package com.tcm.training.admin.config;

import cn.dev33.satoken.interceptor.SaInterceptor;
import cn.dev33.satoken.context.SaHolder;
import cn.dev33.satoken.stp.StpUtil;
import com.tcm.training.admin.common.xss.XssParamInterceptor;
import com.tcm.training.admin.upload.LocalUploadProperties;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

import java.io.File;

@Configuration
public class SaTokenWebConfig implements WebMvcConfigurer {

    private final XssParamInterceptor xssParamInterceptor;
    private final LocalUploadProperties localUploadProperties;

    public SaTokenWebConfig(XssParamInterceptor xssParamInterceptor,
                            LocalUploadProperties localUploadProperties) {
        this.xssParamInterceptor = xssParamInterceptor;
        this.localUploadProperties = localUploadProperties;
    }

    /**
     * 注册 Sa-Token 与 XSS 拦截器。
     */
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new SaInterceptor(handle -> handleAuth()))
                .addPathPatterns("/api/**", "/api/v1/**")
                .excludePathPatterns(
                        localUploadProperties.getPathPrefix() + "/**"
                );

        registry.addInterceptor(xssParamInterceptor)
                .addPathPatterns("/api/**", "/api/v1/**");
    }

    /**
     * 按请求路径切换管理员鉴权与 APP 鉴权。
     */
    private void handleAuth() {
        if ("OPTIONS".equalsIgnoreCase(SaHolder.getRequest().getMethod())) {
            return;
        }
        String requestPath = SaHolder.getRequest().getRequestPath();
        if (isAppApi(requestPath)) {
            // APP 端允许游客访问，只有真正需要用户身份的接口才在业务层显式要求登录。
            return;
        }
        if (isPublicAdminApi(requestPath)) {
            return;
        }
        StpUtil.checkLogin();
    }

    /**
     * 判断是否属于 APP 路由空间。
     */
    private boolean isAppApi(String requestPath) {
        return requestPath.startsWith("/api/app/") || requestPath.startsWith("/api/v1/app/");
    }

    /**
     * 判断当前后台路由是否允许匿名访问。
     */
    private boolean isPublicAdminApi(String requestPath) {
        return "/api/auth/login".equals(requestPath)
                || "/api/auth/captcha".equals(requestPath)
                || requestPath.startsWith("/api/open/")
                || requestPath.startsWith("/api/v1/open/");
    }

    /**
     * 将本地上传目录映射为静态资源，可通过 /uploads/** 访问。
     */
    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        // 转为绝对路径，确保 file: 协议正确。
        String absPath = new File(localUploadProperties.getDir()).getAbsolutePath();
        registry.addResourceHandler(localUploadProperties.getPathPrefix() + "/**")
                .addResourceLocations("file:" + absPath + "/");
    }
}