package cn.mb.cloud.gateway.filter;

import cn.mb.cloud.gateway.util.RedisUtil;
import com.alibaba.fastjson.JSON;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.cloud.client.ServiceInstance;
import org.springframework.cloud.client.discovery.DiscoveryClient;
import org.springframework.cloud.gateway.filter.GatewayFilterChain;
import org.springframework.cloud.gateway.filter.GlobalFilter;
import org.springframework.core.Ordered;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.stereotype.Component;
import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Mono;
import reactor.core.scheduler.Schedulers;

import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.URL;
import java.nio.charset.StandardCharsets;
import java.util.Date;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
import java.util.UUID;

/**
 * 所有经网关进入系统的请求统一写入审计服务。
 * 使用服务发现直连，避免审计请求再次经过网关产生递归；写入异常不会影响业务响应。
 */
@Slf4j
@Component
public class AccountAuditGlobalFilter implements GlobalFilter, Ordered {
    private static final String AUDIT_SERVICE = "mb-cloud-other";

    @Autowired private DiscoveryClient discoveryClient;
    @Autowired private RedisUtil redisUtil;

    @Override public int getOrder() { return 1000; }

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        ServerHttpRequest request = exchange.getRequest();
        String uri = request.getURI().getRawPath();
        if (uri.startsWith("/internal/audit-logs") || !shouldAudit(request.getMethodValue(), uri)) {
            return chain.filter(exchange);
        }
        long startedAt = System.currentTimeMillis();
        return chain.filter(exchange).then(Mono.<Void>fromRunnable(() -> writeAudit(exchange, startedAt))
                .subscribeOn(Schedulers.boundedElastic()));
    }

    private void writeAudit(ServerWebExchange exchange, long startedAt) {
        try {
            ServerHttpRequest request = exchange.getRequest();
            String uri = request.getURI().getRawPath();
            Map<String, Object> audit = new LinkedHashMap<String, Object>();
            audit.put("traceId", request.getHeaders().getFirst("X-Audit-Trace-Id") == null
                    ? UUID.randomUUID().toString().replace("-", "") : request.getHeaders().getFirst("X-Audit-Trace-Id"));
            audit.put("sourceService", "mb-cloud-gateway");
            audit.put("sourceType", "HTTP");
            audit.put("operationType", operationType(request.getMethodValue(), uri));
            audit.put("riskLevel", riskLevel(uri, (String) audit.get("operationType")));
            audit.put("operationName", request.getMethodValue() + " " + uri);
            audit.put("requestMethod", request.getMethodValue());
            audit.put("requestUri", uri);
            audit.put("requestParams", maskedQuery(request));
            // 审计账号用于追溯操作人，必须保留原始账号；手机号、证件号等请求参数仍按规则脱敏。
            audit.put("userAccount", username(request));
            audit.put("clientIp", clientIp(request));
            int status = exchange.getResponse().getStatusCode() == null ? 200 : exchange.getResponse().getStatusCode().value();
            audit.put("result", status < 400 ? "SUCCESS" : "FAIL");
            audit.put("errorMessage", status < 400 ? null : "HTTP " + status);
            audit.put("createdAt", new Date());
            audit.put("durationMs", System.currentTimeMillis() - startedAt);
            post(audit);
        } catch (Exception e) {
            log.warn("统一审计写入失败", e);
        }
    }

    private void post(Map<String, Object> audit) throws Exception {
        List<ServiceInstance> instances = discoveryClient.getInstances(AUDIT_SERVICE);
        if (instances == null || instances.isEmpty()) return;
        ServiceInstance instance = instances.get(0);
        URL url = new URL(instance.getUri().toString() + "/internal/audit-logs");
        HttpURLConnection connection = (HttpURLConnection) url.openConnection();
        connection.setConnectTimeout(1000);
        connection.setReadTimeout(1500);
        connection.setRequestMethod("POST");
        connection.setDoOutput(true);
        connection.setRequestProperty("Content-Type", "application/json;charset=UTF-8");
        byte[] bytes = JSON.toJSONString(audit).getBytes(StandardCharsets.UTF_8);
        try (OutputStream output = connection.getOutputStream()) { output.write(bytes); }
        connection.getResponseCode();
        connection.disconnect();
    }

    private String username(ServerHttpRequest request) {
        String authorization = request.getHeaders().getFirst("Authorization");
        if (StringUtils.isBlank(authorization)) return null;
        String token = authorization.replaceFirst("(?i)^Bearer\\s+", "").trim();
        return token.length() < 32 ? null : redisUtil.getValue(token.substring(token.length() - 32));
    }
    private String operationType(String method, String uri) {
        String lower = uri.toLowerCase();
        if (lower.contains("login") || lower.contains("token")) return "LOGIN";
        if (lower.matches(".*(status|state|ticket|payment|finance|refund|withdraw|balance).*")) return "STATUS_CHANGE";
        if (lower.matches(".*(add|create|save|insert|commit|submit|upload).*")) return "CREATE";
        if ("PUT".equalsIgnoreCase(method) || "PATCH".equalsIgnoreCase(method)) return "UPDATE";
        if ("DELETE".equalsIgnoreCase(method)) return "DELETE";
        if (lower.matches(".*(edit|update|modify|change|set|reset|freeze|unfreeze|enable|disable|audit|approve|reject).*")) return "UPDATE";
        if (lower.matches(".*(phone|mobile|idcard|identity|bank|wallet).*")) return "VIEW_SENSITIVE";
        return "READ";
    }

    /**
     * 网关只记录外部用户真正触发的业务变更、登录和敏感数据访问。
     * POST 在本系统中大量用于列表/详情查询，不能再按 HTTP 方法一概当作新增。
     */
    private boolean shouldAudit(String method, String uri) {
        String lower = uri == null ? "" : uri.toLowerCase();
        if (lower.matches(".*(login|token|phone|mobile|idcard|identity|bank|wallet).*")) return true;
        if ("PUT".equalsIgnoreCase(method) || "PATCH".equalsIgnoreCase(method)
                || "DELETE".equalsIgnoreCase(method)) return true;
        return "POST".equalsIgnoreCase(method)
                && lower.matches(".*(add|create|save|insert|edit|update|modify|delete|remove|del|"
                + "change|set|reset|freeze|unfreeze|enable|disable|commit|submit|upload|"
                + "audit|approve|reject|refund|withdraw|payment).*" );
    }
    private String riskLevel(String uri, String type) {
        String lower = uri.toLowerCase();
        if ("STATUS_CHANGE".equals(type) || lower.matches(".*(finance|payment|refund|withdraw|balance|ticket).*")) return "CRITICAL";
        return lower.matches(".*(phone|mobile|idcard|identity|bank|wallet).*") ? "SENSITIVE" : "NORMAL";
    }
    private String maskedQuery(ServerHttpRequest request) {
        Map<String, Object> values = new LinkedHashMap<String, Object>();
        request.getQueryParams().forEach((key, value) -> values.put(key,
                key.toLowerCase().matches(".*(password|token|secret|idcard|bank|phone|mobile).*") ? "***" : value));
        return JSON.toJSONString(values);
    }
    private String clientIp(ServerHttpRequest request) { String value = request.getHeaders().getFirst("X-Forwarded-For"); return StringUtils.isBlank(value) ? String.valueOf(request.getRemoteAddress()) : value.split(",")[0].trim(); }
}