package com.ard.web.controller.sample.media;

import com.ard.oss.model.CredentialsDTO;
import com.ard.oss.service.impl.OssServiceContext;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiOperation;
import lombok.extern.slf4j.Slf4j;
import okhttp3.*;
import okio.BufferedSink;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import javax.net.ssl.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.InputStream;
import java.security.SecureRandom;
import java.util.Enumeration;
import java.util.concurrent.TimeUnit;

@Api(tags = "机场上传minio")
@Slf4j
@RestController
@RequestMapping("/minioTransfer")
public class MinioStsProxyController {

    // ==================== 常量配置 ====================
    private static final String PROXY_PREFIX = "/minioTransfer";
    private static final int BUFFER_SIZE = 32768;
    private static final String X_AMZ_SECURITY_TOKEN = "X-Amz-Security-Token";
    private static final String TRANSFER_ENCODING = "Transfer-Encoding";
    private static final String CONTENT_LENGTH = "Content-Length";
    private static final String HOST = "Host";

    // 配置文件注入
    @Value("${oss.endpoint}")
    private String minioEndpoint;

    private static final Integer connectTimeout=10;

    private static final Integer readWriteTimeout=300;

    @Autowired
    private OssServiceContext ossService;

    // OkHttp 单例客户端，全局复用
    private static OkHttpClient httpClient;

    // 静态初始化，仅执行一次
    static {
        createUnsafeOkHttpClient();
    }

    /**
     * 修复SSL配置：创建忽略证书校验的OkHttp客户端
     */
    private static void createUnsafeOkHttpClient() {
        try {
            // 1. 创建信任所有证书的TrustManager
            TrustManager[] trustAllCerts = new TrustManager[]{
                    new X509TrustManager() {
                        @Override
                        public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType) {}
                        @Override
                        public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) {}
                        @Override
                        public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                            return new java.security.cert.X509Certificate[0];
                        }
                    }
            };

            // 2. 初始化SSL上下文
            SSLContext sslContext = SSLContext.getInstance("TLS");
            sslContext.init(null, trustAllCerts, new SecureRandom());
            SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();

            // 3. 构建OkHttp客户端
            httpClient = new OkHttpClient.Builder()
                    .sslSocketFactory(sslSocketFactory, (X509TrustManager) trustAllCerts[0])
                    .hostnameVerifier((hostname, session) -> true)
                    .connectTimeout(connectTimeout, TimeUnit.SECONDS)
                    .readTimeout(readWriteTimeout, TimeUnit.SECONDS)
                    .writeTimeout(readWriteTimeout, TimeUnit.SECONDS)
                    .connectionPool(new ConnectionPool(10, 5, TimeUnit.MINUTES))
                    .retryOnConnectionFailure(true)
                    .build();

        } catch (Exception e) {
            log.error("OkHttp SSL配置初始化失败，使用默认客户端", e);
            httpClient = new OkHttpClient();
        }
    }

    @ApiOperation("MinIO STS临时凭证通用代理")
    @RequestMapping("/**")
    public void proxyRequest(HttpServletRequest request, HttpServletResponse response) {
        String method = request.getMethod();
        String requestUri = request.getRequestURI();
        String queryString = request.getQueryString();
        log.info("STS代理请求开始 | 方法:{} | URI:{} | 参数:{}", method, requestUri, queryString);

        // 构造目标地址
        String targetUrl = buildTargetUrl(requestUri, queryString);
        if (targetUrl == null) {
            sendError(response, HttpServletResponse.SC_BAD_REQUEST, "请求路径非法");
            return;
        }

        // 获取STS凭证
        CredentialsDTO credentials = getCredentials();
        if (credentials == null) {
            sendError(response, HttpServletResponse.SC_FORBIDDEN, "STS凭证无效");
            return;
        }

        try {
            // 构建请求
            Request okRequest = buildRequest(request, method, targetUrl, credentials);
            // 执行并转发响应
            forwardResponse(okRequest, response);
            log.info("STS代理请求成功 | 目标地址:{}", targetUrl);
        } catch (Exception e) {
            log.error("STS代理请求执行异常", e);
            sendError(response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "代理服务异常");
        }
    }

    /**
     * 构造MinIO请求地址
     */
    private String buildTargetUrl(String requestUri, String queryString) {
        try {
            String targetPath = requestUri.substring(PROXY_PREFIX.length());
            StringBuilder urlBuilder = new StringBuilder(minioEndpoint).append(targetPath);
            if (queryString != null && !queryString.isBlank()) {
                urlBuilder.append("?").append(queryString);
            }
            return urlBuilder.toString();
        } catch (Exception e) {
            log.error("目标地址构造失败", e);
            return null;
        }
    }

    /**
     * 获取并校验STS临时凭证
     */
    private CredentialsDTO getCredentials() {
        try {
            CredentialsDTO dto = ossService.getCredentials();
            if (dto == null || dto.getAccessKeyId() == null || dto.getSecurityToken() == null) {
                log.error("STS凭证核心字段缺失");
                return null;
            }
            log.info("STS凭证获取成功 | AK前缀:{}", dto.getAccessKeyId().substring(0, 4) + "***");
            return dto;
        } catch (Exception e) {
            log.error("获取STS凭证异常", e);
            return null;
        }
    }

    /**
     * 构建OkHttp请求对象 - 核心修复：移除Content-Length过滤
     */
    private Request buildRequest(HttpServletRequest request, String method, String url, CredentialsDTO credentials) throws IOException {
        Request.Builder builder = new Request.Builder().url(url);

        // 透传原始请求头，仅过滤Host头（OkHttp自动管理），保留Content-Length
        Enumeration<String> headerNames = request.getHeaderNames();
        while (headerNames.hasMoreElements()) {
            String name = headerNames.nextElement();
            // 仅过滤Host，不再过滤Content-Length，修复MissingContentLength错误
            if (name.equalsIgnoreCase(HOST)) {
                continue;
            }
            builder.addHeader(name, request.getHeader(name));
        }

        // 强制添加STS安全令牌（MinIO必填）
        builder.addHeader(X_AMZ_SECURITY_TOKEN, credentials.getSecurityToken());

        // 构造请求体：非GET/HEAD请求携带流数据
        RequestBody body = null;
        if (!"GET".equalsIgnoreCase(method) && !"HEAD".equalsIgnoreCase(method)) {
            // 获取客户端原始Content-Length
            long contentLength = request.getContentLengthLong();
            body = new RequestBody() {
                @Override
                public MediaType contentType() {
                    String contentType = request.getContentType();
                    return contentType != null ? MediaType.parse(contentType) : MediaType.parse("application/octet-stream");
                }

                // 重写方法，告知OkHttp固定长度，避免转为chunked编码
                @Override
                public long contentLength() {
                    return contentLength;
                }

                @Override
                public void writeTo(BufferedSink sink) {
                    try (InputStream inputStream = request.getInputStream()) {
                        byte[] buffer = new byte[BUFFER_SIZE];
                        int len;
                        while ((len = inputStream.read(buffer)) != -1) {
                            sink.write(buffer, 0, len);
                        }
                        sink.flush();
                    } catch (IOException e) {
                        log.error("请求体流写入失败", e);
                    }
                }
            };
        }

        builder.method(method, body);
        return builder.build();
    }

    /**
     * 执行请求并将响应透传给前端
     */
    private void forwardResponse(Request request, HttpServletResponse response) throws IOException {
        try (Response okResponse = httpClient.newCall(request).execute()) {
            // 设置响应状态码
            response.setStatus(okResponse.code());

            // 透传响应头
            Headers headers = okResponse.headers();
            for (String name : headers.names()) {
                if (TRANSFER_ENCODING.equalsIgnoreCase(name)) {
                    continue;
                }
                response.setHeader(name, headers.get(name));
            }

            // 透传响应体
            ResponseBody responseBody = okResponse.body();
            if (responseBody != null) {
                try (InputStream in = responseBody.byteStream()) {
                    byte[] buffer = new byte[BUFFER_SIZE];
                    int len;
                    while ((len = in.read(buffer)) != -1) {
                        response.getOutputStream().write(buffer, 0, len);
                    }
                    response.getOutputStream().flush();
                }
            }
        }
    }

    /**
     * 统一错误响应工具方法
     */
    private void sendError(HttpServletResponse response, int code, String msg) {
        try {
            response.sendError(code, msg);
        } catch (IOException e) {
            log.error("响应错误信息失败", e);
        }
    }
}