<?php

namespace app\admin\middleware;

use app\util\Util;
use ReflectionClass;
use Webman\MiddlewareInterface;
use Webman\Http\Response;
use Webman\Http\Request;

class PermissionCheck implements MiddlewareInterface
{
    public function process(Request $request, callable $handler): Response
    {
        $user = $request->user;
//        $route = $request->route;
        $route = $request->path();

        // 通过反射获取控制器哪些方法不需要登录
        $controller = new ReflectionClass($request->controller);
        $noNeedLogin = $controller->getDefaultProperties()['noNeedLogin'] ?? [];

        $isLogin = !in_array($request->action, $noNeedLogin);

        $permission = substr($route,7);

        $is_auth = str_starts_with($permission, 'auth');
        $permissions = $user?$user->permissions():true;
        if($isLogin && $permission && (empty($permissions) && !$is_auth) && !$user->isPermission($permission)){
            return Util::fail('','无权访问该资源',401);
        }
//        // 检查角色
//        $requiredRoles = $request->route->param('roles', []);
//        if (!empty($requiredRoles) && !$user->hasAnyRole($requiredRoles)) {
//            return $this->forbidden('需要特定角色才能访问');
//        }
//
//        // 检查权限
//        $requiredPermission = $route->param('permission');
//        if ($requiredPermission && !$user->hasPermission($requiredPermission)) {
//            return $this->forbidden('无权访问该资源');
//        }

        return $handler($request);
    }

    private function forbidden($msg)
    {
        return json(['code' => 403, 'msg' => $msg]);
    }
}