<?php
namespace app\admin\middleware;

use Webman\MiddlewareInterface;
use Webman\Http\Response;
use Webman\Http\Request;
use Tymon\JWTAuth\Exceptions\JWTException;

class AuthMiddleware implements MiddlewareInterface
{
    public function process(Request $request, callable $handler): Response
    {
        try {
            $token = $this->getTokenFromRequest($request);

            if (!$token) {
                return $this->unauthorized('缺少访问令牌');
            }

            if (!$user = auth('api')->setToken($token)->user()) {
                return $this->unauthorized('用户不存在');
            }

            // 将用户信息存入请求
            $request->user = $user;

        } catch (\Tymon\JWTAuth\Exceptions\TokenExpiredException $e) {
            return $this->unauthorized('令牌已过期');
        } catch (JWTException $e) {
            return $this->unauthorized('令牌无效');
        }

        return $handler($request);
    }

    private function getTokenFromRequest(Request $request)
    {
        $header = $request->header('Authorization', '');
        if (preg_match('/Bearer\s+(\S+)/', $header, $matches)) {
            return $matches[1];
        }
        return $request->input('token');
    }

    private function unauthorized($msg)
    {
        return json(['code' => 401, 'msg' => $msg]);
    }
}