package com.ruoyi.web.controller.sso;

import com.alibaba.fastjson.JSON;
import com.ruoyi.common.core.domain.entity.SysUser;
import com.ruoyi.common.core.domain.model.LoginUser;
import com.ruoyi.common.utils.StringUtils;
import com.ruoyi.framework.web.service.TokenService;
import com.ruoyi.system.service.ISysUserService;
import com.smartor.domain.SSOTokenResponse;
import com.smartor.domain.SSOUserInfo;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.*;
import org.springframework.http.client.SimpleClientHttpRequestFactory;
import org.springframework.util.LinkedMultiValueMap;
import org.springframework.util.MultiValueMap;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.client.RestTemplate;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.net.URLEncoder;

/**
 * SSO单点登录控制器
 */
@RestController
@RequestMapping("/sso")
@Slf4j
public class SSOController {

    @Value("${sso.client_id}")
    private String clientId;

    @Value("${sso.client_secret}")
    private String clientSecret;

    @Value("${sso.internal.authorize_url}")
    private String internalAuthorizeUrl;

    @Value("${sso.internal.token_url}")
    private String internalTokenUrl;

    @Value("${sso.internal.userinfo_url}")
    private String internalUserinfoUrl;

    @Value("${sso.internal.redirect_uri}")
    private String internalRedirectUri;

    @Value("${sso.external.authorize_url}")
    private String externalAuthorizeUrl;

    @Value("${sso.external.token_url}")
    private String externalTokenUrl;

    @Value("${sso.external.userinfo_url}")
    private String externalUserinfoUrl;

    @Value("${sso.external.redirect_uri}")
    private String externalRedirectUri;

    @Value("${sso.state}")
    private String state;

    @Value("${sso.scope}")
    private String scope;

    @Autowired
    private ISysUserService userService;

    @Autowired
    private TokenService tokenService;

    private final RestTemplate restTemplate;

    public SSOController() {
        // 配置RestTemplate超时
        SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
        factory.setConnectTimeout(10000); // 连接超时10秒
        factory.setReadTimeout(30000);    // 读取超时30秒
        this.restTemplate = new RestTemplate(factory);
    }

    /**
     * SSO登录入口 - 信通院会调用这个地址
     * 访问路径：http://域名:8095/sso/login
     */
    @GetMapping("")
    public void ssoLogin(HttpServletResponse response, HttpServletRequest request) throws IOException {
        log.info("收到SSO登录请求，开始重定向到授权服务器");

        // 获取客户端IP
        String clientIp = getClientIp(request);
        boolean isInternal = isInternalNetwork(clientIp);

        // 构建授权URL
        String authUrl = buildAuthorizationUrl(isInternal);
        log.info("重定向到授权URL: {}", authUrl);

        response.sendRedirect(authUrl);
    }

    /**
     * SSO回调处理
     */
    @GetMapping("/callback")
    public void ssoCallback(@RequestParam(required = false) String code,
                           @RequestParam(required = false) String state,
                           @RequestParam(required = false) String error,
                           HttpServletResponse response,
                           HttpServletRequest request) throws IOException {

        log.info("收到SSO回调，code: {}, state: {}, error: {}", code, state, error);

        if (error != null) {
            log.error("SSO授权失败: {}", error);
            try {
                response.sendRedirect("/login?sso_error=" + URLEncoder.encode(error, "UTF-8"));
            } catch (Exception e) {
                log.error("重定向失败", e);
                response.sendRedirect("/login?sso_error=unknown_error");
            }
            return;
        }

        if (code == null || !this.state.equals(state)) {
            log.error("SSO回调参数错误，code: {}, state: {}", code, state);
            response.sendRedirect("/login?sso_error=invalid_callback");
            return;
        }

        try {
            // 获取客户端IP
            String clientIp = getClientIp(request);
            boolean isInternal = isInternalNetwork(clientIp);

            // 1. 用code换取access_token
            SSOTokenResponse tokenResponse = getAccessToken(code, isInternal);
            log.info("获取到access_token: {}", tokenResponse.getAccess_token());

            // 2. 用access_token获取用户信息
            SSOUserInfo userInfo = getUserInfo(tokenResponse.getAccess_token(), isInternal);
            log.info("获取到用户信息: {}", userInfo);

            // 3. 根据用户信息创建本地会话
            String token = createLocalSession(userInfo);

            // 4. 重定向到前端首页，携带token
            String frontendUrl = "/#/index?token=" + token;
            response.sendRedirect(frontendUrl);

        } catch (RuntimeException e) {
            log.error("SSO业务处理失败: {}", e.getMessage(), e);
            try {
                response.sendRedirect("/login?sso_error=" + URLEncoder.encode(e.getMessage(), "UTF-8"));
            } catch (Exception ex) {
                log.error("重定向失败", ex);
                response.sendRedirect("/login?sso_error=system_error");
            }
        } catch (Exception e) {
            log.error("SSO登录处理失败", e);
            response.sendRedirect("/login?sso_error=login_failed");
        }
    }

    /**
     * 构建授权URL
     */
    private String buildAuthorizationUrl(boolean isInternal) {
        try {
            String redirectUri = getRedirectUri(isInternal);
            return getAuthorizeUrl(isInternal) + "?" +
                    "client_id=" + clientId +
                    "&redirect_uri=" + URLEncoder.encode(redirectUri, "UTF-8") +
                    "&response_type=code" +
                    "&state=" + state +
                    "&scope=" + URLEncoder.encode(scope, "UTF-8");
        } catch (Exception e) {
            log.error("构建授权URL失败", e);
            throw new RuntimeException("构建授权URL失败", e);
        }
    }

    /**
     * 获取访问令牌
     */
    private SSOTokenResponse getAccessToken(String code, boolean isInternal) throws Exception {
        HttpHeaders headers = new HttpHeaders();
        headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);

        MultiValueMap<String, String> params = new LinkedMultiValueMap<>();
        params.add("client_id", clientId);
        params.add("client_secret", clientSecret);
        params.add("code", code);
        params.add("grant_type", "authorization_code");
        params.add("redirect_uri", getRedirectUri(isInternal));

        HttpEntity<MultiValueMap<String, String>> request = new HttpEntity<>(params, headers);

        ResponseEntity<String> response = restTemplate.exchange(
                getTokenUrl(isInternal), HttpMethod.POST, request, String.class);

        log.info("Token响应: {}", response.getBody());

        if (response.getBody() == null || response.getBody().trim().isEmpty()) {
            throw new RuntimeException("Token响应为空");
        }

        SSOTokenResponse tokenResponse = JSON.parseObject(response.getBody(), SSOTokenResponse.class);

        if (tokenResponse == null || StringUtils.isEmpty(tokenResponse.getAccess_token())) {
            throw new RuntimeException("获取access_token失败");
        }

        return tokenResponse;
    }

    /**
     * 获取用户信息
     */
    private SSOUserInfo getUserInfo(String accessToken, boolean isInternal) throws Exception {
        HttpHeaders headers = new HttpHeaders();
        headers.set("Authorization", "Bearer " + accessToken);

        HttpEntity<String> entity = new HttpEntity<>(headers);

        ResponseEntity<String> response = restTemplate.exchange(
                getUserinfoUrl(isInternal), HttpMethod.GET, entity, String.class);

        log.info("用户信息响应: {}", response.getBody());

        if (response.getBody() == null || response.getBody().trim().isEmpty()) {
            throw new RuntimeException("用户信息响应为空");
        }

        SSOUserInfo userInfo = JSON.parseObject(response.getBody(), SSOUserInfo.class);

        if (userInfo == null || StringUtils.isEmpty(userInfo.getName())) {
            throw new RuntimeException("获取用户信息失败或用户名为空");
        }

        return userInfo;
    }

    /**
     * 创建本地会话
     */
    private String createLocalSession(SSOUserInfo userInfo) {
        // 根据SSO用户信息查找本地用户（根据工号匹配）
        SysUser localUser = findLocalUserByName(userInfo.getName());

        if (localUser == null) {
            throw new RuntimeException("用户不存在或未开通系统权限：" + userInfo.getName());
        }

        // 创建登录用户对象
        LoginUser loginUser = new LoginUser(localUser.getUserId(), localUser.getDeptId(), localUser, null);

        // 生成token
        return tokenService.createToken(loginUser);
    }

    /**
     * 根据工号查找本地用户
     */
    private SysUser findLocalUserByName(String workNumber) {
        if (StringUtils.isEmpty(workNumber)) {
            log.error("工号为空，无法查找用户");
            return null;
        }

        try {
            SysUser user = userService.selectUserByUserName(workNumber);
            if (user != null) {
                log.info("找到用户: {} - {}", workNumber, user.getNickName());
            } else {
                log.warn("未找到用户: {}", workNumber);
            }
            return user;
        } catch (Exception e) {
            log.error("查询用户失败: {}", workNumber, e);
            return null;
        }
    }

    /**
     * 根据客户端IP判断是否为内网
     */
    private boolean isInternalNetwork(String clientIp) {
        if (clientIp == null || clientIp.isEmpty()) {
            return false;
        }

        // 判断是否为内网网段 10.10.13.*
        return clientIp.startsWith("10.10.13.");
    }

    /**
     * 获取客户端真实IP
     */
    private String getClientIp(HttpServletRequest request) {
        String ip = request.getHeader("X-Forwarded-For");
        if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("Proxy-Client-IP");
        }
        if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("WL-Proxy-Client-IP");
        }
        if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("HTTP_CLIENT_IP");
        }
        if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("HTTP_X_FORWARDED_FOR");
        }
        if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getRemoteAddr();
        }

        // 如果有多个IP，取第一个
        if (ip != null && ip.contains(",")) {
            ip = ip.split(",")[0].trim();
        }

        log.info("客户端IP: {}", ip);
        return ip;
    }

    /**
     * 根据网络环境获取授权URL
     */
    private String getAuthorizeUrl(boolean isInternal) {
        return isInternal ? internalAuthorizeUrl : externalAuthorizeUrl;
    }

    /**
     * 根据网络环境获取Token URL
     */
    private String getTokenUrl(boolean isInternal) {
        return isInternal ? internalTokenUrl : externalTokenUrl;
    }

    /**
     * 根据网络环境获取用户信息URL
     */
    private String getUserinfoUrl(boolean isInternal) {
        return isInternal ? internalUserinfoUrl : externalUserinfoUrl;
    }

    /**
     * 根据网络环境获取回调URI
     */
    private String getRedirectUri(boolean isInternal) {
        return isInternal ? internalRedirectUri : externalRedirectUri;
    }


}