package secure

import (
	"strconv"
	"strings"

	"gitee.com/gbolt/gbolt"
	"gitee.com/gbolt/kernel/auth"
)

// PermissionMiddleware 权限检查中间件
func PermissionMiddleware(enforcer *Enforcer) gbolt.HandlerFunc {
	return func(c *gbolt.Context) {
		// 获取用户信息
		roleId, err := auth.GetRoleIdFromGin(c)
		if err != nil {
			Unauthorized(c, "无效的认证信息")
			c.Abort()
			return
		}

		// 获取请求信息
		path := c.Request.URL.Path
		method := c.Request.Method
		
		// 管理员跳过权限检查
		if roleId == 888 {
			c.Next()
			return
		}

		// 执行权限检查
		roleIdStr := strconv.Itoa(int(roleId))
		allowed := enforcer.Enforce(roleIdStr, path, method)
		
		if !allowed {
			Forbidden(c, "权限不足")
			c.Abort()
			return
		}
		
		c.Next()
	}
}

// PathPermissionMiddleware 路径权限中间件（针对特定路径）
func PathPermissionMiddleware(enforcer *Enforcer, skipPaths []string) gbolt.HandlerFunc {
	skipMap := make(map[string]bool)
	for _, path := range skipPaths {
		skipMap[path] = true
	}
	
	return func(c *gbolt.Context) {
		// 检查是否为跳过路径
		if skipMap[c.Request.URL.Path] {
			c.Next()
			return
		}
		
		// 获取用户信息
		roleId, err := auth.GetRoleIdFromGin(c)
		if err != nil {
			Unauthorized(c, "无效的认证信息")
			c.Abort()
			return
		}

		// 管理员跳过权限检查
		if roleId == 888 {
			c.Next()
			return
		}

		// 获取请求信息
		path := c.Request.URL.Path
		method := c.Request.Method
		
		// 执行权限检查
		roleIdStr := strconv.Itoa(int(roleId))
		allowed := enforcer.Enforce(roleIdStr, path, method)
		
		if !allowed {
			Forbidden(c, "权限不足")
			c.Abort()
			return
		}
		
		c.Next()
	}
}

// RoleMiddleware 角色权限中间件
func RoleMiddleware(allowedRoles ...uint) gbolt.HandlerFunc {
	return func(c *gbolt.Context) {
		roleId, err := auth.GetRoleIdFromGin(c)
		if err != nil {
			Unauthorized(c, "无效的认证信息")
			c.Abort()
			return
		}

		// 检查用户角色是否在允许的角色列表中
		for _, role := range allowedRoles {
			if roleId == role {
				c.Next()
				return
			}
		}
		
		Forbidden(c, "角色权限不足")
		c.Abort()
	}
}

// AdminOnlyMiddleware 仅管理员访问中间件
func AdminOnlyMiddleware() gbolt.HandlerFunc {
	return RoleMiddleware(888)
}

// ApiKeyMiddleware API Key认证中间件
func ApiKeyMiddleware(validKeys []string) gbolt.HandlerFunc {
	keyMap := make(map[string]bool)
	for _, key := range validKeys {
		keyMap[key] = true
	}
	
	return func(c *gbolt.Context) {
		apiKey := c.GetHeader("X-API-Key")
		if apiKey == "" {
			apiKey = c.Query("api_key")
		}
		
		if apiKey == "" || !keyMap[apiKey] {
			Unauthorized(c, "无效的API Key")
			c.Abort()
			return
		}
		
		c.Next()
	}
}

// IpWhitelistMiddleware IP白名单中间件
func IpWhitelistMiddleware(allowedIPs []string) gbolt.HandlerFunc {
	ipMap := make(map[string]bool)
	for _, ip := range allowedIPs {
		ipMap[ip] = true
	}
	
	return func(c *gbolt.Context) {
		clientIP := c.ClientIP()
		
		// 检查IP是否在白名单中
		allowed := false
		for ip := range ipMap {
			if strings.HasPrefix(clientIP, ip) {
				allowed = true
				break
			}
		}
		
		if !allowed {
			Forbidden(c, "IP地址不在白名单中")
			c.Abort()
			return
		}
		
		c.Next()
	}
}

// AuditMiddleware 审计日志中间件
func AuditMiddleware() gbolt.HandlerFunc {
	return func(c *gbolt.Context) {
		// 记录请求开始时间
		startTime := c.Request.Header.Get("X-Request-ID")
		if startTime == "" {
			startTime = generateRequestID()
		}
		
		// 获取用户信息（如果有）
		var userInfo string
		if username, err := auth.GetUsernameFromGin(c); err == nil {
			userInfo = username
		}
		
		// 记录请求信息
		c.Set("audit_info", map[string]interface{}{
			"user_id":    userInfo,
			"ip":         c.ClientIP(),
			"method":     c.Request.Method,
			"path":       c.Request.URL.Path,
			"user_agent": c.Request.UserAgent(),
			"start_time": startTime,
		})
		
		c.Next()
		
		// 记录响应信息
		if auditInfo, exists := c.Get("audit_info"); exists {
			if info, ok := auditInfo.(map[string]interface{}); ok {
				info["status"] = c.Writer.Status()
				// 这里可以记录到日志或数据库
			}
		}
	}
}