//! RPC 入口门禁。
//!
//! 这些 RPC 只在受信网络里被其它服务调用，不会暴露到公网，所以入口只核对一个
//! 静态共享密钥：调用方把 `auth.rpc_key` 的值放进 `x-rpc-key` 头即可。
//! 不再有调用方服务身份、用户主体（principal）或 scope 判定，具体操作谁由请求
//! 体里的 `user_id` 决定。

use std::sync::Arc;

use tonic::metadata::MetadataMap;
use tonic::service::Interceptor as TonicInterceptor;
use tonic::{Request, Status};
use uuid::Uuid;

use crate::api::error;

pub const RPC_KEY_METADATA: &str = "x-rpc-key";
pub const REQUEST_ID_METADATA: &str = "gitdata-request-id";
pub const REQUEST_ID_HEADER: &str = "x-request-id";
pub const CALLER_SERVICE_METADATA: &str = "gitdata-service-id";

pub const MAX_REQUEST_ID_LEN: usize = 64;

/// 每个请求携带的元信息：只用于日志与事件关联。
#[derive(Debug, Clone, Default)]
pub struct RequestMeta {
    pub request_id: String,
    /// 调用方自报的服务名，仅用于日志，不参与鉴权。
    pub caller_service: String,
}

impl RequestMeta {
    pub fn internal() -> Self {
        Self {
            request_id: Uuid::now_v7().to_string(),
            caller_service: "kenapi".to_owned(),
        }
    }

    pub fn request_id(&self) -> Option<&str> {
        if self.request_id.is_empty() {
            None
        } else {
            Some(self.request_id.as_str())
        }
    }
}

pub fn validate_request_id(value: &str) -> Option<String> {
    let trimmed = value.trim();
    if trimmed.is_empty() || trimmed.len() > MAX_REQUEST_ID_LEN {
        return None;
    }
    let valid_chars = trimmed
        .bytes()
        .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.' | b':'));
    if !valid_chars {
        return None;
    }
    Some(trimmed.to_owned())
}

pub fn request_id_from(metadata: &MetadataMap) -> Option<String> {
    metadata
        .get(REQUEST_ID_HEADER)
        .or_else(|| metadata.get(REQUEST_ID_METADATA))
        .and_then(|value| value.to_str().ok())
        .and_then(validate_request_id)
}

pub fn caller_service_from(metadata: &MetadataMap) -> Option<String> {
    metadata
        .get(CALLER_SERVICE_METADATA)
        .and_then(|value| value.to_str().ok())
        .map(|value| value.trim().to_owned())
        .filter(|value| !value.is_empty())
}

pub fn new_request_id() -> String {
    Uuid::now_v7().to_string()
}

/// 共享密钥门禁：校验 `x-rpc-key`，并把 `RequestMeta` 挂到请求扩展上。
#[derive(Clone)]
pub struct Interceptor {
    key: Arc<str>,
}

impl Interceptor {
    pub fn new(key: impl Into<Arc<str>>) -> Self {
        Self { key: key.into() }
    }

    /// 空密钥会让所有「缺失/非法」的请求一起通过，所以构造后必须先确认门禁真的能拒绝。
    pub fn is_armed(&self) -> bool {
        !self.key.trim().is_empty()
    }
}

impl TonicInterceptor for Interceptor {
    fn call(&mut self, mut request: Request<()>) -> Result<Request<()>, Status> {
        let metadata = request.metadata().clone();
        let request_id = request_id_from(&metadata);
        let presented = metadata
            .get(RPC_KEY_METADATA)
            .and_then(|value| value.to_str().ok())
            .map(str::trim)
            .unwrap_or_default();
        if !self.is_armed() {
            return Err(error::unauthenticated(
                "rpc gate is not configured",
                request_id.as_deref(),
            ));
        }
        if presented.is_empty()
            || !crate::share::crypto::constant_time_eq(presented.as_bytes(), self.key.as_bytes())
        {
            return Err(error::unauthenticated(
                "rpc key is missing or invalid",
                request_id.as_deref(),
            ));
        }
        let meta = RequestMeta {
            request_id: request_id.unwrap_or_else(new_request_id),
            caller_service: caller_service_from(&metadata).unwrap_or_default(),
        };
        request.extensions_mut().insert(meta);
        Ok(request)
    }
}

/// 读取门禁挂上的元信息。拦截器已经校验过密钥，这里只做扩展读取。
pub async fn meta<T>(request: &Request<T>) -> Result<RequestMeta, Status> {
    request
        .extensions()
        .get::<RequestMeta>()
        .cloned()
        .ok_or_else(|| {
            error::unauthenticated("rpc gate did not attach request metadata", None::<&str>)
        })
}