package checkPermission

import (
	"net/http"
	"strings"
	"time"

	"91porn-server/common"

	"github.com/gin-gonic/gin"
	"github.com/storyicon/grbac"
)

// 白名单，不需要验证token的api
var whitelist = map[string]bool{
	"/swagger": true,
}

func QueryRolesByHeaders(c *gin.Context) (roles []string, err error) {
	role, _ := common.GetAdminRole(c)
	roles = append(roles, role)
	return roles, err
}

var rbac *grbac.Controller

func init() {
	var err error
	rbac, err = grbac.New(grbac.WithJSON("config/rules.json", 10*time.Minute))
	if err != nil {
		panic(err)
	}
}

func CheckPermission(c *gin.Context) {
	for url, ok := range whitelist {
		if ok && strings.HasPrefix(c.Request.URL.Path, url) {
			return
		}
	}

	roles, _ := QueryRolesByHeaders(c)
	state, _ := rbac.IsRequestGranted(c.Request, roles)
	if !state.IsGranted() {
		c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
			"code": http.StatusUnauthorized,
			"msg":  "没有操作权限",
		})
		return
	}
}