@Slf4j
@Component
@RequiredArgsConstructor
public class JwtAuthorizationCookieFilter implements GlobalFilter, Ordered {

    @Value("${jwt.secret-key}")
    private String secretKey;

    private final List<String> whitelist = List.of(
            "/user-service/api/auth/login",
            "/user-service/api/auth/signup",
            "/user-service/api/auth/refresh"
    );

    private final Predicate<ServerHttpRequest> isSecured = request ->
            whitelist.stream().noneMatch(path -> request.getURI().getPath().startsWith(path));

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        ServerHttpRequest request = exchange.getRequest();

        // pass
        if (!isSecured.test(request)) {
            log.debug("PASS");
            return chain.filter(exchange);
        }

        // 헤더 기반
        String authHeader = request.getHeaders().getFirst("Authorization");

        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
            return this.onError(exchange, "Authorization header missing or malformed", HttpStatus.UNAUTHORIZED);
        }

        // Bearer => 띄어쓰기까지 7자
        String token = authHeader.substring(7);
        if (isInvalidToken(token)) {
            return this.onError(exchange, "JWT token invalid", HttpStatus.UNAUTHORIZED);
        }

        // 쿠키 기반
//        HttpCookie jwtCookie = request.getCookies().getFirst("access_token");
//        if (jwtCookie == null) {
//            return this.onError(exchange, "JWT cookie missing", HttpStatus.UNAUTHORIZED);
//        }
//
//        String token = jwtCookie.getValue();
//        if (isInvalidToken(token)) {
//            return this.onError(exchange, "JWT token invalid", HttpStatus.UNAUTHORIZED);
//        }

        Claims claims = parseClaims(token);
        String userId = claims.getSubject();

        ServerHttpRequest mutatedRequest = request.mutate()
                .header("X-USER-ID", userId)
                .build();

        return chain.filter(exchange.mutate().request(mutatedRequest).build());
    }

    private boolean isInvalidToken(String token) {
        try {
            parseClaims(token);
            return false;
        } catch (ExpiredJwtException e) {
            log.warn("Expired JWT: {}", e.getMessage());
        } catch (JwtException e) {
            log.warn("Invalid JWT: {}", e.getMessage());
        }
        return true;
    }

    private Claims parseClaims(String token) {
        Key key = Keys.hmacShaKeyFor(secretKey.getBytes(StandardCharsets.UTF_8));
        return Jwts
                .parserBuilder()
                .setSigningKey(key)
                .build()
                .parseClaimsJws(token)
                .getBody();
    }

    private Mono<Void> onError(ServerWebExchange exchange, String message, HttpStatus status) {
        log.warn("Authorization error: {}", message);
        ServerHttpResponse response = exchange.getResponse();
        response.setStatusCode(status);
        return response.setComplete();
    }

    @Override
    public int getOrder() {
        return -1;
    }
}

public class JwtAuthFilter extends OncePerRequestFilter {

    private final JwtProvider jwtProvider;
    private final RefreshTokenClient refreshTokenClient; // Feign 또는 RestTemplate 등

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {

        String accessToken = extractToken(request);

        if (accessToken != null && jwtProvider.isExpired(accessToken)) {
            String refreshToken = extractRefreshTokenFromCookie(request);

            // 리프레시 요청
            String newAccessToken = refreshTokenClient.refresh(refreshToken);

            if (newAccessToken != null) {
                // 새 AccessToken을 Authorization 헤더에 삽입 (mutable request wrapper 사용 필요)
                MutableHttpServletRequest mutableRequest = new MutableHttpServletRequest(request);
                mutableRequest.putHeader("Authorization", "Bearer " + newAccessToken);

                filterChain.doFilter(mutableRequest, response);
                return;
            } else {
                response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Token expired and refresh failed");
                return;
            }
        }

        // 유효하거나 토큰 없음 → 그대로 진행
        filterChain.doFilter(request, response);
    }
}

public class MutableHttpServletRequest extends HttpServletRequestWrapper {
    private final Map<String, String> customHeaders = new HashMap<>();

    public MutableHttpServletRequest(HttpServletRequest request) {
        super(request);
    }

    public void putHeader(String name, String value) {
        this.customHeaders.put(name, value);
    }

    @Override
    public String getHeader(String name) {
        return customHeaders.getOrDefault(name, super.getHeader(name));
    }

    @Override
    public Enumeration<String> getHeaderNames() {
        Set<String> names = new HashSet<>(customHeaders.keySet());
        Enumeration<String> originalNames = super.getHeaderNames();
        while (originalNames.hasMoreElements()) {
            names.add(originalNames.nextElement());
        }
        return Collections.enumeration(names);
    }
}