package com.tourguide.security;

import com.fasterxml.jackson.databind.ObjectMapper;
import com.tourguide.common.api.ApiResponse;
import com.tourguide.modules.user.domain.ClientType;
import com.tourguide.modules.user.domain.UserRole;
import com.tourguide.modules.user.entity.AdminUser;
import com.tourguide.modules.user.entity.GuideUser;
import com.tourguide.modules.user.entity.MiniUser;
import com.tourguide.modules.user.service.AdminUserService;
import com.tourguide.modules.user.service.GuideUserService;
import com.tourguide.modules.user.service.MiniUserService;
import com.tourguide.modules.system.service.AdminPermissionService;
import org.springframework.http.MediaType;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Component;
import org.springframework.util.StringUtils;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.nio.charset.StandardCharsets;

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {
    private final JwtTokenService jwtTokenService;
    private final TokenSessionService tokenSessionService;
    private final AdminUserService adminUserService;
    private final AdminPermissionService adminPermissionService;
    private final MiniUserService miniUserService;
    private final GuideUserService guideUserService;
    private final ObjectMapper objectMapper;

    public JwtAuthenticationFilter(JwtTokenService jwtTokenService, TokenSessionService tokenSessionService,
                                   AdminUserService adminUserService, AdminPermissionService adminPermissionService,
                                   MiniUserService miniUserService,
                                   GuideUserService guideUserService, ObjectMapper objectMapper) {
        this.jwtTokenService = jwtTokenService;
        this.tokenSessionService = tokenSessionService;
        this.adminUserService = adminUserService;
        this.adminPermissionService = adminPermissionService;
        this.miniUserService = miniUserService;
        this.guideUserService = guideUserService;
        this.objectMapper = objectMapper;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        String token = resolveToken(request);
        if (!StringUtils.hasText(token)) {
            filterChain.doFilter(request, response);
            return;
        }
        try {
            TokenPayload payload = jwtTokenService.parse(token);
            ClientType expectedClientType = resolveExpectedClientType(request.getRequestURI());
            if (expectedClientType != null && payload.getClientType() != expectedClientType) {
                writeUnauthorized(response, "Token端类型不匹配");
                return;
            }
            if (!tokenSessionService.isActive(payload)) {
                writeUnauthorized(response, "Token已失效");
                return;
            }
            AppUserPrincipal principal = loadPrincipal(payload, request.getRequestURI());
            if (!principal.getRole().equals(payload.getRole())) {
                writeUnauthorized(response, "Token权限信息已变更");
                return;
            }
            UsernamePasswordAuthenticationToken authentication =
                    new UsernamePasswordAuthenticationToken(principal, token, principal.getAuthorities());
            SecurityContextHolder.getContext().setAuthentication(authentication);
            filterChain.doFilter(request, response);
        } catch (Exception exception) {
            SecurityContextHolder.clearContext();
            writeUnauthorized(response, "Token无效或已过期");
        }
    }

    /** 根据 Token 端类型读取对应用户表，任何端都不会回退查询其他用户表。 */
    private AppUserPrincipal loadPrincipal(TokenPayload payload, String requestUri) {
        if (payload.getClientType() == ClientType.ADMIN) {
            AdminUser user = adminUserService.findEnabledById(payload.getUserId());
            return new AppUserPrincipal(user.getId(), user.getUsername(), user.getRoleCode(), ClientType.ADMIN,
                    adminPermissionService.getMenuCodes(user.getRoleCode()));
        }
        if (payload.getClientType() == ClientType.MINI) {
            MiniUser user = miniUserService.findEnabledById(payload.getUserId());
            return new AppUserPrincipal(user.getId(), user.getUsername(), UserRole.MINI_USER.name(), ClientType.MINI);
        }
        GuideUser user = allowsDisabledGuide(requestUri)
                ? guideUserService.findWorkbenchAccessibleById(payload.getUserId())
                : guideUserService.findEnabledById(payload.getUserId());
        return new AppUserPrincipal(user.getId(), user.getUsername(), UserRole.GUIDE_USER.name(), ClientType.GUIDE);
    }

    private boolean allowsDisabledGuide(String requestUri) {
        return requestUri.startsWith("/api/guide/workbench")
                || requestUri.startsWith("/api/guide/notifications")
                || requestUri.equals("/api/guide/auth/logout");
    }

    private ClientType resolveExpectedClientType(String uri) {
        if (uri.startsWith("/api/admin/")) { return ClientType.ADMIN; }
        if (uri.startsWith("/api/mini/")) { return ClientType.MINI; }
        if (uri.startsWith("/api/guide/")) { return ClientType.GUIDE; }
        return null;
    }

    private String resolveToken(HttpServletRequest request) {
        String authorization = request.getHeader("Authorization");
        return StringUtils.hasText(authorization) && authorization.startsWith("Bearer ") ? authorization.substring(7) : null;
    }

    private void writeUnauthorized(HttpServletResponse response, String message) throws IOException {
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        response.setCharacterEncoding(StandardCharsets.UTF_8.name());
        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
        objectMapper.writeValue(response.getWriter(), ApiResponse.failure(401, message));
    }
}