import { apiKeyPermissions, apiKeys, db } from '~/drizzle/db'
import { and, eq, sql } from 'drizzle-orm'
import { ApiLogService } from '~~/server/services/apiLogService'
import {
  API_ERROR_CODES,
  API_ERROR_MESSAGES,
  API_KEY_CONSTANTS,
  HTTP_STATUS
} from '~~/server/config/constants'
import { getBeijingTime } from '~/utils/timeUtils'
import { getIPBlockRemainingTime, isIPBlocked } from '~~/server/services/securityService'
import { getClientIP } from '~~/server/utils/ip-utils'
import { verifyApiKey } from '~~/server/utils/apiKeyUtils'

const truncateResponseBody = (responseBody: any, maxLength = 10000) => {
  try {
    const json = JSON.stringify(responseBody)
    return json.length <= maxLength ? json : `${json.slice(0, maxLength)}...`
  } catch {
    return String(responseBody).slice(0, maxLength)
  }
}

/**
 * 记录API访问日志
 */
async function logApiAccess(
  apiKeyId: string,
  method: string,
  endpoint: string,
  statusCode: number,
  responseTimeMs: number,
  ipAddress: string,
  userAgent: string,
  requestBody?: string,
  responseBody?: any,
  errorMessage?: string
) {
  try {
    // 写入数据库日志
    await ApiLogService.logAccess({
      apiKeyId,
      endpoint,
      method,
      ipAddress,
      userAgent,
      statusCode,
      responseTimeMs,
      requestBody,
      responseBody: responseBody ? truncateResponseBody(responseBody) : undefined,
      errorMessage
    })
  } catch (error) {
    console.error('[API Auth Middleware] 记录API访问日志失败:', error)
  }
}

/**
 * API Key认证中间件
 * 处理开放API的认证和权限验证
 */
export default defineEventHandler(async (event) => {
  const url = getRequestURL(event)
  const pathname = url.pathname

  // 只处理开放API路由 (/api/open/*)
  if (!pathname.startsWith('/api/open/')) {
    return
  }

  const startTime = Date.now()
  const method = getMethod(event)
  const userAgent = getHeader(event, 'user-agent') || ''
  console.log(`[API Auth Middleware] 开始处理开放API请求: ${method} ${pathname}`)

  // 获取客户端真实IP地址
  const ipAddress = getClientIP(event)

  // 检查IP是否被限制
  if (isIPBlocked(ipAddress)) {
    const remainingTime = getIPBlockRemainingTime(ipAddress)
    await ApiLogService.logAccess({
      apiKeyId: null,
      endpoint: pathname,
      method,
      ipAddress,
      userAgent,
      statusCode: 423,
      responseTimeMs: Date.now() - startTime,
      errorMessage: `IP地址已被限制访问，剩余时间: ${remainingTime}分钟`
    })

    return sendError(
      event,
      createError({
        statusCode: 423,
        message: `您的IP地址已被限制访问，请在 ${remainingTime} 分钟后重试`
      })
    )
  }

  // 获取API Key
  const apiKey = getHeader(event, 'x-api-key')

  console.log('[API Auth Middleware] 已收到开放API Key，开始校验')

  if (!apiKey) {
    console.log(`[API Auth Middleware] API Key缺失`)
    await ApiLogService.logAccess({
      apiKeyId: null,
      endpoint: pathname,
      method,
      ipAddress,
      userAgent,
      statusCode: 401,
      responseTimeMs: Date.now() - startTime
    })

    return sendError(
      event,
      createError({
        statusCode: HTTP_STATUS.UNAUTHORIZED,
        message: API_ERROR_MESSAGES[API_ERROR_CODES.MISSING_API_KEY]
      })
    )
  }

  try {
    // 验证API Key格式 (应该是 vhub_xxxxxxxxxxxxxxxx 格式)
    console.log('[API Auth Middleware] 验证API Key格式')

    if (
      !apiKey.startsWith(API_KEY_CONSTANTS.PREFIX) ||
      apiKey.length !== API_KEY_CONSTANTS.TOTAL_LENGTH
    ) {
      console.log(`[API Auth Middleware] API Key格式无效`)
      throw new Error(API_ERROR_MESSAGES[API_ERROR_CODES.INVALID_API_KEY_FORMAT])
    }

    // 提取前缀用于候选匹配，不输出任何明文片段
    const keyPrefix = apiKey.substring(0, API_KEY_CONSTANTS.PREFIX_LENGTH)
    console.log('[API Auth Middleware] 开始按前缀匹配API Key候选')

    // 查询API Key信息
    const apiKeyResult = await db
      .select({
        id: apiKeys.id,
        name: apiKeys.name,
        keyHash: apiKeys.keyHash,
        isActive: apiKeys.isActive,
        expiresAt: apiKeys.expiresAt,
        usageCount: apiKeys.usageCount,
        createdByUserId: apiKeys.createdByUserId
      })
      .from(apiKeys)
      .where(eq(apiKeys.keyPrefix, keyPrefix))

    console.log(
      `[API Auth Middleware] 数据库查询结果: ${apiKeyResult.length > 0 ? '找到记录' : '未找到记录'}`
    )

    const apiKeyRecord = await findValidApiKeyRecord(apiKey, apiKeyResult)

    if (!apiKeyRecord) {
      console.log(`[API Auth Middleware] API Key未找到或未激活`)
      await ApiLogService.logAccess({
        apiKeyId: null,
        endpoint: pathname,
        method,
        ipAddress,
        userAgent,
        statusCode: HTTP_STATUS.UNAUTHORIZED,
        responseTimeMs: Date.now() - startTime,
        errorMessage: API_ERROR_MESSAGES[API_ERROR_CODES.INVALID_API_KEY]
      })

      throw new Error(API_ERROR_MESSAGES[API_ERROR_CODES.INVALID_API_KEY])
    }

    console.log('[API Auth Middleware] API Key验证通过')

    // 检查API Key是否激活
    if (!apiKeyRecord.isActive) {
      await ApiLogService.logAccess({
        apiKeyId: apiKeyRecord.id,
        endpoint: pathname,
        method,
        ipAddress,
        userAgent,
        statusCode: HTTP_STATUS.FORBIDDEN,
        responseTimeMs: Date.now() - startTime,
        errorMessage: API_ERROR_MESSAGES[API_ERROR_CODES.API_KEY_DISABLED]
      })

      throw new Error(API_ERROR_MESSAGES[API_ERROR_CODES.API_KEY_DISABLED])
    }

    // 检查API Key是否过期
    if (apiKeyRecord.expiresAt && getBeijingTime() > apiKeyRecord.expiresAt) {
      console.log('[API Auth Middleware] API Key已过期')
      await ApiLogService.logAccess({
        apiKeyId: apiKeyRecord.id,
        endpoint: pathname,
        method,
        ipAddress,
        userAgent,
        statusCode: HTTP_STATUS.FORBIDDEN,
        responseTimeMs: Date.now() - startTime,
        errorMessage: API_ERROR_MESSAGES[API_ERROR_CODES.API_KEY_EXPIRED]
      })

      throw new Error(API_ERROR_MESSAGES[API_ERROR_CODES.API_KEY_EXPIRED])
    }

    // 检查权限
    const requiredPermission = getRequiredPermission(pathname, method)
    console.log(`[API Auth Middleware] 所需权限: ${requiredPermission}`)

    if (requiredPermission) {
      const permissionResult = await db
        .select()
        .from(apiKeyPermissions)
        .where(
          and(
            eq(apiKeyPermissions.apiKeyId, apiKeyRecord.id),
            eq(apiKeyPermissions.permission, requiredPermission)
          )
        )
        .limit(1)

      console.log(
        `[API Auth Middleware] 权限检查结果: ${permissionResult.length > 0 ? '通过' : '失败'}`
      )

      if (permissionResult.length === 0) {
        console.log(`[API Auth Middleware] 缺少必需权限: ${requiredPermission}`)
        await ApiLogService.logAccess({
          apiKeyId: apiKeyRecord.id,
          endpoint: pathname,
          method,
          ipAddress,
          userAgent,
          statusCode: HTTP_STATUS.FORBIDDEN,
          responseTimeMs: Date.now() - startTime,
          errorMessage: `${API_ERROR_MESSAGES[API_ERROR_CODES.INSUFFICIENT_PERMISSIONS]}: ${requiredPermission}`
        })

        throw new Error(
          `${API_ERROR_MESSAGES[API_ERROR_CODES.INSUFFICIENT_PERMISSIONS]}. Required: ${requiredPermission}`
        )
      }
    }

    // 使用原子操作更新API Key使用统计
    console.log('[API Auth Middleware] 开始原子更新API Key使用统计')
    await db
      .update(apiKeys)
      .set({
        lastUsedAt: new Date(),
        usageCount: sql`${apiKeys.usageCount} + 1`,
        updatedAt: new Date()
      })
      .where(eq(apiKeys.id, apiKeyRecord.id))
    console.log('[API Auth Middleware] API Key使用统计原子更新完成')

    // 记录成功的API访问
    console.log('[API Auth Middleware] 开始记录API访问日志')
    try {
      await logApiAccess(
        apiKeyRecord.id,
        method,
        pathname,
        HTTP_STATUS.OK,
        Date.now() - startTime,
        ipAddress,
        getHeader(event, 'user-agent') || 'Unknown'
      )
      console.log('[API Auth Middleware] API访问日志记录完成')
    } catch (error) {
      console.error(`[API Auth Middleware] 记录API访问日志失败:`, error)
    }

    console.log('[API Auth Middleware] 验证成功，继续处理请求')

    // 将API Key信息添加到事件上下文中，供后续处理使用
    event.context.apiKey = apiKeyRecord

    // 记录成功的API访问（在响应后记录）
    event.context.logApiAccess = async (
      statusCode: number,
      responseBody?: any,
      errorMessage?: string
    ) => {
      const requestBody = method !== 'GET' ? await readBody(event).catch(() => null) : null
      await logApiAccess(
        apiKeyRecord.id,
        method,
        pathname,
        statusCode,
        Date.now() - startTime,
        ipAddress,
        userAgent,
        requestBody ? JSON.stringify(requestBody) : undefined,
        responseBody,
        errorMessage
      )
    }

    // 验证成功，让请求继续到API端点
    return
  } catch (error: any) {
    const statusCode =
      error.message.includes('expired') ||
      error.message.includes('disabled') ||
      error.message.includes('permissions') ||
      error.message.includes('IP address')
        ? HTTP_STATUS.FORBIDDEN
        : HTTP_STATUS.UNAUTHORIZED

    return sendError(
      event,
      createError({
        statusCode,
        message: error.message
      })
    )
  }
})

/**
 * 根据路径和方法获取所需权限
 */
function getRequiredPermission(pathname: string, method: string): string | null {
  const normalizedPathname = pathname.replace(/\/+$/, '') || '/'

  if (
    normalizedPathname === '/api/open/card-codes' ||
    normalizedPathname.startsWith('/api/open/card-codes/')
  ) {
    if (
      normalizedPathname === '/api/open/card-codes/delete' ||
      normalizedPathname.startsWith('/api/open/card-codes/delete/')
    )
      return 'card-codes:delete'
    if (method === 'GET') return 'card-codes:read'
    if (method === 'DELETE') return 'card-codes:delete'
    return 'card-codes:write'
  }

  if (normalizedPathname.startsWith('/api/open/schedules')) {
    return 'schedules:read'
  }

  if (normalizedPathname.startsWith('/api/open/songs/mark-played')) {
    return 'songs:write'
  }

  if (normalizedPathname === '/api/open/songs/request' && method === 'POST') {
    return 'songs:request'
  }

  if (normalizedPathname.startsWith('/api/open/songs')) {
    return 'songs:read'
  }

  if (normalizedPathname.startsWith('/api/open/backup')) {
    return 'backup:execute'
  }

  return null
}

async function findValidApiKeyRecord(apiKey: string, records: Array<{ keyHash: string }>) {
  for (const record of records) {
    if (await verifyApiKey(apiKey, record.keyHash)) {
      return record
    }
  }

  return null
}