package com.kmall.admin.fromcomm.security;

import com.alibaba.fastjson.JSON;
import com.kmall.admin.utils.ShiroUtils;
import com.kmall.common.security.SessionManager;
import com.kmall.common.utils.ServletUtils;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.session.Session;
import org.apache.shiro.session.mgt.eis.SessionDAO;
import org.apache.shiro.web.filter.authc.UserFilter;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.util.WebUtils;
import org.springframework.stereotype.Service;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.security.Principal;
import java.util.HashMap;
import java.util.Map;

@Service
public class UserAuthenticationFilter extends UserFilter {


    @Override
    protected boolean onAccessDenied(ServletRequest request,
                                     ServletResponse response) throws Exception {
        HttpServletRequest httpRequest = WebUtils.toHttp(request);
        if (isAjaxRequest(httpRequest)) {
            String msg = "Session超时请重新登陆";
            DefaultWebSecurityManager securityManager = (DefaultWebSecurityManager) SecurityUtils.getSecurityManager();
            SessionManager sessionManager = (SessionManager) securityManager.getSessionManager();
            SessionDAO sessionDao = (SessionDAO) sessionManager.getSessionDAO();
            Session session = sessionDao.readSession(httpRequest.getCookies()[0].getValue());
            HttpServletResponse res = WebUtils.toHttp(response);
            res.setContentType("application/json");
            res.setCharacterEncoding("utf-8");
            Map<String, Object> obj = new HashMap<String, Object>();
            obj.put("requestCode", -1);
            obj.put("msg", msg);
            res.getWriter().print(JSON.toJSONString(obj));
            return false;
        }
        saveRequestAndRedirectToLogin(request, response);
        return false;
    }

    /**
     * 是否是Ajax异步请求
     *
     * @param request
     */
    public static boolean isAjaxRequest(HttpServletRequest request) {

        String accept = request.getHeader("accept");
        String xRequestedWith = request.getHeader("X-Requested-With");
        Principal principal = (Principal) ShiroUtils.getSubject().getPrincipal();

        // 如果是异步请求，则直接返回信息
        return ((accept != null && accept.indexOf("application/json") != -1
                || (xRequestedWith != null && xRequestedWith.indexOf("XMLHttpRequest") != -1)
                || (principal != null)));
    }

}
