package shop.alien.dining.filter;

import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * 预认证过滤器
 * 用于处理微信点餐系统的权限验证
 */
@Component
public class PreAuthFilter extends OncePerRequestFilter {
    // 自定义权限请求头（前端传递角色/权限）
    private static final String USER_TOKEN_HEADER = "Authorization";
    private static final String PLATFORM_TYPE_HEADER = "X-platform-type";

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {
        // 1. 从请求头获取token信息
        String token = request.getHeader(USER_TOKEN_HEADER);
        String platformType = request.getHeader(PLATFORM_TYPE_HEADER);

        /**
         * 如果不是平台端请求，直接放行，加admin权放行
         */
        if(null == platformType || !"platform".equalsIgnoreCase(platformType)) {
            UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
                    "notPlatformUser", // 无认证场景，用户名可自定义
                    null, // 无需密码，置空
                    AuthorityUtils.commaSeparatedStringToAuthorityList(String.join(",", "ROLE_ADMIN")));// 权限列表
            chain.doFilter(request, response);
            return;
        }

        if (token == null) {
            // 无权限头：视为匿名用户（仅能访问公开接口）
            chain.doFilter(request, response);
            return;
        }

        // TODO: 根据实际需求解析token并设置权限
        // 2. 解析角色为权限集合（Spring Security 角色需以ROLE_开头）
        // 3. 构建认证令牌
        UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
                "diningUser", // 用户名
                null, // 无需密码，置空
                AuthorityUtils.commaSeparatedStringToAuthorityList(String.join(",", "ROLE_USER")));// 权限列表
        // 4. 设置请求上下文
        authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
        // 5. 将认证信息存入SecurityContext（标记用户已"认证"，仅用于授权）
        SecurityContextHolder.getContext().setAuthentication(authToken);

        // 继续执行过滤器链
        chain.doFilter(request, response);
    }
}

