package com.estate.expert.common.auth;

import com.alibaba.fastjson.JSONObject;
import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import com.estate.expert.common.exception.TokenExpiredException;
import com.auth0.jwt.interfaces.DecodedJWT;
import com.estate.expert.common.enums.AppEnv;
import com.estate.expert.common.exception.BizException;
import com.google.common.base.Strings;
import com.google.common.io.BaseEncoding;
import lombok.AllArgsConstructor;
import lombok.Builder;
import lombok.Data;
import lombok.ToString;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.StringUtils;
import org.springframework.core.annotation.AnnotationUtils;
import org.springframework.core.annotation.Order;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.HandlerInterceptor;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.lang.annotation.Annotation;
import java.security.KeyFactory;
import java.security.interfaces.RSAPublicKey;
import java.security.spec.X509EncodedKeySpec;
import java.util.Objects;

/**
 * 认证拦截器
 */
@Slf4j
@Order(100)
public class AuthInterceptor implements HandlerInterceptor {

    public final static String AUTH_PAYLOAD_KEY = "_auth_payload_";
    public final static String CALLER_PAYLOAD_KEY = "_caller_payload_";

    private Algorithm algorithm;

    private static final String AUTH_HEADER = "Authorization";

    private static final String SUPPORT_AUTH = "Bearer";

    public static final String ORIGINAL_CALLER_HEADER_NAME = "xg-original-caller";

    public AuthInterceptor(String publicKey) throws Exception {
        Objects.requireNonNull(publicKey);

        RSAPublicKey rsaPublicKey = (RSAPublicKey) KeyFactory.getInstance("RSA")
                .generatePublic(new X509EncodedKeySpec(BaseEncoding.base64().decode(publicKey)));

        this.algorithm = Algorithm.RSA256(rsaPublicKey, null);
    }

    /**
     * 预处理
     * @param request 请求
     * @param response 响应
     * @param handler 处理器
     * @return 是否继续处理
     */
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
        log.info("AuthInterceptor::preHandle::Start Recv ReqBody ==> {}", request.getRequestURI());
        if (!(handler instanceof HandlerMethod)) {
            return true;
        }
        IgnoreAuth ignoreAuth = getAnnotation((HandlerMethod) handler, IgnoreAuth.class);
        if (ignoreAuth != null) {
            return true;
        }

        Token token = Token.from(request.getHeader(AUTH_HEADER));
        if (!StringUtils.equals(SUPPORT_AUTH, token.getType())) {
            throw new BizException(AuthResultCode.API_AUTH_NOT_SUPPORTED);
        }

        try {
            DecodedJWT jwt = JWT.require(algorithm).build()
                    .verify(token.getToken());
            AuthCaller payload = AuthCaller.builder()
                    .appId(jwt.getClaim("appId").asString())
                    .appEnv(AppEnv.valueOf(jwt.getClaim("appEnv").asString()))
                    .ext(jwt.getClaim("ext").asString())
                    .build();

            request.setAttribute(AUTH_PAYLOAD_KEY, payload);

            OriginalCaller caller;
            String originalCallerHeader = request.getHeader(ORIGINAL_CALLER_HEADER_NAME);
            if (!Strings.isNullOrEmpty(originalCallerHeader)) {
                caller = JSONObject.parseObject(originalCallerHeader, OriginalCaller.class);
            } else {
                caller = OriginalCaller.fromAuthCaller(payload);
            }
            request.setAttribute(CALLER_PAYLOAD_KEY, caller);
        } catch (TokenExpiredException e) {
            response.setStatus(TokenExpiredException.STATUS_CODE);
            throw new BizException(AuthResultCode.API_AUTH_TOKEN_EXPIRED);
        } catch (Exception e) {
            log.error("api auth, token is invalid. token = {}", token, e);
            throw new BizException(AuthResultCode.API_AUTH_TOKEN_INVALID);
        }

        return true;
    }

    /**
     * 获取注解
     * @param handlerMethod 处理器方法
     * @param clazz 注解类
     * @return 注解
     */
    private <T extends Annotation> T getAnnotation(HandlerMethod handlerMethod, Class<T> clazz) {
        T annotation = handlerMethod.getMethodAnnotation(clazz);
        if (annotation != null) {
            return annotation;
        }
        annotation = AnnotationUtils.findAnnotation(handlerMethod.getBeanType(), clazz);
        return annotation;
    }

    @Data
    @Builder
    @AllArgsConstructor
    @ToString
    private static class Token {
        private static final transient String DELIMITER = StringUtils.SPACE;

        private String type;

        private String token;

        /**
         * 从字符串中获取Token
         * @param header 字符串
         * @return Token
         */
        public static Token from(String header) {
            return Token.builder()
                    .type(StringUtils.substringBefore(header, DELIMITER))
                    .token(StringUtils.substringAfter(header, DELIMITER))
                    .build();
        }
    }
}