package com.config;

import at.pollux.thymeleaf.shiro.dialect.ShiroDialect;
import com.filter.KickoutSessionFilter;
import com.shiro.RetryLimitHashedCredentialsMatcher;
import com.shiro.ShiroRealm;
import net.sf.ehcache.CacheException;
import net.sf.ehcache.CacheManager;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.cache.ehcache.EhCacheManager;
import org.apache.shiro.io.ResourceUtils;
import org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.CookieRememberMeManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.servlet.SimpleCookie;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.transaction.annotation.EnableTransactionManagement;

import javax.servlet.Filter;
import java.io.IOException;
import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.Map;

/**
 * @项目名称：wyait-manage
 * @包名：com.wyait.manage.config
 * @类描述：
 * @创建人：wyait
 * @创建时间：2017-12-12 18:51
 * @version：V1.0
 */
@Configuration
@EnableTransactionManagement
public class ShiroConfig {
    private static final Logger logger = LoggerFactory
            .getLogger(ShiroConfig.class);

    /**
     * ShiroFilterFactoryBean 处理拦截资源文件过滤器
     * </br>1,配置shiro安全管理器接口securityManage;
     * </br>2,shiro 连接约束配置filterChainDefinitions;
     */
    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(
            org.apache.shiro.mgt.SecurityManager securityManager) {
        //shiroFilterFactoryBean对象
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        logger.debug("-----------------Shiro拦截器工厂类注入开始");
        // 配置shiro安全管理器 SecurityManager
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        //添加kickout认证
        HashMap<String, Filter> hashMap = new HashMap<String, Filter>();
        hashMap.put("kickout", kickoutSessionFilter());
        shiroFilterFactoryBean.setFilters(hashMap);

        // 指定要求登录时的链接
        shiroFilterFactoryBean.setLoginUrl("/toLogin");
        // 登录成功后要跳转的链接
        shiroFilterFactoryBean.setSuccessUrl("/home");
        // 未授权时跳转的界面;
        shiroFilterFactoryBean.setUnauthorizedUrl("/error");

        // filterChainDefinitions拦截器=map必须用：LinkedHashMap，因为它必须保证有序
        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
        // 配置退出过滤器,具体的退出代码Shiro已经实现
        filterChainDefinitionMap.put("/logout", "logout");
        //配置记住我或认证通过可以访问的地址
        filterChainDefinitionMap.put("/user/userList", "user");
        filterChainDefinitionMap.put("/", "user");
        //filterChainDefinitionMap.put("/sysPermission/*", "user");
//
//		// 配置不会被拦截的链接 从上向下顺序判断
        filterChainDefinitionMap.put("/login", "anon");
        filterChainDefinitionMap.put("/css/*", "anon");
        filterChainDefinitionMap.put("/css/*/*", "anon");
        filterChainDefinitionMap.put("/js/*", "anon");
        filterChainDefinitionMap.put("/js/*/*", "anon");
        filterChainDefinitionMap.put("/js/*/*/*", "anon");
        filterChainDefinitionMap.put("/img/*", "anon");
        filterChainDefinitionMap.put("/images/*/**", "anon");
        filterChainDefinitionMap.put("/layui/*", "anon");
        filterChainDefinitionMap.put("/layui/*/**", "anon");
        filterChainDefinitionMap.put("/layuiadmin/*", "anon");
        filterChainDefinitionMap.put("/layuiadmin/*/**", "anon");
        filterChainDefinitionMap.put("/layuiadmin/*/*/**", "anon");
        filterChainDefinitionMap.put("/layuiadmin/*/*/*/**", "anon");
        filterChainDefinitionMap.put("/layuiadmin/*/*/*/*/**", "anon");
        filterChainDefinitionMap.put("/treegrid/*", "anon");
        filterChainDefinitionMap.put("/treegrid/*/*", "anon");
        filterChainDefinitionMap.put("/fragments/*", "anon");
        filterChainDefinitionMap.put("/layout", "anon");

        filterChainDefinitionMap.put("/generalKanBanPage/*", "anon");//通用看板

        filterChainDefinitionMap.put("/kanban/toDemo", "anon");//看板demo
        filterChainDefinitionMap.put("/kanban/*", "anon");//看板
        filterChainDefinitionMap.put("/kanban/*/*", "anon");//看板
        filterChainDefinitionMap.put("/kanban/*/*/*", "anon");//看板


        filterChainDefinitionMap.put("/spc/chart/*", "anon");//SPC
        filterChainDefinitionMap.put("/spc/chart/*/*", "anon");//SPC
        filterChainDefinitionMap.put("/spc/chart/*/*/*", "anon");//SPC


        filterChainDefinitionMap.put("/dev/*", "anon");//看板
        filterChainDefinitionMap.put("/template/*", "anon");//看板


        //gltAndWd_pda
        filterChainDefinitionMap.put("/user/sendMsg", "anon");
        filterChainDefinitionMap.put("/user/login", "anon");
        //filterChainDefinitionMap.put("/home", "anon");//首页
        filterChainDefinitionMap.put("/login1", "anon");
        filterChainDefinitionMap.put("/queryPurview", "anon");
        filterChainDefinitionMap.put("/getRfSetup", "anon");
        filterChainDefinitionMap.put("/getExcProc", "anon");
        filterChainDefinitionMap.put("/getCursor", "anon");
        filterChainDefinitionMap.put("/create/*", "anon");
        filterChainDefinitionMap.put("/little/*", "anon");
        filterChainDefinitionMap.put("/pinput/*", "anon");
        filterChainDefinitionMap.put("/out/*", "anon");
        filterChainDefinitionMap.put("/glue/*", "anon");
        filterChainDefinitionMap.put("/glueinput/*", "anon");
        filterChainDefinitionMap.put("/queryAppVersion", "anon");
        filterChainDefinitionMap.put("/base_file/*", "anon");//pda-ftp附件管理
        filterChainDefinitionMap.put("/getPrintInfoById", "anon");
        filterChainDefinitionMap.put("/getExcuteSql", "anon");//sql查询

        //lyt_pda
        filterChainDefinitionMap.put("/lyt_file/*", "anon");//ftp
        filterChainDefinitionMap.put("/lyt_file_sign/*", "anon");//ftp-样品签名附件管理
        filterChainDefinitionMap.put("/coat_item/*", "anon");//PQC-涂布项目
        filterChainDefinitionMap.put("/pqc_first_input/*", "anon");//PQC首检录入
        filterChainDefinitionMap.put("/defect_input/*", "anon");//不良投入
        filterChainDefinitionMap.put("/pqc_patrol_input/*", "anon");//PQC巡检录入
        filterChainDefinitionMap.put("/pqc_sample_input/*", "anon");//PQC抽检录入
        filterChainDefinitionMap.put("/pqc_retest_input/*", "anon");//PQC复测抽检录入
        filterChainDefinitionMap.put("/sample_sign/*", "anon");//PQC样品签字录入
        filterChainDefinitionMap.put("/pqc_pole_piece/*", "anon");//PQC极片露空时间录入
        filterChainDefinitionMap.put("/fqcPatrol/*", "anon");//FQC，OQC
        filterChainDefinitionMap.put("/equipment_inspection/*", "anon");//设备点检
        filterChainDefinitionMap.put("/SJPatrol/*", "anon");//首检
        filterChainDefinitionMap.put("/ho_patrol/*", "anon");//检验删除


        //swagger
        filterChainDefinitionMap.put("/swagger-ui.html", "anon");
        filterChainDefinitionMap.put("/swagger-resources/**", "anon");
        filterChainDefinitionMap.put("/v2/**", "anon");
        filterChainDefinitionMap.put("/webjars/**", "anon");


        filterChainDefinitionMap.put("/io_dhs/getMesInfo", "anon");//用于德和盛设备调用接口，获取MES数据
        filterChainDefinitionMap.put("/api/uploadDeviceData", "anon");//用于德和盛设备调用接口，获取MES数据

        filterChainDefinitionMap.put("/api/apk/**", "anon");//apk接口


        filterChainDefinitionMap.put("/heyi/login1", "anon");
        filterChainDefinitionMap.put("/heyi/queryPurview", "anon");
        filterChainDefinitionMap.put("/heyi/getRfSetup", "anon");
        filterChainDefinitionMap.put("/heyi/getExcProc", "anon");
        filterChainDefinitionMap.put("/heyi/create/*", "anon");
        filterChainDefinitionMap.put("/heyi/little/*", "anon");
        filterChainDefinitionMap.put("/heyi/pinput/*", "anon");
        filterChainDefinitionMap.put("/heyi/out/*", "anon");

        filterChainDefinitionMap.put("/rk_file/*", "anon");//ftp附件录入


        filterChainDefinitionMap.put("/heyi/template/*", "anon");
        filterChainDefinitionMap.put("/heyi/dev/*", "anon");
        filterChainDefinitionMap.put("/hyKanban/*", "anon");

        // 海关
        filterChainDefinitionMap.put("/hgReport/*", "anon");//看板
        // 宁波亿纬
        filterChainDefinitionMap.put("/eveReport/*", "anon");//看板
        // 格林泰
        filterChainDefinitionMap.put("/gltReport/*", "anon");//

        // 格林泰
        filterChainDefinitionMap.put("/standard/*", "anon");

        filterChainDefinitionMap.put("/largeScreen/*", "anon");//看板

        //sop
        filterChainDefinitionMap.put("/kl_file/*", "anon");
        filterChainDefinitionMap.put("/jhsop/*", "anon");
        filterChainDefinitionMap.put("/sop/*", "anon");


        //filterChainDefinitionMap.put("/console", "anon");//首页内容
//		/*filterChainDefinitionMap.put("/page", "anon");
//		filterChainDefinitionMap.put("/channel/record", "anon");*/
        filterChainDefinitionMap.put("/user/delUser", "authc,perms[usermanage]");
//		//add操作，该用户必须有【addOperation】权限
////		filterChainDefinitionMap.put("/add", "perms[addOperation]");
//
//		// <!-- authc:所有url都必须认证通过才可以访问; anon:所有url都都可以匿名访问【放行】-->
        filterChainDefinitionMap.put("/**", "kickout,authc");
        filterChainDefinitionMap.put("/*/*", "authc");
        filterChainDefinitionMap.put("/*/*/*", "authc");
        filterChainDefinitionMap.put("/*/*/*/**", "authc");

        shiroFilterFactoryBean
                .setFilterChainDefinitionMap(filterChainDefinitionMap);
        logger.debug("-----------------Shiro拦截器工厂类注入成功");
        return shiroFilterFactoryBean;
    }

    /**
     * shiro安全管理器设置realm认证和ehcache缓存管理
     *
     * @return
     */
    @Bean
    public org.apache.shiro.mgt.SecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        // 设置realm.
        securityManager.setRealm(shiroRealm());
        // //注入ehcache缓存管理器;
        securityManager.setCacheManager(ehCacheManager());
        // //注入session管理器;
        securityManager.setSessionManager(sessionManager());
        //注入Cookie记住我管理器
        securityManager.setRememberMeManager(rememberMeManager());
        return securityManager;
    }

    /**
     * 身份认证realm; (账号密码校验；权限等)
     *
     * @return
     */
    @Bean
    public ShiroRealm shiroRealm() {
        ShiroRealm shiroRealm = new ShiroRealm();
        //使用自定义的CredentialsMatcher进行密码校验和输错次数限制
        shiroRealm.setCredentialsMatcher(hashedCredentialsMatcher());
        return shiroRealm;
    }

    /**
     * ehcache缓存管理器；shiro整合ehcache：
     * 通过安全管理器：securityManager
     * 单例的cache防止热部署重启失败
     *
     * @return EhCacheManager
     */
    @Bean
    public EhCacheManager ehCacheManager() {
        logger.debug(
                "=====shiro整合ehcache缓存：ShiroConfiguration.getEhCacheManager()");
        EhCacheManager ehcache = new EhCacheManager();
        CacheManager cacheManager = CacheManager.getCacheManager("shiro");
        if (cacheManager == null) {
            try {

                cacheManager = CacheManager.create(ResourceUtils.getInputStreamForPath("classpath:config/ehcache.xml"));

            } catch (CacheException | IOException e) {
                e.printStackTrace();
            }
        }
        ehcache.setCacheManager(cacheManager);
        return ehcache;
    }

    /**
     * 设置记住我cookie过期时间
     *
     * @return
     */
    @Bean
    public SimpleCookie remeberMeCookie() {
        logger.debug("记住我，设置cookie过期时间！");
        //cookie名称;对应前端的checkbox的name = rememberMe
        SimpleCookie scookie = new SimpleCookie("rememberMe");
        //记住我cookie生效时间30天 ,单位秒  [10天]
        scookie.setMaxAge(864000);
        return scookie;
    }

    /**
     * 配置cookie记住我管理器
     *
     * @return
     */
    @Bean
    public CookieRememberMeManager rememberMeManager() {
        logger.debug("配置cookie记住我管理器！");
        CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
        cookieRememberMeManager.setCookie(remeberMeCookie());
        return cookieRememberMeManager;
    }

    /**
     * 凭证匹配器 （由于我们的密码校验交给Shiro的SimpleAuthenticationInfo进行处理了
     * 所以我们需要修改下doGetAuthenticationInfo中的代码,更改密码生成规则和校验的逻辑一致即可; ）
     *
     * @return
     */
    @Bean
    public HashedCredentialsMatcher hashedCredentialsMatcher() {
        HashedCredentialsMatcher hashedCredentialsMatcher = new RetryLimitHashedCredentialsMatcher(ehCacheManager());
        //new HashedCredentialsMatcher();
        hashedCredentialsMatcher.setHashAlgorithmName("md5");// 散列算法:这里使用MD5算法;
        hashedCredentialsMatcher.setHashIterations(1);// 散列的次数，比如散列两次，相当于 // md5(md5(""));
        return hashedCredentialsMatcher;
    }

    /**
     * @return
     * @描述：ShiroDialect，为了在thymeleaf里使用shiro的标签的bean
     * @创建人：wyait
     * @创建时间：2017年12月21日 下午1:52:59
     */
    @Bean
    public ShiroDialect shiroDialect() {
        return new ShiroDialect();
    }

    /**
     * EnterpriseCacheSessionDAO shiro sessionDao层的实现；
     * 提供了缓存功能的会话维护，默认情况下使用MapCache实现，内部使用ConcurrentHashMap保存缓存的会话。
     */
    @Bean
    public EnterpriseCacheSessionDAO enterCacheSessionDAO() {
        EnterpriseCacheSessionDAO enterCacheSessionDAO = new EnterpriseCacheSessionDAO();
        //添加缓存管理器
        //enterCacheSessionDAO.setCacheManager(ehCacheManager());
        //添加ehcache活跃缓存名称（必须和ehcache缓存名称一致）
        enterCacheSessionDAO.setActiveSessionsCacheName("shiro-activeSessionCache");
        return enterCacheSessionDAO;
    }

    /**
     * @return
     * @描述：sessionManager添加session缓存操作DAO
     * @创建人：wyait
     * @创建时间：2018年4月24日 下午8:13:52
     */
    @Bean
    public DefaultWebSessionManager sessionManager() {
        DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
        //sessionManager.setCacheManager(ehCacheManager());
        sessionManager.setSessionDAO(enterCacheSessionDAO());
        sessionManager.setSessionIdCookie(sessionIdCookie());
        return sessionManager;
    }

    /**
     * @return
     * @描述：自定义cookie中session名称等配置
     * @创建人：wyait
     * @创建时间：2018年5月8日 下午1:26:23
     */
    @Bean
    public SimpleCookie sessionIdCookie() {
        //DefaultSecurityManager
        SimpleCookie simpleCookie = new SimpleCookie();
        //sessionManager.setCacheManager(ehCacheManager());
        //如果在Cookie中设置了"HttpOnly"属性，那么通过程序(JS脚本、Applet等)将无法读取到Cookie信息，这样能有效的防止XSS攻击。
        simpleCookie.setHttpOnly(true);
        simpleCookie.setName("SHRIOSESSIONID");
        //单位秒
        simpleCookie.setMaxAge(86400);
        return simpleCookie;
    }

    /**
     * @return
     * @描述：kickoutSessionFilter同一个用户多设备登录限制
     * @创建人：wyait
     * @创建时间：2018年4月24日 下午8:14:28
     */
    public KickoutSessionFilter kickoutSessionFilter() {
        KickoutSessionFilter kickoutSessionFilter = new KickoutSessionFilter();
        //使用cacheManager获取相应的cache来缓存用户登录的会话；用于保存用户—会话之间的关系的；
        //这里我们还是用之前shiro使用的ehcache实现的cacheManager()缓存管理
        //也可以重新另写一个，重新配置缓存时间之类的自定义缓存属性
        kickoutSessionFilter.setCacheManager(ehCacheManager());
        //用于根据会话ID，获取会话进行踢出操作的；
        kickoutSessionFilter.setSessionManager(sessionManager());
        //是否踢出后来登录的，默认是false；即后者登录的用户踢出前者登录的用户；踢出顺序。
        kickoutSessionFilter.setKickoutAfter(false);
        //同一个用户最大的会话数，默认1；比如2的意思是同一个用户允许最多同时两个人登录；
        kickoutSessionFilter.setMaxSession(1);
        //被踢出后重定向到的地址；
        kickoutSessionFilter.setKickoutUrl("/toLogin?kickout=1");
        return kickoutSessionFilter;
    }

    /**
     * @return
     * @描述：开启Shiro的注解(如@RequiresRoles,@RequiresPermissions),需借助SpringAOP扫描使用Shiro注解的类,并在必要时进行安全逻辑验证 配置以下两个bean(DefaultAdvisorAutoProxyCreator和AuthorizationAttributeSourceAdvisor)即可实现此功能
     * </br>Enable Shiro Annotations for Spring-configured beans. Only run after the lifecycleBeanProcessor(保证实现了Shiro内部lifecycle函数的bean执行) has run
     * </br>不使用注解的话，可以注释掉这两个配置
     * @创建人：wyait
     * @创建时间：2018年5月21日 下午6:07:56
     */
    @Bean
    public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
        advisorAutoProxyCreator.setProxyTargetClass(true);
        return advisorAutoProxyCreator;
    }

    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor() {
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager());
        return authorizationAttributeSourceAdvisor;
    }

}