<?php
declare(strict_types=1);

namespace app\adminapi\controller\identity;

use app\adminapi\controller\BaseAdminController;
use app\adminapi\service\IdentityHospitalSsoService;
use app\common\service\JsonService;
use think\exception\HttpResponseException;

final class HospitalSsoController extends BaseAdminController
{
    // The service authenticates the real source DB session; exchange authenticates its private PKCE ticket.
    public array $notNeedLogin = ['issue', 'exchange'];

    public function issue()
    {
        return $this->handoff('issue');
    }

    public function exchange()
    {
        return $this->handoff('exchange');
    }

    private function handoff(string $operation)
    {
        $headers = ['Cache-Control' => 'no-store', 'Referrer-Policy' => 'no-referrer'];
        if (!$this->request->isPost()) { return JsonService::fail('请使用POST请求')->code(405)->header($headers); }
        if ($this->request->get() !== []) { return JsonService::fail('请求包含不支持的字段')->header($headers); }
        $origin = (string) $this->request->header('origin', '');
        if ($operation === 'exchange' && (($origin !== '' && $origin !== $this->request->domain())
                || $this->request->header('sec-fetch-site', '') === 'cross-site')) {
            return JsonService::fail('登录请求来源不合法')->header($headers);
        }
        try {
            $service = new IdentityHospitalSsoService();
            $result = $operation === 'issue'
                ? $service->issue((string) $this->request->header('token', ''), $this->request->post())
                : $service->exchange($this->request->post());
            return JsonService::data($result)->header($headers);
        } catch (HttpResponseException $error) { return $error->getResponse()->header($headers); }
        catch (\Throwable $error) { return JsonService::fail('医院登录暂时不可用，请稍后重试')->header($headers); }
    }
}