package com.iot.gateway.oauth;

import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.iot.gateway.entity.OpenClient;
import com.iot.gateway.mapper.OpenClientMapper;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.tags.Tag;
import java.time.LocalDateTime;
import java.util.HashMap;
import java.util.Map;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

@Slf4j
@Tag(name = "OAuth 2.0 授权中心")
@RestController
@RequestMapping("/oauth2")
public class OAuth2TokenController {

    @Autowired
    private OpenClientMapper clientMapper;

    @Autowired
    private JwtTokenProvider jwtTokenProvider;

    @Operation(summary = "客户端凭据模式换取访问令牌 (Client Credentials Grant)")
    @PostMapping(value = "/token")
    public ResponseEntity<Map<String, Object>> issueToken(
            @RequestParam(value = "grant_type", required = false) String formGrantType,
            @RequestParam(value = "client_id", required = false) String formClientId,
            @RequestParam(value = "client_secret", required = false) String formClientSecret,
            @RequestParam(value = "scope", required = false) String formScope,
            @RequestBody(required = false) Map<String, String> jsonBody,
            jakarta.servlet.http.HttpServletRequest request) {

        String grantType = formGrantType != null ? formGrantType : (jsonBody != null ? jsonBody.get("grant_type") : null);
        String clientId = formClientId != null ? formClientId : (jsonBody != null ? jsonBody.get("client_id") : null);
        String clientSecret = formClientSecret != null ? formClientSecret : (jsonBody != null ? jsonBody.get("client_secret") : null);
        String scope = formScope != null ? formScope : (jsonBody != null ? jsonBody.get("scope") : null);

        Map<String, Object> error = new HashMap<>();

        if (!"client_credentials".equalsIgnoreCase(grantType)) {
            error.put("error", "unsupported_grant_type");
            error.put("error_description", "仅支持 client_credentials 客户端凭据授权模式");
            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(error);
        }

        if (clientId == null || clientSecret == null) {
            error.put("error", "invalid_client");
            error.put("error_description", "client_id 或 client_secret 不能为空");
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(error);
        }

        OpenClient client = clientMapper.selectOne(new LambdaQueryWrapper<OpenClient>()
                .eq(OpenClient::getClientId, clientId));

        if (client == null || !client.getClientSecret().equals(clientSecret)) {
            error.put("error", "invalid_client");
            error.put("error_description", "客户端标识或密钥错误");
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(error);
        }

        if (client.getStatus() == null || client.getStatus() != 1) {
            error.put("error", "unauthorized_client");
            error.put("error_description", "客户端已被禁用，无法申请令牌");
            return ResponseEntity.status(HttpStatus.FORBIDDEN).body(error);
        }

        if (client.getExpireTime() != null && client.getExpireTime().isBefore(LocalDateTime.now())) {
            error.put("error", "expired_token");
            error.put("error_description", "客户端凭证已过期");
            return ResponseEntity.status(HttpStatus.FORBIDDEN).body(error);
        }

        // 校验 IP 白名单
        String clientIp = com.iot.gateway.common.IpUtils.getClientIp(request);
        if (!com.iot.gateway.common.IpUtils.isAllowed(clientIp, client.getIpWhitelist())) {
            log.warn("OAuth 2.0 客户端 IP 白名单拦截: clientId={}, clientIp={}, whitelist={}",
                    clientId, clientIp, client.getIpWhitelist());
            error.put("error", "unauthorized_client");
            error.put("error_description", "客户端来源 IP [" + clientIp + "] 不在允许的白名单范围内");
            return ResponseEntity.status(HttpStatus.FORBIDDEN).body(error);
        }

        String accessToken = jwtTokenProvider.generateToken(client);
        log.info("OAuth 2.0 成功颁发令牌: clientId={}, clientIp={}, tenantId={}", clientId, clientIp, client.getTenantId());

        Map<String, Object> response = new HashMap<>();
        response.put("access_token", accessToken);
        response.put("token_type", "Bearer");
        response.put("expires_in", jwtTokenProvider.getTokenExpireSeconds());
        response.put("scope", client.getScopes());
        response.put("tenant_id", client.getTenantId());
        response.put("client_name", client.getClientName());

        return ResponseEntity.ok(response);
    }
}