from aiohttp import web
from .utils.response import json_res
import logging

logger = logging.getLogger(__name__)

# 白名单 (相对于子应用的路径)
WHITE_LIST = {
    "/api/login", 
    "/api/auth/status", 
    "/", 
    "/static/"
}

async def auth_middleware(app, handler):
    async def mid(req):
        path = req.path
        
        # 检查白名单
        if any(path.startswith(w) for w in WHITE_LIST):
            return await handler(req)
            
        # 提取 Token
        token = req.cookies.get("panel_token")
        if not token and req.headers.get("Authorization", "").startswith("Bearer "):
            token = req.headers["Authorization"].split(" ", 1)[1]
        
        valid, info = False, {}
        
        # 验证 Token (简单内存验证，后期可接 Redis/DB)
        session_store = app.get('session_store', {})
        if token and token in session_store:
            valid, info = True, session_store[token]
        
        if valid:
            req['user'] = info
            return await handler(req)
        return json_res({"error": "未认证"}, 401)
    return mid