package middleware

import (
	"net/http"
	"time"

	securityEntities "hyapi-server/internal/domains/security/entities"
	securityServices "hyapi-server/internal/domains/security/services"
	"hyapi-server/internal/shared/interfaces"

	"github.com/gin-gonic/gin"
	"go.uber.org/zap"
)

// ManagedIPBlacklistMiddleware 管理端维护的 IP 黑名单拦截
type ManagedIPBlacklistMiddleware struct {
	blacklist *securityServices.BlacklistService
	response  interfaces.ResponseBuilder
	logger    *zap.Logger
}

func NewManagedIPBlacklistMiddleware(
	blacklist *securityServices.BlacklistService,
	response interfaces.ResponseBuilder,
	logger *zap.Logger,
) *ManagedIPBlacklistMiddleware {
	return &ManagedIPBlacklistMiddleware{
		blacklist: blacklist,
		response:  response,
		logger:    logger,
	}
}

func (m *ManagedIPBlacklistMiddleware) GetName() string { return "managed_ip_blacklist" }
func (m *ManagedIPBlacklistMiddleware) GetPriority() int { return 25 }
func (m *ManagedIPBlacklistMiddleware) IsGlobal() bool   { return true }

func (m *ManagedIPBlacklistMiddleware) Handle() gin.HandlerFunc {
	return func(c *gin.Context) {
		ip := c.ClientIP()
		blocked, entry := m.blacklist.IsIPBlocked(c.Request.Context(), ip)
		if !blocked {
			c.Next()
			return
		}
		reason := "IP在黑名单中"
		if entry != nil && entry.Reason != "" {
			reason = entry.Reason
		}
		m.blacklist.RecordHit(&securityEntities.BlacklistHitRecord{
			HitType:   securityEntities.HitTypeIP,
			IP:        ip,
			Path:      c.Request.URL.Path,
			Method:    c.Request.Method,
			Reason:    reason,
			UserAgent: c.GetHeader("User-Agent"),
		})
		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
			"success":    false,
			"message":    "访问被拒绝",
			"error":      "该IP已被列入黑名单",
			"request_id": c.GetString("request_id"),
			"timestamp":  time.Now().Unix(),
		})
	}
}