package com.iplatform.security;

import com.iplatform.base.ArgumentsConstants;
import com.iplatform.base.AsyncManager;
import com.iplatform.base.PlatformLoginCallback;
import com.iplatform.base.SecurityConstants;
import com.iplatform.base.SecuritySpi;
import com.iplatform.base.VariableConstants;
import com.iplatform.base.callback.AfterLoginCallback;
import com.iplatform.base.callback.PlatformCallbackPostProcessor;
import com.iplatform.base.config.LogProperties;
import com.iplatform.base.exception.LoginException;
import com.iplatform.base.pojo.RequestLogin;
import com.iplatform.base.service.LogServiceImpl;
import com.iplatform.base.service.LoginServiceImpl;
import com.iplatform.base.support.strategy.LoginStrategyManager;
import com.iplatform.base.util.TokenUtils;
import com.iplatform.base.util.UserUtils;
import com.iplatform.core.BeanContextAware;
import com.iplatform.model.po.S_login_info;
import com.iplatform.model.po.S_user_core;
import com.iplatform.model.po.S_user_login;
import com.iplatform.security.config.SecurityProperties;
import com.iplatform.security.util.LoginCallbackUtils;
import com.iplatform.security.util.SecurityConfigUtils;
import com.walker.cache.CacheProvider;
import com.walker.infrastructure.arguments.ArgumentsManager;
import com.walker.infrastructure.arguments.Variable;
import com.walker.infrastructure.utils.DateUtils;
import com.walker.infrastructure.utils.NumberGenerator;
import com.walker.infrastructure.utils.StringUtils;
import com.walker.web.CaptchaProvider;
import com.walker.web.CaptchaResult;
import com.walker.web.CaptchaType;
import com.walker.web.Constants;
import com.walker.web.LoginType;
import com.walker.web.ResponseCode;
import com.walker.web.TokenGenerator;
import com.walker.web.UserOnlineProvider;
import com.walker.web.UserPrincipal;
import com.walker.web.WebAgentService;
import com.walker.web.WebRuntimeException;
import com.walker.web.WebUserAgent;
import com.walker.web.util.IdUtils;
import com.walker.web.util.ServletUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.password.PasswordEncoder;

import javax.servlet.http.HttpServletRequest;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.TimerTask;

public class DefaultSecuritySpi implements SecuritySpi {

    protected final transient Logger logger = LoggerFactory.getLogger(this.getClass());

    public DefaultSecuritySpi(){}

    @Override
    public boolean isAllowMobileLoginRegister(){
        return this.getSecurityProperties().isAllowMobileLoginReg();
    }

    @Override
    public Map<String, Object> login(RequestLogin requestLogin) throws LoginException {
        String username = requestLogin.getUsername();
        // 2023-01-26 为了支持多种登录方式，使用登录回调处理具体登录细节。
        // 2023-12-28 移动端登录验证
        CaptchaType captchaType = CaptchaType.getType(requestLogin.getVerifyType());
        PlatformLoginCallback loginCallback = LoginCallbackUtils.getLoginCallbackBean(LoginType.getType(requestLogin.getLoginType()), true, captchaType);

        boolean captchaEnabled = this.getArgumentVariable(ArgumentsConstants.KEY_SECURITY_CAPTCHA_ENABLED).getBooleanValue();
        // 2023-01-26 这里APP端是不需要验证码的
        if(captchaEnabled){
            CaptchaProvider<CaptchaResult> captchaProvider = loginCallback.getCaptchaProvider();
            if(captchaProvider == null){
//                return ResponseValue.error("系统需要验证码，但登录未配置:" + loginCallback.getClass().getName());
                throw new LoginException("系统需要验证码，但登录未配置:" + loginCallback.getClass().getName());
            }
            if(StringUtils.isEmpty(requestLogin.getVerifyType())){
//                return ResponseValue.error("请求错误：验证码类型为空");
                throw new LoginException("请求错误：验证码类型为空");
            }

            // 第三方对接的认证登录，不需要检测验证码类型是否与后台一致。2023-07-03
            if(captchaProvider.getCaptchaType() != CaptchaType.ThirdParty
                    && !requestLogin.getVerifyType().equals(captchaProvider.getCaptchaType().getIndex())){
                throw new LoginException("前端配置的验证码类型与后台不一致! verifyType = " + captchaProvider.getCaptchaType());
            }
            if(loginCallback.isValidateCaptcha()){
                logger.debug("需要验证码，getCaptchaType={}", loginCallback.getCaptchaProvider().getCaptchaType());
                String error = this.validateCaptcha(requestLogin.getCode(), requestLogin.getUuid(), captchaProvider);
                if(error != null){
//                    return ResponseValue.error(error);
                    throw new LoginException(error);
                }
            }
        }

        // 2023-07-11 检查登录策略是否满足
        if(this.getLogProperties().isLoginEnabled()){
            String error = this.getLoginStrategyManager().execute(requestLogin);
            if(error != null){
                throw new LoginException(error);
            }
        }

        // 用户验证
        Authentication authentication = null;

        try{
//            UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(username, password);
            DefaultAuthenticationToken authenticationToken = new DefaultAuthenticationToken(username, requestLogin.getPassword(), requestLogin);
            // 这里放入线程，后面UserDetailsService会使用
            SecurityContextHolder.getContext().setAuthentication(authenticationToken);
            authentication = this.getAuthenticationManager().authenticate(authenticationToken);

        } catch (Exception e){
            this.recordLoginInfo(requestLogin.getUsername(), String.valueOf(ResponseCode.ERROR.getCode()), "登录未成功认证", 0, null, null);
            if(e instanceof UsernameNotFoundException){
//                logger.debug(".............用户不存在：" + requestLogin.getUsername());
                throw new LoginException("用户账号不存在，或已停用：" + requestLogin.getUsername(), e, true);
            }
            if (e instanceof BadCredentialsException){
//                return ResponseValue.error(ResponseCode.USER_CREDENTIALS_ERROR.getCode(), ResponseCode.USER_CREDENTIALS_ERROR.getMessage());
                logger.debug("++++++++++++++++++ 密码错误");
                throw new LoginException(ResponseCode.USER_CREDENTIALS_ERROR.getMessage());
            } else {
                // 2023-03-20
                // 登录验证抛出异常，会在这里统一处理，如：PcUserStopAppException。
                // DefaultAuthenticationProvider
//                return ResponseValue.error(ResponseCode.USER_CREDENTIALS_ERROR.getCode(), e.getMessage());
                throw new LoginException(e.getMessage());
            }
        }

        DefaultUserDetails userDetails = (DefaultUserDetails)authentication.getPrincipal();
        if(this.logger.isDebugEnabled()){
            logger.debug(userDetails.getUserPrincipal().toString());
        }

        // 2023-03-20，对于空验证码类型（登录方式），需要后台自动生成uuid，因为前端没有机会请求验证码获得uuid
        // 2023-07-03, 添加第三方对接的验证类型，也需要自动生成UUID，因为前端直接请求后台（目前预算一体化使用）
        CaptchaType currentCaptchaType = loginCallback.getCaptchaProvider().getCaptchaType();
        if(currentCaptchaType == CaptchaType.None
                || currentCaptchaType == CaptchaType.ThirdParty){
            requestLogin.setUuid(IdUtils.simpleUUID());
        }

        // 添加token失效时间（从配置获取），2023-03-28
        long expiredMinutes = SecurityConfigUtils.getTokenExpireMinutes(requestLogin.getClientType(), this.getSecurityProperties());
        String token = TokenUtils.generateToken(userDetails.getUserPrincipal().getId()
                , userDetails.getUsername(), requestLogin.getUuid(), this.getTokenGenerator(), expiredMinutes);
        logger.debug("token失效分钟:{}", expiredMinutes);
//        String token = this.tokenGenerator.createToken(requestLogin.getUuid(), userDetails.getUserPrincipal().getId()
//                , VariableConstants.DEFAULT_TOKEN_EXPIRED_MINUTES, VariableConstants.TOKEN_SECRET);
        // 缓存登录信息
        // 2024-01-05 登录缓存，失效时间应当长一些，系统默认30天。这和token
        long loginCacheExpiredTime = VariableConstants.DEFAULT_TOKEN_EXPIRED_MINUTES;
        if(expiredMinutes > loginCacheExpiredTime){
            loginCacheExpiredTime = expiredMinutes;
        }
        this.getUserOnlineProvider().cacheUserPrincipal(requestLogin.getUuid(), userDetails.getUserPrincipal(), loginCacheExpiredTime);
        // 把成功登录日志，与uuid关联保存放一起，在异步中调用。2023-03-23
        this.recordLoginInfo(username, String.valueOf(ResponseCode.SUCCESS.getCode()), "登录成功"
                , userDetails.getUserPrincipal().getUserInfo().getId(), requestLogin.getUuid(), requestLogin.getClientType());

        // 2023-08-18，登录成功回调
        AfterLoginCallback afterLoginCallback = PlatformCallbackPostProcessor.getCallbackObject(AfterLoginCallback.class);
        if(afterLoginCallback != null){
            afterLoginCallback.onSuccess(requestLogin, userDetails.getUserPrincipal());
        }

        // 2023-05-12，加上用户信息（商户系统用）
        Map<String, Object> param = new HashMap<>(2);
        param.put(com.walker.web.Constants.TOKEN_NAME, token);
        param.put(SecurityConstants.KEY_USER_INFO, UserUtils.acquireClientUserInfo(userDetails.getUserPrincipal().getUserInfo(), token));
        param.put(SecurityConstants.KEY_USER_INFO_APP, userDetails.getUserPrincipal());
//        return ResponseValue.success(ResponseValueUtils.acquireOneParam(com.walker.web.Constants.TOKEN_NAME, token));
        return param;
    }

    private String validateCaptcha(String code, String uuid, CaptchaProvider<CaptchaResult> captchaProvider){
        if(StringUtils.isEmpty(uuid) || StringUtils.isEmpty(code)){
//            throw new CaptchaException();
            return "请输入验证码";
        }

        CaptchaResult captchaResult = new CaptchaResult();
        captchaResult.setUuid(uuid);
        captchaResult.setCode(code);
        boolean success = captchaProvider.validateCaptcha(captchaResult);

        // 2023-04-07 调整，使用提供者判断验证码是否正确。
        // 2023-06-30 只有短信验证码时，不能删除缓存的验证码，因为存在手机端登录（并同时注册）情况，会调用两次login操作。
        if(captchaProvider.getCaptchaType() != CaptchaType.SmsCode){
            this.getCaptchaCacheProvider().removeCacheData(com.iplatform.base.Constants.CAPTCHA_CODE_PREFIX + uuid);// 删除缓存的验证码
        }

        if(!success){
            logger.error("验证码校验失败: code = " + code);
            return "验证码错误";
        }

        /*String verifyKey = Constants.CAPTCHA_CODE_PREFIX + uuid;
        String captchaCode = this.captchaCacheProvider.getCacheData(verifyKey);
        if(StringUtils.isEmpty(captchaCode)){
            return "验证码不存在，可能已经失效";
        }
        this.captchaCacheProvider.removeCacheData(verifyKey);   // 删除缓存的验证码
        if(!code.equalsIgnoreCase(captchaCode)){
            logger.error("验证码校验失败:" + captchaCode + ", code = " + code);
            return "验证码错误";
        }*/
        return null;
    }

    private void recordLoginInfo(String loginId, String status, String message, long userId, String uuid, String clientType){
        if(this.getLogProperties().isLoginEnabled()){
            logger.debug("异步记录登录日志，后续要补充:" + status + ", " + message);
            AsyncManager.me().execute(this.acquireLoginInfoTask(loginId, status, message, userId, uuid, clientType));
        }
    }

    private TimerTask acquireLoginInfoTask(String loginId, String status, String message, Long userId
            , String uuid, String clientType){
        HttpServletRequest request = ServletUtils.getRequest();
        final WebUserAgent webUserAgent = this.getWebAgentService().getWebUserAgent(request.getHeader("User-Agent"), request);

        return new TimerTask() {
            @Override
            public void run() {
                S_login_info login_info = new S_login_info();
                login_info.setLogin_time(Long.parseLong(DateUtils.getDateTimeSecondForShow()));
                login_info.setUser_name(loginId);
                login_info.setMsg(message);
                login_info.setStatus(status);
                login_info.setInfo_id(NumberGenerator.getLongSequenceNumber());
                if(webUserAgent != null){
                    login_info.setLogin_location(webUserAgent.getLocation());
                    login_info.setBrowser(webUserAgent.getBrowserName());
                    login_info.setIpaddr(webUserAgent.getIp());
                    login_info.setOs(webUserAgent.getOsName());
                }

                // 2023-03-23
                if(status.equals(String.valueOf(ResponseCode.SUCCESS.getCode()))){
                    S_user_login user_login = null;
                    if(getLoginStrategyManager().hasUserLogin(loginId)){
                        user_login = getLoginService().execUpdateUserLogin(userId, loginId, uuid, clientType, login_info, true);
                        getLoginStrategyManager().updateUserLoginCache(user_login);
                    } else {
                        // 登录成功才记录uuid关联缓存
                        user_login = getLoginService().execUpdateUserLogin(userId, loginId, uuid, clientType, login_info, false);
                        getLoginStrategyManager().putUserLoginCache(user_login);
                    }
                } else {
                    // 登录失败，仅记录登录日志
                    getLogService().execInsertLoginLog(login_info, userId);
                }
            }
        };
    }

    private AuthenticationManager getAuthenticationManager(){
        return BeanContextAware.getBeanByType(AuthenticationManager.class);
    }
    private TokenGenerator getTokenGenerator(){
        return BeanContextAware.getBeanByType(TokenGenerator.class);
    }
    private CacheProvider<String> getCaptchaCacheProvider(){
        return (CacheProvider<String>)BeanContextAware.getBeanByName(BEAN_NAME_CAPTCHA_CACHE);
    }
    private WebAgentService getWebAgentService(){
        return BeanContextAware.getBeanByType(WebAgentService.class);
    }
    private UserOnlineProvider getUserOnlineProvider(){
        return BeanContextAware.getBeanByType(UserOnlineProvider.class);
    }
    private SecurityProperties getSecurityProperties(){
        return BeanContextAware.getBeanByType(SecurityProperties.class);
    }
    private LogProperties getLogProperties(){
        return BeanContextAware.getBeanByType(LogProperties.class);
    }
    private LoginServiceImpl getLoginService(){
        return BeanContextAware.getBeanByType(LoginServiceImpl.class);
    }
    private LogServiceImpl getLogService(){
        return BeanContextAware.getBeanByType(LogServiceImpl.class);
    }
    private LoginStrategyManager getLoginStrategyManager(){
        return BeanContextAware.getBeanByType(LoginStrategyManager.class);
    }

    private static final String BEAN_NAME_CAPTCHA_CACHE = "captchaCacheProvider";
    //~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`
    //~ 以上是登录方法抽取代码。2023-06-28
    //~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`

    @Deprecated
    public void loginAsWorkflowRole(){
        DefaultUserDetails userDetails = this.getCurrentUserDetails();
        userDetails.addGrantedAuthority(Constants.ROLE_ACTIVITI_USER);
        logger.debug("......loginAsWorkflowRole(), {}", userDetails.getRoleIdList());
    }

    @Override
    public List<String> getCurrentUserRoleIdList(){
        DefaultUserDetails userDetails = this.getCurrentUserDetails();
        if(userDetails == null){
            logger.error("获取当前登录用户错误：getCurrentUserDetails() == null");
            return null;
        }
        return userDetails.getRoleIdList();
    }

    @Override
    public UserPrincipal<S_user_core> getCurrentUserPrincipal() {
        DefaultUserDetails userDetails = this.getCurrentUserDetails();
        if(userDetails == null){
            logger.error("获取当前登录用户错误：getCurrentUserDetails() == null");
            return null;
        }
        return userDetails.getUserPrincipal();
    }

    @Override
    public S_user_core getCurrentUser() {
        UserPrincipal<S_user_core> userPrincipal = this.getCurrentUserPrincipal();
        if(userPrincipal == null){
            throw new WebRuntimeException("当前操作未找到登录人员: userPrincipal not found in thread!");
        }
        return userPrincipal.getUserInfo();
    }

    @Override
    public long getCurrentUserId() {
        S_user_core user = this.getCurrentUser();
        return user.getId();
    }

    @Override
    public String encryptPassword(String password) {
        PasswordEncoder passwordEncoder = BeanContextAware.getBeanByType(PasswordEncoder.class);
        return passwordEncoder.encode(password);
    }

    @Override
    public boolean matchesPassword(String rawPassword, String encodedPassword) {
        PasswordEncoder passwordEncoder = BeanContextAware.getBeanByType(PasswordEncoder.class);
        return passwordEncoder.matches(rawPassword, encodedPassword);
    }

    private DefaultUserDetails getCurrentUserDetails(){
        Authentication authentication = this.getAuthentication();
        if(authentication == null){
            throw new WebRuntimeException("当前操作未找到登录认证对象: authentication not found in thread!");
        }
        Object userDetails = authentication.getPrincipal();
        if(userDetails instanceof DefaultUserDetails){
            return (DefaultUserDetails) userDetails;
        }
        return null;
    }

    /**
     * 获取Authentication
     * @author 时克英
     * @date 2022-11-10
     */
    private Authentication getAuthentication() {
        return SecurityContextHolder.getContext().getAuthentication();
    }

    /**
     * 返回系统配置可变参数对象。
     * @param key 参数 key
     * @return
     * @date 2022-11-29
     */
    private Variable getArgumentVariable(String key){
        Variable v =  BeanContextAware.getBeanByType(ArgumentsManager.class).getVariable(key);
        if(v == null){
            throw new IllegalArgumentException("可变配置参数不存在: " + key);
        }
        return v;
    }
}