package com.brframework.commonoss.core.sts;

import com.alibaba.fastjson.JSON;
import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.http.MethodType;
import com.aliyuncs.http.ProtocolType;
import com.aliyuncs.profile.DefaultProfile;
import com.aliyuncs.profile.IClientProfile;
import com.aliyuncs.sts.model.v20150401.AssumeRoleRequest;
import com.aliyuncs.sts.model.v20150401.AssumeRoleResponse;
import com.brframework.commonoss.exception.OSSAuthorizationException;
import lombok.Data;
import lombok.extern.slf4j.Slf4j;

import java.util.LinkedHashMap;
import java.util.Map;

/**
 * @author xu
 * @date 2019/8/21 16:26
 */
@Slf4j
public class AliYunSTSClient {

    // 目前只有"cn-hangzhou"这个region可用, 不要使用填写其他region的值
    public static final String REGION_CN_HANGZHOU = "cn-hangzhou";
    public static final String STS_API_VERSION = "2015-04-01";

    private String accessKeyId;
    private String accessKeySecret;
    private String roleArn;
    private String roleSessionName;
    private Long durationSeconds;

    private AliYunSTSClient(){};

    public AliYunSTSClient(String accessKeyId, String accessKeySecret
            , String roleArn, String roleSessionName
            , Long durationSeconds){

        this.accessKeyId = accessKeyId;
        this.accessKeySecret = accessKeySecret;
        this.roleArn = roleArn;
        this.roleSessionName = roleSessionName;
        this.durationSeconds = durationSeconds;

    }

    /**
     * 获取 sts 授权
     * @param policyBuilder  授权规则
     * @return
     */
    public STSAuthorization getSTSAuthorization(AliYunSTSPolicyBuilder policyBuilder){

        try {
            // 创建一个 Aliyun Acs Client, 用于发起 OpenAPI 请求
            IClientProfile profile = DefaultProfile
                    .getProfile(REGION_CN_HANGZHOU
                            , accessKeyId, accessKeySecret);
            DefaultAcsClient client = new DefaultAcsClient(profile);

            // 创建一个 AssumeRoleRequest 并设置请求参数
            final AssumeRoleRequest request = new AssumeRoleRequest();
            request.setVersion(STS_API_VERSION);
            request.setMethod(MethodType.POST);
            request.setProtocol(ProtocolType.HTTPS);

            request.setRoleArn(roleArn);
            request.setRoleSessionName(roleSessionName);

            request.setPolicy(policyBuilder.build().toJSONString());
            request.setDurationSeconds(durationSeconds);

            // 发起请求，并得到response
            final AssumeRoleResponse stsResponse = client.getAcsResponse(request);

            STSAuthorization auth = new STSAuthorization();
            auth.setAccessKeyId(stsResponse.getCredentials().getAccessKeyId());
            auth.setAccessKeySecret(stsResponse.getCredentials().getAccessKeySecret());
            auth.setSecurityToken(stsResponse.getCredentials().getSecurityToken());
            auth.setExpiration(stsResponse.getCredentials().getExpiration());

            return auth;
        } catch (Throwable e){
            log.error("获取STS授权失败", e);
            throw new OSSAuthorizationException();
        }

    }



}
