package middleware

import (
	"encoding/json"
	"strings"

	"github.com/gogf/gf/v2/errors/gerror"
	"github.com/gogf/gf/v2/net/ghttp"

	"easygoadmin/internal/consts"
	"easygoadmin/utility/cache"
	jwtutil "easygoadmin/utility/jwt"
	"easygoadmin/utility/response"
)

// ============================== 身份认证中间件 ==============================

// JWT 身份认证中间件
//
// 处理流程：
//  1. 免登录路由直接放行
//  2. 解析 Bearer Token，校验签名、过期与签发者
//  3. 校验 Redis 黑名单，登出或刷新后的旧令牌失效
//  4. 加载角色与权限（缓存 300 秒）并注入请求上下文
func JWT(r *ghttp.Request) {
	if IsPublicPath(r.URL.Path) {
		r.Middleware.Next()
		return
	}
	token := parseBearer(r.Header.Get("Authorization"))
	if token == "" {
		token = r.Get("token").String() // 兼容个别 URL 直传场景
	}
	if token == "" {
		writeUnauthorized(r)
		return
	}
	claims, err := jwtutil.Parse(r.Context(), token)
	if err != nil {
		writeUnauthorized(r)
		return
	}
	// 黑名单（登出/轮换后的旧令牌）
	if cache.Exists(r.Context(), consts.CacheKeyTokenBlacklist(claims.ID)) {
		writeUnauthorized(r)
		return
	}

	ctx := r.Context()
	ctx = consts.WithUserID(ctx, claims.UserID)
	ctx = consts.WithTenantID(ctx, claims.TenantID)
	ctx = consts.WithUsername(ctx, claims.Username)
	ctx = consts.WithRealname(ctx, claims.Realname)
	ctx = consts.WithTokenJTI(ctx, claims.ID)
	if claims.ExpiresAt != nil {
		ctx = consts.WithTokenExpire(ctx, claims.ExpiresAt.Time)
	}

	// 身份扩展（角色/权限/数据范围）：缓存优先
	if idn := loadIdentity(r, claims.UserID); idn != nil {
		ctx = consts.WithRoles(ctx, idn.Roles)
		ctx = consts.WithPerms(ctx, idn.Perms)
		ctx = consts.WithDataScope(ctx, idn.DataScope)
		ctx = consts.WithDeptID(ctx, idn.DeptId)
	}
	r.SetCtx(ctx)
	r.Middleware.Next()
}

// loadIdentity 读取用户身份
//
// 优先读取身份缓存，未命中时回源 IdentityLoader 并写入缓存
func loadIdentity(r *ghttp.Request, userID int) *Identity {
	if userID <= 0 {
		return nil
	}
	ck := consts.CacheKeyUserIdentity(userID)
	if v, ok := cache.Get(r.Context(), ck); ok {
		idn := &Identity{}
		if err := json.Unmarshal([]byte(v), idn); err == nil {
			return idn
		}
	}
	if IdentityLoader == nil {
		return &Identity{}
	}
	idn, err := IdentityLoader(r.Context(), userID)
	if err != nil || idn == nil {
		glogWarn(r.Context(), "加载用户身份失败 userID=%d err=%v", userID, err)
		return &Identity{}
	}
	if b, err := json.Marshal(idn); err == nil {
		_ = cache.Set(r.Context(), ck, string(b), 300)
	}
	return idn
}

// parseBearer 解析 Bearer 令牌
//
// 兼容带前缀与直接传值两种形式
func parseBearer(h string) string {
	if h == "" {
		return ""
	}
	if strings.HasPrefix(h, "Bearer ") || strings.HasPrefix(h, "bearer ") {
		return strings.TrimSpace(h[7:])
	}
	return strings.TrimSpace(h)
}

// writeUnauthorized 输出未认证响应
//
// 状态码为 401，供前端识别并跳转登录页
func writeUnauthorized(r *ghttp.Request) {
	res := response.Fail(gerror.NewCode(consts.CodeUnauthorized))
	response.WriteWithCode(r, res, 401)
}