package middleware

import (
	"strings"

	"lokistack/models"
	"lokistack/pkg/jwt"
	"lokistack/repository"
	"lokistack/utils"

	"github.com/gin-gonic/gin"
)

func JWTAuth() gin.HandlerFunc {
	return func(c *gin.Context) {
		authHeader := c.GetHeader("Authorization")
		if authHeader == "" {
			utils.Unauthorized(c, "missing authorization header")
			c.Abort()
			return
		}

		parts := strings.SplitN(authHeader, " ", 2)
		if len(parts) != 2 || strings.ToLower(parts[0]) != "bearer" {
			utils.Unauthorized(c, "invalid authorization header format")
			c.Abort()
			return
		}

		claims, err := jwt.ParseToken(parts[1])
		if err != nil {
			utils.Unauthorized(c, "invalid or expired token")
			c.Abort()
			return
		}

		// 安全增强：拒绝refresh token用于API访问
		if claims.TokenType == "refresh" {
			utils.Unauthorized(c, "refresh token cannot be used for API access")
			c.Abort()
			return
		}

		// 会话版本校验：改密/重置密码后 TokenVersion 递增，旧 token 立即失效；
		// 同时以数据库中的最新 role 为准（角色变更即时生效，不依赖旧 claims）。
		db := repository.GetDB()
		db.RLock()
		var current *models.User
		for i := range db.Users {
			if db.Users[i].ID == claims.UserID {
				u := db.Users[i]
				current = &u
				break
			}
		}
		db.RUnlock()
		if current == nil {
			utils.Unauthorized(c, "user no longer exists")
			c.Abort()
			return
		}
		if claims.TokenVersion != current.TokenVersion {
			utils.Unauthorized(c, "session revoked, please login again")
			c.Abort()
			return
		}

		c.Set("user", claims)
		c.Set("userId", current.ID)
		c.Set("username", current.Username)
		c.Set("role", current.Role)
		c.Next()
	}
}

func AdminAuth() gin.HandlerFunc {
	return func(c *gin.Context) {
		role, exists := c.Get("role")
		if !exists || role != "admin" {
			utils.Forbidden(c, "admin access required")
			c.Abort()
			return
		}
		c.Next()
	}
}

func CORSMiddleware() gin.HandlerFunc {
	return func(c *gin.Context) {
		origin := c.GetHeader("Origin")
		if origin == "" {
			origin = "*"
		}
		c.Writer.Header().Set("Access-Control-Allow-Origin", origin)
		c.Writer.Header().Set("Access-Control-Allow-Credentials", "true")
		c.Writer.Header().Set("Access-Control-Allow-Headers", "Content-Type, Content-Length, Authorization, Accept, X-Requested-With")
		c.Writer.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS, PATCH")
		if c.Request.Method == "OPTIONS" {
			c.AbortWithStatus(204)
			return
		}
		c.Next()
	}
}