func (h *AuthHandler) Auth(c *gin.Context) {
	var req dto.AuthRequest

	// 支持form和json两种格式
	if err := c.ShouldBind(&req); err != nil {
		logger.Errorf("Auth bind error: %v", err)
		c.JSON(http.StatusOK, dto.AuthResponse{Result: "deny"})
		return
	}

	logger.Debugf("Auth request: clientid=%s, username=%s, peerhost=%s",
		req.ClientID, req.Username, req.PeerHost)

	resp, err := h.authService.Authenticate(&req)
	if err != nil {
		logger.Errorf("Auth error: %v", err)
		c.JSON(http.StatusOK, dto.AuthResponse{Result: "deny"})
		return
	}

	c.JSON(http.StatusOK, resp)
}


func (s *AuthService) Authenticate(req *dto.AuthRequest) (*dto.AuthResponse, error) {
	db := database.DB()
	if db == nil {
		return nil, errors.New("database connection not available")
	}

	var user model.MqttAuthUser
	result := db.Where("username = ?", req.Username).First(&user)
	if result.Error != nil {
		logger.Infof("Auth failed: user not found, username=%s", req.Username)
		return &dto.AuthResponse{Result: "deny"}, nil
	}

	// 检查用户状态
	if !user.Enabled {
		logger.Infof("Auth failed: user disabled, username=%s", req.Username)
		return &dto.AuthResponse{Result: "deny"}, nil
	}

	// 验证密码 (bcrypt)
	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.Password)); err != nil {
		logger.Infof("Auth failed: invalid password, username=%s", req.Username)
		return &dto.AuthResponse{Result: "deny"}, nil
	}

	//是否超级管理员
	if user.IsSuperuser {
		return &dto.AuthResponse{
			Result:      "allow",
			IsSuperuser: user.IsSuperuser,
		}, nil
	}

	// 如果指定了ClientID，验证是否匹配
	if user.ClientId != "" && req.ClientID != "" && user.ClientId != req.ClientID {
		logger.Infof("Auth failed: client_id mismatch, username=%s, expected=%s, got=%s",
			req.Username, user.ClientId, req.ClientID)
		return &dto.AuthResponse{Result: "deny"}, nil
	}

	logger.Infof("Auth success: username=%s, clientid=%s, is_superuser=%v, tenant_id=%d",
		req.Username, req.ClientID, user.IsSuperuser, user.TenantId)

	// 构建客户端属性
	clientAttrs := make(map[string]string, 10)

	if user.TenantId > 0 {
		clientAttrs["tenant_id"] = strconv.FormatInt(user.TenantId, 10)
	}
	if user.Type == model.MqttAuthUserTypeDevice {
		clientAttrs["device_id"] = strconv.FormatInt(user.Id, 10)
		//根据user.id 关联 model.Device的MqttAuthUserId查询device_code
		var device model.Device
		if err := db.Where("mqtt_auth_user_id = ?", user.Id).First(&device).Error; err == nil {
			clientAttrs["device_code"] = device.DeviceCode
			if user.TenantId == 0 {
				clientAttrs["tenant_id"] = strconv.FormatInt(device.TenantId, 10)
			}
		}
		// 验证device类型必须要有tenantId和deviceCode
		if clientAttrs["tenant_id"] == "" {
			logger.Infof("Auth failed: tenant_id not found for device, username=%s", req.Username)
			return &dto.AuthResponse{Result: "deny"}, nil
		}
		if clientAttrs["device_code"] == "" {
			logger.Infof("Auth failed: device_code not found, username=%s", req.Username)
			return &dto.AuthResponse{Result: "deny"}, nil
		}
		clientAttrs["type"] = "device"
	} else {
		clientAttrs["user_id"] = strconv.FormatInt(user.Id, 10)
		clientAttrs["username"] = user.Username
		// 验证非device类型必须要有tenantId和userId
		if clientAttrs["tenant_id"] == "" {
			logger.Infof("Auth failed: tenant_id not found, username=%s", req.Username)
			return &dto.AuthResponse{Result: "deny"}, nil
		}
		if clientAttrs["user_id"] == "" {
			logger.Infof("Auth failed: user_id not found, username=%s", req.Username)
			return &dto.AuthResponse{Result: "deny"}, nil
		}
		clientAttrs["type"] = "user"
	}
	clientAttrs["client_id"] = user.ClientId

	return &dto.AuthResponse{
		Result:      "allow",
		IsSuperuser: user.IsSuperuser,
		ClientAttrs: clientAttrs,
	}, nil
}