package org.hzhub.erp.config;

import cn.dev33.satoken.interceptor.SaInterceptor;
import cn.dev33.satoken.stp.StpUtil;
import jakarta.servlet.http.HttpServletRequest;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

import java.util.Arrays;
import java.util.List;

/**
 * Sa-Token 路由拦截器配置
 */
@Configuration
public class SecurityConfig implements WebMvcConfigurer {

    /**
     * 不需要拦截的路径
     */
    private static final List<String> EXCLUDE_PATHS = Arrays.asList(
        "/erp/test/**",
        "/erp/customer/**",
        "/erp/api/**",       // API配置管理（开发阶段暂时跳过认证）
        "/erp/dynamic/**",   // 动态API执行（开发阶段暂时跳过认证）
        "/actuator/**",
        "/error"
    );

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        // 开发阶段：完全跳过拦截器配置，不添加任何拦截器
        // 生产环境：需要启用以下拦截器配置

        /*
        registry.addInterceptor(new SaInterceptor(handle -> {
            // 如果请求来自 Gateway（已验证 JWT），直接放行
            HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
            if ("true".equals(request.getHeader("X-Gateway-Verified"))) {
                return;
            }
            StpUtil.checkLogin();
        }))
            .addPathPatterns("/**")
            .excludePathPatterns(EXCLUDE_PATHS);
        */
    }
}

