#Guard 패턴 Cookbook

use ranvier_http::prelude::*;
use ranvier_guard::prelude::*;

Ranvier::http()
    .guard(RequestIdGuard::new())
    .guard(AccessLogGuard::new())
    .guard(CorsGuard::new(CorsConfig {
        allowed_origins: vec!["https://app.example.com".into()],
        allowed_methods: vec!["GET".into(), "POST".into(), "PUT".into(), "DELETE".into()],
        allowed_headers: vec!["Content-Type".into(), "Authorization".into()],
        max_age_seconds: 86400,
        allow_credentials: true,
    }))
    .guard(SecurityHeadersGuard::new(SecurityPolicy::default()))
    .guard(CompressionGuard::new().prefer_brotli())
    .get("/api/health", health_circuit)
    .run(())
    .await?;

use ranvier_http::{guards, prelude::*};
use ranvier_guard::prelude::*;

Ranvier::http()
    .guard(AccessLogGuard::new())                    // 글로벌 — 모든 라우트
    .guard(CorsGuard::<()>::permissive())    // 글로벌 — 모든 라우트
    .post_with_guards("/api/orders", order_circuit, guards![
        ContentTypeGuard::json(),                    // 라우트별 — POST만
        IdempotencyGuard::ttl_5min(),                // 라우트별 — POST만
        RequestSizeLimitGuard::max_2mb(),            // 라우트별 — POST만
    ])
    .get("/api/orders", list_circuit)                // 추가 Guard 없음
    .run(())
    .await?;

use async_trait::async_trait;
use ranvier_core::prelude::*;
use serde::{Deserialize, Serialize};

/// Bus 타입: Accept 헤더에서 추출한 API 버전.
#[derive(Debug, Clone)]
pub struct ApiVersion(pub String);

/// 지원되는 API 버전이 없는 요청을 거부하는 Guard.
#[derive(Debug, Clone)]
pub struct ApiVersionGuard<T> {
    supported: Vec<String>,
    _marker: std::marker::PhantomData<T>,
}

impl<T> ApiVersionGuard<T> {
    pub fn new(supported: Vec<String>) -> Self {
        Self {
            supported,
            _marker: std::marker::PhantomData,
        }
    }
}

#[async_trait]
impl<T: Send + Sync + 'static> Transition<T, T> for ApiVersionGuard<T> {
    type Error = String;
    type Resources = ();

    async fn run(
        &self,
        input: T,
        _resources: &Self::Resources,
        bus: &mut Bus,
    ) -> Outcome<T, Self::Error> {
        let version = bus.get_cloned::<ApiVersion>()
            .map(|v| v.0)
            .unwrap_or_default();

        if self.supported.contains(&version) {
            Outcome::next(input)
        } else {
            Outcome::fault(format!(
                "406 Not Acceptable: API 버전 '{}'은(는) 지원되지 않습니다",
                version
            ))
        }
    }
}

use ranvier_http::{PathParams, prelude::*};
use ranvier_guard::prelude::*;
use sqlx::PgPool;

let pool = PgPool::connect(&database_url).await?;

Ranvier::http()
    .bind("0.0.0.0:8080")
    .bus_injector({
        let pool = pool.clone();
        move |parts: &http::request::Parts, bus: &mut Bus| {
            // 애플리케이션 데이터
            bus.insert(pool.clone());
            // 경로 파라미터 (HttpIngress가 자동 추출)
            if let Some(params) = parts.extensions.get::<PathParams>() {
                bus.insert(params.clone());
            }
            // 요청 헤더를 Vec<(String, String)>으로 변환
            let headers: Vec<(String, String)> = parts.headers.iter()
                .map(|(k, v)| (k.to_string(), v.to_str().unwrap_or("").to_string()))
                .collect();
            bus.insert(headers);
        }
    })
    // Guard는 자체 Bus 타입(RequestOrigin 등)을 자동 주입
    .guard(CorsGuard::<()>::permissive())
    .guard(AccessLogGuard::new())
    .post_typed("/api/orders", order_pipeline())
    .get("/api/orders/:id", get_order_pipeline())
    .run(())
    .await?;

use ranvier_guard::prelude::*;

// 간단한 토큰 검증
let auth = AuthGuard::bearer(vec![
    std::env::var("API_TOKEN").expect("API_TOKEN must be set"),
]);

Ranvier::http()
    .guard(auth)
    .get("/api/protected", protected_circuit)
    .run(())
    .await?;

use ranvier_core::iam::IamPolicy;
use ranvier_guard::prelude::*;

let admin_auth = AuthGuard::bearer(vec!["admin-token".into()])
    .with_policy(IamPolicy::RequireRole("admin".into()));

Ranvier::http()
    .get_with_guards("/api/admin", admin_circuit, guards![admin_auth])
    .run(())
    .await?;

use ranvier_core::iam::IamIdentity;
use ranvier_guard::prelude::*;

let jwt_auth = AuthGuard::custom(|header_value| {
    let token = header_value
        .strip_prefix("Bearer ")
        .ok_or("Bearer 스키마가 필요합니다")?;
    // JWT 검증 로직
    let claims = validate_jwt(token).map_err(|e| e.to_string())?;
    Ok(IamIdentity::new(&claims.sub).with_role(&claims.role))
});

use ranvier_http::{guards, prelude::*};
use ranvier_guard::prelude::*;
use std::time::Duration;

let api_token = std::env::var("API_TOKEN").expect("API_TOKEN required");

Ranvier::http()
    .bind("0.0.0.0:8080")
    // --- 글로벌 Guard (모든 라우트) ---
    .guard(RequestIdGuard::new())
    .guard(AccessLogGuard::new().redact_paths(vec!["/auth/login".into()]))
    .guard(CorsGuard::new(CorsConfig {
        allowed_origins: vec!["https://app.example.com".into()],
        ..Default::default()
    }))
    .guard(SecurityHeadersGuard::new(
        SecurityPolicy::default().with_csp("default-src 'self'"),
    ))
    .guard(RateLimitGuard::new(100, 60_000))  // 분당 100회
    .guard(CompressionGuard::new().prefer_brotli())
    // --- 인증이 필요한 라우트 ---
    .get_with_guards("/api/users", list_users, guards![
        AuthGuard::bearer(vec![api_token.clone()]),
    ])
    .post_with_guards("/api/users", create_user, guards![
        AuthGuard::bearer(vec![api_token.clone()]),
        ContentTypeGuard::json(),
        RequestSizeLimitGuard::max_2mb(),
        IdempotencyGuard::ttl_5min(),
    ])
    // --- 공개 라우트 (인증 Guard 없음) ---
    .get("/health", health_circuit)
    .run(())
    .await?;