package handler

import (
	"baron-sso-backend/internal/domain"
	"baron-sso-backend/internal/repository"
	"baron-sso-backend/internal/service"
	"baron-sso-backend/internal/utils"
	"context"
	"encoding/csv"
	"errors"
	"fmt"
	"log/slog"
	"net/http"
	"os"
	"regexp"
	"strconv"
	"strings"
	"time"

	"github.com/gofiber/fiber/v2"
)

// OryProviderAPI defines the subset of Ory Provider used by UserHandler
type OryProviderAPI interface {
	CreateUser(user *domain.BrokerUser, password string) (string, error)
	UpdateUserPassword(loginID, newPassword string, r *http.Request) error
	GetPasswordPolicy() (*domain.PasswordPolicy, error)
}

type UserHandler struct {
	KratosAdmin    service.KratosAdminService
	OryProvider    OryProviderAPI
	TenantService  service.TenantService
	KetoService    service.KetoService
	KetoOutboxRepo repository.KetoOutboxRepository
	UserRepo       repository.UserRepository
	UserGroupRepo  repository.UserGroupRepository
}

func NewUserHandler(kratosAdmin service.KratosAdminService, oryProvider OryProviderAPI, tenantService service.TenantService, ketoService service.KetoService, ketoOutboxRepo repository.KetoOutboxRepository, userRepo repository.UserRepository, userGroupRepo repository.UserGroupRepository) *UserHandler {
	return &UserHandler{
		KratosAdmin:    kratosAdmin,
		OryProvider:    oryProvider,
		TenantService:  tenantService,
		KetoService:    ketoService,
		KetoOutboxRepo: ketoOutboxRepo,
		UserRepo:       userRepo,
		UserGroupRepo:  userGroupRepo,
	}
}

type userSummary struct {
	ID              string          `json:"id"`
	Email           string          `json:"email"`
	Name            string          `json:"name"`
	Phone           string          `json:"phone"`
	Role            string          `json:"role"`
	Status          string          `json:"status"`
	CompanyCode     string          `json:"companyCode"`
	Metadata        domain.JSONMap  `json:"metadata,omitempty"`
	Tenant          *domain.Tenant  `json:"tenant,omitempty"`
	JoinedTenants   []domain.Tenant `json:"joinedTenants,omitempty"` // [New] 다중 소속 테넌트 목록
	Department      string          `json:"department"`
	Position        string          `json:"position"`
	JobTitle        string          `json:"jobTitle"`
	CreatedAt       string          `json:"createdAt"`
	UpdatedAt       string          `json:"updatedAt"`
	InitialPassword string          `json:"initialPassword,omitempty"`
}

type userListResponse struct {
	Items  []userSummary `json:"items"`
	Limit  int           `json:"limit"`
	Offset int           `json:"offset"`
	Total  int64         `json:"total"`
}

func (h *UserHandler) ListUsers(c *fiber.Ctx) error {
	// [New] Get requester profile from middleware
	var requesterRole string
	if profile, ok := c.Locals("user_profile").(*domain.UserProfileResponse); ok {
		requesterRole = domain.NormalizeRole(profile.Role)
	}

	limit := c.QueryInt("limit", 50)
	offset := c.QueryInt("offset", 0)
	search := strings.TrimSpace(c.Query("search"))
	tenantSlug := strings.TrimSpace(c.Query("tenantSlug"))

	if limit <= 0 {
		limit = 50
	}
	if offset < 0 {
		offset = 0
	}

	// [New] Manageable Tenants Map for efficient lookup
	manageableSlugs := make(map[string]bool)
	if requesterRole == domain.RoleTenantAdmin {
		profile, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
		if profile != nil {
			for _, t := range profile.ManageableTenants {
				manageableSlugs[strings.ToLower(t.Slug)] = true
			}
			// Include primary tenant slug if not already there
			if profile.CompanyCode != "" {
				manageableSlugs[strings.ToLower(profile.CompanyCode)] = true
			}
		}
	}

	// 1. Try Kratos First
	identities, err := h.KratosAdmin.ListIdentities(c.Context())
	if err == nil {
		filtered := make([]service.KratosIdentity, 0, len(identities))
		searchLower := strings.ToLower(search)

		for _, identity := range identities {
			email := strings.ToLower(extractTraitString(identity.Traits, "email"))
			name := strings.ToLower(extractTraitString(identity.Traits, "name"))
			compCode := strings.ToLower(extractTraitString(identity.Traits, "companyCode"))

			// Tenant Admin filtering
			if requesterRole == domain.RoleTenantAdmin {
				if !manageableSlugs[compCode] {
					continue
				}
			}

			// Dedicated tenantSlug filter
			if tenantSlug != "" && !strings.EqualFold(compCode, tenantSlug) {
				continue
			}

			// Search filtering (Keyword search in email, name, or companyCode)
			if search != "" {
				if !strings.Contains(email, searchLower) &&
					!strings.Contains(name, searchLower) &&
					!strings.Contains(strings.ToLower(compCode), searchLower) {
					continue
				}
			}
			filtered = append(filtered, identity)
		}

		total := int64(len(filtered))
		if offset > len(filtered) {
			offset = len(filtered)
		}
		end := offset + limit
		if end > len(filtered) {
			end = len(filtered)
		}

		items := make([]userSummary, 0, end-offset)
		for _, identity := range filtered[offset:end] {
			summary := h.mapIdentitySummary(c.Context(), identity)
			items = append(items, summary)
		}

		// [Lazy Sync] Asynchronously update local DB with fresh data from Kratos
		// This ensures that member counts (which use local DB) eventually match reality
		if h.UserRepo != nil {
			go func(ids []service.KratosIdentity) {
				ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
				defer cancel()
				for _, identity := range ids {
					localUser := h.mapToLocalUser(identity)
					_ = h.UserRepo.Update(ctx, localUser)
				}
			}(filtered)
		}

		return c.JSON(userListResponse{Items: items, Limit: limit, Offset: offset, Total: total})
	}

	// 2. Fallback to Local DB if Kratos is down
	slog.Warn("Kratos unavailable, falling back to local DB for user list", "error", err)

	// Fetch from UserRepo
	users, total, err := h.UserRepo.List(c.Context(), offset, limit, search, tenantSlug)
	if err != nil {
		return errorJSON(c, fiber.StatusInternalServerError, "failed to fetch users from both kratos and local db")
	}

	items := make([]userSummary, 0, len(users))
	for _, u := range users {
		items = append(items, userSummary{
			ID:          u.ID,
			Email:       u.Email,
			Name:        u.Name,
			Phone:       u.Phone,
			Role:        u.Role,
			Status:      u.Status,
			CompanyCode: u.CompanyCode,
			Department:  u.Department,
			CreatedAt:   u.CreatedAt.Format(time.RFC3339),
			UpdatedAt:   u.UpdatedAt.Format(time.RFC3339),
		})
	}

	return c.JSON(userListResponse{
		Items:  items,
		Total:  total,
		Limit:  limit,
		Offset: offset,
	})
}

func (h *UserHandler) GetUser(c *fiber.Ctx) error {
	if h.KratosAdmin == nil {
		return errorJSON(c, fiber.StatusServiceUnavailable, "identity provider not available")
	}

	userID := strings.TrimSpace(c.Params("id"))
	if userID == "" {
		return errorJSON(c, fiber.StatusBadRequest, "user id is required")
	}

	identity, err := h.KratosAdmin.GetIdentity(c.Context(), userID)
	if err != nil {
		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
	}
	if identity == nil {
		return errorJSON(c, fiber.StatusNotFound, "user not found")
	}

	// [New] Check access scope
	requester, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
	if requester != nil && requester.Role == domain.RoleTenantAdmin {
		compCode := strings.ToLower(extractTraitString(identity.Traits, "companyCode"))

		// Check if the target user's companyCode is in requester's manageable tenants
		allowed := false
		for _, t := range requester.ManageableTenants {
			if strings.ToLower(t.Slug) == compCode {
				allowed = true
				break
			}
		}
		// Also check primary company code
		if !allowed && strings.ToLower(requester.CompanyCode) == compCode {
			allowed = true
		}

		if !allowed {
			return errorJSON(c, fiber.StatusForbidden, "forbidden: access to user in another tenant denied")
		}
	}

	return c.JSON(h.mapIdentitySummary(c.Context(), *identity))
}

func (h *UserHandler) CreateUser(c *fiber.Ctx) error {
	if h.OryProvider == nil || h.KratosAdmin == nil {
		return errorJSON(c, fiber.StatusServiceUnavailable, "identity provider not available")
	}

	var req struct {
		Email       string         `json:"email"`
		Password    string         `json:"password"`
		Name        string         `json:"name"`
		Phone       string         `json:"phone"`
		Role        string         `json:"role"`
		CompanyCode string         `json:"companyCode"`
		Department  string         `json:"department"`
		Metadata    map[string]any `json:"metadata"`
	}
	if err := c.BodyParser(&req); err != nil {
		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
	}

	email := strings.TrimSpace(req.Email)
	if email == "" {
		return errorJSON(c, fiber.StatusBadRequest, "email is required")
	}
	if !strings.Contains(email, "@") || !strings.Contains(email, ".") {
		return errorJSON(c, fiber.StatusBadRequest, "invalid email format")
	}
	name := strings.TrimSpace(req.Name)
	if name == "" {
		return errorJSON(c, fiber.StatusBadRequest, "name is required")
	}

	password := strings.TrimSpace(req.Password)
	policy, err := h.OryProvider.GetPasswordPolicy()
	if err != nil || policy == nil {
		policy = &domain.PasswordPolicy{
			MinLength:         12,
			Lowercase:         true,
			Uppercase:         false,
			Number:            true,
			NonAlphanumeric:   true,
			MinCharacterTypes: 0,
		}
	}

	generatedPassword := ""
	if password == "" {
		generated, genErr := utils.GeneratePasswordWithPolicy(policy)
		if genErr != nil {
			return errorJSON(c, fiber.StatusInternalServerError, "failed to generate password")
		}
		password = generated
		generatedPassword = generated
	} else {
		if err := utils.ValidatePasswordWithPolicy(policy, password); err != nil {
			return errorJSON(c, fiber.StatusBadRequest, err.Error())
		}
	}

	role := domain.NormalizeRole(req.Role)
	if role == "" {
		role = domain.RoleUser
	}

	attributes := map[string]interface{}{
		"department":      req.Department,
		"affiliationType": "internal",
		"companyCode":     req.CompanyCode,
		"grade":           role,
	}

	// [Resolve TenantID and LoginID before Kratos creation]
	var tenantID string
	if req.CompanyCode != "" && h.TenantService != nil {
		if tenant, err := h.TenantService.GetTenantBySlug(c.Context(), req.CompanyCode); err == nil && tenant != nil {
			tenantID = tenant.ID

			// Sync custom field to LoginID if configured
			if loginIDField, ok := tenant.Config["loginIdField"].(string); ok && loginIDField != "" {
				if val, exists := req.Metadata[loginIDField]; exists {
					if loginIDStr, ok := val.(string); ok && loginIDStr != "" {
						attributes["id"] = loginIDStr
					}
				}
			}
		}
	}
	attributes["role"] = role
	if tenantID != "" {
		attributes["tenant_id"] = tenantID
	}

	// [Override with explicit LoginID if provided]
	if req.LoginID != "" {
		attributes["id"] = req.LoginID
	}

	// Merge custom metadata into attributes
	for k, v := range req.Metadata {
		// Don't overwrite core fields
		if _, exists := attributes[k]; !exists {
			attributes[k] = v
		}
	}

	brokerUser := &domain.BrokerUser{
		Email:       email,
		LoginID:     extractString(attributes, "id"),
		Name:        name,
		PhoneNumber: normalizePhoneNumber(req.Phone),
		Attributes:  attributes,
	}

	// [Validation] Based on Tenant Schema
	if req.CompanyCode != "" && h.TenantService != nil {
		tenant, err := h.TenantService.GetTenantBySlug(c.Context(), req.CompanyCode)
		if err == nil && tenant != nil {
			if schema, ok := tenant.Config["userSchema"].([]interface{}); ok {
				if err := h.validateMetadata(req.Metadata, schema, true); err != nil {
					return errorJSON(c, fiber.StatusBadRequest, "metadata validation failed: "+err.Error())
				}
			}
		}
	}

	identityID, err := h.OryProvider.CreateUser(brokerUser, password)
	if err != nil {
		if strings.Contains(err.Error(), "already exists") {
			return errorJSON(c, fiber.StatusConflict, "email already exists")
		}
		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
	}

	// Fetch the newly created identity to ensure we have all traits
	identity, err := h.KratosAdmin.GetIdentity(c.Context(), identityID)
	if err != nil {
		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
	}
	if identity == nil {
		return c.Status(fiber.StatusCreated).JSON(fiber.Map{"id": identityID, "initialPassword": generatedPassword})
	}

	// [New] Local DB Sync - Ensure user exists in read-model
	if h.UserRepo != nil {
		localUser := h.mapToLocalUser(*identity)

		// Sync to local DB (Synchronous for immediate consistency)
		if err := h.UserRepo.Update(c.Context(), localUser); err != nil {
			slog.Error("[UserHandler] Failed to sync new user to local DB", "email", localUser.Email, "error", err)
		}

		// [Keto] Sync relations via Outbox (Synchronous for accurate counting)
		if h.KetoOutboxRepo != nil {
			// 1. Role based relations
			h.syncKetoRole(c.Context(), localUser.ID, role, "", "", localUser.TenantID)

			// 2. Direct membership to the Tenant (for accurate counting)
			if localUser.TenantID != nil && *localUser.TenantID != "" {
				_ = h.KetoOutboxRepo.Create(c.Context(), &domain.KetoOutbox{
					Namespace: "Tenant",
					Object:    *localUser.TenantID,
					Relation:  "members",
					Subject:   "User:" + localUser.ID,
					Action:    domain.KetoOutboxActionCreate,
				})
			}
		}
	}

	response := h.mapIdentitySummary(c.Context(), *identity)
	if generatedPassword != "" {
		response.InitialPassword = generatedPassword
	}
	return c.Status(fiber.StatusCreated).JSON(response)
}

type bulkUserItem struct {
	Email      string         `json:"email"`
	LoginID    string         `json:"loginId"`
	Name       string         `json:"name"`
	Phone      string         `json:"phone"`
	Role       string         `json:"role"`
	TenantSlug string         `json:"tenantSlug"`
	Department string         `json:"department"`
	Metadata   map[string]any `json:"metadata"`
}

type bulkUserResult struct {
	Email   string `json:"email"`
	Success bool   `json:"success"`
	Message string `json:"message,omitempty"`
	UserID  string `json:"userId,omitempty"`
}

func (h *UserHandler) BulkCreateUsers(c *fiber.Ctx) error {
	if h.OryProvider == nil || h.KratosAdmin == nil {
		return errorJSON(c, fiber.StatusServiceUnavailable, "identity provider not available")
	}

	var req struct {
		Users []bulkUserItem `json:"users"`
	}
	if err := c.BodyParser(&req); err != nil {
		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
	}

	if len(req.Users) == 0 {
		return errorJSON(c, fiber.StatusBadRequest, "no users provided")
	}

	policy, err := h.OryProvider.GetPasswordPolicy()
	if err != nil || policy == nil {
		policy = &domain.PasswordPolicy{
			MinLength: 12, Number: true, NonAlphanumeric: true,
		}
	}

	requester, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
	results := make([]bulkUserResult, 0, len(req.Users))

	// Pre-fetch tenant data to avoid redundant DB calls
	type tenantCacheItem struct {
		ID           string
		Schema       []interface{}
		Groups       []domain.UserGroup
		LoginIDField string
	}
	tenantCache := make(map[string]tenantCacheItem)

	for _, item := range req.Users {
		email := strings.TrimSpace(item.Email)
		name := strings.TrimSpace(item.Name)
		tenantSlug := strings.TrimSpace(item.TenantSlug)
		dept := strings.TrimSpace(item.Department)

		if email == "" || name == "" {
			results = append(results, bulkUserResult{Email: email, Success: false, Message: "email and name are required"})
			continue
		}

		if tenantSlug == "" {
			results = append(results, bulkUserResult{Email: email, Success: false, Message: "tenantSlug is required"})
			continue
		}

		// Role-based access check
		if requester != nil && requester.Role == domain.RoleTenantAdmin {
			if tenantSlug != requester.CompanyCode {
				results = append(results, bulkUserResult{Email: email, Success: false, Message: "forbidden: cannot add users to another tenant"})
				continue
			}
		}

		// Verify Tenant Existence and Resolve ID (with Cache)
		var tItem tenantCacheItem
		var exists bool
		if tItem, exists = tenantCache[tenantSlug]; !exists {
			if h.TenantService != nil {
				tenant, err := h.TenantService.GetTenantBySlug(c.Context(), tenantSlug)
				if err != nil || tenant == nil {
					results = append(results, bulkUserResult{Email: email, Success: false, Message: "invalid tenantSlug: tenant not found"})
					continue
				}
				tItem.ID = tenant.ID
				if s, ok := tenant.Config["userSchema"].([]interface{}); ok {
					tItem.Schema = s
				}
				if lf, ok := tenant.Config["loginIdField"].(string); ok {
					tItem.LoginIDField = lf
				}
				// [Fix] Cache user groups for this tenant to match department
				if h.UserGroupRepo != nil {
					if groups, err := h.UserGroupRepo.ListByTenantID(c.Context(), tenant.ID); err == nil {
						tItem.Groups = groups
					}
				}

				tenantCache[tenantSlug] = tItem
			} else {
				results = append(results, bulkUserResult{Email: email, Success: false, Message: "tenant service unavailable"})
				continue
			}
		}

		// Validation based on schema
		if tItem.Schema != nil {
			if err := h.validateMetadata(item.Metadata, tItem.Schema, true); err != nil {
				results = append(results, bulkUserResult{Email: email, Success: false, Message: "validation failed: " + err.Error()})
				continue
			}
		}

		password, _ := utils.GeneratePasswordWithPolicy(policy)
		role := item.Role
		if role == "" {
			role = "user"
		}

		attributes := map[string]interface{}{
			"department":      dept,
			"affiliationType": "internal",
			"companyCode":     tenantSlug,
			"tenant_id":       tItem.ID,
			"grade":           role,
			"role":            role,
		}

		// Sync LoginID from configured custom field
		if tItem.LoginIDField != "" {
			if val, exists := item.Metadata[tItem.LoginIDField]; exists {
				if loginIDStr, ok := val.(string); ok && loginIDStr != "" {
					attributes["id"] = loginIDStr
				}
			}
		}

		// Override with explicit LoginID if provided
		if item.LoginID != "" {
			attributes["id"] = item.LoginID
		}

		// Merge metadata
		for k, v := range item.Metadata {
			if _, exists := attributes[k]; !exists {
				attributes[k] = v
			}
		}

		identityID, err := h.OryProvider.CreateUser(&domain.BrokerUser{
			Email:       email,
			LoginID:     extractTraitString(attributes, "id"),
			Name:        item.Name,
			PhoneNumber: normalizePhoneNumber(item.Phone),
			Attributes:  attributes,
		}, password)
		if err != nil {
			// 만약 이미 존재하는 사용자라면 로컬 DB 및 Keto 관계만 업데이트(Sync)를 시도
			if strings.Contains(err.Error(), "already exists") {
				identityID, err = h.KratosAdmin.FindIdentityIDByIdentifier(c.Context(), email)
				if err != nil || identityID == "" {
					results = append(results, bulkUserResult{Email: email, Success: false, Message: "이미 존재하는 사용자지만 ID를 찾을 수 없습니다."})
					continue
				}
				slog.Info("BulkCreate: User already exists, syncing local DB and Keto", "email", email, "identityID", identityID)
			} else {
				results = append(results, bulkUserResult{Email: email, Success: false, Message: err.Error()})
				continue
			}
		}

		// [CRITICAL FIX] Sync to local DB directly using current data
		// Don't fetch from Kratos here as it might have propagation lag
		if h.UserRepo != nil {
			localUser := &domain.User{
				ID:              identityID,
				Email:           email,
				LoginID:         extractTraitString(attributes, "id"),
				Name:            name,
				Phone:           normalizePhoneNumber(item.Phone),
				Role:            role,
				Status:          "active",
				CompanyCode:     tenantSlug,
				Department:      dept,
				AffiliationType: "internal",
				CreatedAt:       time.Now(),
				UpdatedAt:       time.Now(),
			}

			if tItem.ID != "" {
				localUser.TenantID = &tItem.ID
			}

			// Merge metadata
			localUser.Metadata = make(domain.JSONMap)
			for k, v := range item.Metadata {
				localUser.Metadata[k] = v
			}

			if err := h.UserRepo.Update(c.Context(), localUser); err != nil {
				slog.Error("Failed to sync bulk user to local DB", "email", email, "error", err)
			}

			if h.KetoOutboxRepo != nil {
				// 1. Sync Role based relationship
				h.syncKetoRole(c.Context(), localUser.ID, role, "", "", localUser.TenantID)

				// 2. Sync direct membership to the Tenant (for count)
				if localUser.TenantID != nil && *localUser.TenantID != "" {
					_ = h.KetoOutboxRepo.Create(c.Context(), &domain.KetoOutbox{
						Namespace: "Tenant",
						Object:    *localUser.TenantID,
						Relation:  "members",
						Subject:   "User:" + localUser.ID,
						Action:    domain.KetoOutboxActionCreate,
					})
				}

				// 3. Sync membership to UserGroup if department matches
				if dept != "" {
					for _, g := range tItem.Groups {
						if strings.EqualFold(strings.TrimSpace(g.Name), dept) {
							_ = h.KetoOutboxRepo.Create(c.Context(), &domain.KetoOutbox{
								Namespace: "Tenant",
								Object:    g.ID,
								Relation:  "members",
								Subject:   "User:" + localUser.ID,
								Action:    domain.KetoOutboxActionCreate,
							})
							break
						}
					}
				}
			}
		}

		results = append(results, bulkUserResult{Email: email, Success: true, UserID: identityID})
	}

	return c.Status(fiber.StatusOK).JSON(fiber.Map{
		"results": results,
	})
}

func (h *UserHandler) ExportUsersCSV(c *fiber.Ctx) error {
	search := strings.TrimSpace(c.Query("search"))
	companyCode := strings.TrimSpace(c.Query("companyCode"))

	var requesterRole string
	var manageableSlugs []string
	var profile *domain.UserProfileResponse

	// [New] Manual profile resolution to support query-param role mocking
	// This is needed because browsers cannot send custom headers for direct downloads
	mockRole := c.Query("x-test-role")
	appEnv := strings.ToLower(os.Getenv("APP_ENV"))
	isDev := appEnv == "dev" || appEnv == "development" || appEnv == ""

	if isDev && mockRole != "" {
		slog.Info("🔑 [AUTH] Using mock role from query for export", "role", mockRole)
		requesterRole = mockRole
		// In dev mocking, we might not have a full profile, but we need to know the manageable tenants if it's a tenant_admin
		if requesterRole == domain.RoleTenantAdmin {
			// Try to get actual profile if possible to get manageableTenants
			p, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
			if p != nil {
				profile = p
			}
		}
	} else {
		// Use real profile from middleware
		p, ok := c.Locals("user_profile").(*domain.UserProfileResponse)
		if !ok || p == nil {
			return errorJSON(c, fiber.StatusUnauthorized, "invalid session (trace:export_auth)")
		}
		profile = p
		requesterRole = profile.Role
	}

	// [New] Access Control: only admin roles can export
	if requesterRole != domain.RoleSuperAdmin && requesterRole != domain.RoleTenantAdmin {
		return errorJSON(c, fiber.StatusForbidden, "forbidden: insufficient permissions for export")
	}

	if profile != nil && requesterRole == domain.RoleTenantAdmin {
		for _, t := range profile.ManageableTenants {
			manageableSlugs = append(manageableSlugs, strings.ToLower(t.Slug))
		}
		if profile.CompanyCode != "" {
			manageableSlugs = append(manageableSlugs, strings.ToLower(profile.CompanyCode))
		}
	}

	// 1. Fetch Users using Repo for efficiency
	// repo.List expects (ctx, offset, limit, search, companyCode)
	users, _, err := h.UserRepo.List(c.Context(), 0, 10000, search, companyCode)
	if err != nil {
		return errorJSON(c, fiber.StatusInternalServerError, "failed to fetch users for export")
	}

	// 2. Filter by manageable tenants if tenant_admin
	var filtered []domain.User
	if requesterRole == domain.RoleTenantAdmin {
		slugMap := make(map[string]bool)
		for _, s := range manageableSlugs {
			slugMap[s] = true
		}
		for _, u := range users {
			if slugMap[strings.ToLower(u.CompanyCode)] {
				filtered = append(filtered, u)
			}
		}
	} else {
		filtered = users
	}

	// 3. Set CSV Headers
	c.Set("Content-Type", "text/csv; charset=utf-8")
	c.Set("Content-Disposition", "attachment; filename=users_export_"+time.Now().Format("20060102")+".csv")

	// [New] Write UTF-8 BOM for Excel compatibility
	_, _ = c.Write([]byte{0xEF, 0xBB, 0xBF})

	writer := csv.NewWriter(c)
	defer writer.Flush()

	// Header row
	header := []string{"ID", "Email", "Name", "Role", "Status", "Tenant", "Department", "Position", "JobTitle", "CreatedAt"}

	// Collect all possible metadata keys for dynamic columns
	metaKeysMap := make(map[string]bool)
	for _, u := range filtered {
		for k := range u.Metadata {
			metaKeysMap[k] = true
		}
	}
	var metaKeys []string
	for k := range metaKeysMap {
		metaKeys = append(metaKeys, k)
		header = append(header, "Meta:"+k)
	}

	if err := writer.Write(header); err != nil {
		return err
	}

	// Data rows
	for _, u := range filtered {
		row := []string{
			u.ID,
			u.Email,
			u.Name,
			u.Role,
			u.Status,
			u.CompanyCode,
			u.Department,
			u.Position,
			u.JobTitle,
			u.CreatedAt.Format(time.RFC3339),
		}
		// Append metadata values in order
		for _, k := range metaKeys {
			val := ""
			if v, ok := u.Metadata[k]; ok {
				val = fmt.Sprintf("%v", v)
			}
			row = append(row, val)
		}
		if err := writer.Write(row); err != nil {
			return err
		}
	}

	return nil
}

func (h *UserHandler) BulkUpdateUsers(c *fiber.Ctx) error {
	var req struct {
		UserIDs     []string `json:"userIds"`
		Status      *string  `json:"status"`
		Role        *string  `json:"role"`
		CompanyCode *string  `json:"companyCode"`
		Department  *string  `json:"department"`
	}
	if err := c.BodyParser(&req); err != nil {
		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
	}

	if len(req.UserIDs) == 0 {
		return errorJSON(c, fiber.StatusBadRequest, "no user IDs provided")
	}

	requester, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
	if requester == nil {
		return errorJSON(c, fiber.StatusUnauthorized, "unauthorized")
	}

	// [New] Pre-fetch tenant cache if companyCode is being changed
	type tenantCacheItem struct {
		ID     string
		Schema []interface{}
	}
	tenantCache := make(map[string]tenantCacheItem)

	manageableSlugs := make(map[string]bool)
	if requester.Role == domain.RoleTenantAdmin {
		for _, t := range requester.ManageableTenants {
			manageableSlugs[strings.ToLower(t.Slug)] = true
		}
		if requester.CompanyCode != "" {
			manageableSlugs[strings.ToLower(requester.CompanyCode)] = true
		}
	}

	results := make([]map[string]any, 0, len(req.UserIDs))

	for _, id := range req.UserIDs {
		identity, err := h.KratosAdmin.GetIdentity(c.Context(), id)
		if err != nil {
			results = append(results, map[string]any{"id": id, "success": false, "message": "user not found"})
			continue
		}

		// Authorization check
		userComp := strings.ToLower(extractTraitString(identity.Traits, "companyCode"))
		if requester.Role == domain.RoleTenantAdmin {
			if !manageableSlugs[userComp] {
				results = append(results, map[string]any{"id": id, "success": false, "message": "forbidden: user belongs to another tenant"})
				continue
			}
			// If changing companyCode, must be to a manageable one
			if req.CompanyCode != nil {
				if !manageableSlugs[strings.ToLower(*req.CompanyCode)] {
					results = append(results, map[string]any{"id": id, "success": false, "message": "forbidden: target tenant not manageable"})
					continue
				}
			}
		}

		// Prepare updates
		traits := identity.Traits
		if req.Role != nil {
			traits["role"] = *req.Role
		}
		if req.CompanyCode != nil {
			traits["companyCode"] = *req.CompanyCode

			// Resolve and update tenant_id in traits if changed
			if tItem, exists := tenantCache[*req.CompanyCode]; exists {
				traits["tenant_id"] = tItem.ID
			} else if h.TenantService != nil {
				tenant, err := h.TenantService.GetTenantBySlug(c.Context(), *req.CompanyCode)
				if err == nil && tenant != nil {
					tItem.ID = tenant.ID
					tenantCache[*req.CompanyCode] = tItem
					traits["tenant_id"] = tenant.ID
				}
			}
		}
		if req.Department != nil {
			traits["department"] = *req.Department
		}

		state := identity.State
		if req.Status != nil {
			if *req.Status == "active" {
				state = "active"
			} else {
				state = "inactive"
			}
		}

		_, err = h.KratosAdmin.UpdateIdentity(c.Context(), id, traits, state)
		if err != nil {
			results = append(results, map[string]any{"id": id, "success": false, "message": err.Error()})
			continue
		}

		// Sync to local DB
		if h.UserRepo != nil {
			localUser := h.mapToLocalUser(*identity)
			oldRole := extractTraitString(identity.Traits, "grade")
			oldTenantID := extractTraitString(identity.Traits, "tenant_id")

			if req.Role != nil {
				localUser.Role = *req.Role
			}
			if req.Status != nil {
				localUser.Status = *req.Status
			}
			if req.CompanyCode != nil {
				localUser.CompanyCode = *req.CompanyCode
			}
			if req.Department != nil {
				localUser.Department = *req.Department
			}

			// Resolve TenantID if changing companyCode
			if req.CompanyCode != nil && h.TenantService != nil {
				if tenant, err := h.TenantService.GetTenantBySlug(c.Context(), *req.CompanyCode); err == nil && tenant != nil {
					localUser.TenantID = &tenant.ID
				}
			}

			_ = h.UserRepo.Update(c.Context(), localUser)

			// [Keto Sync]
			if h.KetoOutboxRepo != nil {
				h.syncKetoRole(c.Context(), localUser.ID,
					localUser.Role, oldRole, oldTenantID, localUser.TenantID)
			}
		}

		results = append(results, map[string]any{"id": id, "success": true})
	}

	return c.JSON(fiber.Map{"results": results})
}

func (h *UserHandler) BulkDeleteUsers(c *fiber.Ctx) error {
	var req struct {
		UserIDs []string `json:"userIds"`
	}
	if err := c.BodyParser(&req); err != nil {
		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
	}

	if len(req.UserIDs) == 0 {
		return errorJSON(c, fiber.StatusBadRequest, "no user IDs provided")
	}

	requester, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
	if requester == nil {
		return errorJSON(c, fiber.StatusUnauthorized, "unauthorized")
	}

	manageableSlugs := make(map[string]bool)
	if requester.Role == domain.RoleTenantAdmin {
		for _, t := range requester.ManageableTenants {
			manageableSlugs[strings.ToLower(t.Slug)] = true
		}
		if requester.CompanyCode != "" {
			manageableSlugs[strings.ToLower(requester.CompanyCode)] = true
		}
	}

	results := make([]map[string]any, 0, len(req.UserIDs))

	for _, id := range req.UserIDs {
		identity, err := h.KratosAdmin.GetIdentity(c.Context(), id)
		if err != nil {
			results = append(results, map[string]any{"id": id, "success": false, "message": "user not found"})
			continue
		}

		// Authorization check
		if requester.Role == domain.RoleTenantAdmin {
			userComp := strings.ToLower(extractTraitString(identity.Traits, "companyCode"))
			if !manageableSlugs[userComp] {
				results = append(results, map[string]any{"id": id, "success": false, "message": "forbidden"})
				continue
			}
		}

		err = h.KratosAdmin.DeleteIdentity(c.Context(), id)
		if err != nil {
			results = append(results, map[string]any{"id": id, "success": false, "message": err.Error()})
			continue
		}

		// Local DB Sync
		if h.UserRepo != nil {
			_ = h.UserRepo.Delete(c.Context(), id)
		}

		results = append(results, map[string]any{"id": id, "success": true})
	}

	return c.JSON(fiber.Map{"results": results})
}

func (h *UserHandler) UpdateUser(c *fiber.Ctx) error {
	if h.KratosAdmin == nil {
		return errorJSON(c, fiber.StatusServiceUnavailable, "identity provider not available")
	}

	userID := strings.TrimSpace(c.Params("id"))
	if userID == "" {
		return errorJSON(c, fiber.StatusBadRequest, "user id is required")
	}

	identity, err := h.KratosAdmin.GetIdentity(c.Context(), userID)
	if err != nil {
		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
	}
	if identity == nil {
		return errorJSON(c, fiber.StatusNotFound, "user not found")
	}

	// Capture current local state for transition comparison
	var oldRole string
	var oldTenantID string
	if h.UserRepo != nil {
		if local, err := h.UserRepo.FindByID(c.Context(), userID); err == nil && local != nil {
			oldRole = local.Role
			if local.TenantID != nil {
				oldTenantID = *local.TenantID
			}
		}
	}

	// [New] Check access scope
	requester, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
	if requester != nil && domain.NormalizeRole(requester.Role) == domain.RoleTenantAdmin {
		compCode := extractTraitString(identity.Traits, "companyCode")
		if requester.CompanyCode == "" || compCode != requester.CompanyCode {
			return errorJSON(c, fiber.StatusForbidden, "forbidden: cannot update user in another tenant")
		}
	}

	var req struct {
		LoginID     *string        `json:"loginId"`
		Password    *string        `json:"password"`
		Name        *string        `json:"name"`
		Phone       *string        `json:"phone"`
		Role        *string        `json:"role"`
		Status      *string        `json:"status"`
		CompanyCode *string        `json:"companyCode"`
		Department  *string        `json:"department"`
		Metadata    map[string]any `json:"metadata"`
	}
	if err := c.BodyParser(&req); err != nil {
		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
	}

	// [New] Tenant Admin restriction: Cannot change companyCode
	if requester != nil && domain.NormalizeRole(requester.Role) == domain.RoleTenantAdmin {
		if req.CompanyCode != nil && *req.CompanyCode != requester.CompanyCode {
			return errorJSON(c, fiber.StatusForbidden, "forbidden: tenant admins cannot change user's tenant")
		}
	}

	// [Validation] Based on Tenant Schema (Multi-tenant aware)
	isAdmin := requester != nil && (requester.Role == domain.RoleSuperAdmin || requester.Role == domain.RoleTenantAdmin)

	// If metadata is namespaced (key is tenant ID), validate each namespace
	// If it's flat, validate using schemaCompCode
	for key, val := range req.Metadata {
		// Basic check if key looks like a UUID (tenant ID)
		if len(key) >= 32 {
			// Namespaced metadata
			if h.TenantService != nil {
				tenant, err := h.TenantService.GetTenant(c.Context(), key)
				if err == nil && tenant != nil {
					if schema, ok := tenant.Config["userSchema"].([]interface{}); ok {
						if subMeta, ok := val.(map[string]any); ok {
							if err := h.validateMetadataWithAuth(subMeta, schema, isAdmin, false); err != nil {
								return errorJSON(c, fiber.StatusBadRequest, "metadata validation failed for tenant "+tenant.Name+": "+err.Error())
							}
						}
					}
				}
			}
		} else {
			// Legacy/Flat metadata - validate using primary tenant schema
			schemaCompCode := extractTraitString(identity.Traits, "companyCode")
			if req.CompanyCode != nil {
				schemaCompCode = *req.CompanyCode
			}
			if schemaCompCode != "" && h.TenantService != nil {
				tenant, err := h.TenantService.GetTenantBySlug(c.Context(), schemaCompCode)
				if err == nil && tenant != nil {
					if schema, ok := tenant.Config["userSchema"].([]interface{}); ok {
						// For flat metadata, we validate the whole req.Metadata against this schema
						if err := h.validateMetadataWithAuth(req.Metadata, schema, isAdmin, false); err != nil {
							return errorJSON(c, fiber.StatusBadRequest, "metadata validation failed: "+err.Error())
						}
					}
				}
			}
			break // Only need to check flat metadata once
		}
	}

	traits := identity.Traits
	if traits == nil {
		traits = map[string]interface{}{}
	}
	if req.Name != nil {
		traits["name"] = strings.TrimSpace(*req.Name)
	}
	if req.Phone != nil {
		phone := normalizePhoneNumber(strings.TrimSpace(*req.Phone))
		if phone == "" {
			delete(traits, "phone_number")
		} else {
			traits["phone_number"] = phone
		}
	}
	if req.CompanyCode != nil {
		code := strings.TrimSpace(*req.CompanyCode)
		traits["companyCode"] = code
		// Resolve TenantID for Kratos Trait
		if h.TenantService != nil && code != "" {
			if tenant, err := h.TenantService.GetTenantBySlug(c.Context(), code); err == nil && tenant != nil {
				traits["tenant_id"] = tenant.ID
			}
		}
	}
	if req.Department != nil {
		traits["department"] = strings.TrimSpace(*req.Department)
	}
	if req.Role != nil {
		role := domain.NormalizeRole(*req.Role)
		if role == "" {
			role = domain.RoleUser
		}
		traits["grade"] = role
		traits["role"] = role
	}

	// [LoginID Sync based on Tenant Settings]
	schemaCompCode := extractTraitString(traits, "companyCode")
	if req.CompanyCode != nil {
		schemaCompCode = *req.CompanyCode
	}
	if schemaCompCode != "" && h.TenantService != nil {
		if tenant, err := h.TenantService.GetTenantBySlug(c.Context(), schemaCompCode); err == nil && tenant != nil {
			if loginIDField, ok := tenant.Config["loginIdField"].(string); ok && loginIDField != "" {
				// Search in Metadata (could be flat or namespaced)
				if val, exists := req.Metadata[loginIDField]; exists {
					if loginIDStr, ok := val.(string); ok && loginIDStr != "" {
						traits["id"] = loginIDStr
					}
				} else if namespaced, exists := req.Metadata[tenant.ID]; exists {
					if subMeta, ok := namespaced.(map[string]any); ok {
						if val, exists := subMeta[loginIDField]; exists {
							if loginIDStr, ok := val.(string); ok && loginIDStr != "" {
								traits["id"] = loginIDStr
							}
						}
					}
				}
			}
		}
	}

	// [Override with explicit LoginID if provided]
	if req.LoginID != nil && *req.LoginID != "" {
		traits["id"] = *req.LoginID
	}

	// [Namespaced Metadata Sync]
	coreTraits := map[string]bool{
		"email": true, "name": true, "phone_number": true,
		"grade": true, "companyCode": true, "department": true,
		"affiliationType": true, "role": true, "tenant_id": true,
		"id": true,
	}

	// For namespaced metadata, we don't delete everything, we merge.
	// But we should remove legacy flat traits that are not in the new req.Metadata if we want strict sync.
	// For now, let's just merge.
	for k, v := range req.Metadata {
		if !coreTraits[k] {
			traits[k] = v
		}
	}

	state := normalizeKratosState(req.Status)
	updated, err := h.KratosAdmin.UpdateIdentity(c.Context(), userID, traits, state)
	if err != nil {
		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
	}

	// [New] Local DB Sync - Sync synchronously to ensure immediate consistency for the caller
	if h.UserRepo != nil {
		updatedLocalUser := h.mapToLocalUser(*updated)

		ctx := context.Background() // Use request context if appropriate, but sync must finish
		if err := h.UserRepo.Update(ctx, updatedLocalUser); err != nil {
			slog.Error("[UserHandler] Failed to sync updated user to local DB", "userID", updatedLocalUser.ID, "error", err)
		}

		// [Keto Sync] asynchronously as it's less critical for immediate UI count
		go h.syncKetoRole(context.Background(), updatedLocalUser.ID,
			extractTraitString(updated.Traits, "grade"), oldRole, oldTenantID, updatedLocalUser.TenantID)
	}

	if req.Password != nil && *req.Password != "" {
		if err := h.KratosAdmin.UpdateIdentityPassword(c.Context(), userID, *req.Password); err != nil {
			return errorJSON(c, fiber.StatusInternalServerError, err.Error())
		}
	}

	return c.JSON(h.mapIdentitySummary(c.Context(), *updated))
}

func (h *UserHandler) DeleteUser(c *fiber.Ctx) error {
	if h.KratosAdmin == nil {
		return errorJSON(c, fiber.StatusServiceUnavailable, "identity provider not available")
	}

	userID := strings.TrimSpace(c.Params("id"))
	if userID == "" {
		return errorJSON(c, fiber.StatusBadRequest, "user id is required")
	}

	// [New] Check access scope before deletion
	requester, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
	if requester != nil && domain.NormalizeRole(requester.Role) == domain.RoleTenantAdmin {
		identity, err := h.KratosAdmin.GetIdentity(c.Context(), userID)
		if err == nil && identity != nil {
			compCode := extractTraitString(identity.Traits, "companyCode")
			if requester.CompanyCode == "" || compCode != requester.CompanyCode {
				return errorJSON(c, fiber.StatusForbidden, "forbidden: cannot delete user in another tenant")
			}
		}
	}

	if err := h.KratosAdmin.DeleteIdentity(c.Context(), userID); err != nil {
		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
	}

	// [Keto] Cleanup relations via Outbox
	if h.KetoOutboxRepo != nil {
		ctx := context.Background()
		_ = h.KetoOutboxRepo.Create(ctx, &domain.KetoOutbox{
			Namespace: "System",
			Object:    "global",
			Relation:  "super_admins",
			Subject:   "User:" + userID,
			Action:    domain.KetoOutboxActionDelete,
		})
		// Additional cleanup for tenants could be added here if we keep track of user's current tenants
	}

	return c.SendStatus(fiber.StatusNoContent)
}

func (h *UserHandler) mapIdentitySummary(ctx context.Context, identity service.KratosIdentity) userSummary {
	traits := identity.Traits
	role := extractTraitString(traits, "grade")
	if role == "" {
		role = extractTraitString(traits, "role")
	}
	role = domain.NormalizeRole(role)
	if role == "" {
		role = domain.RoleUser
	}

	compCode := extractTraitString(traits, "companyCode")
	slog.Debug("Mapping identity", "email", extractTraitString(traits, "email"), "compCode", compCode)
	summary := userSummary{
		ID:          identity.ID,
		Email:       extractTraitString(traits, "email"),
		Name:        extractTraitString(traits, "name"),
		Phone:       extractTraitString(traits, "phone_number"),
		Role:        role,
		Status:      normalizeStatus(identity.State),
		CompanyCode: compCode,
		Department:  extractTraitString(traits, "department"),
		Metadata:    make(domain.JSONMap),
		CreatedAt:   formatTime(identity.CreatedAt),
		UpdatedAt:   formatTime(identity.UpdatedAt),
	}

	// [New] Fetch all manageable tenants (for Multi-tenancy support)
	if h.TenantService != nil {
		if joined, err := h.TenantService.ListManageableTenants(ctx, identity.ID); err == nil {
			summary.JoinedTenants = joined
		}
	}

	// [Namespaced Metadata] Handling
	// We assume core traits are at the top level.
	// For other keys, if they are UUIDs (tenant IDs), we treat them as namespaced metadata.
	// Otherwise, we put them in a "legacy" or "flat" bucket if needed, but for now let's keep them in summary.Metadata
	coreTraits := map[string]bool{
		"email": true, "name": true, "phone_number": true,
		"grade": true, "companyCode": true, "department": true,
		"affiliationType": true, "role": true, "tenant_id": true,
	}

	for k, v := range traits {
		if coreTraits[k] {
			continue
		}
		// If the key is a tenant ID (uuid-like), it's namespaced metadata
		// If not, it's flat metadata (for backward compatibility)
		summary.Metadata[k] = v
	}

	if compCode != "" && h.TenantService != nil {
		if tenant, err := h.TenantService.GetTenantBySlug(ctx, compCode); err == nil && tenant != nil {
			summary.Tenant = tenant
		}
	}

	return summary
}

func (h *UserHandler) normalizePhoneNumber(phone string) string {
	return normalizePhoneNumber(phone)
}

func (h *UserHandler) mapToLocalUser(identity service.KratosIdentity) *domain.User {
	traits := identity.Traits
	role := extractTraitString(traits, "grade")
	if role == "" {
		role = extractTraitString(traits, "role")
	}
	role = domain.NormalizeRole(role)
	if role == "" {
		role = domain.RoleUser
	}
	compCode := extractTraitString(traits, "companyCode")
	if compCode == "" {
		compCode = extractTraitString(traits, "company_code")
	}

	user := &domain.User{
		ID:              identity.ID,
		Email:           extractTraitString(traits, "email"),
		LoginID:         extractTraitString(traits, "id"),
		Name:            extractTraitString(traits, "name"),
		Phone:           extractTraitString(traits, "phone_number"),
		Role:            role,
		Status:          normalizeStatus(identity.State),
		CompanyCode:     compCode,
		Department:      extractTraitString(traits, "department"),
		AffiliationType: extractTraitString(traits, "affiliationType"),
		CreatedAt:       identity.CreatedAt,
		UpdatedAt:       identity.UpdatedAt,
	}

	// 1. Try to get tenant_id directly from Kratos traits first (Fastest & most reliable)
	tID := extractTraitString(traits, "tenant_id")
	if tID != "" {
		user.TenantID = &tID
	}

	// 2. Fallback to slug lookup only if tenant_id trait is missing
	if (user.TenantID == nil || *user.TenantID == "") && compCode != "" && h.TenantService != nil {
		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
		defer cancel()
		if tenant, err := h.TenantService.GetTenantBySlug(ctx, compCode); err == nil && tenant != nil {
			user.TenantID = &tenant.ID
		}
	}

	// Metadata handling (exclude core fields)
	user.Metadata = make(domain.JSONMap)
	coreTraits := map[string]bool{
		"email": true, "name": true, "phone_number": true,
		"grade": true, "companyCode": true, "department": true,
		"affiliationType": true, "role": true, "tenant_id": true, "company_code": true,
	}
	for k, v := range traits {
		if !coreTraits[k] {
			user.Metadata[k] = v
		}
	}

	return user
}

func (h *UserHandler) syncKetoRole(ctx context.Context, userID, newRole, oldRole, oldTenantID string, newTenantID *string) {
	newRole = domain.NormalizeRole(newRole)
	oldRole = domain.NormalizeRole(oldRole)

	if h.KetoOutboxRepo == nil {
		return
	}

	// 1. Handle Role Changes
	// Remove old roles
	if oldRole == domain.RoleSuperAdmin {
		_ = h.KetoOutboxRepo.Create(ctx, &domain.KetoOutbox{
			Namespace: "System",
			Object:    "global",
			Relation:  "super_admins",
			Subject:   "User:" + userID,
			Action:    domain.KetoOutboxActionDelete,
		})
	} else if oldRole == domain.RoleTenantAdmin && oldTenantID != "" {
		_ = h.KetoOutboxRepo.Create(ctx, &domain.KetoOutbox{
			Namespace: "Tenant",
			Object:    oldTenantID,
			Relation:  "admins",
			Subject:   "User:" + userID,
			Action:    domain.KetoOutboxActionDelete,
		})
	}

	// Add new roles
	if newRole == domain.RoleSuperAdmin {
		_ = h.KetoOutboxRepo.Create(ctx, &domain.KetoOutbox{
			Namespace: "System",
			Object:    "global",
			Relation:  "super_admins",
			Subject:   "User:" + userID,
			Action:    domain.KetoOutboxActionCreate,
		})
	} else if newRole == domain.RoleTenantAdmin && newTenantID != nil {
		_ = h.KetoOutboxRepo.Create(ctx, &domain.KetoOutbox{
			Namespace: "Tenant",
			Object:    *newTenantID,
			Relation:  "admins",
			Subject:   "User:" + userID,
			Action:    domain.KetoOutboxActionCreate,
		})
	}

	// 2. Handle Tenant Membership (for count)
	newTID := ""
	if newTenantID != nil {
		newTID = *newTenantID
	}

	if oldTenantID != newTID {
		// Remove from old tenant
		if oldTenantID != "" {
			_ = h.KetoOutboxRepo.Create(ctx, &domain.KetoOutbox{
				Namespace: "Tenant",
				Object:    oldTenantID,
				Relation:  "members",
				Subject:   "User:" + userID,
				Action:    domain.KetoOutboxActionDelete,
			})
		}
		// Add to new tenant
		if newTID != "" {
			_ = h.KetoOutboxRepo.Create(ctx, &domain.KetoOutbox{
				Namespace: "Tenant",
				Object:    newTID,
				Relation:  "members",
				Subject:   "User:" + userID,
				Action:    domain.KetoOutboxActionCreate,
			})
		}
	}
}

func extractTraitString(traits map[string]interface{}, key string) string {
	if traits == nil {
		return ""
	}
	if raw, ok := traits[key]; ok {
		if value, ok := raw.(string); ok {
			return value
		}
	}
	return ""
}

func formatTime(value time.Time) string {
	if value.IsZero() {
		return ""
	}
	return value.Format(time.RFC3339)
}

func normalizeStatus(state string) string {
	state = strings.ToLower(strings.TrimSpace(state))
	if state == "inactive" || state == "blocked" || state == "active" {
		return state
	}
	if state == "" {
		return "active"
	}
	return state
}

func normalizeKratosState(status *string) string {
	if status == nil {
		return ""
	}
	value := strings.ToLower(strings.TrimSpace(*status))
	if value == "blocked" {
		return "inactive"
	}
	if value == "active" || value == "inactive" {
		return value
	}
	return ""
}

func normalizePhoneNumber(phone string) string {
	normalized := strings.ReplaceAll(phone, "-", "")
	normalized = strings.ReplaceAll(normalized, " ", "")
	if normalized == "" {
		return ""
	}
	if strings.HasPrefix(normalized, "010") {
		return "+82" + normalized[1:]
	}
	if strings.HasPrefix(normalized, "82") {
		return "+" + normalized
	}
	return normalized
}

func (h *UserHandler) validateMetadata(metadata map[string]any, schema []interface{}, checkRequired bool) error {
	return h.validateMetadataWithAuth(metadata, schema, true, checkRequired)
}

func (h *UserHandler) validateMetadataWithAuth(metadata map[string]any, schema []interface{}, isAdmin bool, checkRequired bool) error {
	schemaMap := make(map[string]map[string]interface{})
	for _, s := range schema {
		if m, ok := s.(map[string]interface{}); ok {
			if key, ok := m["key"].(string); ok {
				schemaMap[key] = m
			}
		}
	}

	// 1. Check required fields
	if checkRequired {
		for key, config := range schemaMap {
			required, _ := config["required"].(bool)
			val, exists := metadata[key]
			if required && (!exists || val == nil || val == "") {
				return errors.New("field " + key + " is required")
			}
		}
	}

	// 2. Check each field in metadata
	for key, val := range metadata {
		config, exists := schemaMap[key]
		if !exists {
			continue // Ignore fields not in schema or allow? Let's allow for now
		}

		// Admin Only check
		adminOnly, _ := config["adminOnly"].(bool)
		if adminOnly && !isAdmin {
			return errors.New("field " + key + " is admin only")
		}

		// Type validation
		if expectedType, ok := config["type"].(string); ok && expectedType != "" && val != nil && val != "" {
			switch expectedType {
			case "number":
				var numVal float64
				switch v := val.(type) {
				case float64:
					numVal = v
				case int:
					numVal = float64(v)
				case string:
					parsed, err := strconv.ParseFloat(v, 64)
					if err != nil {
						return errors.New("field " + key + " must be a number")
					}
					numVal = parsed
				default:
					return errors.New("field " + key + " must be a number")
				}
				if float64(int(numVal)) != numVal {
					return errors.New("field " + key + " must be an integer")
				}
				if unsigned, ok := config["unsigned"].(bool); ok && unsigned && numVal < 0 {
					return errors.New("field " + key + " must be an unsigned integer")
				}
			case "float":
				var numVal float64
				switch v := val.(type) {
				case float64:
					numVal = v
				case int:
					numVal = float64(v)
				case string:
					parsed, err := strconv.ParseFloat(v, 64)
					if err != nil {
						return errors.New("field " + key + " must be a float")
					}
					numVal = parsed
				default:
					return errors.New("field " + key + " must be a float")
				}
				if unsigned, ok := config["unsigned"].(bool); ok && unsigned && numVal < 0 {
					return errors.New("field " + key + " must be an unsigned float")
				}
			case "boolean":
				switch v := val.(type) {
				case bool:
					// ok
				case string:
					if v != "true" && v != "false" {
						return errors.New("field " + key + " must be a boolean")
					}
				default:
					return errors.New("field " + key + " must be a boolean")
				}
			case "date":
				if strVal, ok := val.(string); ok {
					if _, err := time.Parse("2006-01-02", strVal); err != nil {
						return errors.New("field " + key + " must be a valid date (YYYY-MM-DD)")
					}
				} else {
					return errors.New("field " + key + " must be a date string")
				}
			case "datetime":
				if strVal, ok := val.(string); ok {
					_, err1 := time.Parse(time.RFC3339, strVal)
					_, err2 := time.Parse("2006-01-02T15:04", strVal)
					_, err3 := time.Parse("2006-01-02T15:04:05", strVal)
					if err1 != nil && err2 != nil && err3 != nil {
						return errors.New("field " + key + " must be a valid datetime")
					}
				} else {
					return errors.New("field " + key + " must be a datetime string")
				}
			case "text":
				if _, ok := val.(string); !ok {
					return errors.New("field " + key + " must be a string")
				}
			}
		}

		// Regex validation
		if regexStr, ok := config["validation"].(string); ok && regexStr != "" {
			strVal := ""
			switch v := val.(type) {
			case string:
				strVal = v
			case float64:
				strVal = fmt.Sprintf("%v", v)
			case int:
				strVal = fmt.Sprintf("%v", v)
			}

			if strVal != "" {
				matched, err := regexp.MatchString(regexStr, strVal)
				if err != nil {
					return errors.New("invalid regex pattern for field " + key)
				}
				if !matched {
					return errors.New("field " + key + " does not match validation pattern")
				}
			}
		}
	}

	return nil
}