/**
 * CmdCode V0.5 - 加密存储系统
 * 
 * 🔐 安全原则：
 * - 密钥永不在代码中硬编码
 * - 密钥永不在环境变量中传递
 * - 密钥永不在命令行参数中出现
 * - 密钥永不在日志文件中记录
 * - 密钥仅在内存中解密，用完即焚
 */
import { createCipheriv, createDecipheriv, randomBytes, createHash } from 'node:crypto'
import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync, chmodSync } from 'node:fs'
import { join } from 'node:path'
import { homedir } from 'node:os'

// ═══════════════════════════════════════════════════════════
// 配置常量
// ═══════════════════════════════════════════════════════════

const SECRETS_FILE = join(homedir(), '.cmdcode', 'secrets.enc')
const CMD_DIR = join(homedir(), '.cmdcode')

// ═══════════════════════════════════════════════════════════
// 类型定义
// ═══════════════════════════════════════════════════════════

/** 密钥池条目（存储形式） */
export interface KeyPoolEntry {
  name: string
  model: string
  baseUrl: string
  apiKeyEncrypted: string // 加密后的 API Key
}

/** 敏感配置结构 */
export interface Secrets {
  // 用户自定义密钥（单密钥模式）
  apiKey?: string
  model?: string
  baseUrl?: string
  
  // 密钥池（多密钥模式）
  chatKeyPool?: KeyPoolEntry[]
  embeddingKeyPool?: KeyPoolEntry[]
  
  // 向量记忆系统配置
  memorySearch?: {
    provider: string
    model: string
    baseUrl: string
  }
  
  // QQ Bot
  qqBotApiKey?: string
  qqBotApiSecret?: string
  
  // 用户登录
  userToken?: string
  userInfo?: { username: string; workspaceDir: string; quota?: number }
  
  // 其他
  [key: string]: any
}

export interface KeyStore { apiKey: string; baseUrl: string }

// ═══════════════════════════════════════════════════════════
// 主密钥管理
// ═══════════════════════════════════════════════════════════

/** 是否使用了 fallback 主密钥（安全警告） */
let usingFallbackKey = false

/** 用户设置的主密码（作为额外熵源） */
let userPassphrase: string | null = null

/** 检查是否使用了不安全的主密钥 */
export function isUsingFallbackKey(): boolean {
  return usingFallbackKey
}

/** 设置用户主密码（增强安全性） */
export function setMasterPassphrase(passphrase: string): void {
  userPassphrase = passphrase
  // 设置后清除 fallback 警告
  usingFallbackKey = false
}

/** 获取加密密钥 - 从机器ID派生 */
function getEncryptionKey(): Buffer {
  let machineId = ''
  let entropySource = ''
  
  try {
    machineId = readFileSync('/etc/machine-id', 'utf-8').trim()
    entropySource = machineId
  } catch {
    // machine-id 不存在
    entropySource = ''
  }
  
  // 如果用户设置了主密码，使用主密码作为主要熵源
  if (userPassphrase && userPassphrase.length >= 8) {
    return createHash('sha256')
      .update(userPassphrase + '-cmdcode-secrets-v2')
      .digest()
  }
  
  // 如果 machine-id 可用，使用机器ID派生
  if (entropySource) {
    return createHash('sha256')
      .update(entropySource + '-cmdcode-secrets')
      .digest()
  }
  
  // ⚠️ 危险：使用了硬编码 fallback
  // 在容器/WSL2/云环境中，所有实例共享同一密钥
  usingFallbackKey = true
  console.error('╔════════════════════════════════════════════════════════════╗')
  console.error('║  ⚠️  安全警告：无法获取机器唯一标识                          ║')
  console.error('║  当前环境可能为容器/WSL2/精简Linux，加密安全性降低          ║')
  console.error('║  建议运行以下命令设置主密码：                               ║')
  console.error('║    /masterkey <你的密码>                                    ║')
  console.error('╚════════════════════════════════════════════════════════════╝')
  
  // 仍使用固定字符串，但标记为不安全
  return createHash('sha256')
    .update('cmdcode-v05-unsafe-fallback-key-do-not-use-in-production')
    .digest()
}

/** 加密数据 */
export function encrypt(data: any): string {
  const key = getEncryptionKey()
  const iv = randomBytes(16)
  const cipher = createCipheriv('aes-256-cbc', key, iv)
  const json = JSON.stringify(data)
  const encrypted = Buffer.concat([cipher.update(json, 'utf8'), cipher.final()])
  return iv.toString('hex') + ':' + encrypted.toString('hex')
}

/** 解密数据 */
export function decrypt<T = any>(encryptedText: string): T {
  const key = getEncryptionKey()
  const [ivHex, dataHex] = encryptedText.split(':')
  if (!ivHex || !dataHex) throw new Error('Invalid format')
  const iv = Buffer.from(ivHex, 'hex')
  const data = Buffer.from(dataHex, 'hex')
  const decipher = createDecipheriv('aes-256-cbc', key, iv)
  const json = decipher.update(data, undefined, 'utf8') + decipher.final('utf8')
  return JSON.parse(json) as T
}

// ═══════════════════════════════════════════════════════════
// 字段级加密（用于密钥池）
// ═══════════════════════════════════════════════════════════

/** 加密单个字段（复用 encrypt，结果形如 iv:data） */
export function encryptField(plaintext: string): string {
  return encrypt(plaintext)
}

/** 解密单个字段 */
export function decryptField(encrypted: string): string {
  return decrypt<string>(encrypted)
}

// ═══════════════════════════════════════════════════════════
// 配置文件管理
// ═══════════════════════════════════════════════════════════

function ensureDir(): void {
  if (!existsSync(CMD_DIR)) mkdirSync(CMD_DIR, { recursive: true })
}

function setPermission(filePath: string): void {
  try { chmodSync(filePath, 0o600) } catch { /* ignore */ }
}

/** 加载所有敏感配置 */
export function loadSecrets(): Secrets {
  if (!existsSync(SECRETS_FILE)) return {}
  try {
    return decrypt<Secrets>(readFileSync(SECRETS_FILE, 'utf-8'))
  } catch {
    return {}
  }
}

/** 保存所有敏感配置 */
export function saveSecrets(secrets: Secrets): void {
  ensureDir()
  writeFileSync(SECRETS_FILE, encrypt(secrets), 'utf-8')
  setPermission(SECRETS_FILE)
}

/** 更新部分敏感配置 */
export function updateSecrets(partial: Partial<Secrets>): void {
  const current = loadSecrets()
  saveSecrets({ ...current, ...partial })
}

/** 清除所有敏感配置 */
export function clearSecrets(): void {
  if (existsSync(SECRETS_FILE)) {
    try { unlinkSync(SECRETS_FILE) } catch { /* ignore */ }
  }
}

export function hasSecrets(): boolean {
  return existsSync(SECRETS_FILE)
}

export function maskSecret(value?: string): string {
  if (!value) return '(未配置)'
  return '✓ 已配置'
}

// ═══════════════════════════════════════════════════════════
// 聊天密钥池管理
// ═══════════════════════════════════════════════════════════

/** 耗尽标记（基于 name，不受索引变动影响） */
const exhaustedChatKeyNames = new Set<string>()
let migrationWarned = false  // P3 #35: 密钥体系迁移提示（只显示一次）
const exhaustedEmbeddingKeyNames = new Set<string>()

/** 并发锁（保护密钥池操作） - 单线程环境下基本安全，但为未来多线程预留 */
let keyPoolOperationInProgress = false
const pendingKeyPoolOperations: (() => void)[] = []

/** 执行带锁的密钥池操作 */
async function withKeyPoolLock<T>(fn: () => T): Promise<T> {
  if (keyPoolOperationInProgress) {
    return new Promise((resolve, reject) => {
      pendingKeyPoolOperations.push(() => {
        try {
          resolve(fn())
        } catch (e) {
          reject(e)
        }
      })
    })
  }
  
  keyPoolOperationInProgress = true
  try {
    return fn()
  } finally {
    keyPoolOperationInProgress = false
    // 执行等待中的操作
    const next = pendingKeyPoolOperations.shift()
    if (next) {
      setTimeout(next, 0) // 异步执行，避免递归
    }
  }
}

/** 加载聊天密钥池 */
export function loadChatKeyPool(): KeyPoolEntry[] {
  const s = loadSecrets()
  return s.chatKeyPool || []
}

/** 保存聊天密钥池 */
export function saveChatKeyPool(pool: KeyPoolEntry[]): void {
  updateSecrets({ chatKeyPool: pool })
}

/** 添加聊天密钥 */
export function addChatKey(name: string, model: string, baseUrl: string, apiKey: string): void {
  const pool = loadChatKeyPool()
  if (pool.some(e => e.name === name)) {
    throw new Error(`Key "${name}" already exists`)
  }
  pool.push({
    name,
    model,
    baseUrl,
    apiKeyEncrypted: encryptField(apiKey),
  })
  saveChatKeyPool(pool)
  // 重置耗尽状态，确保新 Key 可用
  resetChatKeyPool()
}

/** 删除聊天密钥 */
export function removeChatKey(name: string): boolean {
  const pool = loadChatKeyPool()
  const idx = pool.findIndex(e => e.name === name)
  if (idx === -1) return false
  pool.splice(idx, 1)
  saveChatKeyPool(pool)
  resetChatKeyPool()
  return true
}

/** 重置聊天密钥池耗尽状态 */
export function resetChatKeyPool(): void {
  exhaustedChatKeyNames.clear()
}

/** 标记聊天密钥为耗尽 */
export function markChatKeyExhausted(name: string): void {
  exhaustedChatKeyNames.add(name)
}

/** 获取聊天密钥池状态 */
export function getChatKeyPoolStatus(): { total: number; exhausted: number; remaining: number } {
  const pool = loadChatKeyPool()
  const total = pool.length
  const exhausted = pool.filter(e => exhaustedChatKeyNames.has(e.name)).length
  return { total, exhausted, remaining: total - exhausted }
}

// ═══════════════════════════════════════════════════════════
// Embedding 密钥池管理
// ═══════════════════════════════════════════════════════════

export function loadEmbeddingKeyPool(): KeyPoolEntry[] {
  const s = loadSecrets()
  return s.embeddingKeyPool || []
}

export function saveEmbeddingKeyPool(pool: KeyPoolEntry[]): void {
  updateSecrets({ embeddingKeyPool: pool })
}

export function addEmbeddingKey(name: string, model: string, baseUrl: string, apiKey: string): void {
  const pool = loadEmbeddingKeyPool()
  if (pool.some(e => e.name === name)) {
    throw new Error(`Key "${name}" already exists`)
  }
  pool.push({
    name,
    model,
    baseUrl,
    apiKeyEncrypted: encryptField(apiKey),
  })
  saveEmbeddingKeyPool(pool)
  resetEmbeddingKeyPool()
}

export function removeEmbeddingKey(name: string): boolean {
  const pool = loadEmbeddingKeyPool()
  const idx = pool.findIndex(e => e.name === name)
  if (idx === -1) return false
  pool.splice(idx, 1)
  saveEmbeddingKeyPool(pool)
  resetEmbeddingKeyPool()
  return true
}

export function resetEmbeddingKeyPool(): void {
  exhaustedEmbeddingKeyNames.clear()
}

export function markEmbeddingKeyExhausted(name: string): void {
  exhaustedEmbeddingKeyNames.add(name)
}

export function getEmbeddingKeyPoolStatus(): { total: number; exhausted: number; remaining: number } {
  const pool = loadEmbeddingKeyPool()
  const total = pool.length
  const exhausted = pool.filter(e => exhaustedEmbeddingKeyNames.has(e.name)).length
  return { total, exhausted, remaining: total - exhausted }
}

// ═══════════════════════════════════════════════════════════
// 密钥获取（解密后返回明文，用完立即清理）
// ═══════════════════════════════════════════════════════════

/** 内部：解密密钥池条目 */
function decryptKeyPoolEntry(entry: KeyPoolEntry): { name: string; model: string; apiKey: string; baseUrl: string } | null {
  try {
    const apiKey = decryptField(entry.apiKeyEncrypted)
    return { name: entry.name, model: entry.model, apiKey, baseUrl: entry.baseUrl }
  } catch (e: any) {
    // 解密失败时记录警告（不暴露敏感信息）
    console.warn(`⚠️ 密钥 [${entry.name}] 解密失败，可能已损坏或主密钥不匹配`)
    console.warn(`   错误: ${e.message?.slice(0, 50) || 'unknown'}`)
    console.warn(`   建议: 使用 /keypool remove ${entry.name} 删除后重新添加`)
    return null
  }
}

/** 获取聊天 API Key - P3 #35: 新旧密钥体系并存提示 */
export function getChatApiKey(): { name: string; model: string; apiKey: string; baseUrl: string } | null {
  // 1. 用户自定义密钥优先（单密钥模式）
  const s = loadSecrets()
  if (s.apiKey) {
    // P3 #35: 如果同时有密钥池，提示迁移
    if (s.chatKeyPool && s.chatKeyPool.length > 0 && !migrationWarned) {
      migrationWarned = true
      console.log('  💡 提示：当前使用单密钥模式。/keypool 可添加更多密钥实现轮换')
    }
    return {
      name: 'user-custom',
      model: s.model || 'MiniMax-M2.7',
      apiKey: s.apiKey,
      baseUrl: s.baseUrl || 'https://api.minimaxi.com/v1'
    }
  }
  
  // 2. 密钥池（多密钥模式）
  const pool = loadChatKeyPool()
  for (const entry of pool) {
    if (!exhaustedChatKeyNames.has(entry.name)) {
      const decrypted = decryptKeyPoolEntry(entry)
      if (decrypted) {
        return decrypted
      }
    }
  }
  
  return null
}

/** 切换聊天密钥（429 时调用） */
export function rotateChatApiKey(): { name: string; model: string; apiKey: string; baseUrl: string } | null {
  const current = getChatApiKey()
  if (!current) return null
  
  // 标记当前为耗尽
  markChatKeyExhausted(current.name)
  console.log(`  🔄 密钥 [${current.name}] 已标记为耗尽`)
  
  // 返回下一个可用密钥
  return getChatApiKey()
}

/** 获取 Embedding API Key */
export function getEmbeddingApiKey(): { name: string; apiKey: string } | null {
  const pool = loadEmbeddingKeyPool()
  for (const entry of pool) {
    if (!exhaustedEmbeddingKeyNames.has(entry.name)) {
      const decrypted = decryptKeyPoolEntry(entry)
      if (decrypted) {
        return { name: decrypted.name, apiKey: decrypted.apiKey }
      }
    }
  }
  return null
}

/** 切换 Embedding 密钥 */
export function rotateEmbeddingApiKey(): { name: string; apiKey: string } | null {
  const current = getEmbeddingApiKey()
  if (!current) return null
  
  markEmbeddingKeyExhausted(current.name)
  return getEmbeddingApiKey()
}

// ═══════════════════════════════════════════════════════════
// 应用配置管理（非密钥）
// ═══════════════════════════════════════════════════════════

export interface AppSettings {
  permissions?: { allow?: string[]; defaultMode?: string }
  modelType?: string
  model?: string
  language?: string
  effortLevel?: string
  skipDangerousModePermissionPrompt?: boolean
  pluginWorkerForce?: string
  systemPrompt?: string  // 固定提示词，加在用户输入前
  [key: string]: any
}

export function saveAppConfig(config: AppSettings): void {
  const s = loadSecrets()
  saveSecrets({ ...s, ...config })
}

export function loadAppConfig(): AppSettings | null {
  const s = loadSecrets()
  const result: AppSettings = {}
  if (s.permissions) result.permissions = s.permissions
  if (s.modelType) result.modelType = s.modelType
  if (s.model) result.model = s.model
  if (s.language) result.language = s.language
  if (s.effortLevel) result.effortLevel = s.effortLevel
  if (s.skipDangerousModePermissionPrompt) result.skipDangerousModePermissionPrompt = s.skipDangerousModePermissionPrompt
  if (s.pluginWorkerForce) result.pluginWorkerForce = s.pluginWorkerForce
  if (s.systemPrompt) result.systemPrompt = s.systemPrompt
  return Object.keys(result).length > 0 ? result : null
}

// ═══════════════════════════════════════════════════════════
// 用户缓存管理
// ═══════════════════════════════════════════════════════════

export function saveUserCache(token: string, userInfo: { username: string; workspaceDir: string; quota?: number }): void {
  updateSecrets({ userToken: token, userInfo })
}

export function loadUserCache(): { token: string; username: string; workspaceDir: string; quota?: number } | null {
  const s = loadSecrets()
  if (!s.userToken || !s.userInfo) return null
  return { token: s.userToken, ...s.userInfo }
}

export function clearUserCache(): void {
  const s = loadSecrets()
  delete s.userToken
  delete s.userInfo
  saveSecrets(s)
}

// ═══════════════════════════════════════════════════════════
// 向量记忆配置
// ═══════════════════════════════════════════════════════════

export const DEFAULT_MEMORY_SEARCH = {
  provider: 'openai',
  model: 'doubao-embedding-vision',
  baseUrl: 'https://ark.cn-beijing.volces.com/api/coding/v3',
}

export function saveMemorySearchConfig(config: { baseUrl?: string; model?: string }): void {
  const s = loadSecrets()
  s.memorySearch = {
    provider: 'openai',
    model: config.model || DEFAULT_MEMORY_SEARCH.model,
    baseUrl: config.baseUrl || DEFAULT_MEMORY_SEARCH.baseUrl,
  }
  saveSecrets(s)
}

export function loadMemorySearchConfig(): { provider: string; model: string; baseUrl: string } {
  const s = loadSecrets()
  if (s.memorySearch) {
    return s.memorySearch
  }
  return DEFAULT_MEMORY_SEARCH
}

export function hasMemorySearchConfig(): boolean {
  const pool = loadEmbeddingKeyPool()
  return pool.length > 0
}

// ═══════════════════════════════════════════════════════════
// 兼容旧 API
// ═══════════════════════════════════════════════════════════

/** @deprecated 使用 getChatApiKey */
export const getCurrentMinimaxKey = getChatApiKey

/** @deprecated 使用 rotateChatApiKey */
export const rotateMinimaxKey = rotateChatApiKey

/** @deprecated 使用 getChatKeyPoolStatus */
export const getMinimaxKeyPoolStatus = getChatKeyPoolStatus

/** @deprecated 使用 resetChatKeyPool */
export const resetMinimaxKeyPool = resetChatKeyPool

// ═══════════════════════════════════════════════════════════
// 定时重置（每日凌晨重置耗尽状态）
// ═══════════════════════════════════════════════════════════

let resetTimer: ReturnType<typeof setInterval> | null = null

/** 启动每日自动重置 */
export function startDailyKeyPoolReset(): void {
  if (resetTimer) return
  
  // 计算到下一个凌晨的时间
  const now = new Date()
  const tomorrow = new Date(now)
  tomorrow.setDate(tomorrow.getDate() + 1)
  tomorrow.setHours(0, 0, 0, 0)
  const msUntilMidnight = tomorrow.getTime() - now.getTime()
  
  // 先设置一个定时器到凌晨
  setTimeout(() => {
    resetAllKeyPools()
    // 然后每24小时重置一次
    resetTimer = setInterval(resetAllKeyPools, 24 * 60 * 60 * 1000)
  }, msUntilMidnight)
  
  console.log(`  ⏰ 密钥池将在 ${Math.round(msUntilMidnight / 60000)} 分钟后自动重置`)
}

/** 停止自动重置 */
export function stopDailyKeyPoolReset(): void {
  if (resetTimer) {
    clearInterval(resetTimer)
    resetTimer = null
  }
}

/** 重置所有密钥池 */
export function resetAllKeyPools(): void {
  resetChatKeyPool()
  resetEmbeddingKeyPool()
  console.log('  ✅ 所有密钥池状态已重置（每日自动）')
}