package com.dsh.guns.modular.system.controller.system;

import com.dsh.course.feignClient.account.AppUserClient;
import com.dsh.guns.config.UserExt;
import com.dsh.guns.core.common.exception.BizExceptionEnum;
import com.dsh.guns.core.exception.GunsException;
import com.dsh.guns.modular.system.audit.ManagementAuditWriter;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
import com.dsh.guns.modular.system.model.User;
import com.dsh.guns.modular.system.service.IUserService;

import javax.annotation.Resource;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
import java.util.UUID;

/** Deliberately narrow, auditable unmasking capability for the admin account. */
@RestController
@RequestMapping("/system/sensitive")
public class SensitiveDataController {
    @Resource private AppUserClient appUserClient;
    @Resource private ManagementAuditWriter auditWriter;
    @Resource private IUserService userService;

    @GetMapping("/app-user/{id}")
    public Map<String, Object> appUser(@PathVariable Integer id) {
        assertAdmin();
        Map<String, Object> result = appUserClient.sensitiveAppUser(id);
        writeAudit("app-user", id, result == null ? "NOT_FOUND" : "SUCCESS");
        return result;
    }

    @GetMapping("/employee/{id}")
    public Map<String, Object> employee(@PathVariable Integer id) {
        assertAdmin();
        User employee = userService.getById(id);
        Map<String, Object> result = null;
        if (employee != null) {
            result = new HashMap<String, Object>();
            result.put("id", employee.getId());
            result.put("name", employee.getName());
            result.put("phone", employee.getPhone());
            result.put("idCard", employee.getIdCard());
        }
        writeAudit("employee", id, result == null ? "NOT_FOUND" : "SUCCESS");
        return result;
    }

    private void assertAdmin() {
        if (UserExt.getUser() == null || !"admin".equalsIgnoreCase(UserExt.getUser().getAccount())) {
            throw new GunsException(BizExceptionEnum.NO_PERMITION);
        }
    }

    private void writeAudit(String resource, Integer targetUserId, String result) {
        Map<String, Object> audit = new HashMap<String, Object>();
        audit.put("traceId", UUID.randomUUID().toString().replace("-", ""));
        audit.put("sourceService", "mb-cloud-management");
        audit.put("sourceType", "HTTP");
        audit.put("operationType", "VIEW_SENSITIVE");
        audit.put("riskLevel", "SENSITIVE");
        audit.put("operationName", "超级管理员查看敏感信息");
        audit.put("requestMethod", "GET");
        audit.put("requestUri", "/system/sensitive/" + resource + "/" + targetUserId);
        audit.put("requestParams", "targetUserId=" + targetUserId);
        audit.put("userId", UserExt.getUser().getId());
        audit.put("userAccount", "admin");
        audit.put("result", result);
        audit.put("createdAt", new Date());
        auditWriter.append(audit);
    }
}