using Dpz.Core.Service.Mediator.Features.Security.Queries;
using Microsoft.AspNetCore.Authentication;

namespace Dpz.Core.Auth.Middleware;

/// <summary>
/// SecurityStamp验证中间件
/// 用于在密码修改后自动登出其他浏览器的会话
/// </summary>
public class SecurityStampValidationMiddleware(
    RequestDelegate next,
    ILogger<SecurityStampValidationMiddleware> logger
)
{
    public async Task InvokeAsync(
        HttpContext context,
        IMediator mediator,
        IAccountSessionService accountSessionService
    )
    {
        // 只对已认证的用户进行验证
        if (context.User.Identity?.IsAuthenticated == true)
        {
            var account = context.User.NameIdentifier;
            var claimKey = context.User.FindFirst("Key")?.Value;
            var sessionId = context.User.SessionId;

            if (
                !string.IsNullOrWhiteSpace(sessionId)
                && await accountSessionService.IsRevokedAsync(sessionId, context.RequestAborted)
            )
            {
                logger.LogInformation(
                    "用户 {Account} 的会话 {SessionId} 已撤销",
                    account,
                    sessionId
                );
                await context.SignOutAsync();
                context.Response.Redirect("/auth-status/session-expired");
                return;
            }

            if (!string.IsNullOrEmpty(account) && !string.IsNullOrEmpty(claimKey))
            {
                try
                {
                    var result = await mediator.Send(
                        new ValidateUserSecurityStampRequest
                        {
                            UserId = account,
                            SecurityStamp = claimKey,
                        }
                    );
                    var validationResult = result.Success
                        ? result.Data
                        : UserSecurityValidationResult.SecurityStampInvalid;

                    // 根据不同的验证结果进行处理
                    if (validationResult != UserSecurityValidationResult.Valid)
                    {
                        logger.LogInformation(
                            "用户 {Account} 的验证失败，原因：{Reason}",
                            account,
                            validationResult
                        );

                        // 登出用户
                        await context.SignOutAsync();

                        // 根据不同的失败原因，重定向到不同的错误页面
                        var redirectUrl = validationResult switch
                        {
                            UserSecurityValidationResult.UserDisabled =>
                                "/auth-status/account-disabled",
                            UserSecurityValidationResult.SecurityStampInvalid =>
                                "/auth-status/session-expired",
                            UserSecurityValidationResult.UserNotFound =>
                                "/auth-status/user-not-found",
                            _ => "/auth-status/auth-error",
                        };

                        context.Response.Redirect(redirectUrl);
                        return;
                    }
                }
                catch (Exception ex)
                {
                    logger.LogError(ex, "验证用户 {Account} 的SecurityStamp时发生错误", account);
                }
            }
        }

        await next(context);
    }
}

/// <summary>
/// SecurityStamp验证中间件扩展方法
/// </summary>
public static class SecurityStampValidationMiddlewareExtensions
{
    public static IApplicationBuilder UseSecurityStampValidation(this IApplicationBuilder builder)
    {
        return builder.UseMiddleware<SecurityStampValidationMiddleware>();
    }
}