package com.kaidi.oa.web;

import com.kaidi.oa.common.ApiException;
import com.kaidi.oa.common.ApiResp;
import com.kaidi.oa.domain.SysUser;
import com.kaidi.oa.service.AuthService;
import com.kaidi.oa.service.AuthorizationService;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.validation.constraints.NotBlank;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.util.LinkedHashMap;
import java.util.Map;
import java.util.TreeSet;

/**
 * Authentication endpoints. Issues an opaque token on login; the frontend sends
 * it back as a Bearer token. Session lookup and logout supported.
 */
@RestController
@RequestMapping("/api/oa/auth")
public class AuthController {

    private final AuthService authService;
    private final CurrentUserResolver currentUser;
    private final AuthorizationService authorizationService;

    public AuthController(AuthService authService, CurrentUserResolver currentUser,
                          AuthorizationService authorizationService) {
        this.authService = authService;
        this.currentUser = currentUser;
        this.authorizationService = authorizationService;
    }

    public record LoginRequest(@NotBlank String loginName, @NotBlank String password) {
    }

    @PostMapping("/login")
    public ApiResp<Map<String, Object>> login(@RequestBody LoginRequest req) {
        AuthService.LoginResult result = authService.login(req.loginName(), req.password());
        return ApiResp.ok(toSession(result.user(), result.token()));
    }

    @GetMapping("/session")
    public ApiResp<Map<String, Object>> session(HttpServletRequest request) {
        String token = currentUser.extractToken(request);
        SysUser user = authService.resolve(token);
        if (user == null) {
            throw new ApiException(401, "未登录或会话已过期");
        }
        return ApiResp.ok(toSession(user, token));
    }

    @PostMapping("/logout")
    public ApiResp<Void> logout(HttpServletRequest request) {
        authService.logout(currentUser.extractToken(request));
        return ApiResp.ok();
    }

    private Map<String, Object> toSession(SysUser user, String token) {
        Map<String, Object> map = new LinkedHashMap<>();
        map.put("token", token);
        map.put("id", user.getId());
        map.put("loginName", user.getLoginName());
        map.put("displayName", user.getDisplayName());
        map.put("deptId", user.getDeptId());
        map.put("title", user.getTitle());
        map.put("email", user.getEmail());
        map.put("roles", new TreeSet<>(authorizationService.roleCodesOf(user.getId())));
        return map;
    }
}