package com.ruoyi.security.service.impl;

import java.util.Arrays;
import java.util.List;

import org.springframework.stereotype.Service;

import com.ruoyi.security.service.AuthorizationService;

/**
 * Authorization service implementation
 */
@Service
public class AuthorizationServiceImpl implements AuthorizationService {
    

    
    @Override
    public boolean hasPermission(Long userId, String resource, String action) {
        // Simple permission check - in real implementation, this would query database
        if (userId == null || resource == null || action == null) {
            return false;
        }
        
        // Mock admin user
        if (userId == 1L) {
            return true;
        }
        
        // Basic permissions for other users
        return Arrays.asList("READ", "VIEW").contains(action.toUpperCase());
    }
    
    @Override
    public boolean isIpAllowed(Long userId, String ipAddress) {
        // Simple IP check - allow localhost and private networks
        if (ipAddress == null) {
            return false;
        }
        
        List<String> allowedIps = Arrays.asList("127.0.0.1", "localhost", "::1");
        return allowedIps.contains(ipAddress) || 
               ipAddress.startsWith("192.168.") || 
               ipAddress.startsWith("10.") ||
               ipAddress.startsWith("172.");
    }
    
    @Override
    public String maskSensitiveData(String data, String userRole, String fieldType) {
        if (data == null || data.isEmpty()) {
            return data;
        }
        
        // Admin users see everything
        if ("ADMIN".equals(userRole)) {
            return data;
        }
        
        // Apply masking based on field type
        switch (fieldType) {
            case "BANK_ACCOUNT":
                return maskBankAccount(data);
            case "PHONE":
                return maskPhone(data);
            case "EMAIL":
                return maskEmail(data);
            case "AMOUNT":
                return "****";
            default:
                return maskDefault(data);
        }
    }
    
    @Override
    public String getAccessLevel(Long userId, String resourceType) {
        // Mock access levels
        if (userId == 1L) {
            return "FULL";
        }
        return "READ_ONLY";
    }
    
    @Override
    public boolean canAccessField(Long userId, String fieldName) {
        // Simple field-level permission check
        if (userId == 1L) {
            return true; // Admin can access all fields
        }
        
        // Restrict sensitive fields for non-admin users
        List<String> restrictedFields = Arrays.asList("bankAccount", "ssn", "salary");
        return !restrictedFields.contains(fieldName);
    }
    
    private String maskBankAccount(String account) {
        if (account.length() > 8) {
            return account.substring(0, 4) + "****" + account.substring(account.length() - 4);
        }
        return "****";
    }
    
    private String maskPhone(String phone) {
        if (phone.length() == 11) {
            return phone.substring(0, 3) + "****" + phone.substring(7);
        }
        return "****";
    }
    
    private String maskEmail(String email) {
        int atIndex = email.indexOf("@");
        if (atIndex > 3) {
            return email.substring(0, 3) + "***" + email.substring(atIndex);
        }
        return "***@***";
    }
    
    private String maskDefault(String data) {
        if (data.length() > 4) {
            return data.substring(0, 2) + "****" + data.substring(data.length() - 2);
        }
        return "****";
    }
}