use std::sync::Arc;

use tonic::metadata::MetadataMap;
use tonic::service::Interceptor as TonicInterceptor;
use tonic::{Request, Status};

pub const RPC_KEY_HEADER: &str = "x-rpc-key";
pub const CALLER_SERVICE_HEADER: &str = "gitdata-service-id";

/// 门禁通过后挂到请求扩展上的元信息；只用于日志与审计。
#[derive(Debug, Clone)]
pub struct RequestMeta {
    pub request_id: ::envelope::RequestId,
    pub caller_service: String,
}

impl RequestMeta {
    pub fn request_id(&self) -> Option<&str> {
        (!self.request_id.0.is_empty()).then_some(self.request_id.as_str())
    }
}

pub fn request_id_from(metadata: &MetadataMap) -> Option<String> {
    metadata
        .get(::envelope::REQUEST_ID_HEADER)
        .or_else(|| metadata.get(::envelope::LEGACY_REQUEST_ID_HEADER))
        .and_then(|value| value.to_str().ok())
        .and_then(::envelope::validate_request_id)
}

/// 共享密钥门禁：校验 `x-rpc-key`，通过后把 `RequestMeta` 挂到请求扩展。
#[derive(Clone)]
pub struct Gate {
    key: Arc<str>,
}

impl Gate {
    pub fn new(key: impl Into<Arc<str>>) -> Self {
        Self { key: key.into() }
    }

    /// 空密钥会让所有请求通过，所以装配后必须先确认门禁真的能拒绝。
    pub fn is_armed(&self) -> bool {
        !self.key.trim().is_empty()
    }
}

impl TonicInterceptor for Gate {
    fn call(&mut self, mut request: Request<()>) -> Result<Request<()>, Status> {
        let metadata = request.metadata().clone();
        let request_id = ::envelope::context::request_id()
            .and_then(|value| ::envelope::validate_request_id(&value))
            .or_else(|| request_id_from(&metadata));
        if !self.is_armed() {
            return Err(unauthorized(
                "rpc gate is not configured",
                request_id.as_deref(),
            ));
        }
        let presented = metadata
            .get(RPC_KEY_HEADER)
            .and_then(|value| value.to_str().ok())
            .map(str::trim)
            .unwrap_or_default();
        if presented.is_empty()
            || !crypt::constant_time_eq(presented.as_bytes(), self.key.as_bytes())
        {
            return Err(unauthorized(
                "rpc key is missing or invalid",
                request_id.as_deref(),
            ));
        }
        let meta = RequestMeta {
            request_id: ::envelope::RequestId(
                request_id.unwrap_or_else(::envelope::new_request_id),
            ),
            caller_service: metadata
                .get(CALLER_SERVICE_HEADER)
                .and_then(|value| value.to_str().ok())
                .map(|value| value.trim().to_owned())
                .filter(|value| !value.is_empty())
                .unwrap_or_default(),
        };
        request.extensions_mut().insert(meta);
        Ok(request)
    }
}

fn unauthorized(message: &str, request_id: Option<&str>) -> Status {
    let _ = request_id;
    Status::unauthenticated(message)
}

/// 读取门禁挂上的元信息；拦截器已校验密钥，这里只做扩展读取。
pub fn meta<T>(request: &Request<T>) -> Result<RequestMeta, Status> {
    request
        .extensions()
        .get::<RequestMeta>()
        .cloned()
        .ok_or_else(|| Status::unauthenticated("rpc gate did not attach request metadata"))
}