import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.time.LocalDateTime;
import java.time.format.DateTimeFormatter;
import java.util.Base64;

public class HmacClientExample {

    public static void main(String[] args) throws Exception {
        // 1) 準備必要參數(shù)
        String accessKeyId = "myKeyId";
        String accessKeySecret = "myKeySecret"; // 保密
        String method = "POST";
        String path = "/api/secure";
        // 例如攜帶一個 timestamp (yyyyMMddHHmmss)
        String timestamp = LocalDateTime.now().format(DateTimeFormatter.ofPattern("yyyyMMddHHmmss"));

        // 2) 如果有請求體，需要計算 bodyHash (這里只是示例)
        //   實際可對 JSON 字符串做 MD5 或 SHA256，再 Hex 或 Base64
        String requestBody = "{\"foo\":\"bar\"}"; // JSON
        String bodyHash = sha256Hex(requestBody);

        // 3) 拼裝 StringToSign (示例邏輯，可自定義)
        //    這里用換行分隔 method, path, timestamp, bodyHash
        String stringToSign = method + "\n" 
                              + path + "\n" 
                              + timestamp + "\n" 
                              + bodyHash;

        // 4) 做 HMAC-SHA256
        String signature = hmacSha256Base64(stringToSign, accessKeySecret);

        // 5) 將簽名和 keyId、timestamp 放到 HTTP 頭部
        //    偽代碼: 構(gòu)建 HTTP 請求
        System.out.println("X-AccessKeyId: " + accessKeyId);
        System.out.println("X-Timestamp: " + timestamp);
        System.out.println("X-Signature: " + signature);
        // 之后再把 requestBody 當作 JSON 發(fā)出 (POST)
        // ...

        // 這是示例演示，真實項目中可用 HttpClient、OkHttp 等發(fā)請求
    }

    /**
     * 計算字符串的 SHA-256 再轉(zhuǎn) hex (可選：也可用 Base64)
     */
    private static String sha256Hex(String data) throws Exception {
        MessageDigest digest = MessageDigest.getInstance("SHA-256");
        byte[] bytes = digest.digest(data.getBytes(StandardCharsets.UTF_8));
        return bytesToHex(bytes);
    }

    /**
     * HMAC-SHA256 + Base64
     */
    private static String hmacSha256Base64(String data, String secret) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA256");
        SecretKeySpec keySpec = new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
        mac.init(keySpec);
        byte[] rawHmac = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        return Base64.getEncoder().encodeToString(rawHmac);
    }

    private static String bytesToHex(byte[] bytes) {
        StringBuilder sb = new StringBuilder(bytes.length * 2);
        for (byte b : bytes) {
            sb.append(String.format("%02x", b));
        }
        return sb.toString();
    }
}

@RestController
@RequestMapping("/api")
public class SecureApiController {

    // 示例：內(nèi)存中保存 keyId -> keySecret 映射
    private Map<String, String> keyStore = new HashMap<>();

    public SecureApiController() {
        // 假設(shè)這里初始化了一個myKeyId -> myKeySecret
        keyStore.put("myKeyId", "myKeySecret");
    }

    @PostMapping("/secure")
    public ResponseEntity<?> secureEndpoint(
            HttpServletRequest request,
            @RequestBody(required=false) String body // raw JSON
    ) {
        try {
            // 1) 從header讀取
            String accessKeyId = request.getHeader("X-AccessKeyId");
            String timestamp = request.getHeader("X-Timestamp");
            String clientSignature = request.getHeader("X-Signature");

            if (accessKeyId == null || timestamp == null || clientSignature == null) {
                return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Missing auth headers");
            }

            // 2) 查找keySecret
            String keySecret = keyStore.get(accessKeyId);
            if (keySecret == null) {
                return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Invalid accessKeyId");
            }

            // 3) 計算 bodyHash(可選)
            //    假設(shè)客戶端用了 sha256Hex(body)
            String bodyHash = sha256Hex(body == null ? "" : body);

            // 4) 與客戶端相同的拼接方式
            String method = request.getMethod(); // "POST"
            String path = request.getRequestURI(); // "/api/secure"
            // StringToSign
            String stringToSign = method + "\n" 
                                + path + "\n" 
                                + timestamp + "\n" 
                                + bodyHash;

            // 5) 服務(wù)端做 HMAC-SHA256
            String serverSignature = hmacSha256Base64(stringToSign, keySecret);

            // 6) 比對簽名
            if (!serverSignature.equals(clientSignature)) {
                return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Signature mismatch");
            }

            // 7) 可選校驗: timestamp 是否過期
            if (!checkTimestampValid(timestamp)) {
                return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Timestamp expired or invalid");
            }

            // 8) 一切正常
            return ResponseEntity.ok("Success! Request body was: " + body);

        } catch (Exception e) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Auth error: " + e.getMessage());
        }
    }

    // 計算 SHA256Hex
    private String sha256Hex(String data) throws Exception {
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        byte[] digest = md.digest(data.getBytes(StandardCharsets.UTF_8));
        return bytesToHex(digest);
    }

    // HMAC-SHA256 + Base64
    private String hmacSha256Base64(String data, String secret) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA256");
        SecretKeySpec keySpec = new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
        mac.init(keySpec);
        byte[] rawHmac = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        return Base64.getEncoder().encodeToString(rawHmac);
    }

    private String bytesToHex(byte[] bytes) {
        StringBuilder sb = new StringBuilder(bytes.length * 2);
        for (byte b : bytes) {
            sb.append(String.format("%02x", b));
        }
        return sb.toString();
    }

    // 時間戳校驗 (±15分鐘示例)
    private boolean checkTimestampValid(String timestampStr) {
        try {
            // 這里假設(shè) timestampStr 是 yyyyMMddHHmmss
            DateTimeFormatter fmt = DateTimeFormatter.ofPattern("yyyyMMddHHmmss");
            LocalDateTime reqTime = LocalDateTime.parse(timestampStr, fmt);
            LocalDateTime now = LocalDateTime.now();
            return !reqTime.isBefore(now.minusMinutes(15)) && !reqTime.isAfter(now.plusMinutes(15));
        } catch (Exception e) {
            return false;
        }
    }
}