package com.trafficaudit.security.filter;

import com.trafficaudit.security.utils.JwtUtils;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.annotation.Resource;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Arrays;
import java.util.List;

/**
 * 接口登录校验过滤器：/api/** 除白名单外必须携带有效 Bearer 令牌，否则直接返回 401。
 * 白名单只保留登录前必须调用的接口（登录、行为验证码）。
 */
@Component
@Order(1)
public class JwtAuthFilter extends OncePerRequestFilter {

    /** 免登录接口（登录页在拿到令牌前必须能调用） */
    private static final List<String> WHITELIST = Arrays.asList(
            "/api/auth/login",
            "/api/auth/captcha",
            "/api/auth/captcha/verify",
            "/api/auth/captcha-config"
    );

    @Resource
    private JwtUtils jwtUtils;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {
        String uri = request.getRequestURI();
        // 非接口请求（前端静态资源、首页）放行
        if (uri == null || !uri.startsWith("/api")) {
            chain.doFilter(request, response);
            return;
        }
        // 预检请求放行，交由 CORS 处理
        if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
            chain.doFilter(request, response);
            return;
        }
        if (WHITELIST.contains(uri)) {
            chain.doFilter(request, response);
            return;
        }
        String username = jwtUtils.resolveUsername(request.getHeader("Authorization"));
        if (username == null) {
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            response.setContentType("application/json;charset=UTF-8");
            response.getWriter().write("{\"code\":401,\"message\":\"未登录或登录已过期\",\"data\":null}");
            return;
        }
        request.setAttribute("loginUser", username);
        chain.doFilter(request, response);
    }
}