/**
 * Copyright &copy; 2013-2017 <a href="http://www.rhcncpa.com/">瑞华会计师事务所</a> All rights reserved.
 */
package com.jeeplus.modules.sys.security;

import com.jeeplus.common.config.Global;
import com.jeeplus.common.servlet.ValidateCodeServlet;
import com.jeeplus.common.utils.Encodes;
import com.jeeplus.common.utils.JedisUtils;
import com.jeeplus.common.utils.SpringContextHolder;
import com.jeeplus.common.web.Servlets;
import com.jeeplus.modules.sys.dao.UserDao;
import com.jeeplus.modules.sys.entity.*;
import com.jeeplus.modules.sys.service.OfficeService;
import com.jeeplus.modules.sys.service.SystemService;
import com.jeeplus.modules.sys.utils.DictUtils;
import com.jeeplus.modules.sys.utils.LogUtils;
import com.jeeplus.modules.sys.utils.UserUtils;
import com.jeeplus.modules.sys.web.LoginController;
import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.Permission;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.SimplePrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.apache.shiro.web.util.WebUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import redis.clients.jedis.Jedis;

import javax.annotation.PostConstruct;
import javax.servlet.http.HttpServletRequest;
import java.io.Serializable;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

/**
 * 系统安全认证实现类
 * @author jeeplus
 * @version 2014-7-5
 */
@Service
//@DependsOn({"userDao","roleDao","menuDao"})
public class SystemAuthorizingRealm extends AuthorizingRealm {

	private Logger logger = LoggerFactory.getLogger(getClass());

	private SystemService systemService;

	@Autowired
	private OfficeService officeService;

	@Autowired
	private UserDao userDao;

	@Autowired
	HttpServletRequest request;

	/**
	 * 认证回调函数, 登录时调用
	 */
	@Override
	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) {
		System.out.println("doGetAuthenticationInfo");
//		Jedis jedis = null;
		/*try {*/
			UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
			/*int activeSessionSize = getSystemService().getSessionDao().getActiveSessions(false).size();
			if (logger.isDebugEnabled()){
				logger.debug("login submit, active session size: {}, username: {}", activeSessionSize, token.getUsername());
			}*/
			boolean mobile = WebUtils.isTrue(request, FormAuthenticationFilter.DEFAULT_MOBILE_PARAM);
			// 校验登录验证码
			if (!mobile && LoginController.isValidateCodeLogin(token.getUsername(), false, false)){
				Session session = UserUtils.getSession();
//				jedis = JedisUtils.getResource();
				String code = (String)session.getAttribute(ValidateCodeServlet.VALIDATE_CODE);
                //String code = (String)jedis.get(ValidateCodeServlet.VALIDATE_CODE);
				if (token.getCaptcha() == null || !token.getCaptcha().toUpperCase().equals(code)){
					//返还到连接池
//					if (jedis != null) {
//						JedisUtils.returnResource(jedis);
//					}
					throw new AuthenticationException("msg:验证码错误, 请重试.");
				}
			}

			// 校验用户名密码
			User user = getSystemService().getUserByLoginName(token.getUsername());
			if (user ==null || StringUtils.isBlank(user.getId())){
				throw new AuthenticationException("msg:登录失败, 该用户未注册.");
			}
			//多用户校验
		    User user1 = new User();
			String loginName = token.getUsername();
		    user1.setName(loginName);
		    List<User> list = userDao.getByName(user1);
		    if(list != null && list.size()>1){
			    throw new AuthenticationException("msg:"+loginName+"存在重名.");
		    }
			if (user !=null && user.getCompany()!=null && StringUtils.isNotBlank(user.getCompany().getUseable()) && "2".equals(user.getCompany().getUseable())){
				throw new AuthenticationException("msg:登录失败, 该用户当前所在公司已被禁用.");
			}
			//logger.info("user="+user);
			List<Role> roles = new ArrayList<>();
			if (user != null) {
				if (Global.NO.equals(user.getLoginFlag())){
					throw new AuthenticationException("msg:该帐号已注销.");
				}
				byte[] salt = Encodes.decodeHex(user.getPassword().substring(0,16));

				//****将选择的企业加入Cache**start********//

				Role role1 = new Role();
				role1.setUser(user);
				List<Role> roleList=systemService.findRole(role1);
				if(roleList==null||roleList.size()==0){
                    List<Dict> dictList = DictUtils.getDictList("defalut_role");
                    Dict dict = dictList.get(0);
                    Role role = systemService.getRole(dict.getValue());
                    role.setOffice(new Office("5"));
                    systemService.assignUserToRole(role,user,0);
                    roleList.add(role);
                }
				String companyName = request.getParameter("companyName");
				String comId = user.getComId();
				String officeId = user.getOffice().getId();
				if(companyName==null){
					if(user.isAdmin()){
						UserUtils.putCache("selectCompany","1");
						UserUtils.putCache("selectOffice", "1");
						Role role = new Role("1c54e003c1fc4dcd9b087ef8d48abac3");
						role.setDataScope("1");
						roles.add(role);
						//UserUtils.putCache("selectRole","1c54e003c1fc4dcd9b087ef8d48abac3");
					}else if(StringUtils.isNotBlank(comId)) {
						UserUtils.putCache("selectCompany", comId);
						UserUtils.putCache("selectOffice", officeId);
						if(comId.equals("1")){
							List<Role> roleList1 = UserUtils.getRoleListByCompany(user.getId());
							if (roleList1!=null && roleList1.size()!=0){
								roles.addAll(roleList1);
								//UserUtils.putCache("selectRole", roleList1.get(0).getId());
							}
						}else {
							List<Role> roleList1 = UserUtils.getRoleListByCompany(user.getId());
							if (roleList1!=null && roleList1.size()!=0){
								roles.addAll(roleList1);
								//UserUtils.putCache("selectRole", roleList1.get(0).getId());
							}
						}

					}
					UserUtils.putCache("selectRole",roles);
					return new SimpleAuthenticationInfo(new Principal(user, token.isMobileLogin()),
							user.getPassword().substring(16), ByteSource.Util.bytes(salt), getName());
				}
				if(companyName.equals("新用户")){
					companyName="总公司";
				}
				if (StringUtils.isNotBlank(companyName) && !companyName.equals("0")){
					if(user.isAdmin()){
						UserUtils.putCache("selectCompany","1");
						UserUtils.putCache("selectOffice", "1");
						Role role = new Role("1c54e003c1fc4dcd9b087ef8d48abac3");
						role.setDataScope("1");
						roles.add(role);
						//UserUtils.putCache("selectRole","1c54e003c1fc4dcd9b087ef8d48abac3");
					}else{
						UserUtils.putCache("selectOffice", officeId);
						boolean nameStatus = true;
						for (Role role2 : roleList) {
							if(role2.getCompany().getName().equals(companyName)){
								nameStatus = false;
								if(UserUtils.getCache("selectCompany") ==null){
									UserUtils.putCache("selectCompany", role2.getCompany().getId());
								}else if (UserUtils.getCache("selectCompany") !=null && !role2.getCompany().getId().equals(UserUtils.getCache("selectCompany").toString())){
									UserUtils.putCache("selectCompany", role2.getCompany().getId());
								}
								roles.add(role2);
								//UserUtils.putCache("selectRole", role2.getId());
								//UserUtils.putCache("selectCompany", role2.getCompany().getId());
								/*if(user.getCompany()==null){
									user.setCompany(role2.getCompany());
								}
								if(user.getOffice()==null){
									user.setOffice(role2.getOffice());
								}*/
							}
						}
						if (nameStatus){
							//获取默认公司名称
							String comName ="0";
							if(comId!=null){
								Office office = officeService.get(comId);
								comName = office.getName();
							}
							UserUtils.putCache("selectCompany", comId);
							UserUtils.putCache("selectOffice", officeId);
							for (Role role2 : roleList) {
								if(role2.getCompany().getName().equals(comName)){
									roles.add(role2);
									//UserUtils.putCache("selectRole", role2.getId());
								}
							}
						}
					}
				}
				if(companyName.equals("0")){
					if(user.isAdmin()){
						UserUtils.putCache("selectCompany","1");
						UserUtils.putCache("selectOffice", "1");
						Role role = new Role("1c54e003c1fc4dcd9b087ef8d48abac3");
						role.setDataScope("1");
						roles.add(role);
						//UserUtils.putCache("selectRole","1c54e003c1fc4dcd9b087ef8d48abac3");
					}else{
						//获取默认公司名称
						String comName ="0";
						if(comId!=null){
							Office office = officeService.get(comId);
							comName = office.getName();
						}
						UserUtils.putCache("selectCompany", comId);
						UserUtils.putCache("selectOffice", officeId);
						for (Role role2 : roleList) {
							if(role2.getCompany().getName().equals(comName)){
								roles.add(role2);
							}
						}
					}
					/*String comId = user.getComId();
					if(StringUtils.isNotBlank(comId)) {
						UserUtils.putCache("selectCompany", comId);
						List<Role> roleList1 = UserUtils.getRoleList(user);
						if(roleList1.size()>0) {
							UserUtils.putCache("selectOffice", roleList1.get(0).getOffice().getId());
							UserUtils.putCache("selectRole", roleList1.get(0).getId());
						}
					}else{
						UserUtils.putCache("selectCompany", comId);
						List<Role> roleList1 = UserUtils.getRoleListByCompany(user.getId());
						if(roleList1.size()>0) {
							UserUtils.putCache("selectOffice", roleList1.get(0).getOffice().getId());
							UserUtils.putCache("selectRole", roleList1.get(0).getId());
						}
					}*/
				}
				UserUtils.putCache("selectRole",roles);
				//****将选择的企业加入Cache**end********//
				Principal p =new Principal(user, token.isMobileLogin());
				return new SimpleAuthenticationInfo(p,user.getPassword().substring(16), ByteSource.Util.bytes(salt), getName());
			} else {
				return null;
			}
		/*} catch (Exception e) {
			//logger.error("getActiveSessions", e);
			return null;
		} finally {
			JedisUtils.returnResource(jedis);
		}*/
	}

	/**
	 * 授权查询回调函数, 进行鉴权但缓存中无用户的授权信息时调用
	 */
	@Override
	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
		Principal principal = (Principal) getAvailablePrincipal(principals);
		// 获取当前已登录的用户
		if (!Global.TRUE.equals(Global.getConfig("user.multiAccountLogin"))){
			Collection<Session> sessions = getSystemService().getSessionDao().getActiveSessions(true, principal, UserUtils.getSession());
			if (sessions.size() > 0){
				// 如果是登录进来的，则踢出已在线用户
				if (UserUtils.getSubject().isAuthenticated()){
					for (Session session : sessions){
						getSystemService().getSessionDao().delete(session);
					}
				}
				// 记住我进来的，并且当前用户已登录，则退出当前用户提示信息。
				else{
					UserUtils.getSubject().logout();
					throw new AuthenticationException("msg:账号已在其它地方登录，请重新登录。");
				}
			}
		}
		User user = getSystemService().getUserByLoginName(principal.getLoginName());
		if (user != null) {
			SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
			List<Menu> list = UserUtils.getMenuList();
			for (Menu menu : list){
				if (StringUtils.isNotBlank(menu.getPermission())){
					// 添加基于Permission的权限信息
					for (String permission : StringUtils.split(menu.getPermission(),",")){
						info.addStringPermission(permission);
					}
				}
			}
			// 添加用户权限
			info.addStringPermission("user");
			// 添加用户岗位信息
			for (Role role : user.getRoleList()){
				info.addRole(role.getEnname());
			}
			// 更新登录IP和时间
			getSystemService().updateUserLoginInfo(user);
			// 记录登录日志
			LogUtils.saveLog(Servlets.getRequest(), "系统登录");
			return info;
		} else {
			return null;
		}
	}

	@Override
	protected void checkPermission(Permission permission, AuthorizationInfo info) {
		authorizationValidate(permission);
		super.checkPermission(permission, info);
	}

	@Override
	protected boolean[] isPermitted(List<Permission> permissions, AuthorizationInfo info) {
		if (permissions != null && !permissions.isEmpty()) {
			for (Permission permission : permissions) {
				authorizationValidate(permission);
			}
		}
		return super.isPermitted(permissions, info);
	}

	@Override
	public boolean isPermitted(PrincipalCollection principals, Permission permission) {
		authorizationValidate(permission);
		return super.isPermitted(principals, permission);
	}

	@Override
	protected boolean isPermittedAll(Collection<Permission> permissions, AuthorizationInfo info) {
		if (permissions != null && !permissions.isEmpty()) {
			for (Permission permission : permissions) {
				authorizationValidate(permission);
			}
		}
		return super.isPermittedAll(permissions, info);
	}

	/**
	 * 授权验证方法
	 * @param permission
	 */
	private void authorizationValidate(Permission permission){
		// 模块授权预留接口
	}

	/**
	 * 设定密码校验的Hash算法与迭代次数
	 */
	@PostConstruct
	public void initCredentialsMatcher() {
		HashedCredentialsMatcher matcher = new HashedCredentialsMatcher(SystemService.HASH_ALGORITHM);
		matcher.setHashIterations(SystemService.HASH_INTERATIONS);
		setCredentialsMatcher(matcher);
	}

	/**
	 * 清空用户关联权限认证，待下次使用时重新加载
	 */
	public void clearCachedAuthorizationInfo(Principal principal) {
		SimplePrincipalCollection principals = new SimplePrincipalCollection(principal, getName());
		clearCachedAuthorizationInfo(principals);
	}

	/**
	 * 清空所有关联认证
	 * @Deprecated 不需要清空，授权缓存保存到session中
	 */
	@Deprecated
	public void clearAllCachedAuthorizationInfo() {
//		Cache<Object, AuthorizationInfo> cache = getAuthorizationCache();
//		if (cache != null) {
//			for (Object key : cache.keys()) {
//				cache.remove(key);
//			}
//		}
	}

	/**
	 * 获取系统业务对象
	 */
	public SystemService getSystemService() {
		if (systemService == null){
			systemService = SpringContextHolder.getBean(SystemService.class);
		}
		return systemService;
	}

	/**
	 * 授权用户信息
	 */
	public static class Principal implements Serializable {

		private static final long serialVersionUID = 1L;

		private String id; // 编号
		private String loginName; // 登录名
		private String name; // 姓名
		private boolean mobileLogin; // 是否手机登录
		private String companyName; // 用户登录公司名称
		private boolean firstFlag; // 是否首次登陆

//		private Map<String, Object> cacheMap;

		public Principal(User user, boolean mobileLogin) {
			this.id = user.getId();
			this.loginName = user.getLoginName();
			this.name = user.getName();
			this.mobileLogin = mobileLogin;
			if(user.getCompany()!=null){
				this.setCompanyName(user.getCompany().getName());
			}
            if("1".equals(user.getFirstFlag())){
			    this.firstFlag=true;
            }
		}

		public String getId() {
			return id;
		}

		public String getLoginName() {
			return loginName;
		}

		public String getName() {
			return name;
		}

		public boolean isMobileLogin() {
			return mobileLogin;
		}

//		@JsonIgnore
//		public Map<String, Object> getCacheMap() {
//			if (cacheMap==null){
//				cacheMap = new HashMap<String, Object>();
//			}
//			return cacheMap;
//		}

		/**
		 * 获取SESSIONID
		 */
		public String getSessionid() {
			try{
				return (String) UserUtils.getSession().getId();
			}catch (Exception e) {
				return "";
			}
		}

		@Override
		public String toString() {
			return id;
		}

		public String getCompanyName() {
			return companyName;
		}

		public void setCompanyName(String companyName) {
			this.companyName = companyName;
		}

        public boolean isFirstFlag() {
            return firstFlag;
        }

        public void setFirstFlag(boolean firstFlag) {
            this.firstFlag = firstFlag;
        }
    }

    protected Object getAuthorizationCacheKey(PrincipalCollection principals) {
        return principals.toString();
    }
}
