package cn.mb.cloud.auth.controller;

import cn.mb.cloud.auth.service.IUserDetailsService;
import cn.mb.cloud.auth.feignclient.AccountAuditClient;
import cn.mb.cloud.auth.warpper.GetTokenRequest;
import cn.mb.cloud.auth.warpper.RefreshTokenRequest;
import cn.mb.cloud.auth.warpper.TokenResponse;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.*;

import javax.annotation.Resource;
import javax.servlet.http.HttpServletRequest;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;

@RestController
@RequestMapping("/oauth")
public class UserController {

    @Autowired
    private IUserDetailsService userDetailsService;

    @Resource
    private AccountAuditClient accountAuditClient;


    /**
     * 获取认证token
     * @param request
     */
    @ResponseBody
    @PostMapping("/getToken")
    public TokenResponse getToken(@RequestBody GetTokenRequest request, HttpServletRequest httpRequest){
        TokenResponse response = null;
        String error = null;
        try {
            response = userDetailsService.getToken(request);
            return response;
        }catch (Exception e){
            e.printStackTrace();
            error = e.getMessage();
        } finally {
            appendLoginAudit(request, httpRequest, response != null && response.getToken() != null, error);
        }
        return null;
    }

    private void appendLoginAudit(GetTokenRequest request, HttpServletRequest httpRequest, boolean success, String error) {
        try {
            Map<String, Object> audit = new HashMap<String, Object>();
            audit.put("sourceService", "mb-cloud-auth");
            audit.put("sourceType", "LOGIN");
            audit.put("operationType", "LOGIN");
            audit.put("riskLevel", "NORMAL");
            audit.put("operationName", "账号登录");
            audit.put("requestMethod", "POST");
            audit.put("requestUri", "/oauth/getToken");
            audit.put("requestParams", "username=" + (request == null ? null : request.getUsername()));
            // 登录账号是审计追溯字段，不做掩码；密码、token 等敏感字段仍然脱敏。
            audit.put("userAccount", request == null ? null : request.getUsername());
            audit.put("result", success ? "SUCCESS" : "FAIL");
            audit.put("errorMessage", error == null ? null : error.replaceAll("(?i)(password|token)\\s*[:=]\\s*[^,\\s&}]+", "$1=***"));
            audit.put("clientIp", clientIp(httpRequest));
            audit.put("createdAt", new Date());
            accountAuditClient.append(audit);
        } catch (Exception ignored) {
            // 审计链路不可用时绝不能影响认证主流程；客户端会输出 Feign 异常用于告警。
        }
    }

    private String clientIp(HttpServletRequest request) {
        if (request == null) return null;
        String forwarded = request.getHeader("X-Forwarded-For");
        return forwarded == null || forwarded.trim().isEmpty() ? request.getRemoteAddr() : forwarded.split(",")[0].trim();
    }

    /**
     * 刷新token
     * @param request
     * @return
     */
    @ResponseBody
    @PostMapping("/refreshToken")
    public TokenResponse refreshToken(@RequestBody RefreshTokenRequest request){
        try {
            return userDetailsService.refreshToken(request);
        }catch (Exception e){
            e.printStackTrace();
        }
        return null;
    }
}