<?php
/**
 * 后台认证中间件.
 *
 * @author nj <nj@gmail.com>
 * @date   2019-11-03 14:07:35
 */
declare(strict_types=1);

namespace Modules\Manage\Middlewares;

use App\Constants\ErrorCode;
use App\Repositories\Utils\AccessControllerListsRepository;
use App\Repositories\Utils\JwtRepository;
use Hyperf\HttpServer\Contract\RequestInterface;
use Hyperf\HttpServer\Contract\ResponseInterface as HttpResponse;
use Lcobucci\JWT\UnencryptedToken;
use Modules\Manage\Services\AuthService;
use Psr\Container\ContainerInterface;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;
use Psr\SimpleCache\CacheInterface;

class ManageAuthMiddleware implements MiddlewareInterface
{
    /**
     * 容器实例.
     *
     * @var ContainerInterface
     */
    protected $container = null;

    /**
     * 响应实例.
     *
     * @var HttpResponse
     */
    protected $response = null;

    /**
     * 请求实例.
     *
     * @var RequestInterface
     */
    protected $request = null;

    public function __construct(ContainerInterface $container, HttpResponse $response, RequestInterface $request)
    {
        $this->container = $container;
        $this->response = $response;
        $this->request = $request;
    }

    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        $authService = new AuthService;
        $token = $authService->getHeaderToken();
        if (empty($token)) {
            return json_fail(trans('common.err_failed_authorization'), 403);
        }
        $jwtRepo = make(JwtRepository::class);
        $aud = 'manage-users';
        $validateResult = $jwtRepo->validateToken($token, $aud);
        if (!$validateResult['is_valid']) {
            if ($validateResult['is_expired']) {
                return json_fail('认证过期', 401);
            }
            return json_fail(trans('common.err_failed_authorization'), 403);
        } else {
            /**
             * @var UnencryptedToken $tokenObj
             */
            $tokenObj = $validateResult['token_obj'];
            // 验证单点.
            $tokenManagerId = $tokenObj->claims()->get('manager_id');
            $tokenIp = $tokenObj->claims()->get('ip');
            $clientIp = $jwtRepo->getClientIp();
            $cacheKey = $authService->getManagerCacheKey($tokenManagerId);
            $cache = make(CacheInterface::class);
            $cacheToken = $cache->has($cacheKey) ? $cache->get($cacheKey) : '';
            if (empty($cacheToken) || $cacheToken !== $token) {
                return json_fail(trans('common.err_failed_authorization'), 403);
            }
            if (empty($tokenIp) || empty($clientIp) || $tokenIp !== $clientIp) {
                return json_fail(trans('common.err_failed_authorization'), 403);
            }
        }
        $managerInfo = $authService->getManagerInfo();
        $roleId = $managerInfo['role_id'];
        $managerId = $managerInfo['manager_id'];
        $authConfig = config('manage_acl');
        $aclRepo = make(AccessControllerListsRepository::class);
        $aclRepo->init($authConfig, $roleId);
        $aclStatus = $aclRepo->check('Controller');

        if ($aclStatus !== true) {
            return json_fail('无权访问', ErrorCode::NO_PERMISSION);
        }

        return $handler->handle($request);  // 洋葱管道正常执行下一个管道.
    }
}