package com.dsh.guns.modular.system.audit;

import com.dsh.guns.config.UserExt;
import feign.RequestInterceptor;
import feign.RequestTemplate;
import org.springframework.stereotype.Component;
import org.springframework.util.StringUtils;

import javax.annotation.Resource;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
import java.util.UUID;

/** Spring 会把该 RequestInterceptor 应用于管理端全部 Feign 客户端。 */
@Component
public class ManagementFeignAuditInterceptor implements RequestInterceptor {
    @Resource private ManagementAuditWriter auditWriter;

    @Override
    public void apply(RequestTemplate template) {
        try {
            Map<String, Object> audit = new HashMap<String, Object>();
            String url = template.url();
            if (url != null && url.startsWith("/internal/sensitive/")
                    && UserExt.getUser() != null && "admin".equalsIgnoreCase(UserExt.getUser().getAccount())) {
                template.header("X-Internal-Sensitive-Access", "true");
            }
            audit.put("traceId", UUID.randomUUID().toString().replace("-", ""));
            audit.put("sourceService", "mb-cloud-management");
            audit.put("sourceType", "FEIGN");
            audit.put("operationType", "FEIGN_CALL");
            audit.put("riskLevel", riskLevel(url));
            audit.put("operationName", template.feignTarget() == null ? "Feign调用" : template.feignTarget().name());
            audit.put("requestMethod", template.method());
            audit.put("requestUri", url);
            audit.put("requestParams", template.body() == null ? null : "bodyBytes=" + template.body().length);
            audit.put("userId", UserExt.getUser() == null ? null : UserExt.getUser().getId());
            audit.put("userAccount", UserExt.getUser() == null ? null : mask(UserExt.getUser().getAccount()));
            audit.put("result", "REQUESTED");
            audit.put("createdAt", new Date());
            auditWriter.append(audit);
        } catch (Exception ignored) {
            // 审计异常绝不能阻塞原 Feign 调用。
        }
    }

    private String riskLevel(String url) {
        String value = url == null ? "" : url.toLowerCase();
        return value.matches(".*(ticket|payment|finance|refund|withdraw|balance|status|state).*") ? "CRITICAL" : "NORMAL";
    }
    private String mask(String value) {
        if (StringUtils.isEmpty(value)) return null;
        return value.length() <= 4 ? "***" : value.substring(0, 3) + "***" + value.substring(value.length() - 2);
    }
}