package com.gkhy.hazmat.framework.security.filter;

import com.alibaba.fastjson2.JSON;
import com.gkhy.hazmat.common.annotation.ThirdPartyToken;
import com.gkhy.hazmat.common.api.CommonResult;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.MediaType;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Component;
import org.springframework.util.StringUtils;
import org.springframework.web.filter.OncePerRequestFilter;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.HandlerExecutionChain;
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;

/**
 * 第三方平台token验证过滤器
 */
@Component
public class ThirdPartyTokenFilter extends OncePerRequestFilter {

    @Value("${third-party.token:}")
    private String thirdPartyToken;

    private static final Logger logger = LoggerFactory.getLogger(ThirdPartyTokenFilter.class);
    private static final String TOKEN_HEADER = "X-Token";

    private final RequestMappingHandlerMapping handlerMapping;

    public ThirdPartyTokenFilter(RequestMappingHandlerMapping handlerMapping) {
        this.handlerMapping = handlerMapping;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        // 跨域OPTIONS预检直接放行
        if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
            filterChain.doFilter(request, response);
            return;
        }

        boolean isThirdAuth = false;
        try {
            HandlerExecutionChain handlerChain = handlerMapping.getHandler(request);
            boolean needThirdToken = false;
            if (handlerChain != null && handlerChain.getHandler() instanceof HandlerMethod) {
                HandlerMethod handlerMethod = (HandlerMethod) handlerChain.getHandler();
                ThirdPartyToken annotation = handlerMethod.getMethodAnnotation(ThirdPartyToken.class);
                if (annotation == null) {
                    annotation = handlerMethod.getBeanType().getAnnotation(ThirdPartyToken.class);
                }
                needThirdToken = annotation != null;
            }

            // 仅标记@ThirdPartyToken的接口校验固定Token
            if (needThirdToken) {
                String clientToken = request.getHeader(TOKEN_HEADER);
                if (!StringUtils.hasText(clientToken)) {
                    writeError(response, "请求头缺少X-Token第三方凭证");
                    return;
                }
                if (!thirdPartyToken.equals(clientToken)) {
                    writeError(response, "第三方Token无效，请核对凭证");
                    return;
                }
                // 写入安全上下文，携带专属权限
                UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
                        "third_party_single_platform", null, new ArrayList<>()
                );
                SecurityContextHolder.getContext().setAuthentication(authToken);
                isThirdAuth = true;
            }
            filterChain.doFilter(request, response);
        } catch (Exception e) {
            logger.error("第三方Token过滤器解析处理器异常", e);
            filterChain.doFilter(request, response);
        } finally {
            // 清除上下文，防止线程复用越权
            if (isThirdAuth) {
                SecurityContextHolder.clearContext();
            }
        }
    }

    /**
     * 统一401错误返回
     */
    private void writeError(HttpServletResponse response, String msg) throws IOException {
        response.setContentType("application/json;charset=UTF-8");
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        response.getWriter().write("{\"code\":401,\"msg\":\"" + msg + "\",\"data\":null}");
    }
}