<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\DB;
use Symfony\Component\HttpFoundation\Response;

class HisAuth
{
    public function handle(Request $request, Closure $next): Response
    {
        $apiKey = $request->header('X-His-Api-Key');

        if (empty($apiKey)) {
            return response()->json([
                'success' => false,
                'message' => '缺少 HIS 接口认证密钥',
                'code' => 401,
                'data' => null,
            ], 401)->setEncodingOptions(JSON_UNESCAPED_UNICODE);
        }

        $config = DB::table('sys_config')
            ->where('config_key', 'his_api_key')
            ->where('status', 1)
            ->where('deleted', 0)
            ->first();

        if (!$config || $config->config_value !== $apiKey) {
            return response()->json([
                'success' => false,
                'message' => 'HIS 接口认证失败',
                'code' => 401,
                'data' => null,
            ], 401)->setEncodingOptions(JSON_UNESCAPED_UNICODE);
        }

        $ipConfig = DB::table('sys_config')
            ->where('config_key', 'his_allowed_ips')
            ->where('status', 1)
            ->where('deleted', 0)
            ->first();

        if ($ipConfig && !empty($ipConfig->config_value)) {
            $allowedIps = json_decode($ipConfig->config_value, true);
            if (is_array($allowedIps) && !empty($allowedIps)) {
                $clientIp = $request->ip();
                if (!in_array($clientIp, $allowedIps) && !in_array('*', $allowedIps)) {
                    return response()->json([
                        'success' => false,
                        'message' => 'IP 地址不在白名单内',
                        'code' => 403,
                        'data' => null,
                    ], 403)->setEncodingOptions(JSON_UNESCAPED_UNICODE);
                }
            }
        }

        return $next($request);
    }
}