package com.baiyue.common.security;

import com.baiyue.common.core.mybatis.AuditorProvider;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.boot.autoconfigure.AutoConfiguration;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Primary;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

/**
 * Servlet 服务安全自动配置，建立无状态 JWT 认证链、统一异常响应和审计操作者解析。
 */
@AutoConfiguration(
        after = JwksJwtDecoderAutoConfiguration.class,
        before = SecurityAutoConfiguration.class)
@EnableMethodSecurity
public class BaiyueSecurityAutoConfiguration {
    @Bean
    @ConditionalOnMissingBean
    JwtClaimsMapper jwtClaimsMapper() { return new JwtClaimsMapper(); }

    @Bean
    @ConditionalOnMissingBean(AuthenticationEntryPoint.class)
    AuthenticationEntryPoint jsonAuthenticationEntryPoint(ObjectMapper objectMapper) {
        return new JsonAuthenticationEntryPoint(objectMapper);
    }

    @Bean
    @ConditionalOnMissingBean(AccessDeniedHandler.class)
    AccessDeniedHandler jsonAccessDeniedHandler(ObjectMapper objectMapper) {
        return new JsonAccessDeniedHandler(objectMapper);
    }

    @Bean
    @ConditionalOnMissingBean
    JwtAuthenticationFilter jwtAuthenticationFilter(JwtDecoder jwtDecoder, JwtClaimsMapper claimsMapper,
                                                      AuthenticationEntryPoint entryPoint,
                                                      org.springframework.beans.factory.ObjectProvider<StringRedisTemplate> redis,
                                                      ObjectMapper objectMapper,
                                                      @Value("${baiyue.security.token-key-prefix:baiyue:auth}") String keyPrefix,
                                                      @Value("${baiyue.security.session-mode:redis}") String sessionMode,
                                                      @Value("${baiyue.security.session-validation-uri:http://auth:9100/internal/auth/accounts/sessions/validate}") String validationUri,
                                                      @Value("${baiyue.security.internal-service-token}") String internalToken) {
        if (!"redis".equalsIgnoreCase(sessionMode)) {
            throw new IllegalStateException("Only shared Redis access sessions are supported");
        }
        StringRedisTemplate template = redis.getIfAvailable();
        if (template == null) throw new IllegalStateException("Redis access sessions require StringRedisTemplate");
        AccessTokenSessionValidator validator = new RedisAccessTokenSessionValidator(template, keyPrefix, objectMapper,
            new HttpSessionStateVerifier(validationUri, internalToken, objectMapper));
        return new JwtAuthenticationFilter(jwtDecoder, claimsMapper, entryPoint, validator);
    }

    @Bean
    FilterRegistrationBean<JwtAuthenticationFilter> disableContainerRegistration(
            JwtAuthenticationFilter filter) {
        FilterRegistrationBean<JwtAuthenticationFilter> registration = new FilterRegistrationBean<>(filter);
        registration.setEnabled(false);
        return registration;
    }

    @Bean
    @ConditionalOnMissingBean(SecurityFilterChain.class)
    SecurityFilterChain baiyueSecurityFilterChain(
            HttpSecurity http, JwtAuthenticationFilter jwtFilter,
            AuthenticationEntryPoint entryPoint, AccessDeniedHandler deniedHandler) throws Exception {
        return http
                .csrf(csrf -> csrf.disable())
                .httpBasic(httpBasic -> httpBasic.disable())
                .formLogin(form -> form.disable())
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .exceptionHandling(errors -> errors
                        .authenticationEntryPoint(entryPoint).accessDeniedHandler(deniedHandler))
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers("/actuator/health", "/v3/api-docs/**", "/swagger-ui/**", "/api/pda-updates/**").permitAll()
                        .requestMatchers("/internal/**").permitAll()
                        .requestMatchers("/openapi/**").permitAll()
                        .requestMatchers("/api/merchant/**").hasAuthority("APP_MERCHANT")
                        .requestMatchers("/api/platform/**").hasAuthority("APP_PLATFORM")
                        .anyRequest().authenticated())
                .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class)
                .build();
    }

    @Bean
    @Primary
    AuditorProvider securityAuditorProvider() { return new SecurityAuditorProvider(); }
}