package com.uas.platform.b2b.filter;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.http.HttpStatus;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;

import com.uas.platform.core.util.encry.HmacUtils;

/**
 * 对需要签名认证的请求进行拦截认证
 * 
 * @author yingp
 *
 */
public class SignatureInterceptor extends HandlerInterceptorAdapter {

	private final static String signatureParam = "_signature";

	@Override
	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
		String sign = request.getParameter(signatureParam);
		if (sign != null) {
			String urlMessage = request.getRequestURL() + "?"
					+ request.getQueryString().substring(0, request.getQueryString().indexOf(signatureParam) - 1);
			if (sign.equals(HmacUtils.encode(urlMessage))) {
                return true;
            }
		}
		response.setStatus(HttpStatus.FORBIDDEN.value());
		return false;
	}

}
