const login = async () => {
  const userInfo = { username: 'zs', password: '123' }
  const { data } = await userLogin(userInfo)

  // 存儲雙Token
  localStorage.setItem('access_token', data.access_token)
  localStorage.setItem('refresh_token', data.refresh_token)
  isLogin.value = true
}

api.interceptors.request.use(config => {
  const token = localStorage.getItem('access_token')
  if (token) {
    config.headers.Authorization = `Bearer ${token}`
  }
  return config
})

// 核心全局變量：解決多接口并發(fā)401重復刷新BUG
// 刷新鎖：控制同一時間僅執(zhí)行一次token刷新
let isRefreshing = false
// 請求隊列：存儲刷新期間失敗的所有業(yè)務請求
let requestQueue = []

api.interceptors.response.use(
  // 正常響應直接返回
  res => res,
  // 統(tǒng)一處理異常響應
  async error => {
    const { response, config } = error || {}
    const status = response?.status
    const isRefreshApi = config.url === '/refresh'

    // 非401錯誤、刷新接口自身報錯，直接拋出異常，不做處理
    if (status !== 401 || isRefreshApi) {
      return Promise.reject(error)
    }

    // 場景一：正在刷新中，將當前失敗請求推入隊列，等待刷新完成重試
    if (isRefreshing) {
      return new Promise(resolve => {
        requestQueue.push(() => resolve(api(config)))
      })
    }

    // 場景二：無刷新進行中，開啟鎖，執(zhí)行刷新邏輯
    isRefreshing = true

    try {
      // 調用刷新接口，更新雙令牌
      await refreshToken()
      // 刷新成功：批量執(zhí)行隊列中所有等待請求
      requestQueue.forEach(cb => cb())
      // 清空隊列，避免臟數據殘留
      requestQueue = []
      // 重試當前失敗的接口
      return api(config)
    } catch (e) {
      // 刷新失?。簉efresh_token 徹底失效，重置登錄態(tài)
      localStorage.clear()
      requestQueue = []
      window.location.href = '/login'
      return Promise.reject(e)
    } finally {
      // 無論成功失敗，最終釋放刷新鎖，允許下次刷新
      isRefreshing = false
    }
  }
)

async function refreshToken() {
  const rt = localStorage.getItem('refresh_token')
  const { data } = await api.get('/refresh', { params: { token: rt } })

  localStorage.setItem('access_token', data.access_token)
  localStorage.setItem('refresh_token', data.refresh_token)
  return data
}

app.post('/login', (req, res) => {
  const { username, password } = req.body
  const user = users.find(u => u.username === username && u.password === password)

  if (!user) return res.status(401).json({ message: '賬號或密碼錯誤' })

  // 生成短時效訪問Token + 長時效刷新Token
  const access_token = generateToken(user, '1h')
  const refresh_token = generateToken(user, '7d')

  res.json({ access_token, refresh_token, userInfo: user })
})

app.get('/refresh', (req, res) => {
  const { token } = req.query
  try {
    const userData = verifyToken(token)
    const access_token = generateToken(userData, '1h')
    const refresh_token = generateToken(userData, '7d')
    res.json({ access_token, refresh_token })
  } catch (err) {
    res.status(401).json({ message: '刷新令牌已失效' })
  }
})

const jwt = require('jsonwebtoken')
const secret = 'MY_SECRET_KEY'

function generateToken(user, expiresIn) {
  return jwt.sign({ username: user.username }, secret, { expiresIn })
}

function verifyToken(token) {
  return jwt.verify(token, secret)
}

module.exports = { generateToken, verifyToken }