package middleware

import (
	"strings"

	"photowall/pkg/jwt"
	"photowall/pkg/response"

	"github.com/gin-gonic/gin"
)

// Context keys
const (
	CtxUserID   = "user_id"
	CtxUsername = "username"
	CtxRole     = "role"
)

// Auth JWT 认证中间件
func Auth(jm *jwt.Manager) gin.HandlerFunc {
	return func(c *gin.Context) {
		header := c.GetHeader("Authorization")
		if header == "" {
			response.Unauthorized(c, "未登录")
			c.Abort()
			return
		}
		parts := strings.SplitN(header, " ", 2)
		if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") {
			response.Unauthorized(c, "认证格式错误")
			c.Abort()
			return
		}
		claims, err := jm.Parse(parts[1])
		if err != nil {
			response.Unauthorized(c, "登录已过期，请重新登录")
			c.Abort()
			return
		}
		c.Set(CtxUserID, claims.UserID)
		c.Set(CtxUsername, claims.Username)
		c.Set(CtxRole, claims.Role)
		c.Next()
	}
}

// AdminOnly 平台管理员权限
func AdminOnly() gin.HandlerFunc {
	return func(c *gin.Context) {
		role, _ := c.Get(CtxRole)
		if role != "admin" {
			response.Forbidden(c, "需要平台管理员权限")
			c.Abort()
			return
		}
		c.Next()
	}
}

// CurrentUserID 从 context 取当前用户ID
func CurrentUserID(c *gin.Context) uint {
	v, ok := c.Get(CtxUserID)
	if !ok {
		return 0
	}
	id, _ := v.(uint)
	return id
}

// CurrentUsername 从 context 取当前用户名
func CurrentUsername(c *gin.Context) string {
	v, _ := c.Get(CtxUsername)
	s, _ := v.(string)
	return s
}

// CurrentRole 从 context 取当前角色
func CurrentRole(c *gin.Context) string {
	v, _ := c.Get(CtxRole)
	s, _ := v.(string)
	return s
}