using System;
using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.Hosting;
using Microsoft.Extensions.Logging;

namespace Dpz.Core.Infrastructure.RateLimiting;

/// <summary>
/// 窗口期限流中间件
/// 检查 IP 是否处于封禁期，封禁期内延迟响应并返回 429
/// </summary>
public class RateLimitMiddleware(
    RequestDelegate next,
    IConfiguration configuration,
    IWebHostEnvironment webHostEnvironment,
    IIpRateLimitService rateLimitService,
    ILogger<RateLimitMiddleware> logger
)
{
    public async Task InvokeAsync(HttpContext context)
    {
        // 已登录用户和开发环境不参与限流
        if (
            context.User.Identity?.IsAuthenticated == true
            || webHostEnvironment.IsDevelopment()
            || IsIgnoredPath(context)
        )
        {
            await next(context);
            return;
        }

        var clientIp = context.Request.GetIpAddress();
        if (string.IsNullOrEmpty(clientIp))
        {
            await next(context);
            return;
        }

        var result = await rateLimitService.CheckLimitStatusAsync(clientIp, context.RequestAborted);
        if (result.IsAllowed)
        {
            await next(context);
            return;
        }

        await RespondBlockedAsync(context, result);
    }

    /// <summary>
    /// 忽略列表内的请求不参与限流，与机器人拦截中间件保持一致
    /// </summary>
    private bool IsIgnoredPath(HttpContext context)
    {
        var requestPath = context.Request.Path.Value ?? "";
        var ignorePrefixes =
            configuration.GetSection("IgnoreRequestPrefix").Get<List<string>>() ?? [];

        return ignorePrefixes.Any(prefix =>
            requestPath.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)
        );
    }

    /// <summary>
    /// 延迟指定时间后返回 429 响应，增加攻击成本
    /// </summary>
    private async Task RespondBlockedAsync(HttpContext context, RateLimitResult result)
    {
        var delayMs = result.DelayMs;
        if (delayMs > 0 && !context.Response.HasStarted)
        {
            try
            {
                await Task.Delay(delayMs, context.RequestAborted);
            }
            catch (OperationCanceledException)
            {
                // 客户端已断开，直接结束
                return;
            }
        }

        if (context.Response.HasStarted)
        {
            logger.LogWarning(
                "IP {ClientIp} 限流响应时发现响应已开始，无法返回 429，路径: {RequestPath}",
                context.Request.GetIpAddress(),
                context.Request.Path
            );
            return;
        }

        context.Response.StatusCode = StatusCodes.Status429TooManyRequests;
        context.Response.ContentType = "application/json; charset=utf-8";

        var response = new
        {
            error = "IP_BLOCKED",
            message = result.Message,
            timestamp = DateTime.UtcNow,
            path = context.Request.Path.Value,
            delayMs,
        };
        await context.Response.WriteAsync(
            JsonSerializer.Serialize(
                response,
                new JsonSerializerOptions { PropertyNamingPolicy = JsonNamingPolicy.CamelCase }
            )
        );

        logger.LogWarning(
            "IP {ClientIp} 处于封禁期，返回 429，路径: {RequestPath}，延迟: {DelayMs}ms",
            context.Request.GetIpAddress(),
            context.Request.Path,
            delayMs
        );
    }
}