package cn.novalon.manage.sys.config;

import cn.novalon.manage.sys.security.JwtAuthenticationFilter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.env.Environment;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.SecurityWebFiltersOrder;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.web.server.SecurityWebFilterChain;

/**
 * 安全配置类
 * 
 * @author 张翔
 * @date 2026-03-13
 */
@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

    private static final Logger logger = LoggerFactory.getLogger(SecurityConfig.class);
    private final JwtAuthenticationFilter jwtAuthenticationFilter;
    private final Environment environment;

    public SecurityConfig(JwtAuthenticationFilter jwtAuthenticationFilter, Environment environment) {
        this.jwtAuthenticationFilter = jwtAuthenticationFilter;
        this.environment = environment;
    }

    @Bean
    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
        String[] activeProfiles = environment.getActiveProfiles();
        final boolean isDevOrTest;
        
        isDevOrTest = java.util.Arrays.stream(activeProfiles)
                .anyMatch(profile -> "dev".equals(profile) || "test".equals(profile));
        
        logger.info("SecurityConfig初始化: 当前环境={}, Swagger启用状态={}", 
                activeProfiles.length > 0 ? String.join(",", activeProfiles) : "default", isDevOrTest);

        http
                .csrf(ServerHttpSecurity.CsrfSpec::disable)
                .httpBasic(ServerHttpSecurity.HttpBasicSpec::disable)
                .formLogin(ServerHttpSecurity.FormLoginSpec::disable)
                .addFilterBefore(jwtAuthenticationFilter, SecurityWebFiltersOrder.AUTHENTICATION)
                .authorizeExchange(spec -> {
                    spec.pathMatchers("/api/auth/**").permitAll()
                            .pathMatchers("/api/public/**").permitAll()
                            .pathMatchers("/ws/**").permitAll()
                            .pathMatchers("/actuator/**").permitAll();

                    if (isDevOrTest) {
                        spec.pathMatchers("/swagger-ui.html").permitAll()
                                .pathMatchers("/swagger-ui/**").permitAll()
                                .pathMatchers("/api-docs/**").permitAll()
                                .pathMatchers("/v3/api-docs/**").permitAll()
                                .pathMatchers("/swagger-resources/**").permitAll()
                                .pathMatchers("/webjars/**").permitAll();
                        logger.info("SecurityConfig: Swagger路径已放行");
                    }

                    spec.anyExchange().authenticated();
                });

        return http.build();
    }
}
