package com.friday.custody.interceptor;

import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.ArrayUtils;
import org.apache.commons.lang3.StringUtils;
import org.springframework.util.DigestUtils;
import org.springframework.web.servlet.HandlerInterceptor;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

@Slf4j
public class ApiInterceptor implements HandlerInterceptor {

    public static final String CLIENT_ID = "X-ClientId";
    public static final String SIGN = "sign";

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {

        StringBuffer requestURL = request.getRequestURL();
        //说明：clientId优先从header里取，没有的话从请求参数里取
        String clientId = request.getHeader(CLIENT_ID);
        if(StringUtils.isBlank(clientId))
        {
            clientId = request.getParameter(CLIENT_ID);
        }

        if(StringUtils.isBlank(clientId))
        {
            String json = "{\"exception\": \"非法请求\"}";
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response.setContentType("application/json;charset=UTF-8");
            response.getWriter().write(json);
            return false;
        }
        //校验ClientId
        //说明：这里为所有外部接入第三方的配置参数，可从配置文件中读取，实现动态增加
        String[] clientIds = {"taie-default", "HTFC"};
        String[] clientKeys = {"123456", "bfc6b26bc19b628bf13cf1a6a3b52f9b"};
        if(!ArrayUtils.contains(clientIds, clientId))
        {
            String json = "{\"exception\": \"不支持的请求来源，请检查请求参数\"}";
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response.setContentType("application/json;charset=UTF-8");
            response.getWriter().write(json);
            return false;
        }
        String clientKey = clientKeys[ArrayUtils.indexOf(clientIds, clientId)];

        //校验请求参数
        String sign = request.getHeader(SIGN);
        if(StringUtils.isBlank(sign))
        {
            sign = request.getParameter(SIGN);
        }
        if(StringUtils.isBlank(sign))
        {
            String json = "{\"exception\": \"未获得参数签名sign，请检查请求参数\"}";
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response.setContentType("application/json;charset=UTF-8");
            response.getWriter().write(json);
            return false;
        }
        //说明：这里简单使用了clientId和key拼接生成sign。避免客户端请求参数可能是json，后面可补上请求参数拼接的字符串作为生成sign的依据
        String string = "xClientId="+ clientId + clientKey;
        String newsign = DigestUtils.md5DigestAsHex((string).getBytes());

        if(!ArrayUtils.contains(clientKeys, sign))
        {
            String json = "{\"exception\": \"验签失败，请检查请求参数\"}";
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response.setContentType("application/json;charset=UTF-8");
            response.getWriter().write(json);
            return false;
        }

        return true;
    }
}
