package middleware

import (
	"strings"

	"github.com/gin-gonic/gin"

	"eai_agentplatform/backend/internal/auth"
	"eai_agentplatform/backend/internal/config"
	"eai_agentplatform/backend/internal/model"
	"eai_agentplatform/backend/internal/store"
	"eai_agentplatform/backend/internal/web"
)

// Auth 解析 JWT → 校验用户 → 注入 current_user
func Auth(cfg *config.Config) gin.HandlerFunc {
	return func(c *gin.Context) {
		tokenStr := extractBearer(c)
		if tokenStr == "" {
			web.Fail(c, web.NewAuthError("缺少 Authorization Bearer 令牌"))
			c.Abort()
			return
		}

		claims, err := auth.ParseToken(tokenStr, cfg.JWTSecret)
		if err != nil {
			web.Fail(c, web.NewAuthError("令牌无效或已过期"))
			c.Abort()
			return
		}

		username, _ := claims["sub"].(string)
		if username == "" {
			web.Fail(c, web.NewAuthError("令牌中缺少用户标识"))
			c.Abort()
			return
		}

		var user model.User
		if err := store.DB.Where("username = ?", username).First(&user).Error; err != nil {
			web.Fail(c, web.NewAuthError("用户不存在"))
			c.Abort()
			return
		}
		if user.Status != "active" {
			web.Fail(c, web.NewAuthError("账号已禁用"))
			c.Abort()
			return
		}

		c.Set("current_user", &user)
	c.Next()
	}
}

// RequireAdmin 管理员角色守卫（须在 Auth 之后）
func RequireAdmin() gin.HandlerFunc {
	return func(c *gin.Context) {
		u := CurrentUser(c)
		if u == nil || u.Role != "admin" {
			web.Fail(c, web.NewForbiddenError("需要管理员权限"))
			c.Abort()
			return
		}
		c.Next()
	}
}

// CurrentUser 从 context 取当前用户（可能为 nil）
func CurrentUser(c *gin.Context) *model.User {
	if v, ok := c.Get("current_user"); ok {
		if u, ok := v.(*model.User); ok {
			return u
		}
	}
	return nil
}

func extractBearer(c *gin.Context) string {
	h := c.GetHeader("Authorization")
	if strings.HasPrefix(h, "Bearer ") {
		return strings.TrimSpace(h[len("Bearer "):])
	}
	return ""
}