package com.landtool.lanbase.common.shiro;

import java.io.IOException;
import java.net.URLEncoder;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.http.HttpStatus;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.StringUtils;
import org.apache.shiro.web.filter.authc.AuthenticatingFilter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.RequestMethod;

import com.google.gson.Gson;
import com.landtool.lanbase.common.utils.HttpUtils;
import com.landtool.lanbase.common.utils.Result;

/**
 * @author lanbase
 * @Description: TODO(shiro 认证过滤器)
 * @date 2017-6-23 15:07
 */
public class ShiroAuthenticatingFilter extends AuthenticatingFilter {

	private static  String loginUrl; // http://127.0.0.1:8082/login
	private static String CasHost;// https://cas.nmsmp.com/cas/
	 
	private Logger logger = LoggerFactory.getLogger(getClass());

	public ShiroAuthenticatingFilter(String loginUrl,String casHost)
	{
		this.loginUrl=loginUrl;
		this.CasHost=casHost;
	}
	
	// 创建shiro认证的token
	@Override
	protected AuthenticationToken createToken(ServletRequest request, ServletResponse response) throws Exception {
		HttpServletRequest httpRequest = (HttpServletRequest) request;
		String username = httpRequest.getRemoteUser();
		// 获取请求token
		String token = getRequestToken((HttpServletRequest) request);
		ShiroToken shiroToken = null;
//		if (!StringUtils.isBlank(token)) {
//			shiroToken = new ShiroToken(token);
//		} else if (!StringUtils.isBlank(username)) {
//			shiroToken = new ShiroToken(username, true);
//		} else {
//			return null;
//		}
		return shiroToken;
	}

	// protected boolean preHandle(ServletRequest request, ServletResponse
	// response) throws Exception {
	// HttpServletRequest httpRequest = WebUtils.toHttp(request);
	// HttpServletResponse httpResponse = WebUtils.toHttp(response);
	// if (httpRequest.getMethod().equals(RequestMethod.OPTIONS.name())) {
	// httpResponse.setHeader("Access-control-Allow-Origin", origin);
	// httpResponse.setHeader("Access-Control-Allow-Methods",
	// httpRequest.getMethod());
	// httpResponse.setHeader("Access-Control-Allow-Headers",
	// httpRequest.getHeader("Access-Control-Request-Headers"));
	// httpResponse.setStatus(HttpStatus.OK.value());
	// return false;
	// }
	// return super.preHandle(request, response);
	// }

	// 是否允许访问
	@Override
	protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
		return false;
	}

	// 拒绝访问的出来
	@Override
	protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
			HttpServletRequest httpRequest = (HttpServletRequest) request;
		HttpServletResponse httpResponse = (HttpServletResponse) response;
		// 处理CORS的options请求 by Tanbin
		if (httpRequest.getMethod().equals(RequestMethod.OPTIONS.name())) {
			String origin = httpRequest.getHeader("Origin");
			httpResponse.setHeader("Access-control-Allow-Origin", origin);
			httpResponse.setHeader("Access-Control-Allow-Methods", httpRequest.getMethod());
			httpResponse.setHeader("Access-Control-Allow-Credentials", "true");
			httpResponse.setHeader("Access-Control-Allow-Headers",
					httpRequest.getHeader("Access-Control-Request-Headers"));
			httpResponse.setStatus(HttpStatus.SC_OK);
			return false;
		}
		 

		String username = httpRequest.getRemoteUser();
		if (StringUtils.hasText(username)) {// 已经登录shiro
			logger.debug("0----已经登录shiro:" + username);
			 return true ;
		} else {
			username = getLoginNamefromXml(httpRequest);
			if (StringUtils.hasText(username)) {
				Subject subject = SecurityUtils.getSubject();
				ShiroToken shiroToken = new ShiroToken(username, true);
				 if(!subject.isAuthenticated())
				 {
					 subject.login(shiroToken);
					 logger.debug("8----loginshiro:" );
				 }
 
				String redirectUrl=	 getValidateTicketServer(httpRequest);

				logger.debug("3----RedirectOldurl:" + redirectUrl);
				//WebUtils.issueRedirect(request, response, oldUrl);
				httpResponse.setHeader("P3P", "CP=CAO PSA OUR");
				httpResponse.sendRedirect(redirectUrl);
				
			} else { 
				String reloginUrl=	getFirstServer(httpRequest); 
				reloginUrl=	CasHost +  "login?service="+URLEncoder.encode( reloginUrl);
				logger.debug("1----RedirectCasloginUrl:" + reloginUrl);
				httpResponse.sendRedirect(reloginUrl);// 用户名不存在跳转回登录页面
				return false;
			}
		}
		return true ;
	}

	@Override
	protected boolean onLoginFailure(AuthenticationToken token, AuthenticationException e, ServletRequest request,
			ServletResponse response) {
		HttpServletResponse httpResponse = (HttpServletResponse) response;
		httpResponse.setContentType("application/json;charset=utf-8");
		try {
			// 处理登录失败的异常
			Throwable throwable = e.getCause() == null ? e : e.getCause();
			Result r = Result.error(HttpStatus.SC_UNAUTHORIZED, throwable.getMessage());

			String json = new Gson().toJson(r);
			httpResponse.getWriter().print(json);
		} catch (IOException e1) {

		}

		return false;
	}

	/**
	 * 获取请求的token
	 */
	private String getRequestToken(HttpServletRequest httpRequest) {
		// 从header中获取token
		String token = httpRequest.getHeader("token");

		// 如果header中不存在token，则从参数中获取token
		if (!StringUtils.hasText(token)) {
			token = httpRequest.getParameter("token");
		}

		return token;
	}

	

	private String getLoginNamefromXml(HttpServletRequest request) throws Exception {
		String username = "";
		
		Subject subject = SecurityUtils.getSubject();
		Session session =subject.getSession(true); 
		username = session.getAttribute("shirousername") == null ? ""
				: session.getAttribute("shirousername").toString();
		logger.debug("4----shirousername:" + session.getAttribute("shirousername") +(session.getId() ));
		if (org.springframework.util.StringUtils.isEmpty(username)) {
			 

			String ticket = request.getParameter("ticket");

			if (!org.springframework.util.StringUtils.isEmpty(ticket)) {
				
				String reloginUrl=	 getValidateTicketServer(request);
				
				String url = CasHost.replace("https", "http");
				String validateurl = url + "serviceValidate?ticket=" + ticket + "&service=" +  URLEncoder.encode(reloginUrl);
				 
				logger.debug("2----ServiceValidate:" + validateurl);

				String casxml;
				casxml = HttpUtils.get(validateurl);
				logger.debug(casxml);
				Integer index = casxml.indexOf("<cas:user>");
				Integer end = casxml.indexOf("</cas:user>");

				if (index > 0) {
					username = casxml.substring(index + 10, end);
				}
			}
		}
		return username;
	}

	private String getValidateTicketServer(HttpServletRequest request) {
		String server = getServerParameter(request);
		
		String reloginUrl=	 request.getRequestURL().toString();
		if(StringUtils.hasText(  server))
		{
			reloginUrl+="?"+server;
		}
		return reloginUrl;
	}
	

	private String getServerParameter(HttpServletRequest request) {
		String server = request.getQueryString();
		String ticket = request.getParameter("ticket");
		if (!org.springframework.util.StringUtils.isEmpty(ticket)) {
			server = server.replace("ticket=" + ticket, "");
			if (server.endsWith("&"))
				server = server.substring(0, server.length() - 1);
		}
		return server;
	}
	

	/***
	 * 获取原始访问路径
	 * 
	 * @return
	 */
	private String getFirstServer(HttpServletRequest httpRequest) {
		String reloginUrl=	 httpRequest.getRequestURL().toString();
		if(StringUtils.hasText( httpRequest.getQueryString()))
		{
			reloginUrl+="?"+httpRequest.getQueryString();
		}
		return reloginUrl;
	}
 
}