@Component
public class RequestLoggingFilter implements Filter {

    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
                         FilterChain chain) throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        long start = System.currentTimeMillis();

        // 前置：记录请求信息
        String traceId = UUID.randomUUID().toString().replace("-", "");
        MDC.put("traceId", traceId);

        chain.doFilter(request, response); // 执行后续链条

        // 后置：记录耗时
        long cost = System.currentTimeMillis() - start;
        HttpServletResponse res = (HttpServletResponse) response;
        log.info("{} {} -> {} {}ms",
                req.getMethod(), req.getRequestURI(), res.getStatus(), cost);

        MDC.clear();
    }
}

// 跨域 Filter —— 同样是 Filter 的典型用途
@Component
public class CorsFilter implements Filter {

    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
                         FilterChain chain) throws IOException, ServletException {
        HttpServletResponse res = (HttpServletResponse) response;
        res.setHeader("Access-Control-Allow-Origin", "*");
        res.setHeader("Access-Control-Allow-Methods", "GET,POST,PUT,DELETE");
        res.setHeader("Access-Control-Allow-Headers", "Content-Type,Authorization");
        chain.doFilter(request, response);
    }
}

@Configuration
public class FilterConfig {

    @Bean
    public FilterRegistrationBean<RequestLoggingFilter> loggingFilter() {
        FilterRegistrationBean<RequestLoggingFilter> bean = new FilterRegistrationBean<>();
        bean.setFilter(new RequestLoggingFilter());
        bean.setOrder(1);               // 数字越小越靠前
        bean.addUrlPatterns("/api/*");  // 只拦截指定路径
        return bean;
    }
}

@Component
public class AuthInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request,
                             HttpServletResponse response,
                             Object handler) throws Exception {
        // 从 Header 中获取 token
        String token = request.getHeader("Authorization");
        if (token == null || token.isEmpty()) {
            response.setStatus(401);
            response.getWriter().write("{\"code\":401,\"msg\":\"未登录\"}");
            return false; // 拦截，不再往下走
        }

        // 验证 token，解析用户信息
        Long userId = TokenUtils.parseUserId(token);
        if (userId == null) {
            response.setStatus(401);
            response.getWriter().write("{\"code\":401,\"msg\":\"token无效\"}");
            return false;
        }

        // 存入 request attribute，供后续 Controller 使用
        request.setAttribute("userId", userId);
        return true; // 放行
    }

    @Override
    public void afterCompletion(HttpServletRequest request,
                                HttpServletResponse response,
                                Object handler, Exception ex) {
        // 记录操作日志（不论成功与否都会执行）
        Long userId = (Long) request.getAttribute("userId");
        String uri = request.getRequestURI();
        log.info("用户 {} 访问 {} {}", userId, request.getMethod(), uri);
    }
}

@Configuration
public class WebConfig implements WebMvcConfigurer {

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new AuthInterceptor())
                .addPathPatterns("/api/**")      // 拦截路径
                .excludePathPatterns("/api/login", "/api/public/**") // 排除路径
                .order(1);
    }
}

@ControllerAdvice
public class DecryptRequestBodyAdvice extends RequestBodyAdviceAdapter {

    @Override
    public boolean supports(MethodParameter methodParameter,
                            Type targetType,
                            Class<? extends HttpMessageConverter<?>> converterType) {
        // 只处理带有 @Decrypt 注解的方法参数
        return methodParameter.hasParameterAnnotation(Decrypt.class);
    }

    @Override
    public HttpInputMessage beforeBodyRead(HttpInputMessage inputMessage,
                                           MethodParameter parameter,
                                           Type targetType,
                                           Class<? extends HttpMessageConverter<?>> converterType)
            throws IOException {
        // 在这里可以记录原始请求体
        return inputMessage; // 返回原消息或包装后的消息
    }

    @Override
    public Object afterBodyRead(Object body, HttpInputMessage inputMessage,
                                MethodParameter parameter, Type targetType,
                                Class<? extends HttpMessageConverter<?>> converterType) {
        // body 是已经反序列化好的 Controller 入参对象
        log.info("请求体：{}", JSON.toJSONString(body));

        // 示例：如果 DTO 实现了 Decryptable 接口，则解密其中的加密字段
        if (body instanceof Decryptable) {
            ((Decryptable) body).decrypt();
        }
        return body; // 返回的 body 将作为 Controller 的最终入参
    }
}

// 配套注解
@Target(ElementType.PARAMETER)
@Retention(RetentionPolicy.RUNTIME)
public @interface Decrypt {
}

// Controller 使用
@PostMapping("/user")
public Result createUser(@RequestBody @Decrypt UserDTO dto) {
    // dto 中的加密字段已在 RequestAdvice 中解密
    userService.save(dto);
    return Result.success();
}

@ControllerAdvice
public class ApiResponseAdvice implements ResponseBodyAdvice<Object> {

    @Override
    public boolean supports(MethodParameter returnType,
                            Class<? extends HttpMessageConverter<?>> converterType) {
        // 排除不需要封装的情况（如文件下载、Swagger接口等）
        return !returnType.getParameterType().equals(ResponseEntity.class);
    }

    @Override
    public Object beforeBodyWrite(Object body, MethodParameter returnType,
                                  MediaType selectedContentType,
                                  Class<? extends HttpMessageConverter<?>> selectedConverterType,
                                  ServerHttpRequest request, ServerHttpResponse response) {
        // 如果已经是 Result 类型，不再重复包装
        if (body instanceof Result) {
            return body;
        }
        // 如果是 String 类型，需要特殊处理（StringHttpMessageConverter 的限制）
        if (body instanceof String) {
            return JSON.toJSONString(Result.success(body));
        }
        return Result.success(body);
    }
}

// 统一响应体结构
@Data
@AllArgsConstructor
public class Result<T> {
    private int code;
    private String msg;
    private T data;

    public static <T> Result<T> success(T data) {
        return new Result<>(200, "success", data);
    }

    public static <T> Result<T> error(int code, String msg) {
        return new Result<>(code, msg, null);
    }
}

// 1. Filter：生成 traceId，设置到 MDC
@Component
public class TraceFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
                         FilterChain chain) throws IOException, ServletException {
        String traceId = ((HttpServletRequest) request).getHeader("X-Trace-Id");
        if (traceId == null) traceId = UUID.randomUUID().toString().replace("-", "");
        MDC.put("traceId", traceId);
        chain.doFilter(request, response);
        MDC.clear();
    }
}

// 2. Interceptor：在业务日志中记录用户 + traceId 的关联
@Component
public class TraceInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest request,
                             HttpServletResponse response, Object handler) {
        // traceId 已在 Filter 中设置，这里只需设置用户信息
        Long userId = (Long) request.getAttribute("userId");
        if (userId != null) MDC.put("userId", userId.toString());
        return true;
    }
    @Override
    public void afterCompletion(HttpServletRequest request,
                                HttpServletResponse response,
                                Object handler, Exception ex) {
        MDC.remove("userId");
    }
}

// 3. RequestAdvice / ResponseAdvice：在请求体/响应体日志中自带 traceId
// log.info("请求体：{}", body) 时，logback 会自动从 MDC 中取出 traceId 一并打印

// RequestAdvice：入参加密 → 解密
// ResponseAdvice：返回值 → 脱敏

@ControllerAdvice
public class SensitiveDataAdvice extends RequestBodyAdviceAdapter
                                  implements ResponseBodyAdvice<Object> {

    // --- RequestAdvice：解密入参 ---
    @Override
    public Object afterBodyRead(Object body, ...) {
        // 解密请求中的敏感字段
        if (body instanceof SensitiveInput) {
            ((SensitiveInput) body).decryptFields();
        }
        return body;
    }

    // --- ResponseAdvice：脱敏出参 ---
    @Override
    public Object beforeBodyWrite(Object body, ...) {
        // 脱敏响应中的手机号、身份证号
        if (body instanceof SensitiveOutput) {
            ((SensitiveOutput) body).maskFields();
        }
        return body;
    }
}

@RestController
@RequestMapping("/api/orders")
public class OrderController {

    @PostMapping
    @Decrypt  // RequestAdvice 负责解密
    public OrderVO create(@RequestBody @Valid CreateOrderDTO dto) {
        // 不需要关心：
        // - traceId（Filter 做了）
        // - 登录态（Interceptor 做了）
        // - 参数解密（RequestAdvice 做了）
        // - 响应封装（ResponseAdvice 做了）
        // 只需要关心业务逻辑
        return orderService.create(dto);
    }
}