package com.asinking.cloud.uc.admin.util;

import com.alibaba.fastjson.JSON;
import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;

import javax.crypto.Cipher;
import java.net.URLEncoder;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.Base64;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;

/**
 * <p>
 *  SSO-JWT第三方系統(tǒng)代碼示例
 * </p>
 */
public class SSOJwtUtil {

    private static final String PRIVATE_KEY = "MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAMl5dXIwbawEOpMY+x02TRMhRXl0Ng4fbF0xofgCRfPkeO9JKU/An4+MtSyXDQNEGh+Eb8e1M2zJ4M7zf3DZ2wBcXn3247xKK8xol8VW2ytuGm5yBvtQpuuwwMTuf4k5rmQj4cMW4Ob2hIumjI4TiwwpEV0CIN4HKsLPXmC2EMsdAgMBAAECgYA/51F0NZ4jqHe3vn2vx1BtF+mEW3LlydvCN4LrOjVb5YTiSO9ch3lUu8mfag3LkmdCxev6iSPVhrbSjXNHpSIMC/xKk/FMjKGXCCsMt8DTzIgOSS8V+7TSr/vxwOOEmQyYxrjdS748dXlAlQ8YslbUxIWO34qFLjpG+YkIb9JvNQJBAO9Ec9P9IQAuslcrhH4Lpph8PHaTdKp+R4xHbx2hbmTdgTg+cYKBTVGec3Caeocr8VgtfSZgPBJGEJi7RNcfXk8CQQDXkGh+dHYli7Sz/Cj4RQzXWAlmaw0Jgmc4eoucj5BGtM85ZtmSKZUXTM3iLidiD8euyOlEIgOL/15o1abNdPDTAkEA7oa5Sd6RZZMn60rQ3K9Ut7Myu6sopUcaoLgeB9YFLby8s4tcsZOhtvpVby4xdEvUX+mJWBacDEOZDAm1CRiWdQJAWpj+0ebwoOcOk3avYWjj9L2zdbAYUp7T8xDODIbqBE2Jqn5ngt6nIpvNC/qJ4tTu/67BGzmQdA5oB3eEG2XCsQJAQinkQqRb42t+yn7AbKm5vx9kFs0r3wlBYihYguM5HU/W2HYS5iyY1r2EmYpaJiHrKGXnND61w3N0k8GSMVD7uA==";
    private static final String URL_PARAM = "?authType=jwt&param=%s";

    /**
     * TODO 需要替換為客戶訪問領星ERP系統(tǒng)的域名，SAAS客戶統(tǒng)一為 https://erp.lingxing.com,獨立部署客戶需要替換為自己的服務域名
     * 如果需要登錄默認進入指定菜單，請攜帶具體路徑
     * eg： 默認進入用戶管理頁面， https://erp.lingxing.com/erp/muser/userManage
     */
    private static final String DOMAIN = "https://erp.lingxing.com";

    // TODO 需要替換為配置在ERP系統(tǒng)的驗簽密鑰字段值 （菜單路徑：設置/業(yè)務配置/全局/單點登錄設置：驗簽密鑰）
    private static final String SIGN_KEY = "387e98090e064129886e959a94f7aea2";

    // TODO 需替換為配置在ERP系統(tǒng)的企業(yè)唯一標識值 （菜單路徑：設置/業(yè)務配置/全局/單點登錄設置：企業(yè)唯一標識）
    private static final String CLIENT_ID = "4B008083446B05FAE42589CEEEBD611A ";

    // TODO 如果需要指定當前jwtToken的過期時間，請手動調整此項值
    public static final Long EXPIRE_TIME = 3600L;//過期時間，單位秒，默認一小時

    public static void main(String[] args) {
        // TODO 用戶信息需替換為本系統(tǒng)的用戶數據
        String uniqueKey = "userId001";
        String mobile = "10000";
        String email = "lingxingUser@lingxing.com";
        String username = "lingxingUser";
        String realname = "領星用戶";

        String redirectUrl = getRedirectUrl(uniqueKey, mobile, email, username, realname);
        System.out.println("redirectUrl:" + redirectUrl);
    }

    /**
     * 獲取重定向到領星ERP系統(tǒng)的地址
     * @param uniqueKey
     * @param mobile
     * @param email
     * @param username
     * @param realname
     * @return
     */
    public static String getRedirectUrl(String uniqueKey, String mobile, String email, String username, String realname ){
        String jwtToken = createJWTToken(uniqueKey, mobile, email, username, realname);
        String jwtSSOLoginParam = encodeJwtSSOLoginParam(CLIENT_ID, jwtToken);
        return DOMAIN + String.format(URL_PARAM, jwtSSOLoginParam);
    }


    /**
     * 加密單點登錄入參內容
     * @param clientId 企業(yè)唯一標識
     * @param jwtToken token信息
     * @return
     */
    private static String encodeJwtSSOLoginParam(String clientId, String jwtToken) {
        Map<String, Object> param = new HashMap<>();
        param.put("jwtToken", jwtToken);
        param.put("clientId", clientId);
        return encrypt(JSON.toJSONString(param), PRIVATE_KEY);
    }

    /**
     * 生成JWT-TOKEN
     * @return
     */
    private static String createJWTToken(String uniqueKey, String mobile, String email, String username, String realname) {
        Map<String, Object> header = new HashMap<>();
        header.put("type", "JWT");
        header.put("alg","HS256");
        Date exp = new Date(new Date().getTime() + EXPIRE_TIME * 1000);
        return JWT.create()
                .withHeader(header)
                .withSubject(uniqueKey)
                .withExpiresAt(exp)
                .withClaim("mobile", mobile)
                .withClaim("email", email)
                .withClaim("username", username)
                .withClaim("realname", realname)
                .withClaim("timestamp", System.currentTimeMillis())
                .sign(Algorithm.HMAC256(SIGN_KEY));
    }

    /**
     * RSA加密 - 私鑰分段加密
     * @param content
     * @param privateKeyStr
     * @return
     */
    private static String encrypt(String content, String privateKeyStr) {
        try {
            // 獲取私鑰
            PrivateKey privateKey = getPrivateKey(privateKeyStr);
            Cipher cipher = Cipher.getInstance("RSA");
            cipher.init(Cipher.ENCRYPT_MODE, privateKey);
            // URLEncoder編碼解決中文亂碼問題
            byte[] data = URLEncoder.encode(content, "UTF-8").getBytes("UTF-8");
            // 加密時超過117字節(jié)就報錯。為此采用分段加密的辦法來加密
            byte[] enBytes = null;
            for (int i = 0; i < data.length; i += 117) {
                // 注意要使用2的倍數，否則會出現加密后的內容再解密時為亂碼
                byte[] doFinal = cipher.doFinal(subarray(data, i, i + 117));
                enBytes = addAll(enBytes, doFinal);
            }
            return Base64.getEncoder().encodeToString(enBytes).replaceAll("\\+", "-").replaceAll("/", "_").replaceAll("=", "");
        } catch(Exception e) {
            throw new RuntimeException("UC-RSA加密出錯");
        }
    }

    /**
     * 將base64編碼后的私鑰字符串轉成PrivateKey實例
     * @param privateKey 私鑰
     * @return PrivateKey實例
     * @throws Exception 異常信息
     */
    private static PrivateKey getPrivateKey(String privateKey) throws Exception {
        byte[] keyBytes = Base64.getDecoder().decode(privateKey);
        PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(keyBytes);
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
        return keyFactory.generatePrivate(keySpec);
    }

    private static byte[] subarray(byte[] array, int startIndexInclusive, int endIndexExclusive) {
        if (array == null) {
            return null;
        } else {
            if (startIndexInclusive < 0) {
                startIndexInclusive = 0;
            }

            if (endIndexExclusive > array.length) {
                endIndexExclusive = array.length;
            }

            int newSize = endIndexExclusive - startIndexInclusive;
            if (newSize <= 0) {
                return new byte[0];
            } else {
                byte[] subarray = new byte[newSize];
                System.arraycopy(array, startIndexInclusive, subarray, 0, newSize);
                return subarray;
            }
        }
    }

    private static byte[] addAll(byte[] array1, byte... array2) {
        if (array1 == null) {
            return clone(array2);
        } else if (array2 == null) {
            return clone(array1);
        } else {
            byte[] joinedArray = new byte[array1.length + array2.length];
            System.arraycopy(array1, 0, joinedArray, 0, array1.length);
            System.arraycopy(array2, 0, joinedArray, array1.length, array2.length);
            return joinedArray;
        }
    }

    private static byte[] clone(byte[] array) {
        return array == null ? null : (byte[])array.clone();
    }

}