main.go

package main

import (
	"io"
	"log/slog"
	"mime"
	"net/http"
	"os"
	"path/filepath"
	"strings"
	"time"

	"clash-config-store/internal/applog"
	"clash-config-store/internal/config"
	"clash-config-store/internal/handler"
	"clash-config-store/internal/middleware"
	"clash-config-store/internal/repository"
	"clash-config-store/internal/util"
	"clash-config-store/static"

	"github.com/gin-contrib/cors"
	"github.com/gin-gonic/gin"
)

func main() {
	applog.Init()
	cfg := config.Load()
	// godotenv 在 config.Load 中执行，晚于 gin 的 init()，此处同步 GIN_MODE
	if m := strings.TrimSpace(os.Getenv("GIN_MODE")); m != "" {
		gin.SetMode(m)
	}

	if err := util.InitGeoIP(cfg.GeoIPPath); err != nil {
		slog.Warn("GeoIP 初始化失败", slog.String("component", "main"), slog.Any("err", err))
	}
	defer util.CloseGeoIP()

	if err := util.InitRSA(); err != nil {
		slog.Error("RSA 密钥初始化失败", slog.String("component", "main"), slog.Any("err", err))
		os.Exit(1)
	}

	if err := repository.Init(cfg); err != nil {
		slog.Error("数据库初始化失败", slog.String("component", "main"), slog.Any("err", err))
		os.Exit(1)
	}

	r := gin.Default()
	if err := r.SetTrustedProxies(ginTrustedProxies()); err != nil {
		slog.Warn("Gin TrustedProxies 无效，回退为仅本机", slog.String("component", "main"), slog.Any("err", err))
		_ = r.SetTrustedProxies([]string{"127.0.0.1", "::1"})
	}

	r.Use(cors.New(cors.Config{
		AllowAllOrigins:  true,
		AllowMethods:     []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
		AllowHeaders:     []string{"Origin", "Content-Type", "Authorization"},
		ExposeHeaders:    []string{"Subscription-Userinfo"},
		AllowCredentials: false,
		MaxAge:           12 * time.Hour,
	}))

	// 公开路由：订阅下发，无需认证
	r.GET("/sub/:token", handler.HandleSub)
	r.GET("/ruleset/:token/:name", handler.HandleRuleSet)

	api := r.Group("/api")
	{
		auth := api.Group("/auth")
		auth.GET("/public-key", handler.GetPublicKey)
		auth.POST("/register", handler.Register)
		auth.POST("/login", handler.Login)

		protected := api.Group("", middleware.Auth())
		{
			// 用户信息
			user := protected.Group("/user")
			user.GET("/profile", handler.GetProfile)
			user.PUT("/profile", handler.UpdateProfile)
			user.PUT("/password", handler.UpdatePassword)

			// 仪表盘
			protected.GET("/dashboard/stats", handler.GetDashboardStats)
			protected.POST("/dashboard/refresh-all-providers", handler.RefreshAllProviders)

			// User-Agent 管理
			ua := protected.Group("/user-agents")
			ua.GET("", handler.ListUserAgents)
			ua.POST("", handler.CreateUserAgent)
			ua.PUT("/:id", handler.UpdateUserAgent)
			ua.DELETE("/:id", handler.DeleteUserAgent)

			// 上游订阅源管理
			prov := protected.Group("/providers")
			prov.GET("", handler.ListProviders)
			prov.POST("", handler.CreateProvider)
			prov.PUT("/:id", handler.UpdateProvider)
			prov.DELETE("/:id", handler.DeleteProvider)
			prov.POST("/:id/refresh", handler.RefreshProvider)

			// 配置模板管理
			ct := protected.Group("/config-templates")
			ct.GET("", handler.ListConfigTemplates)
			ct.POST("", handler.CreateConfigTemplate)
			ct.GET("/:id", handler.GetConfigTemplate)
			ct.PUT("/:id", handler.UpdateConfigTemplate)
			ct.DELETE("/:id", handler.DeleteConfigTemplate)

			// 规则集库管理
			rp := protected.Group("/rule-providers")
			rp.GET("", handler.ListRuleProviders)
			rp.POST("", handler.CreateRuleProvider)
			rp.GET("/:id", handler.GetRuleProvider)
			rp.PUT("/:id", handler.UpdateRuleProvider)
			rp.DELETE("/:id", handler.DeleteRuleProvider)

			hrs := protected.Group("/hosted-rule-sets")
			hrs.GET("", handler.ListHostedRuleSets)
			hrs.POST("", handler.CreateHostedRuleSet)
			hrs.GET("/:id", handler.GetHostedRuleSet)
			hrs.PUT("/:id", handler.UpdateHostedRuleSet)
			hrs.DELETE("/:id", handler.DeleteHostedRuleSet)
			hrs.POST("/reset-tokens", handler.ResetHostedRuleSetTokens)

			// 自定义配置管理
			cc := protected.Group("/custom-configs")
			cc.GET("", handler.ListCustomConfigs)
			cc.POST("", handler.CreateCustomConfig)
			cc.POST("/import", handler.ImportCustomConfig)
			cc.GET("/:id", handler.GetCustomConfig)
			cc.PUT("/:id", handler.UpdateCustomConfig)
			cc.DELETE("/:id", handler.DeleteCustomConfig)
			cc.POST("/:id/clone", handler.CloneCustomConfig)
			cc.GET("/:id/export", handler.ExportCustomConfig)
			cc.GET("/:id/preview", handler.PreviewCustomConfig)

			// 订阅管理
			sub := protected.Group("/subscriptions")
			sub.GET("", handler.ListSubscriptions)
			sub.POST("", handler.CreateSubscription)
			sub.GET("/:id", handler.GetSubscription)
			sub.PUT("/:id", handler.UpdateSubscription)
			sub.DELETE("/:id", handler.DeleteSubscription)
			sub.POST("/:id/regenerate-token", handler.RegenerateToken)
			sub.GET("/:id/access-logs", handler.GetAccessLogs)
			sub.GET("/:id/restrictions", handler.ListRestrictions)
			sub.POST("/:id/restrictions", handler.CreateRestriction)
			sub.DELETE("/:id/restrictions/:rid", handler.DeleteRestriction)
		}
	}

	staticFS, err := static.GetFS()
	if err != nil {
		slog.Warn("静态文件初始化失败", slog.String("component", "main"), slog.Any("err", err))
	} else {
		r.NoRoute(func(c *gin.Context) {
			p := c.Request.URL.Path
			if len(p) > 0 && p[0] == '/' {
				p = p[1:]
			}
			if p == "" {
				p = "index.html"
			}
			f, err := staticFS.Open(p)
			if err != nil {
				p = "index.html"
				f, err = staticFS.Open(p)
				if err != nil {
					c.Status(http.StatusNotFound)
					return
				}
			}
			defer f.Close()
			content, err := io.ReadAll(f)
			if err != nil {
				c.Status(http.StatusInternalServerError)
				return
			}
			ext := filepath.Ext(p)
			contentType := mime.TypeByExtension(ext)
			if contentType == "" {
				contentType = "application/octet-stream"
			}
			c.Data(http.StatusOK, contentType, content)
		})
	}

	slog.Info("服务启动", slog.String("component", "main"), slog.String("addr", ":"+cfg.Port))
	if err := r.Run(":" + cfg.Port); err != nil {
		slog.Error("服务启动失败", slog.String("component", "main"), slog.Any("err", err))
		os.Exit(1)
	}
}

// ginTrustedProxies 解析 GIN_TRUSTED_PROXIES（逗号分隔的 IP 或 CIDR）；未设置时仅信任本机回环，避免默认「信任所有代理」。
func ginTrustedProxies() []string {
	s := strings.TrimSpace(os.Getenv("GIN_TRUSTED_PROXIES"))
	if s == "" {
		return []string{"127.0.0.1", "::1"}
	}
	parts := strings.Split(s, ",")
	out := make([]string, 0, len(parts))
	for _, p := range parts {
		p = strings.TrimSpace(p)
		if p != "" {
			out = append(out, p)
		}
	}
	if len(out) == 0 {
		return []string{"127.0.0.1", "::1"}
	}
	return out
}