交易所API设计

package api

import (
	"encoding/json"
	"net/http"
	"strconv"
	"time"

	"github.com/gorilla/mux"
)

type APIServer struct {
	router      *mux.Router
	orderSvc    OrderService
	accountSvc  AccountService
	marketSvc   MarketService
	authSvc     AuthService
}

func NewAPIServer() *APIServer {
	s := &APIServer{
		router: mux.NewRouter(),
	}

	s.registerRoutes()
	return s
}

func (s *APIServer) registerRoutes() {
	// Public API
	public := s.router.PathPrefix("/api/v1").Subrouter()
	public.HandleFunc("/time", s.handleGetServerTime).Methods("GET")
	public.HandleFunc("/markets", s.handleGetMarkets).Methods("GET")
	public.HandleFunc("/markets/{symbol}", s.handleGetMarket).Methods("GET")
	public.HandleFunc("/ticker/{symbol}", s.handleGetTicker).Methods("GET")
	public.HandleFunc("/depth/{symbol}", s.handleGetDepth).Methods("GET")
	public.HandleFunc("/trades/{symbol}", s.handleGetTrades).Methods("GET")
	public.HandleFunc("/klines/{symbol}", s.handleGetKlines).Methods("GET")

	// Private API (需要认证)
	private := s.router.PathPrefix("/api/v1").Subrouter()
	private.Use(s.authMiddleware)
	private.HandleFunc("/account", s.handleGetAccount).Methods("GET")
	private.HandleFunc("/balance", s.handleGetBalance).Methods("GET")
	private.HandleFunc("/orders", s.handleGetOrders).Methods("GET")
	private.HandleFunc("/orders/{orderId}", s.handleGetOrder).Methods("GET")
	private.HandleFunc("/orders/open", s.handleGetOpenOrders).Methods("GET")

	// Trade API
	trade := s.router.PathPrefix("/api/v1").Subrouter()
	trade.Use(s.authMiddleware)
	trade.Use(s.rateLimitMiddleware)
	trade.HandleFunc("/orders", s.handleCreateOrder).Methods("POST")
	trade.HandleFunc("/orders/{orderId}", s.handleCancelOrder).Methods("DELETE")
	trade.HandleFunc("/orders/cancel-all", s.handleCancelAllOrders).Methods("POST")
}

// ============ Public API ============

// 获取服务器时间
func (s *APIServer) handleGetServerTime(w http.ResponseWriter, r *http.Request) {
	response := map[string]interface{}{
		"serverTime": time.Now().UnixMilli(),
	}
	s.writeJSON(w, http.StatusOK, response)
}

// 获取所有交易对
func (s *APIServer) handleGetMarkets(w http.ResponseWriter, r *http.Request) {
	markets := s.marketSvc.GetAllMarkets()
	s.writeJSON(w, http.StatusOK, markets)
}

// 获取特定交易对信息
func (s *APIServer) handleGetMarket(w http.ResponseWriter, r *http.Request) {
	vars := mux.Vars(r)
	symbol := vars["symbol"]

	market, err := s.marketSvc.GetMarket(symbol)
	if err != nil {
		s.writeError(w, http.StatusNotFound, "MARKET_NOT_FOUND", "Market not found")
		return
	}

	s.writeJSON(w, http.StatusOK, market)
}

// 获取Ticker
func (s *APIServer) handleGetTicker(w http.ResponseWriter, r *http.Request) {
	vars := mux.Vars(r)
	symbol := vars["symbol"]

	ticker, err := s.marketSvc.GetTicker(symbol)
	if err != nil {
		s.writeError(w, http.StatusNotFound, "SYMBOL_NOT_FOUND", "Symbol not found")
		return
	}

	s.writeJSON(w, http.StatusOK, ticker)
}

// 获取订单簿深度
func (s *APIServer) handleGetDepth(w http.ResponseWriter, r *http.Request) {
	vars := mux.Vars(r)
	symbol := vars["symbol"]

	// 可选参数：limit (默认100)
	limitStr := r.URL.Query().Get("limit")
	limit := 100
	if limitStr != "" {
		if l, err := strconv.Atoi(limitStr); err == nil {
			limit = l
		}
	}

	depth, err := s.marketSvc.GetDepth(symbol, limit)
	if err != nil {
		s.writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", err.Error())
		return
	}

	s.writeJSON(w, http.StatusOK, depth)
}

// 获取最近成交记录
func (s *APIServer) handleGetTrades(w http.ResponseWriter, r *http.Request) {
	vars := mux.Vars(r)
	symbol := vars["symbol"]

	limitStr := r.URL.Query().Get("limit")
	limit := 500
	if limitStr != "" {
		if l, err := strconv.Atoi(limitStr); err == nil && l <= 1000 {
			limit = l
		}
	}

	trades, err := s.marketSvc.GetRecentTrades(symbol, limit)
	if err != nil {
		s.writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", err.Error())
		return
	}

	s.writeJSON(w, http.StatusOK, trades)
}

// 获取K线数据
func (s *APIServer) handleGetKlines(w http.ResponseWriter, r *http.Request) {
	vars := mux.Vars(r)
	symbol := vars["symbol"]

	interval := r.URL.Query().Get("interval") // 1m, 5m, 15m, 1h, 1d, etc.
	if interval == "" {
		interval = "1m"
	}

	limitStr := r.URL.Query().Get("limit")
	limit := 500
	if limitStr != "" {
		if l, err := strconv.Atoi(limitStr); err == nil {
			limit = l
		}
	}

	klines, err := s.marketSvc.GetKlines(symbol, interval, limit)
	if err != nil {
		s.writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", err.Error())
		return
	}

	s.writeJSON(w, http.StatusOK, klines)
}

// ============ Private API ============

// 获取账户信息
func (s *APIServer) handleGetAccount(w http.ResponseWriter, r *http.Request) {
	userID := r.Context().Value("userID").(string)

	account, err := s.accountSvc.GetAccount(userID)
	if err != nil {
		s.writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", err.Error())
		return
	}

	s.writeJSON(w, http.StatusOK, account)
}

// 获取余额
func (s *APIServer) handleGetBalance(w http.ResponseWriter, r *http.Request) {
	userID := r.Context().Value("userID").(string)

	balances, err := s.accountSvc.GetBalances(userID)
	if err != nil {
		s.writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", err.Error())
		return
	}

	s.writeJSON(w, http.StatusOK, balances)
}

// 获取订单列表
func (s *APIServer) handleGetOrders(w http.ResponseWriter, r *http.Request) {
	userID := r.Context().Value("userID").(string)

	symbol := r.URL.Query().Get("symbol")
	limitStr := r.URL.Query().Get("limit")
	limit := 100
	if limitStr != "" {
		if l, err := strconv.Atoi(limitStr); err == nil {
			limit = l
		}
	}

	orders, err := s.orderSvc.GetOrders(userID, symbol, limit)
	if err != nil {
		s.writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", err.Error())
		return
	}

	s.writeJSON(w, http.StatusOK, orders)
}

// 获取未完成订单
func (s *APIServer) handleGetOpenOrders(w http.ResponseWriter, r *http.Request) {
	userID := r.Context().Value("userID").(string)

	symbol := r.URL.Query().Get("symbol")

	orders, err := s.orderSvc.GetOpenOrders(userID, symbol)
	if err != nil {
		s.writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", err.Error())
		return
	}

	s.writeJSON(w, http.StatusOK, orders)
}

// ============ Trade API ============

// 创建订单
func (s *APIServer) handleCreateOrder(w http.ResponseWriter, r *http.Request) {
	userID := r.Context().Value("userID").(string)

	var req CreateOrderRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		s.writeError(w, http.StatusBadRequest, "INVALID_REQUEST", "Invalid request body")
		return
	}

	// 验证参数
	if err := s.validateOrderRequest(&req); err != nil {
		s.writeError(w, http.StatusBadRequest, "INVALID_PARAMS", err.Error())
		return
	}

	// 创建订单
	order, err := s.orderSvc.CreateOrder(userID, &req)
	if err != nil {
		s.writeError(w, http.StatusInternalServerError, "ORDER_FAILED", err.Error())
		return
	}

	s.writeJSON(w, http.StatusOK, order)
}

// 撤销订单
func (s *APIServer) handleCancelOrder(w http.ResponseWriter, r *http.Request) {
	userID := r.Context().Value("userID").(string)
	vars := mux.Vars(r)
	orderID := vars["orderId"]

	err := s.orderSvc.CancelOrder(userID, orderID)
	if err != nil {
		s.writeError(w, http.StatusInternalServerError, "CANCEL_FAILED", err.Error())
		return
	}

	s.writeJSON(w, http.StatusOK, map[string]string{
		"orderId": orderID,
		"status":  "canceled",
	})
}

// 撤销所有订单
func (s *APIServer) handleCancelAllOrders(w http.ResponseWriter, r *http.Request) {
	userID := r.Context().Value("userID").(string)

	var req struct {
		Symbol string `json:"symbol"`
	}
	json.NewDecoder(r.Body).Decode(&req)

	count, err := s.orderSvc.CancelAllOrders(userID, req.Symbol)
	if err != nil {
		s.writeError(w, http.StatusInternalServerError, "CANCEL_FAILED", err.Error())
		return
	}

	s.writeJSON(w, http.StatusOK, map[string]interface{}{
		"canceled": count,
	})
}

// ============ 辅助函数 ============

type CreateOrderRequest struct {
	Symbol      string  `json:"symbol"`
	Side        string  `json:"side"`        // "buy" or "sell"
	Type        string  `json:"type"`        // "limit" or "market"
	Price       float64 `json:"price"`
	Quantity    float64 `json:"quantity"`
	TimeInForce string  `json:"timeInForce"` // "GTC", "IOC", "FOK"
}

func (s *APIServer) validateOrderRequest(req *CreateOrderRequest) error {
	if req.Symbol == "" {
		return fmt.Errorf("symbol is required")
	}
	if req.Side != "buy" && req.Side != "sell" {
		return fmt.Errorf("invalid side")
	}
	if req.Type != "limit" && req.Type != "market" {
		return fmt.Errorf("invalid type")
	}
	if req.Type == "limit" && req.Price <= 0 {
		return fmt.Errorf("price must be positive for limit orders")
	}
	if req.Quantity <= 0 {
		return fmt.Errorf("quantity must be positive")
	}
	return nil
}

// 统一响应格式
type APIResponse struct {
	Success bool        `json:"success"`
	Data    interface{} `json:"data,omitempty"`
	Error   *APIError   `json:"error,omitempty"`
}

type APIError struct {
	Code    string `json:"code"`
	Message string `json:"message"`
}

func (s *APIServer) writeJSON(w http.ResponseWriter, status int, data interface{}) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteStatus(status)

	response := APIResponse{
		Success: true,
		Data:    data,
	}

	json.NewEncoder(w).Encode(response)
}

func (s *APIServer) writeError(w http.ResponseWriter, status int, code, message string) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(status)

	response := APIResponse{
		Success: false,
		Error: &APIError{
			Code:    code,
			Message: message,
		},
	}

	json.NewEncoder(w).Encode(response)
}

package auth

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"net/url"
	"sort"
	"strings"
	"time"
)

type Signer struct {
	apiKey    string
	secretKey string
}

func NewSigner(apiKey, secretKey string) *Signer {
	return &Signer{
		apiKey:    apiKey,
		secretKey: secretKey,
	}
}

// 生成签名
func (s *Signer) Sign(method, path string, params map[string]string) string {
	// 1. 添加时间戳和API Key
	params["timestamp"] = fmt.Sprintf("%d", time.Now().UnixMilli())
	params["apiKey"] = s.apiKey

	// 2. 按字母顺序排序参数
	keys := make([]string, 0, len(params))
	for k := range params {
		keys = append(keys, k)
	}
	sort.Strings(keys)

	// 3. 拼接查询字符串
	var parts []string
	for _, k := range keys {
		parts = append(parts, fmt.Sprintf("%s=%s", k, url.QueryEscape(params[k])))
	}
	queryString := strings.Join(parts, "&")

	// 4. 构造待签名字符串
	// 格式：METHOD\nPATH\nQUERY_STRING
	signString := fmt.Sprintf("%s\n%s\n%s", method, path, queryString)

	// 5. HMAC-SHA256签名
	h := hmac.New(sha256.New, []byte(s.secretKey))
	h.Write([]byte(signString))
	signature := hex.EncodeToString(h.Sum(nil))

	return signature
}

// 验证签名
func (s *Signer) Verify(method, path string, params map[string]string, signature string) bool {
	expectedSignature := s.Sign(method, path, params)
	return hmac.Equal([]byte(signature), []byte(expectedSignature))
}

// 检查时间戳（防重放攻击）
func (s *Signer) ValidateTimestamp(timestamp int64) bool {
	now := time.Now().UnixMilli()
	// 允许5分钟的时间差
	if abs(now-timestamp) > 5*60*1000 {
		return false
	}
	return true
}

func abs(n int64) int64 {
	if n < 0 {
		return -n
	}
	return n
}

func (s *APIServer) authMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// 1. 获取签名和时间戳
		signature := r.Header.Get("X-Signature")
		timestampStr := r.Header.Get("X-Timestamp")
		apiKey := r.Header.Get("X-API-Key")

		if signature == "" || timestampStr == "" || apiKey == "" {
			s.writeError(w, http.StatusUnauthorized, "MISSING_AUTH", "Missing authentication headers")
			return
		}

		// 2. 验证时间戳
		timestamp, err := strconv.ParseInt(timestampStr, 10, 64)
		if err != nil || !s.authSvc.ValidateTimestamp(timestamp) {
			s.writeError(w, http.StatusUnauthorized, "INVALID_TIMESTAMP", "Invalid or expired timestamp")
			return
		}

		// 3. 获取用户密钥
		secretKey, err := s.authSvc.GetSecretKey(apiKey)
		if err != nil {
			s.writeError(w, http.StatusUnauthorized, "INVALID_API_KEY", "Invalid API key")
			return
		}

		// 4. 验证签名
		params := extractParams(r)
		signer := auth.NewSigner(apiKey, secretKey)
		if !signer.Verify(r.Method, r.URL.Path, params, signature) {
			s.writeError(w, http.StatusUnauthorized, "INVALID_SIGNATURE", "Invalid signature")
			return
		}

		// 5. 获取用户ID
		userID, err := s.authSvc.GetUserID(apiKey)
		if err != nil {
			s.writeError(w, http.StatusUnauthorized, "INVALID_USER", "User not found")
			return
		}

		// 6. 将用户ID放入上下文
		ctx := context.WithValue(r.Context(), "userID", userID)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}

func extractParams(r *http.Request) map[string]string {
	params := make(map[string]string)

	// 从URL query参数提取
	for k, v := range r.URL.Query() {
		if len(v) > 0 {
			params[k] = v[0]
		}
	}

	// 从body提取（POST请求）
	if r.Method == "POST" || r.Method == "PUT" {
		r.ParseForm()
		for k, v := range r.PostForm {
			if len(v) > 0 {
				params[k] = v[0]
			}
		}
	}

	return params
}

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
)

type ExchangeClient struct {
	apiKey    string
	secretKey string
	baseURL   string
	signer    *auth.Signer
}

func NewExchangeClient(apiKey, secretKey, baseURL string) *ExchangeClient {
	return &ExchangeClient{
		apiKey:    apiKey,
		secretKey: secretKey,
		baseURL:   baseURL,
		signer:    auth.NewSigner(apiKey, secretKey),
	}
}

// 创建订单
func (c *ExchangeClient) CreateOrder(symbol, side, orderType string, price, quantity float64) (*Order, error) {
	params := map[string]string{
		"symbol":   symbol,
		"side":     side,
		"type":     orderType,
		"price":    fmt.Sprintf("%.8f", price),
		"quantity": fmt.Sprintf("%.8f", quantity),
	}

	return c.signedRequest("POST", "/api/v1/orders", params)
}

func (c *ExchangeClient) signedRequest(method, path string, params map[string]string) (*Order, error) {
	// 1. 生成签名
	signature := c.signer.Sign(method, path, params)
	timestamp := params["timestamp"]

	// 2. 构造请求
	url := c.baseURL + path
	var body io.Reader
	if method == "POST" {
		jsonData, _ := json.Marshal(params)
		body = bytes.NewBuffer(jsonData)
	}

	req, err := http.NewRequest(method, url, body)
	if err != nil {
		return nil, err
	}

	// 3. 添加认证头
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("X-API-Key", c.apiKey)
	req.Header.Set("X-Timestamp", timestamp)
	req.Header.Set("X-Signature", signature)

	// 4. 发送请求
	client := &http.Client{}
	resp, err := client.Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()

	// 5. 解析响应
	var result Order
	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
		return nil, err
	}

	return &result, nil
}

package websocket

import (
	"encoding/json"
	"sync"
	"time"

	"github.com/gorilla/websocket"
)

type WSServer struct {
	clients    map[*Client]bool
	broadcast  chan []byte
	register   chan *Client
	unregister chan *Client
	mu         sync.RWMutex
}

type Client struct {
	conn   *websocket.Conn
	send   chan []byte
	topics map[string]bool // 订阅的主题
	mu     sync.RWMutex
}

func NewWSServer() *WSServer {
	return &WSServer{
		clients:    make(map[*Client]bool),
		broadcast:  make(chan []byte, 1000),
		register:   make(chan *Client),
		unregister: make(chan *Client),
	}
}

func (s *WSServer) Run() {
	for {
		select {
		case client := <-s.register:
			s.mu.Lock()
			s.clients[client] = true
			s.mu.Unlock()

		case client := <-s.unregister:
			s.mu.Lock()
			if _, ok := s.clients[client]; ok {
				delete(s.clients, client)
				close(client.send)
			}
			s.mu.Unlock()

		case message := <-s.broadcast:
			s.mu.RLock()
			for client := range s.clients {
				select {
				case client.send <- message:
				default:
					close(client.send)
					delete(s.clients, client)
				}
			}
			s.mu.RUnlock()
		}
	}
}

// 处理客户端连接
func (s *WSServer) HandleClient(w http.ResponseWriter, r *http.Request) {
	upgrader := websocket.Upgrader{
		CheckOrigin: func(r *http.Request) bool {
			return true // 生产环境应检查origin
		},
	}

	conn, err := upgrader.Upgrade(w, r, nil)
	if err != nil {
		log.Println(err)
		return
	}

	client := &Client{
		conn:   conn,
		send:   make(chan []byte, 256),
		topics: make(map[string]bool),
	}

	s.register <- client

	// 启动读写goroutine
	go client.writePump()
	go client.readPump(s)
}

// 读取客户端消息
func (c *Client) readPump(server *WSServer) {
	defer func() {
		server.unregister <- c
		c.conn.Close()
	}()

	c.conn.SetReadDeadline(time.Now().Add(60 * time.Second))
	c.conn.SetPongHandler(func(string) error {
		c.conn.SetReadDeadline(time.Now().Add(60 * time.Second))
		return nil
	})

	for {
		_, message, err := c.conn.ReadMessage()
		if err != nil {
			break
		}

		// 处理订阅/取消订阅
		var msg WSMessage
		if err := json.Unmarshal(message, &msg); err != nil {
			continue
		}

		switch msg.Method {
		case "subscribe":
			c.subscribe(msg.Params...)
		case "unsubscribe":
			c.unsubscribe(msg.Params...)
		}
	}
}

// 向客户端发送消息
func (c *Client) writePump() {
	ticker := time.NewTicker(54 * time.Second)
	defer func() {
		ticker.Stop()
		c.conn.Close()
	}()

	for {
		select {
		case message, ok := <-c.send:
			c.conn.SetWriteDeadline(time.Now().Add(10 * time.Second))
			if !ok {
				c.conn.WriteMessage(websocket.CloseMessage, []byte{})
				return
			}

			w, err := c.conn.NextWriter(websocket.TextMessage)
			if err != nil {
				return
			}
			w.Write(message)

			// 批量发送队列中的消息
			n := len(c.send)
			for i := 0; i < n; i++ {
				w.Write([]byte{'\n'})
				w.Write(<-c.send)
			}

			if err := w.Close(); err != nil {
				return
			}

		case <-ticker.C:
			c.conn.SetWriteDeadline(time.Now().Add(10 * time.Second))
			if err := c.conn.WriteMessage(websocket.PingMessage, nil); err != nil {
				return
			}
		}
	}
}

// 订阅主题
func (c *Client) subscribe(topics ...string) {
	c.mu.Lock()
	defer c.mu.Unlock()

	for _, topic := range topics {
		c.topics[topic] = true
	}
}

// 取消订阅
func (c *Client) unsubscribe(topics ...string) {
	c.mu.Lock()
	defer c.mu.Unlock()

	for _, topic := range topics {
		delete(c.topics, topic)
	}
}

// WebSocket消息格式
type WSMessage struct {
	Method string   `json:"method"` // subscribe, unsubscribe
	Params []string `json:"params"` // 主题列表
}

// 推送消息到订阅了特定主题的客户端
func (s *WSServer) PublishToTopic(topic string, data interface{}) {
	message, _ := json.Marshal(map[string]interface{}{
		"topic": topic,
		"data":  data,
	})

	s.mu.RLock()
	defer s.mu.RUnlock()

	for client := range s.clients {
		client.mu.RLock()
		subscribed := client.topics[topic]
		client.mu.RUnlock()

		if subscribed {
			select {
			case client.send <- message:
			default:
				close(client.send)
				delete(s.clients, client)
			}
		}
	}
}