<?php

declare(strict_types=1);

namespace app\adminapi\controller\system;

use app\adminapi\controller\Base;
use app\adminapi\middleware\AccessTokenMiddleware;
use app\adminapi\middleware\OperationMiddleware;
use app\adminapi\middleware\PermissionMiddleware;
use app\attribute\SkipApiEncrypt;
use app\service\admin\system\ConfigService;
use core\tool\ApiEncryptService;
use core\tool\Json;
use madong\swagger\annotation\response\DataResponse;
use madong\swagger\attribute\Permission;
use OpenApi\Attributes as OA;
use support\annotation\Middleware;
use support\Request;
use support\Response;

#[SkipApiEncrypt]
#[Middleware(AccessTokenMiddleware::class, PermissionMiddleware::class, OperationMiddleware::class)]
final class ApiEncryptController extends Base
{
    protected ApiEncryptService $encryptService;

    protected ConfigService $configService;

    public function __construct(ApiEncryptService $encryptService, ConfigService $configService)
    {
        $this->encryptService = $encryptService;
        $this->configService = $configService;
    }

    #[OA\Get(path: '/system/api-encrypt', summary: '获取接口加密配置', tags: ['系统配置'])]
    #[Permission(code: 'system:config:update')]
    #[DataResponse(description: '获取成功')]
    public function detail(Request $request): Response
    {
        $config = $this->configService->config('api_encrypt_setting', [], ['group_code' => 'system']);
        $config = is_array($config) ? $config : [];

        return Json::success('获取成功', [
            'enabled' => (int) ($config['enabled'] ?? ($this->encryptService->isEnabled() ? 1 : 0)),
            'scope' => (string) ($config['scope'] ?? $this->encryptService->getScope()),
            'key_version' => (string) ($config['key_version'] ?? $this->encryptService->getKeyVersion()),
            'timestamp_tolerance' => (int) ($config['timestamp_tolerance'] ?? 300),
            'exclude_paths' => $config['exclude_paths'] ?? [],
            'encrypted_paths' => $config['encrypted_paths'] ?? $this->encryptService->getEncryptedPaths(),
            'public_key_path' => (string) ($config['public_key_path'] ?? ''),
            'private_key_path' => (string) ($config['private_key_path'] ?? ''),
            'public_key' => $this->encryptService->getPublicKey(),
            'private_key' => $this->encryptService->getPrivateKey(),
        ]);
    }

    #[OA\Post(path: '/system/api-encrypt/generate-keypair', summary: '生成接口加密密钥对', tags: ['系统配置'])]
    #[Permission(code: 'system:config:update')]
    #[DataResponse(description: '生成成功')]
    public function generateKeypair(Request $request): Response
    {
        try {
            $keys = $this->encryptService->generateKeyPair();
            $this->encryptService->persistKeyPair($keys);

            return Json::success('生成成功', [
                'public_key' => $this->encryptService->getPublicKey(),
                'private_key' => $this->encryptService->getPrivateKey(),
            ]);
        } catch (\Throwable $exception) {
            return Json::fail($exception->getMessage());
        }
    }
}