#!/usr/bin/env python
# -*- coding: utf-8 -*-
"""
认证工具模块
提供JWT token生成、验证和权限装饰器
"""

import jwt
import hashlib
import logging
from datetime import datetime, timedelta
from functools import wraps
from flask import request, jsonify, g
from database_config import get_db_manager

logger = logging.getLogger('article_server')

# JWT配置
JWT_SECRET_KEY = 'wht_secret_key_2025'  # 生产环境应使用环境变量
JWT_ALGORITHM = 'HS256'
JWT_EXPIRATION_HOURS = 24  # token有效期24小时

class AuthUtils:
    """认证工具类"""
    
    @staticmethod
    def hash_password(password):
        """密码加密"""
        return hashlib.sha256(password.encode('utf-8')).hexdigest()
    
    @staticmethod
    def verify_password(password, hashed_password):
        """验证密码"""
        return AuthUtils.hash_password(password) == hashed_password
    
    @staticmethod
    def generate_token(user_id, username, role, enterprise_id=None):
        """生成JWT token"""
        try:
            payload = {
                'user_id': user_id,
                'username': username,
                'role': role,
                'enterprise_id': enterprise_id,
                'exp': datetime.utcnow() + timedelta(hours=JWT_EXPIRATION_HOURS),
                'iat': datetime.utcnow()
            }
            token = jwt.encode(payload, JWT_SECRET_KEY, algorithm=JWT_ALGORITHM)
            logger.info(f"[Token生成] 用户: {username}, ID: {user_id}, 角色: {role}")
            return token
        except Exception as e:
            logger.error(f"[Token生成失败] {e}")
            raise
    
    @staticmethod
    def verify_token(token):
        """验证JWT token"""
        try:
            payload = jwt.decode(token, JWT_SECRET_KEY, algorithms=[JWT_ALGORITHM])
            logger.info(f"[Token验证成功] 用户ID: {payload.get('user_id')}")
            return payload
        except jwt.ExpiredSignatureError:
            logger.warning("[Token验证失败] Token已过期")
            return None
        except jwt.InvalidTokenError as e:
            logger.warning(f"[Token验证失败] 无效的Token: {e}")
            return None
        except Exception as e:
            logger.error(f"[Token验证异常] {e}")
            return None
    
    @staticmethod
    def get_current_user():
        """获取当前登录用户信息"""
        return getattr(g, 'current_user', None)

def require_auth(f):
    """需要认证的装饰器"""
    @wraps(f)
    def decorated_function(*args, **kwargs):
        # 获取token
        auth_header = request.headers.get('Authorization')
        if not auth_header:
            logger.warning("[认证失败] 缺少Authorization header")
            return jsonify({
                'code': 401,
                'message': '未提供认证token',
                'data': None
            }), 401
        
        # 验证Bearer格式
        parts = auth_header.split()
        if len(parts) != 2 or parts[0].lower() != 'bearer':
            logger.warning("[认证失败] Authorization header格式错误")
            return jsonify({
                'code': 401,
                'message': 'Token格式错误',
                'data': None
            }), 401
        
        token = parts[1]
        
        # 验证token
        payload = AuthUtils.verify_token(token)
        if not payload:
            return jsonify({
                'code': 401,
                'message': 'Token无效或已过期',
                'data': None
            }), 401
        
        # 将用户信息存储到g对象
        g.current_user = payload
        
        return f(*args, **kwargs)
    
    return decorated_function

def require_role(*allowed_roles):
    """需要特定角色的装饰器"""
    def decorator(f):
        @wraps(f)
        def decorated_function(*args, **kwargs):
            current_user = AuthUtils.get_current_user()
            if not current_user:
                logger.warning("[权限检查失败] 未找到当前用户")
                return jsonify({
                    'code': 401,
                    'message': '未登录',
                    'data': None
                }), 401
            
            user_role = current_user.get('role')
            if user_role not in allowed_roles:
                logger.warning(f"[权限检查失败] 用户角色 {user_role} 不在允许的角色 {allowed_roles} 中")
                return jsonify({
                    'code': 403,
                    'message': '权限不足',
                    'data': None
                }), 403
            
            return f(*args, **kwargs)
        
        return decorated_function
    
    return decorator