# nginx.conf
resolver 127.0.0.11 valid=5s;

# 模块加载路径，确保 OpenResty 能找到 resty.* 模块
lua_package_path "/usr/local/openresty/lualib/?.lua;;;/usr/local/openresty/nginx/lua/?.lua;;";
# 启用 LuaJIT 内存共享，用于存储一些全局配置或缓存（如果需要的话）
lua_shared_dict my_cache 10m;

# 错误日志级别设置为 debug，以便查看 Lua 脚本的详细调试信息
# 在生产环境中，可以切换到 info 或 warn
error_log /usr/local/openresty/nginx/logs/error.log error; # <-- !!! 调试关键 !!!

# 上游服务定义，保持不变
upstream resource-service {
    server resource-service:8030;
    keepalive 32;
}

upstream robot-service {
    server robot-service:8040;
    keepalive 32;
}

upstream ai-service {
    server ai-service:8010;
    keepalive 32;
}

upstream openapi-service {
    server openapi-service:8020;
    keepalive 32;
}

upstream rpa-auth-service {
    server rpa-auth:10251;
    keepalive 32;
}

upstream casdoor {
    server casdoor:8000;
    keepalive 32;
}

server {
    listen 80;
    server_name localhost;

    # 通用配置
    client_max_body_size 100M;
    proxy_connect_timeout 60s;
    proxy_send_timeout 60s;
    proxy_read_timeout 60s;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # 定义一个方便在 Lua 脚本中判断当前上下文类型的变量
    set $context_type "HTTP";

    # resource-service 路由
    location /api/resource/ {
        access_by_lua_file lua/auth_handler.lua; # 调用外部 Lua 认证脚本
        
        proxy_pass http://resource-service;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_connect_timeout 10s;
        proxy_send_timeout 10s;
        proxy_read_timeout 10s;
    }

    # robot-service 路由
    # 默认不对此路由进行认证，以避免认证服务自身的循环调用
    # 如果需要保护 robot-service 的其他接口（排除 /user/info），则需要更细的粒度控制
    location /api/robot/ {
        # 如果需要认证 /api/robot/ 其他接口，但排除 /user/info
        # if ($request_uri != "/api/robot/user/info") {
        #     access_by_lua_file lua/auth_handler.lua;
        # }

        proxy_pass http://robot-service;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }

    # ai-service 路由
    location /api/rpa-ai-service/ {
        access_by_lua_file lua/auth_handler.lua; # 调用外部 Lua 认证脚本

        rewrite ^/api/rpa-ai-service/(.*)$ /$1 break;
        proxy_pass http://ai-service;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_connect_timeout 600s;
        proxy_send_timeout 600s;
        proxy_read_timeout 600s;
    }

    # openapi-service 路由
    # MCP 专用 location - 同时处理带/不带斜杠的请求
    location ~ ^/api/rpa-openapi/mcp/?$ {
        # MCP 接口跳过会话认证，使用 API Key 认证
        # API Key 在查询参数中传递：?key=xxx
        # 支持以下格式：
        # - /api/rpa-openapi/mcp?key=xxx
        # - /api/rpa-openapi/mcp/?key=xxx
        
        rewrite ^/api/rpa-openapi/mcp/?(.*)$ /mcp/$1 break;
        proxy_pass http://openapi-service;
        proxy_connect_timeout 600s;
        proxy_send_timeout 600s;
        proxy_read_timeout 600s;
    }

    # WebSocket 专用 location
    location /api/rpa-openapi/ws {
        # 为 WebSocket 认证设置上下文类型
        set $context_type "WebSocket";
        access_by_lua_file lua/auth_handler.lua; # 调用外部 Lua 认证脚本

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade"; # WebSocket 升级需要
        proxy_http_version 1.1;
        proxy_read_timeout 60s;

        rewrite ^/api/rpa-openapi/(.*)$ /$1 break;
        proxy_pass http://openapi-service;
    }

    # 通用 API location - 需要会话认证
    location /api/rpa-openapi/ {
        access_by_lua_file lua/auth_handler.lua; # 调用外部 Lua 认证脚本

        rewrite ^/api/rpa-openapi/(.*)$ /$1 break;
        proxy_pass http://openapi-service;
        proxy_connect_timeout 600s;
        proxy_send_timeout 600s;
        proxy_read_timeout 600s;
    }

    # rpa-auth 路由
    location /api/rpa-auth/ {
        proxy_pass http://rpa-auth-service;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }

    # casdoor 路由
    location /api/casdoor/ {
        rewrite ^/api/casdoor/(.*)$ /$1 break;
        proxy_pass http://casdoor;
        proxy_connect_timeout 600s;
        proxy_send_timeout 600s;
        proxy_read_timeout 600s;
    }

    # 健康检查
    location /health {
        access_log off;
        return 200 "healthy\n";
        add_header Content-Type text/plain;
    }

    # 处理 favicon.ico 请求
    location /favicon.ico {
        access_log off;
        return 204;
    }

    # 默认路由
    location / {
        return 404 "Not Found";
    }
}
