import CryptoJS from 'crypto-js'
import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto'
import { createError } from 'h3'

export interface OAuthState {
  target: string
  csrf: string
  timestamp: number
  provider?: string
  returnTo?: string
  loginType?: string
}

export const getSafeOAuthReturnPath = (value: unknown): string | undefined => {
  const path = Array.isArray(value) ? value[0] : value
  return typeof path === 'string' &&
    path.startsWith('/') &&
    !path.startsWith('//') &&
    !path.startsWith('/\\')
    ? path
    : undefined
}

const normalizePort = (url: URL): string => {
  if (url.port) return url.port
  if (url.protocol === 'https:') return '443'
  if (url.protocol === 'http:') return '80'
  return ''
}

const OAUTH_STATE_COOKIE_PREFIX = 'b64url:'

export interface OAuthStateCookieNames {
  csrf: string
  fullState: string
  compactState: string
}

export const LEGACY_OAUTH_STATE_COOKIE_NAMES: OAuthStateCookieNames = {
  csrf: 'oauth_csrf',
  fullState: 'oauth_full_state',
  compactState: 'oauth_compact_state'
}

export const getOAuthStateCookieNames = (compactState?: string): OAuthStateCookieNames => {
  if (!compactState) return LEGACY_OAUTH_STATE_COOKIE_NAMES

  const suffix = createHash('sha256').update(compactState).digest('hex').slice(0, 24)
  return {
    csrf: `oauth_csrf_${suffix}`,
    fullState: `oauth_full_state_${suffix}`,
    compactState: `oauth_compact_state_${suffix}`
  }
}

// AES state 是标准 Base64，Cookie 中只需转换为 URL 安全格式以避免 +、/、= 被改写。
export const encodeOAuthStateCookie = (state: string): string =>
  `${OAUTH_STATE_COOKIE_PREFIX}${Buffer.from(state, 'base64').toString('base64url')}`

export const decodeOAuthStateCookie = (state: string): string => {
  if (!state.startsWith(OAUTH_STATE_COOKIE_PREFIX)) {
    return state
  }

  const encodedState = state.slice(OAUTH_STATE_COOKIE_PREFIX.length)
  if (!encodedState || !/^[A-Za-z0-9_-]+$/.test(encodedState)) {
    return ''
  }

  try {
    const decodedState = Buffer.from(encodedState, 'base64url')
    if (decodedState.toString('base64url') !== encodedState) {
      return ''
    }
    return decodedState.toString('base64')
  } catch {
    return ''
  }
}

// 生成 OAuth 状态参数
export const generateState = (
  targetOrigin: string,
  provider?: string,
  secretKey?: string,
  returnTo?: string,
  loginType?: string
): { state: string; csrf: string } => {
  if (!secretKey) {
    throw createError({
      statusCode: 500,
      message: 'OAuth State 密钥未配置，请在管理员后台配置 OAuth State 密钥'
    })
  }

  const csrf = randomBytes(32).toString('hex')
  const payload: OAuthState = {
    target: targetOrigin,
    csrf,
    timestamp: Date.now(),
    provider,
    returnTo: getSafeOAuthReturnPath(returnTo),
    loginType
  }
  const json = JSON.stringify(payload)
  const state = CryptoJS.AES.encrypt(json, secretKey).toString()
  return { state, csrf }
}

// 聚合登录服务会把 state 截断为 100 字符，因此 Broker 只接收携带源站的可验签短路由信息。
// 完整状态保存在 HttpOnly Cookie 中，回调时仍会校验 Origin、CSRF 和过期时间。
export const generateCompactOAuthState = (targetOrigin: string, secretKey?: string): string => {
  if (!secretKey) {
    throw createError({ statusCode: 500, message: 'OAuth State 密钥未配置' })
  }

  const target = new URL(targetOrigin).origin
  const encodedTarget = Buffer.from(target, 'utf8').toString('base64url')
  const nonce = randomBytes(8).toString('base64url')
  const payload = `v1.${encodedTarget}.${nonce}`
  const signature = createHmac('sha256', secretKey)
    .update(payload)
    .digest()
    .subarray(0, 12)
    .toString('base64url')
  const state = `${payload}.${signature}`

  if (state.length > 100) {
    throw createError({
      statusCode: 400,
      message: '当前站点地址过长，无法兼容聚合登录的 state 长度限制'
    })
  }

  return state
}

// 校验紧凑 state 的 HMAC 签名，阻止伪造的 state 进入后续流程。
export const verifyCompactOAuthState = (state: string, secretKey?: string): boolean => {
  if (!secretKey) {
    throw createError({ statusCode: 500, message: 'OAuth State 密钥未配置' })
  }

  const lastDot = state.lastIndexOf('.')
  if (lastDot <= 0 || !state.startsWith('v1.')) return false

  try {
    const payload = state.slice(0, lastDot)
    const expected = createHmac('sha256', secretKey).update(payload).digest().subarray(0, 12)
    const actual = Buffer.from(state.slice(lastDot + 1), 'base64url')
    return actual.length === expected.length && timingSafeEqual(actual, expected)
  } catch {
    return false
  }
}

// 解析 OAuth 状态参数
export const parseState = (
  stateStr: string,
  expectedOrigin?: string,
  expectedCsrf?: string,
  secretKey?: string
): OAuthState | null => {
  if (!secretKey) {
    throw createError({
      statusCode: 500,
      message: 'OAuth State 密钥未配置，请在管理员后台配置 OAuth State 密钥'
    })
  }

  // 修复 base64 中的 '+' 在 URL 传输中被错误解析为空格的问题
  // 某些 OAuth 提供商或浏览器环境可能会导致 URL 查询参数中的 '+' 号变成空格
  const sanitizedStateStr = stateStr.replace(/ /g, '+')

  try {
    const bytes = CryptoJS.AES.decrypt(sanitizedStateStr, secretKey)
    const json = bytes.toString(CryptoJS.enc.Utf8)
    if (!json) return null

    const payload = JSON.parse(json)

    // 检查时间戳是否过期（例如：10分钟）
    if (Date.now() - payload.timestamp > 10 * 60 * 1000) {
      console.error('OAuth state expired')
      return null
    }

    // 验证 target origin - 在Codespaces等环境中，两次请求可能使用不同的host
    // 所以我们只验证protocol相同，但允许不同的subdomain
    if (expectedOrigin && payload.target) {
      try {
        const expectedUrl = new URL(expectedOrigin)
        const payloadUrl = new URL(payload.target)

        // 如果protocol不匹配，拒绝
        if (expectedUrl.protocol !== payloadUrl.protocol) {
          console.error(
            `OAuth state protocol mismatch: ${expectedUrl.protocol} vs ${payloadUrl.protocol}`
          )
          return null
        }

        // 判断是否为相同的源站
        // 使用 hostname 避免端口导致误判，端口单独比较
        const expectedHost = expectedUrl.hostname
        const payloadHost = payloadUrl.hostname
        const expectedPort = normalizePort(expectedUrl)
        const payloadPort = normalizePort(payloadUrl)

        // hostname 相同时也要校验端口一致，避免同 host 不同端口被接受
        if (expectedHost === payloadHost) {
          if (expectedPort !== payloadPort) {
            console.error(`OAuth state port mismatch: ${expectedPort} vs ${payloadPort}`)
            return null
          }
        } else {
          // host 不同 - 检查是否为已知的需要兼容的环境
          // 仅在 *.github.dev（Codespaces 环境）中允许不同的子域名
          const isExpectedGitHubDev =
            expectedHost.endsWith('.github.dev') ||
            expectedHost === 'localhost' ||
            expectedHost === '127.0.0.1'
          const isPayloadGitHubDev =
            payloadHost.endsWith('.github.dev') ||
            payloadHost === 'localhost' ||
            payloadHost === '127.0.0.1'

          if (isExpectedGitHubDev && isPayloadGitHubDev) {
            // 在 Codespaces 等环境中，允许子域名变化（例如端口号变化导致的 subdomain 变化）
            // 但仍需要验证基础域名相同（.github.dev）
            const expectedParts = expectedHost.split('.')
            const payloadParts = payloadHost.split('.')

            // 对于 localhost, 要求完全相同
            if (expectedHost === 'localhost' || payloadHost === 'localhost') {
              if (expectedHost !== payloadHost || expectedPort !== payloadPort) {
                console.error(
                  `OAuth state host/port mismatch (localhost): ${expectedHost}:${expectedPort} vs ${payloadHost}:${payloadPort}`
                )
                return null
              }
            } else if (expectedHost === '127.0.0.1' || payloadHost === '127.0.0.1') {
              // 对于 127.0.0.1，也要求完全相同
              if (expectedHost !== payloadHost || expectedPort !== payloadPort) {
                console.error(
                  `OAuth state host/port mismatch (127.0.0.1): ${expectedHost}:${expectedPort} vs ${payloadHost}:${payloadPort}`
                )
                return null
              }
            } else {
              // 对于 *.github.dev，允许不同的子域名，但要求基础部分相同
              // 例如：crispy-funicular-q77p479p56r9hx7vr-3000.app.github.dev
              // 和 crispy-funicular-q77p479p56r9hx7vr.app.github.dev 都可以通过
              const expectedBase = expectedParts.slice(-3).join('.')
              const payloadBase = payloadParts.slice(-3).join('.')

              if (expectedBase !== payloadBase) {
                console.error(`OAuth state domain mismatch: ${expectedBase} vs ${payloadBase}`)
                return null
              }
            }
          } else {
            // 对于非白名单环境，要求 host 完全相同
            console.error(`OAuth state host mismatch: ${expectedHost} vs ${payloadHost}`)
            return null
          }
        }
      } catch (e) {
        console.error('Failed to parse OAuth state URLs', e)
        return null
      }
    }

    // 验证 CSRF
    if (!expectedCsrf || payload.csrf !== expectedCsrf) {
      console.error('OAuth state CSRF mismatch or missing cookie')
      return null
    }

    payload.returnTo = getSafeOAuthReturnPath(payload.returnTo)
    return payload
  } catch {
    // 解密失败通常来自密钥不一致或客户端状态损坏，不应作为服务端异常上报。
    console.warn('OAuth state 解密失败：state 已损坏、被截断或 OAuth State 密钥不一致')
    return null
  }
}

export const getRedirectUri = (provider: string, redirectUriTemplate?: string): string => {
  let redirectUri = redirectUriTemplate
  if (!redirectUri) {
    throw createError({
      statusCode: 500,
      message: 'OAuth 重定向 URI 未配置，请在管理员后台配置 OAuth 重定向 URI'
    })
  }

  // 支持 [provider] 占位符
  redirectUri = redirectUri.replace('[provider]', provider)

  // 兼容用户可能错误地将 "provider" 作为字面量填写的情况
  if (redirectUri.includes('/provider/callback')) {
    redirectUri = redirectUri.replace('/provider/callback', `/${provider}/callback`)
  }

  return redirectUri
}