/*
 * Copyright 2018-2020 by jason. All Rights Reserved.
 *
 * Permission to use, copy, modify, and distribute this software and its
 * documentation for any purpose and without fee is hereby granted,
 * provided that the above copyright notice appear in all copies and that
 * both that copyright notice and this permission notice appear in
 * supporting documentation, and that the name of Vinay Sajip
 * not be used in advertising or publicity pertaining to distribution
 * of the software without specific, written prior permission.
 * VINAY SAJIP DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
 * ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
 * VINAY SAJIP BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
 * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER
 * IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 *
 */

package cn.mb.cloud.gateway.filter;

import cn.mb.cloud.common.cache.RedisFastJsonTemplate;
import cn.mb.cloud.common.core.constant.SecurityConstants;
import cn.mb.cloud.common.core.constant.enums.ErrorCodeConstants;
import cn.mb.cloud.common.core.util.ResponseData;
import cn.mb.cloud.common.gateway.common.PermissionResult;
import cn.mb.cloud.common.gateway.config.FilterIgnorePropertiesConfig;
import cn.mb.cloud.gateway.handler.AppTypeContextHolder;
import cn.mb.cloud.gateway.service.MbCloudRedisTokenStore;
import com.alibaba.fastjson.JSON;
import com.dsh.utils.login.LoginHelper;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.cloud.gateway.filter.GatewayFilterChain;
import org.springframework.cloud.gateway.filter.GlobalFilter;
import org.springframework.context.annotation.Bean;
import org.springframework.core.Ordered;
import org.springframework.core.io.buffer.DataBuffer;
import org.springframework.data.redis.connection.RedisConnectionFactory;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.http.server.reactive.ServerHttpResponse;
import org.springframework.security.oauth2.common.OAuth2AccessToken;
import org.springframework.security.oauth2.provider.token.store.redis.RedisTokenStore;
import org.springframework.stereotype.Component;
import org.springframework.util.AntPathMatcher;
import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Mono;

import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Optional;

/**
 * @author: jason
 * @Date: 2019-05-20 15:50
 * @Description:
 */
@Slf4j
@Component
public class PermissionsFilter implements GlobalFilter, Ordered {

    @Autowired
    private RedisFastJsonTemplate redisTemplate;

    @Autowired
    private FilterIgnorePropertiesConfig filterIgnorePropertiesConfig;

    @Autowired
    private MbCloudRedisTokenStore redisTokenStore;

    @Value("${cn.mbcloud.gateway.permissions.basic}")
    private Boolean isBasic = Boolean.FALSE;


    private AntPathMatcher pathMatcher = new AntPathMatcher();

    /**
     * Redis Token 仓库前缀
     */
    String REDIS_TOKEN_STORE_PREFIX = "oauth2_";


    /**
     * 拦截存储资源模块
     */

    @Value("${ignore.image.prefix}")
    String IGNORE_IMAGE_PREFIX;
    /**
     * 放行存储资源地址
     */
    @Value("${ignore.image.uris}")
    String IGNORE_IMAGE_URIS;
    /**
     * 拦截综合管理后台模块
     */
    @Value("${ignore.upms.prefix}")
    String IGNORE_UPMS_PREFIX;
    /**
     * 放行综合管理后台地址
     */
    @Value("${ignore.upms.uris}")
    String IGNORE_UPMS_URIS;

    /**
     * 拦截APP模块
     */
    @Value("${ignore.app.prefix}")
    String IGNORE_APP_PREFIX;
    /**
     * 放行APP地址
     */
    @Value(("${ignore.app.uris}"))
    String IGNORE_APP_URIS;

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        ServerHttpRequest request = exchange.getRequest();
        String appType = request.getHeaders().getFirst(AppTypeContextHolder.APP_TYPE);
        AppTypeContextHolder.setDeviceType(appType);
        PermissionResult permissionResult = hasPermission(exchange, request);
        AppTypeContextHolder.clear();
        if (permissionResult != PermissionResult.PASS) {
            ServerHttpResponse response = exchange.getResponse();
            response.setRawStatusCode(permissionResult.getValue());
            ResponseData responseData = ResponseData.builder().code(ErrorCodeConstants.FAIL.getValue()).msg("您还未登录").build();
            byte[] bits = JSON.toJSONBytes(responseData);
            DataBuffer buffer = response.bufferFactory().wrap(bits);
            response.getHeaders().add("Content-Type", "application/json;charset=UTF-8");
            return response.writeWith(Mono.just(buffer));
        } else {
            return chain.filter(exchange.mutate().request(request.mutate().build()).build());
        }
    }

    @Override
    public int getOrder() {
        return -Integer.MAX_VALUE;
    }

    public PermissionResult hasPermission(ServerWebExchange exchange, ServerHttpRequest request) {
        String uri = request.getURI().getRawPath();

        // 获取头信息
        Map<String, String> params = getHeaderParams(request);
        log.info("请求操作 -> " + uri + " || 请求参数 -> " + request.getQueryParams() + " || Header信息 -> " + params);
        if(uri.contains("v2/api-docs")){
            return PermissionResult.PASS;
        }
        // 校验放行URL地址
//		PermissionResult result = ignoreURLFilter(uri, request);
//		if (result != PermissionResult.PASS) {
//			return result;
//		}
        // ----------------------------------------------------------------- 放行存储资源模块-IMAGE
        if (uri.startsWith(IGNORE_IMAGE_PREFIX)) {
            return PermissionResult.PASS;
        }

        // ----------------------------------------------------------------- 放行APP模块-APP
        String token = getAccessToken(request);
        if (uri.startsWith(IGNORE_APP_PREFIX) && token == null) {
            if (IGNORE_APP_URIS.contains(uri) || uri.contains("/app/courseorder/notify")) {
                return PermissionResult.PASS;
            }
        }

        // ----------------------------------------------------------------- 放行综合后台授权登录-UPMS
        if (uri.startsWith(IGNORE_UPMS_PREFIX)) {
            if (IGNORE_UPMS_URIS.contains(uri)) {
                return PermissionResult.PASS;
            }
            String accessToken = getAccessToken(request);
            if (StringUtils.isEmpty(accessToken)) {
                log.warn("访问令牌为空，accessToken：" + accessToken);
                return PermissionResult.TOKEN_INVALID;
            }

            boolean hasAuth = LoginHelper.userExist(accessToken);
            if (!hasAuth) {
                log.warn("Redis Token Store未找到对应的令牌，accessToken：" + accessToken);
                return PermissionResult.TOKEN_INVALID;
            } else {
                if (!LoginHelper.isExpired(LoginHelper.getUser(accessToken))) {
                    log.warn("访问令牌已过期，accessToken：" + accessToken);
                    return PermissionResult.TOKEN_EXPIRED;
                }
                LoginHelper.update(LoginHelper.getUser(accessToken), 86400000L);
                return PermissionResult.PASS;
            }
        }

        // 判断是否是忽略列表中的
        if (!filterIgnorePropertiesConfig.getPermissionUrls().isEmpty()) {
            Optional<String> optional = filterIgnorePropertiesConfig.getPermissionUrls().stream().filter(url -> pathMatcher.match(url, uri)).findFirst();
            if (optional.isPresent()) {
                return PermissionResult.PASS;
            }
        }

        String accessToken = getAccessToken(request);
        if (StringUtils.isEmpty(accessToken)) {
            log.warn("访问令牌为空，accessToken：" + accessToken);
            return PermissionResult.TOKEN_INVALID;
        }

        OAuth2AccessToken oAuth2AccessToken = redisTokenStore.readAccessToken(accessToken);
        if (oAuth2AccessToken == null) {
            log.warn("Redis Token Store未找到对应的令牌，accessToken：" + accessToken);
            return PermissionResult.TOKEN_INVALID;
        }
        if (oAuth2AccessToken.isExpired()) {
            log.warn("访问令牌已过期，accessToken：" + accessToken);
            return PermissionResult.TOKEN_EXPIRED;
        }
        Long userId = (Long) oAuth2AccessToken.getAdditionalInformation().get("user_id");
        String username = (String) oAuth2AccessToken.getAdditionalInformation().get("username");
        //用户令牌有效则进行用户信息的注入到头信息中
        request.mutate().header("userId", userId.toString()).header("username", username);
        //是否开启简单认证模式如果开启则不验证URL权限只验证是否拥有token的合法性
        if (isBasic) {
            return PermissionResult.PASS;
        }
        HashSet<String> permissions = (HashSet<String>) redisTemplate.opsForValue().get(SecurityConstants.CACHE_USER_PERMISSIONS_KEY + "urls:" + userId);
        if (permissions == null || permissions.isEmpty()) {
            log.warn("用户URL权限为空，urlSet：" + JSON.toJSONString(permissions));
            return PermissionResult.FORBIDDEN;
        }

        log.info("用户 -> " + username + " || 请求操作 -> " + uri + " || 请求参数 -> " + request.getQueryParams() + " || Header信息 -> " + params);

        Optional<String> optional = permissions.stream().filter(url -> pathMatcher.match(url, uri)).findFirst();
        return optional.isPresent() ? PermissionResult.PASS : PermissionResult.FORBIDDEN;
    }

    /**
     * 获取请求中token
     *
     * @param request
     * @return token
     */
    private String getAccessToken(ServerHttpRequest request) {
        String headerValue = request.getHeaders().getFirst("Authorization");
        if (StringUtils.isEmpty(headerValue)) {
            return null;
        }
        final String bearerType = OAuth2AccessToken.BEARER_TYPE.toLowerCase();
        if (headerValue.toLowerCase().startsWith(bearerType)) {
            String substring = headerValue.substring(bearerType.length());
            return substring.trim();
        } else {
            return headerValue;
        }
    }

    /**
     * 获取请求中Header参数
     *
     * @param request
     * @return
     */
    private Map<String, String> getHeaderParams(ServerHttpRequest request) {
        String device = request.getHeaders().getFirst("Device");
        String deviceModel = request.getHeaders().getFirst("DeviceModel");
        String jPushDevice = request.getHeaders().getFirst("JPushDevice");
        String versionCode = request.getHeaders().getFirst("VersionCode");
        Map<String, String> map = new HashMap<>();
        map.put("device", device);
        map.put("deviceModel", deviceModel);
        map.put("jPushDevice", jPushDevice);
        map.put("versionCode", versionCode);
        return map;
    }

    @Bean
    public RedisTokenStore redisTokenStore(RedisConnectionFactory redisConnectionFactory) {
        RedisTokenStore tokenStore = new RedisTokenStore(redisConnectionFactory);
        tokenStore.setPrefix(REDIS_TOKEN_STORE_PREFIX);
        return tokenStore;
    }

    private void setIgnoreLoginAuthHeaderToken(ServerHttpRequest request) {
        String accessToken = getAccessToken(request);
        if (StringUtils.isEmpty(accessToken)) {
            log.warn("访问令牌为空，accessToken：" + accessToken);
            return;
        }

        OAuth2AccessToken oAuth2AccessToken = redisTokenStore.readAccessToken(accessToken);
        if (oAuth2AccessToken == null) {
            log.warn("Redis Token Store未找到对应的令牌，accessToken：" + accessToken);
            return;
        }
        if (oAuth2AccessToken.isExpired()) {
            log.warn("访问令牌已过期，accessToken：" + accessToken);
            return;
        }
        Long userId = (Long) oAuth2AccessToken.getAdditionalInformation().get("user_id");
        String username = (String) oAuth2AccessToken.getAdditionalInformation().get("username");
        //用户令牌有效则进行用户信息的注入到头信息中
        request.mutate().header("userId", userId.toString()).header("username", username);
    }
}