package com.iplatform.security;

import com.iplatform.base.DefaultUserPrincipal;
import com.iplatform.base.SecurityConstants;
import com.iplatform.base.VariableConstants;
import com.iplatform.base.util.TokenUtils;
import com.iplatform.core.TokenAwareContext;
import com.iplatform.core.TokenEntity;
import com.iplatform.model.po.S_user_core;
import com.iplatform.security.config.SecurityProperties;
import com.walker.infrastructure.ApplicationRuntimeException;
import com.walker.web.Constants;
import com.walker.web.ResponseCode;
import com.walker.web.ResponseValue;
import com.walker.web.TokenException;
import com.walker.web.TokenGenerator;
import com.walker.web.UserOnlineProvider;
import com.walker.web.UserPrincipal;
import com.walker.web.util.ServletUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.List;

public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {

    protected final transient Logger logger = LoggerFactory.getLogger(getClass());

    private TokenGenerator tokenGenerator;
    private UserOnlineProvider userOnlineProvider;
    private DefaultUserDetailsService defaultUserDetailsService;

    // 2023-03-28
    private SecurityProperties securityProperties;

    public void setSecurityProperties(SecurityProperties securityProperties) {
        this.securityProperties = securityProperties;
    }

    public void setDefaultUserDetailsService(DefaultUserDetailsService defaultUserDetailsService) {
        this.defaultUserDetailsService = defaultUserDetailsService;
    }

    public void setUserOnlineProvider(UserOnlineProvider userOnlineProvider) {
        this.userOnlineProvider = userOnlineProvider;
    }

    public void setTokenGenerator(TokenGenerator tokenGenerator) {
        this.tokenGenerator = tokenGenerator;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request
            , HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {

        String token = TokenUtils.getAuthorizationToken(request);
        if(token != null){
            try{
                String data = tokenGenerator.validateToken(token, VariableConstants.TOKEN_SECRET);
                logger.debug("token_data = " + data);
                String[] userIdAndKey = TokenUtils.getUserIdAndKey(data);
                if(userIdAndKey == null || userIdAndKey.length != 3){
                    throw new ApplicationRuntimeException("token携带用户信息解析错误:" + data);
                }

                String uuid = userIdAndKey[2];
                String loginId = userIdAndKey[1];
                DefaultUserDetails userDetails = null;

                // 根据token获取用户对象
                DefaultUserPrincipal userPrincipal = this.acquireAuthenticationUser(uuid);
                if(userPrincipal == null){
                    // 2022-11-15，这里要告诉客户端刷新token
                    // redis中缓存登录时间应小于token失效时间
                    userDetails = this.defaultUserDetailsService.acquireUserPrincipal(loginId);

                    // 2023-09-03 当前端传入的 token 是无效的情况下，如：用户已不存在，需要删除登录缓存
                    if(userDetails == null){
                        this.userOnlineProvider.removeUserPrincipal(uuid);
                        this.logger.warn("用户已不存在，删除登录状态缓存：{}", uuid);
                        return;
                    }

                    userPrincipal = (DefaultUserPrincipal)userDetails.getUserPrincipal();
                    logger.debug("token需要刷新: " + userPrincipal.getUserName());
                    this.tellClientRefreshToken(response, uuid, userPrincipal);
                    // 2022-11-15，以下响应代码不再需要，因为已经刷新token，重新缓存登录用户，
//                    ServletUtils.renderString(response, ResponseValue.error(ResponseCode.RE_LOGIN.getCode(), "token不存在或已过期，请重新认证"));
//                    return;
                } else {
                    userDetails = this.acquireUserDetails(userPrincipal);
                }

                UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
                authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(authentication);

                // 2023-08-05
                TokenAwareContext.setCurrentToken(new TokenEntity(uuid, loginId));

            } catch (TokenException ex){
                if(ex.isExpired()){
                    ServletUtils.renderString(response, ResponseValue.error(ResponseCode.RE_LOGIN.getCode(), "token已过期，请重新获取"));
                    return;
                }
                System.out.println(ex.getTitle());
                ServletUtils.renderString(response, ResponseValue.error(ResponseCode.ERROR.getCode(), ex.getTitle()));
                return;

            } catch (Exception ex){
                logger.error("根据token获得登录信息错误:" + ex.getMessage(), ex);
                ServletUtils.renderString(response, ResponseValue.error(ResponseCode.ERROR.getCode(), ex.getMessage()));
                return;
            }
        }
        // 要尝试：token不存在不能访问
//        logger.warn("token不存在，无法访问系统更能");
        filterChain.doFilter(request, response);
        // 2023-08-05
        TokenAwareContext.clearCurrentToken();
    }

    /**
     * 通知终端刷新token，token会写入响应头中: TokenRefresh 字段。
     * @param response
     * @param uuid
     * @param userPrincipal
     */
    private void tellClientRefreshToken(HttpServletResponse response, String uuid, DefaultUserPrincipal userPrincipal){
//        String token = this.tokenGenerator.createToken(uuid, userPrincipal.getId()
//                , VariableConstants.DEFAULT_TOKEN_EXPIRED_MINUTES, VariableConstants.TOKEN_SECRET);
        // 刷新token，通常PC端会用到，移动端时间长使用几率低，因此这里找PC端配置。2023-03-28
        String token = TokenUtils.generateToken(userPrincipal.getId()
                , userPrincipal.getUserName(), uuid, this.tokenGenerator, securityProperties.getTokenExpireWeb());
        // 重新设置用户创建token时间
        userPrincipal.setLastLoginTime(System.currentTimeMillis());
        this.userOnlineProvider.cacheUserPrincipal(uuid, userPrincipal, securityProperties.getTokenExpireWeb());
        response.addHeader(Constants.TOKEN_HEADER_REFRESH, token);
        if(this.logger.isDebugEnabled()){
            logger.debug("刷新token, uuid = " + uuid + ", " + token);
        }
    }

    private DefaultUserDetails acquireUserDetails(UserPrincipal<S_user_core> userPrincipal){
        DefaultUserDetails userDetails = new DefaultUserDetails(userPrincipal);
//        if(userPrincipal.getUserInfo().isSupervisor()){
        if(userDetails.isSupervisor()){
            userDetails.addGrantedAuthority(SecurityConstants.ROLE_SUPER_ADMIN);
            userDetails.addGrantedAuthority(SecurityConstants.ROLE_ADMIN);
            userDetails.addGrantedAuthority(SecurityConstants.ROLE_USER);
        } else {
            // 当前数据库只有一个普通角色:2
//            userDetails.addGrantedAuthority("2");
            // 在用户登录后，缓存的就有角色ID集合，这里每次访问重新设置到对象中。2022-11-11
            List<String> roleIdList = userPrincipal.getRoleIdList();
            logger.info("缓存中获取 userPrincipal.getRoleIdList() = " + roleIdList);
            if(roleIdList != null){
                for(String roleId : roleIdList){
                    userDetails.addGrantedAuthority(roleId);
                }
            }
        }
        return userDetails;
    }

    /**
     * 模拟测试，后续修改为数据库方式。<p></p>
     * 从缓存中读取用户登录信息，如果换成失效为空。
     * @param uuid
     * @return
     * @date 2022-11-15
     */
    private DefaultUserPrincipal acquireAuthenticationUser(String uuid){
        /*String userId = userIdAndKey[0];
        if(userId.equals("0")){
            // 0 为超级管理员
            return MockPrincipalUtils.createSupervisor();
        } else {
            // 其他值模拟为普通用户
            return MockPrincipalUtils.createNormalUser("100");
        }*/
        // uuid
//        String loginKey = userIdAndKey[2];
        return (DefaultUserPrincipal)this.userOnlineProvider.getUserPrincipal(uuid);
    }
}