成功',
          data: result,
        });
      } catch (err) {
        console.error('[employee/get detail]', err);
        return res.status(500).json({ code: 500, message: '服务器内部错误' });
      }
    }

    // 否则返回列表
    const pageInfo: PerformanceDAO.PageInfo = {
      page: Math.max(1, parseInt(page, 10) || 1),
      pageSize: Math.min(100, Math.max(1, parseInt(pageSize, 10) || 10)),
    };

    try {
      const result = await PerformanceDAO.findByUserId(user.userId, month, pageInfo);

      // Enrich each record with attendance and AI result
      const { findDetailByPerfId } = await import('../dao/PerformanceDAO');
      const { findByPerfId: findAIByPerfId } = await import('../dao/AIResultDAO');

      const enriched = await Promise.all(
        result.records.map(async (rec) => {
          const detail = await findDetailByPerfId(rec.perf_id);
          const aiResult = await findAIByPerfId(rec.perf_id);
          
          // 转换为驼峰格式，确保数值字段为 number 类型
          return {
            perfId: rec.perf_id,
            userId: rec.user_id,
            month: rec.month,
            status: rec.status,
            selfScore: rec.self_score != null ? Number(rec.self_score) : undefined,
            aiScore: rec.ai_score != null ? Number(rec.ai_score) : undefined,
            managerScore: rec.manager_score != null ? Number(rec.manager_score) : undefined,
            totalScore: rec.total_score != null ? Number(rec.total_score) : undefined,
            level: rec.level,
            rewardPunish: rec.reward_punish,
            workSummary: rec.work_summary,
            submitTime: rec.submit_time,
            reviewTime: rec.review_time,
            reviewOpinion: rec.review_opinion,
            performanceItems: detail?.items?.map(item => ({
              itemId: item.item_id,
              perfId: item.perf_id,
              itemName: item.item_name,
              itemCategory: item.item_category,
              weight: Number(item.weight),
              userContent: item.user_content,
              selfScore: item.self_score != null ? Number(item.self_score) : undefined,
              aiScore: item.ai_score != null ? Number(item.ai_score) : undefined,
              aiExplanation: item.ai_explanation,
              managerScore: item.manager_score != null ? Number(item.manager_score) : undefined,
              managerExplanation: item.manager_explanation,
              evidenceUrl: item.evidence_url,
            })) ?? [],
            attendance: detail?.attendance ? {
              leave: Number(detail.attendance.leave_days),
              late: Number(detail.attendance.late_times),
              absent: Number(detail.attendance.absent_days),
              lackCard: Number(detail.attendance.lack_card_times),
              attendanceScore: detail.attendance.attendance_score != null ? Number(detail.attendance.attendance_score) : undefined,
              remark: detail.attendance.remark,
            } : null,
            aiResult: aiResult ? {
              aiId: aiResult.aiId,
              perfId: aiResult.perfId,
              aiScoreDetail: aiResult.aiScoreDetail,
              aiTotalScore: aiResult.aiTotalScore,
              aiProblems: aiResult.aiProblems,
              aiSuggestions: aiResult.aiSuggestions,
              createTime: aiResult.createTime,
            } : null,
          };
        })
      );

      return res.json({
        code: 200,
        message: '查询成功',
        data: { total: result.total, records: enriched },
      });
    } catch (err) {
      console.error('[employee/get]', err);
      return res.status(500).json({ code: 500, message: '服务器内部错误' });
    }
  }
);

// ─── 6.3 POST /api/performance/request-modification ──────────────────────────
// Employee requests modification of a submitted performance record.
// Records the reason and notifies the manager (logged for now).
router.post(
  '/request-modification',
  authorize('employee'),
  async (req: Request, res: Response) => {
    const user = req.user!;
    const { perfId, reason } = req.body;

    if (!perfId || !reason) {
      return res.status(400).json({ code: 400, message: '绩效ID和申请原因不能为空' });
    }

    try {
      const detail = await PerformanceDAO.findDetailByPerfId(Number(perfId));
      if (!detail) {
        return res.status(404).json({ code: 404, message: '绩效记录不存在' });
      }

      // Verify ownership
      if (detail.performance.user_id !== user.userId) {
        return res.status(403).json({ code: 403, message: '权限不足' });
      }

      // Only submitted records can request modification
      if (detail.performance.status !== 'submitted' && detail.performance.status !== 'under_review') {
        return res.status(400).json({ code: 400, message: '当前状态不允许申请修改' });
      }

      // Record the modification request in operation_log
      const pool = (await import('../config/database')).default;
      await pool.query(
        `INSERT INTO operation_log (user_id, operation_type, target_type, target_id, operation_detail)
         VALUES (?, 'request_modification', 'performance', ?, ?)`,
        [user.userId, perfId, JSON.stringify({ reason })]
      );

      // Notify manager: in a real system this would send a notification;
      // here we log it as a manager-targeted operation log entry.
      console.log(`[修改申请] 员工 ${user.name}(${user.userId}) 申请修改绩效 ${perfId}，原因：${reason}`);

      return res.json({ code: 200, message: '修改申请已提交，等待管理层审批' });
    } catch (err) {
      console.error('[request-modification]', err);
      return res.status(500).json({ code: 500, message: '服务器内部错误' });
    }
  }
);

// ─── 8.1 GET /api/performance/manager/list ───────────────────────────────────
// Returns subordinates' performance list with optional filters and pagination.
// Supports filtering by month, department, employee name, and status.
// Requirements: 4.1, 7.1, 7.2
router.get(
  '/manager/list',
  authorize('manager', 'generalManager'),
  async (req: Request, res: Response) => {
    const user = req.user!;
    const {
      month,
      department,
      employeeName,
      status,
      page = '1',
      pageSize = '10',
    } = req.query as Record<string, string>;

    const pageInfo: PerformanceDAO.PageInfo = {
      page: Math.max(1, parseInt(page, 10) || 1),
      pageSize: Math.min(100, Math.max(1, parseInt(pageSize, 10) || 10)),
    };

    const filters: PerformanceDAO.PerformanceFilter = {
      month: month || undefined,
      department: department || undefined,
      employeeName: employeeName || undefined,
      status: (status as PerformanceDAO.PerformanceStatus) || undefined,
    };

    try {
      const result = await PerformanceDAO.findByManagerId(user.userId, filters, pageInfo);

      // Enrich each record with employee info
      const pool = (await import('../config/database')).default;
      const enriched = await Promise.all(
        result.records.map(async (rec) => {
          const [userRows] = await pool.query<any[]>(
            'SELECT name, department, position FROM user WHERE user_id = ? LIMIT 1',
            [rec.user_id]
          );
          return {
            perfId: rec.perf_id,
            userId: rec.user_id,
            month: rec.month,
            status: rec.status,
            selfScore: rec.self_score != null ? Number(rec.self_score) : null,
            aiScore: rec.ai_score != null ? Number(rec.ai_score) : null,
            managerScore: rec.manager_score != null ? Number(rec.manager_score) : null,
            totalScore: rec.total_score != null ? Number(rec.total_score) : null,
            level: rec.level,
            submitTime: rec.submit_time,
            reviewTime: rec.review_time,
            // 员工信息
            userName: userRows[0]?.name ?? null,
            userDepartment: userRows[0]?.department ?? null,
            userPosition: userRows[0]?.position ?? null,
          };
        })
      );

      return res.json({
        code: 200,
        message: '查询成功',
        data: { total: result.total, records: enriched },
      });
    } catch (err) {
      console.error('[manager/list]', err);
      return res.status(500).json({ code: 500, message: '服务器内部错误' });
    }
  }
);

// ─── GET /api/performance/manager/detail/:perfId ─────────────────────────────
// Returns full detail of a subordinate's performance record for manager review.
router.get(
  '/manager/detail/:perfId',
  authorize('manager', 'generalManager'),
  async (req: Request, res: Response) => {
    const user = req.user!;
    const perfId = parseInt(req.params.perfId, 10);

    try {
      const detail = await PerformanceDAO.findDetailByPerfId(perfId);
      if (!detail) {
        return res.status(404).json({ code: 404, message: '绩效记录不存在' });
      }

      // Verify subordinate relationship (generalManager can view all)
      if (user.role !== 'generalManager') {
        const pool = (await import('../config/database')).default;
        const [empRows] = await pool.query<any[]>(
          'SELECT manager_id, name, department, position FROM user WHERE user_id = ? LIMIT 1',
          [detail.performance.user_id]
        );
        if (!empRows[0] || empRows[0].manager_id !== user.userId) {
          return res.status(403).json({ code: 403, message: '权限不足' });
        }
      }

      const pool = (await import('../config/database')).default;
      const [empRows] = await pool.query<any[]>(
        'SELECT name, department, position FROM user WHERE user_id = ? LIMIT 1',
        [detail.performance.user_id]
      );

      const { findByPerfId: findAIByPerfId } = await import('../dao/AIResultDAO');
      const aiResult = await findAIByPerfId(perfId);
      const rec = detail.performance;

      const result = {
        perfId: rec.perf_id,
        userId: rec.user_id,
        month: rec.month,
        status: rec.status,
        selfScore: rec.self_score != null ? Number(rec.self_score) : null,
        aiScore: rec.ai_score != null ? Number(rec.ai_score) : null,
        managerScore: rec.manager_score != null ? Number(rec.manager_score) : null,
        totalScore: rec.total_score != null ? Number(rec.total_score) : null,
        level: rec.level,
        rewardPunish: rec.reward_punish,
        workSummary: rec.work_summary,
        submitTime: rec.submit_time,
        reviewTime: rec.review_time,
        reviewOpinion: rec.review_opinion,
        // 员工信息
        userName: empRows[0]?.name ?? null,
        userDepartment: empRows[0]?.department ?? null,
        userPosition: empRows[0]?.position ?? null,
        performanceItems: detail.items?.map(item => ({
          itemId: item.item_id,
          itemName: item.item_name,
          itemCategory: item.item_category,
          weight: Number(item.weight),
          userContent: item.user_content,
          selfScore: item.self_score != null ? Number(item.self_score) : null,
          aiScore: item.ai_score != null ? Number(item.ai_score) : null,
          aiExplanation: item.ai_explanation,
          managerScore: item.manager_score != null ? Number(item.manager_score) : null,
          managerExplanation: item.manager_explanation,
          evidenceUrl: item.evidence_url,
        })) ?? [],
        attendance: detail.attendance ? {
          leave: Number(detail.attendance.leave_days),
          late: Number(detail.attendance.late_times),
          absent: Number(detail.attendance.absent_days),
          lackCard: Number(detail.attendance.lack_card_times),
          attendanceScore: detail.attendance.attendance_score != null ? Number(detail.attendance.attendance_score) : null,
          remark: detail.attendance.remark,
        } : null,
        aiResult: aiResult ? {
          aiTotalScore: aiResult.aiTotalScore,
          aiProblems: aiResult.aiProblems,
          aiSuggestions: aiResult.aiSuggestions,
        } : null,
      };

      return res.json({ code: 200, message: '查询成功', data: result });
    } catch (err) {
      console.error('[manager/detail]', err);
      return res.status(500).json({ code: 500, message: '服务器内部错误' });
    }
  }
);

// ─── 8.2 POST /api/performance/manager/review ────────────────────────────────
// Manager reviews a performance record: updates item scores, calculates final
// total score, level, reward/punishment, and archives the record (status → completed).
// Requirements: 4.3, 4.4, 4.5, 4.7
router.post(
  '/manager/review',
  authorize('manager', 'generalManager'),
  async (req: Request, res: Response) => {
    const user = req.user!;
    const { perfId, reviewOpinion, itemScores } = req.body;

    if (!perfId || !reviewOpinion || !Array.isArray(itemScores)) {
      return res.status(400).json({ code: 400, message: '绩效ID、审核意见和考核项评分不能为空' });
    }

    try {
      const detail = await PerformanceDAO.findDetailByPerfId(Number(perfId));
      if (!detail) {
        return res.status(404).json({ code: 404, message: '绩效记录不存在' });
      }

      // Verify the performance belongs to a subordinate of this manager
      const pool = (await import('../config/database')).default;
      const [empRows] = await pool.query<any[]>(
        'SELECT manager_id FROM user WHERE user_id = ? LIMIT 1',
        [detail.performance.user_id]
      );
      if (!empRows[0] || empRows[0].manager_id !== user.userId) {
        return res.status(403).json({ code: 403, message: '权限不足，该员工不是您的下属' });
      }

      // Only submitted/under_review records can be reviewed
      if (
        detail.performance.status !== 'submitted' &&
        detail.performance.status !== 'under_review'
      ) {
        return res.status(400).json({ code: 400, message: '当前状态不允许审核' });
      }

      // Build a map of item scores provided by manager
      const scoreMap = new Map<string, { managerScore: number; managerExplanation: string }>();
      for (const s of itemScores) {
        if (typeof s.itemName !== 'string' || typeof s.managerScore !== 'number') {
          return res.status(400).json({ code: 400, message: '考核项评分格式无效' });
        }
        scoreMap.set(s.itemName, {
          managerScore: s.managerScore,
          managerExplanation: s.managerExplanation ?? '',
        });
      }

      // Calculate manager total score: weighted average of item manager scores
      let weightedSum = 0;
      let totalWeight = 0;
      for (const item of detail.items) {
        const scored = scoreMap.get(item.item_name);
        const score = scored ? scored.managerScore : (item.ai_score ?? item.self_score ?? 0);
        weightedSum += score * item.weight;
        totalWeight += item.weight;
      }
      const managerScore = totalWeight > 0 ? weightedSum / totalWeight : 0;

      // Get attendance score
      const attendanceScore = detail.attendance?.attendance_score ?? 0;

      // Final total score = manager score (already weighted across items) + attendance contribution
      // The items already include attendance-category items; use managerScore directly as total
      const totalScore = Math.min(100, Math.max(0, parseFloat(managerScore.toFixed(2))));

      const { level, rewardPunish } = calculateLevelAndReward(totalScore);

      const reviewData: PerformanceDAO.ReviewData = {
        managerScore: parseFloat(managerScore.toFixed(2)),
        reviewOpinion,
        totalScore,
        level,
        rewardPunish,
        itemScores: detail.items.map((item) => {
          const scored = scoreMap.get(item.item_name);
          return {
            itemName: item.item_name,
            managerScore: scored ? scored.managerScore : (item.ai_score ?? item.self_score ?? 0),
            managerExplanation: scored ? scored.managerExplanation : '',
          };
        }),
      };

      await PerformanceDAO.updateReview(Number(perfId), reviewData);

      // Log the review action
      await pool.query(
        `INSERT INTO operation_log (user_id, operation_type, target_type, target_id, operation_detail)
         VALUES (?, 'review_performance', 'performance', ?, ?)`,
        [user.userId, perfId, JSON.stringify({ totalScore, level, rewardPunish })]
      );

      return res.json({
        code: 200,
        message: '审核完成',
        data: { totalScore, level, rewardPunish },
      });
    } catch (err) {
      console.error('[manager/review]', err);
      return res.status(500).json({ code: 500, message: '服务器内部错误' });
    }
  }
);

// ─── 8.3 POST /api/performance/manager/reject ────────────────────────────────
// Manager rejects a performance record, recording the reason and setting status to rejected.
// Requirements: 4.6
router.post(
  '/manager/reject',
  authorize('manager', 'generalManager'),
  async (req: Request, res: Response) => {
    const user = req.user!;
    const { perfId, reason } = req.body;

    if (!perfId || !reason) {
      return res.status(400).json({ code: 400, message: '绩效ID和驳回原因不能为空' });
    }

    try {
      const detail = await PerformanceDAO.findDetailByPerfId(Number(perfId));
      if (!detail) {
        return res.status(404).json({ code: 404, message: '绩效记录不存在' });
      }

      // Verify subordinate relationship
      const pool = (await import('../config/database')).default;
      const [empRows] = await pool.query<any[]>(
        'SELECT manager_id FROM user WHERE user_id = ? LIMIT 1',
        [detail.performance.user_id]
      );
      if (!empRows[0] || empRows[0].manager_id !== user.userId) {
        return res.status(403).json({ code: 403, message: '权限不足，该员工不是您的下属' });
      }

      if (
        detail.performance.status !== 'submitted' &&
        detail.performance.status !== 'under_review'
      ) {
        return res.status(400).json({ code: 400, message: '当前状态不允许驳回' });
      }

      // Update status to rejected and record the reason in review_opinion
      await pool.query(
        `UPDATE performance_month
         SET status = 'rejected', review_opinion = ?, review_time = NOW()
         WHERE perf_id = ?`,
        [reason, perfId]
      );

      // Log the rejection
      await pool.query(
        `INSERT INTO operation_log (user_id, operation_type, target_type, target_id, operation_detail)
         VALUES (?, 'reject_performance', 'performance', ?, ?)`,
        [user.userId, perfId, JSON.stringify({ reason })]
      );

      console.log(`[驳回] 管理层 ${user.name}(${user.userId}) 驳回绩效 ${perfId}，原因：${reason}`);

      return res.json({ code: 200, message: '驳回成功，已通知员工' });
    } catch (err) {
      console.error('[manager/reject]', err);
      return res.status(500).json({ code: 500, message: '服务器内部错误' });
    }
  }
);

// ─── 8.4 POST /api/performance/manager/approve-modification ──────────────────
// Manager approves or rejects an employee's modification request.
// Approve: unlocks the performance record (status → draft).
// Reject: notifies employee (logged).
// Requirements: 12.3, 12.4
router.post(
  '/manager/approve-modification',
  authorize('manager', 'generalManager'),
  async (req: Request, res: Response) => {
    const user = req.user!;
    const { perfId, approved, rejectReason } = req.body;

    if (!perfId || typeof approved !== 'boolean') {
      return res.status(400).json({ code: 400, message: '绩效ID和审批结果不能为空' });
    }
    if (!approved && !rejectReason) {
      return res.status(400).json({ code: 400, message: '拒绝时必须填写拒绝原因' });
    }

    try {
      const detail = await PerformanceDAO.findDetailByPerfId(Number(perfId));
      if (!detail) {
        return res.status(404).json({ code: 404, message: '绩效记录不存在' });
      }

      // Verify subordinate relationship
      const pool = (await import('../config/database')).default;
      const [empRows] = await pool.query<any[]>(
        'SELECT manager_id, name FROM user WHERE user_id = ? LIMIT 1',
        [detail.performance.user_id]
      );
      if (!empRows[0] || empRows[0].manager_id !== user.userId) {
        return res.status(403).json({ code: 403, message: '权限不足，该员工不是您的下属' });
      }

      if (approved) {
        // Unlock: reset status to draft so employee can re-edit
        await pool.query(
          `UPDATE performance_month SET status = 'draft' WHERE perf_id = ?`,
          [perfId]
        );

        await pool.query(
          `INSERT INTO operation_log (user_id, operation_type, target_type, target_id, operation_detail)
           VALUES (?, 'approve_modification', 'performance', ?, ?)`,
          [user.userId, perfId, JSON.stringify({ approved: true })]
        );

        console.log(`[修改审批] 管理层 ${user.name}(${user.userId}) 同意员工 ${empRows[0].name} 修改绩效 ${perfId}`);
        return res.json({ code: 200, message: '已同意修改申请，绩效表单已解锁' });
      } else {
        // Reject: log the rejection reason as notification to employee
        await pool.query(
          `INSERT INTO operation_log (user_id, operation_type, target_type, target_id, operation_detail)
           VALUES (?, 'reject_modification', 'performance', ?, ?)`,
          [user.userId, perfId, JSON.stringify({ approved: false, rejectReason })]
        );

        console.log(`[修改审批] 管理层 ${user.name}(${user.userId}) 拒绝员工 ${empRows[0].name} 修改绩效 ${perfId}，原因：${rejectReason}`);
        return res.json({ code: 200, message: '已拒绝修改申请，已通知员工' });
      }
    } catch (err) {
      console.error('[manager/approve-modification]', err);
      return res.status(500).json({ code: 500, message: '服务器内部错误' });
    }
  }
);

// ─── 10.3 GET /api/performance/export ────────────────────────────────────────
// Exports performance records as an Excel file.
// Query params:
//   - userId: export a single employee's history (employee self or manager/GM)
//   - month: restrict to a specific month
//   - scope: 'team' (manager's subordinates) | 'company' (GM, all employees)
// Requirements: 7.3, 7.6, 8.4
router.get(
  '/export',
  authorize('employee', 'manager', 'generalManager'),
  async (req: Request, res: Response) => {
    const user = req.user!;
    const { userId, month, scope } = req.query as Record<string, string>;

    try {
      let filter: Parameters<typeof exportPerformanceExcel>[0] = {};

      if (user.role === 'employee') {
        // Employees can only export their own data
        filter.userId = user.userId;
        if (month) filter.month = month;
      } else if (user.role === 'manager') {
        if (userId) {
          // Export a specific subordinate's history — verify relationship
          const pool = (await import('../config/database')).default;
          const [empRows] = await pool.query<any[]>(
            'SELECT manager_id FROM user WHERE user_id = ? LIMIT 1',
            [Number(userId)]
          );
          if (!empRows[0] || empRows[0].manager_id !== user.userId) {
            return res.status(403).json({ code: 403, message: '权限不足，该员工不是您的下属' });
          }
          filter.userId = Number(userId);
        } else {
          // Export entire team
          filter.managerId = user.userId;
        }
        if (month) filter.month = month;
      } else if (user.role === 'generalManager') {
        if (userId) {
          filter.userId = Number(userId);
        } else if (scope === 'company') {
          filter.allEmployees = true;
        } else {
          filter.allEmployees = true;
        }
        if (month) filter.month = month;
      }

      const buffer = await exportPerformanceExcel(filter);

      const filename = encodeURIComponent(`绩效数据_${month ?? '全部'}.xlsx`);
      res.setHeader('Content-Type', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
      res.setHeader('Content-Disposition', `attachment; filename*=UTF-8''${filename}`);
      return res.send(buffer);
    } catch (err) {
      console.error('[performance/export]', err);
      return res.status(500).json({ code: 500, message: '服务器内部错误' });
    }
  }
);

// ─── Internal helper ──────────────────────────────────────────────────────────
async function triggerAIEvaluation(perfId: number): Promise<void> {
  const { evaluatePerformance } = await import('../services/AIEvaluationService');
  await evaluatePerformance(perfId);
}

export default router;