import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'
import { getToken } from 'next-auth/jwt'

// 允许的来源列表（内网和公网） - 支持通过环境变量配置，逗号分隔
const ALLOWED_ORIGINS = (() => {
  const fromEnv = process.env.ALLOWED_ORIGINS || ''
  const list = fromEnv.split(',').map(s => s.trim()).filter(Boolean)
  const defaults = ['http://localhost:3000', 'http://localhost:4320']
  return Array.from(new Set([...defaults, ...list]))
})()

export async function middleware(request: NextRequest) {
  const { pathname, origin } = request.nextUrl
  const requestOrigin = request.headers.get('origin')

  // 处理API路由的CORS
  if (pathname.startsWith('/api/')) {
    // 处理OPTIONS预检请求
    if (request.method === 'OPTIONS') {
      return new NextResponse(null, {
        status: 204,
        headers: {
          'Access-Control-Allow-Credentials': 'true',
          'Access-Control-Allow-Origin': requestOrigin || origin,
          'Access-Control-Allow-Methods': 'GET,DELETE,PATCH,POST,PUT,OPTIONS',
          'Access-Control-Allow-Headers': 'X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version, Authorization, Cookie',
          'Access-Control-Max-Age': '86400',
        },
      })
    }

    // 为所有API响应添加CORS头
    const response = NextResponse.next()
    response.headers.set('Access-Control-Allow-Credentials', 'true')
    response.headers.set('Access-Control-Allow-Origin', requestOrigin || origin)
    response.headers.set('Access-Control-Allow-Methods', 'GET,DELETE,PATCH,POST,PUT,OPTIONS')
    response.headers.set('Access-Control-Allow-Headers', 'X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version, Authorization, Cookie')
    
    return response
  }

  // 处理需要认证的页面
  if (pathname === '/' || pathname.startsWith('/admin')) {
    const token = await getToken({ req: request, secret: process.env.NEXTAUTH_SECRET })
    
    if (!token) {
      const url = new URL('/login', request.url)
      return NextResponse.redirect(url)
    }

    // 管理员页面需要管理员权限
    const requiresAdmin =
      pathname.startsWith('/admin') && !pathname.startsWith('/admin/monitor')
    if (requiresAdmin) {
      if (token.role !== 'ADMIN') {
        const url = new URL('/', request.url)
        return NextResponse.redirect(url)
      }
    }
  }

  return NextResponse.next()
}

export const config = {
  matcher: ['/', '/admin/:path*', '/api/:path*'],
}