package middleware

import (
	"strings"

	"github.com/casdoor/casdoor-go-sdk/casdoorsdk"
	"github.com/gofiber/fiber/v2"
)

// AuthMiddleware 认证中间件
// 可选参数 requiredRoles：若不为空，将检查用户角色是否包含其中之一
func AuthMiddleware(requiredRoles ...string) fiber.Handler {
	return func(c *fiber.Ctx) error {
		authHeader := c.Get("Authorization")
		if authHeader == "" {
			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
				"code": 401,
				"msg":  "Missing Authorization header",
			})
		}

		// 解析 Bearer Token
		tokenString := strings.TrimPrefix(authHeader, "Bearer ")
		if tokenString == authHeader {
			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
				"code": 401,
				"msg":  "Invalid token format",
			})
		}

		// 验证 JWT & 提取 claims
		claims, err := casdoorsdk.ParseJwtToken(tokenString)
		if err != nil {
			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
				"code": 401,
				"msg":  "Invalid or expired token",
			})
		}

		// 检查角色（可选）
		if len(requiredRoles) > 0 {
			for _, userRole := range claims.User.Roles {
				authorized := false
				for _, r := range requiredRoles {
					if userRole.Name == r {
						authorized = true
						break
					}
				}
				if !authorized {
					return c.Status(fiber.StatusForbidden).JSON(fiber.Map{
						"code": 403,
						"msg":  "Forbidden: insufficient role",
					})
				}
			}
		}

		// 注入用户信息
		c.Locals("user", claims)
		return c.Next()
	}
}