package com.tourguide.api.admin;

import com.tourguide.common.api.ApiResponse;
import com.tourguide.modules.user.domain.ClientType;
import com.tourguide.modules.user.dto.AuthResponse;
import com.tourguide.modules.user.dto.LoginRequest;
import com.tourguide.modules.user.dto.UserResponse;
import com.tourguide.modules.user.service.AdminUserService;
import com.tourguide.modules.user.service.AuthService;
import com.tourguide.modules.system.service.AdminPermissionService;
import com.tourguide.security.AppUserPrincipal;
import com.tourguide.security.BearerTokenResolver;
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.web.bind.annotation.*;
import javax.validation.Valid;

/**
 * 管理后台认证接口。
 * 仅签发和接收 ADMIN 客户端类型的 Token，防止后台凭证被游客端或导游端接口复用。
 */
@RestController
@RequestMapping("/api/admin/auth")
public class AdminAuthController {
    private final AuthService authService;
    private final AdminUserService userService;
    private final AdminPermissionService permissionService;
    private final BearerTokenResolver tokenResolver;

    public AdminAuthController(AuthService authService, AdminUserService userService,
                               AdminPermissionService permissionService, BearerTokenResolver tokenResolver) {
        this.authService = authService;
        this.userService = userService;
        this.permissionService = permissionService;
        this.tokenResolver = tokenResolver;
    }

    /**
     * 使用后台账号和密码登录，校验账号状态后签发 ADMIN Token。
     *
     * @param request 后台登录账号和明文密码
     * @return Token 信息及当前后台账号资料
     */
    @PostMapping("/login")
    public ApiResponse<AuthResponse<UserResponse>> login(@Valid @RequestBody LoginRequest request) {
        return ApiResponse.success(authService.loginAdmin(request));
    }

    /**
     * 注销当前后台会话，使 Authorization 请求头中的 ADMIN Token 立即失效。
     *
     * @param authorization Bearer Token 请求头
     * @return 无业务数据的成功响应
     */
    @PostMapping("/logout")
    public ApiResponse<Void> logout(@RequestHeader("Authorization") String authorization) {
        authService.logout(tokenResolver.resolve(authorization), ClientType.ADMIN);
        return ApiResponse.success();
    }

    /**
     * 查询当前已登录后台账号的基础资料和角色信息。
     *
     * @param principal 安全过滤器解析出的当前后台用户身份
     * @return 当前启用状态的后台账号信息
     */
    @GetMapping("/me")
    public ApiResponse<UserResponse> me(@AuthenticationPrincipal AppUserPrincipal principal) {
        return ApiResponse.success(UserResponse.from(userService.findEnabledById(principal.getUserId()),
                permissionService.getMenuCodes(principal.getRole())));
    }
}