using System.Net;
using System.Security.Claims;
using Dpz.Core.EnumLibrary;
using Microsoft.AspNetCore.Authentication;
using OpenIddict.Client.AspNetCore;

namespace Dpz.Core.Web.Jobs.Security;

/// <summary>
/// Hangfire Dashboard 访问控制中间件：对 Dashboard 路径进行认证和权限校验。
/// </summary>
/// <param name="next">下一个中间件。</param>
/// <param name="webHostEnvironment">宿主环境，用于读取静态文件。</param>
public class HangfireDashboardAccessMiddleware(
    RequestDelegate next,
    IWebHostEnvironment webHostEnvironment
)
{
    private const string ForbiddenPagePath = "template/HangfireForbidden.html";

    /// <summary>
    /// 中间件入口：仅对 Dashboard 路径生效，依次执行认证检查、权限检查。
    /// </summary>
    /// <param name="context">当前 HTTP 上下文。</param>
    public async Task InvokeAsync(HttpContext context)
    {
        // 非 Dashboard 路径直接放行
        if (!context.Request.Path.StartsWithSegments(Program.ConsoleUrl))
        {
            await next(context);
            return;
        }

        // 未登录 → 跳转 OpenIddict 认证
        if (context.User.Identity?.IsAuthenticated != true)
        {
            await ChallengeAsync(context);
            return;
        }

        // 无 System 权限 → 返回 403 禁止页面
        if (!HangfireDashboardPermission.HasPermission(context.User, Permissions.System))
        {
            await WriteForbiddenPageAsync(context, webHostEnvironment);
            return;
        }

        await next(context);
    }

    private static Task ChallengeAsync(HttpContext context)
    {
        var returnUrl =
            context.Request.PathBase + context.Request.Path + context.Request.QueryString;
        var properties = new AuthenticationProperties { RedirectUri = returnUrl };

        return context.ChallengeAsync(
            OpenIddictClientAspNetCoreDefaults.AuthenticationScheme,
            properties
        );
    }

    private static async Task WriteForbiddenPageAsync(
        HttpContext context,
        IWebHostEnvironment webHostEnvironment
    )
    {
        context.Response.StatusCode = StatusCodes.Status403Forbidden;
        context.Response.ContentType = "text/html; charset=utf-8";
        context.Response.Headers.CacheControl = "no-store";

        var displayName = context.User.FindFirst("displayName")?.Value;
        var accountLabel = string.IsNullOrWhiteSpace(displayName)
            ? "当前账号"
            : WebUtility.HtmlEncode(displayName);

        var fileInfo = webHostEnvironment.WebRootFileProvider.GetFileInfo(ForbiddenPagePath);
        if (!fileInfo.Exists)
        {
            await context.Response.WriteAsync("没有对应的权限");
            return;
        }

        await using var stream = fileInfo.CreateReadStream();
        using var reader = new StreamReader(stream);
        var html = await reader.ReadToEndAsync(context.RequestAborted);

        // 将模板中的 {{accountLabel}} 占位符替换为当前用户名
        await context.Response.WriteAsync(
            html.Replace("{{accountLabel}}", accountLabel, StringComparison.Ordinal),
            context.RequestAborted
        );
    }
}

/// <summary>
/// <see cref="HangfireDashboardAccessMiddleware"/> 的 IApplicationBuilder 扩展方法。
/// </summary>
public static class HangfireDashboardAccessMiddlewareExtensions
{
    /// <summary>
    /// 注册 Hangfire Dashboard 访问控制中间件。
    /// </summary>
    /// <param name="app">应用构建器。</param>
    public static IApplicationBuilder UseHangfireDashboardAccess(this IApplicationBuilder app)
    {
        return app.UseMiddleware<HangfireDashboardAccessMiddleware>();
    }
}

/// <summary>
/// Hangfire Dashboard 权限校验工具类，基于 Claims 中的 Permission 声明做位运算判断。
/// </summary>
public static class HangfireDashboardPermission
{
    /// <summary>
    /// 检查用户是否拥有指定权限（位掩码匹配）。
    /// </summary>
    /// <param name="user">当前用户主体。</param>
    /// <param name="permission">需要校验的权限位。</param>
    /// <returns>用户已认证且拥有该权限时返回 <c>true</c>。</returns>
    public static bool HasPermission(ClaimsPrincipal user, Permissions permission)
    {
        var permissionClaim = user.FindFirst("Permission")?.Value;

        return !string.IsNullOrWhiteSpace(permissionClaim)
            && Enum.TryParse<Permissions>(permissionClaim, ignoreCase: true, out var permissions)
            && (permissions & permission) == permission;
    }
}