// 本机 WireGuard 隧道：密钥生成、配置渲染与提权启停。
//
// 私钥只在本机生成、只保存在本机数据目录（0600），绝不上传。
// 启停需要系统权限：Linux 走 pkexec，macOS 走 osascript 管理员授权；
// Windows 暂无受控提权通道，明确报错而不是静默失败。
use std::path::{Path, PathBuf};

use base64::Engine;
use serde::{Deserialize, Serialize};

use crate::api::DeviceConfig;

/// 生成 WireGuard 密钥对（X25519），返回 (私钥, 公钥)，均为 base64。
pub fn generate_keypair() -> Result<(String, String), String> {
    use x25519_dalek::{PublicKey, StaticSecret};
    let secret = StaticSecret::random_from_rng(rand_core::OsRng);
    let public = PublicKey::from(&secret);
    let b64 = base64::engine::general_purpose::STANDARD;
    Ok((b64.encode(secret.to_bytes()), b64.encode(public.to_bytes())))
}

/// 用设备私钥 + 服务端下发的参数渲染 wg-quick 配置文本。
pub fn render_config(private_key: &str, cfg: &DeviceConfig) -> String {
    let mut out = format!(
        "[Interface]\nPrivateKey = {private_key}\nAddress = {}\n",
        cfg.client_address
    );
    if !cfg.dns.is_empty() {
        out.push_str(&format!("DNS = {}\n", cfg.dns));
    }
    if cfg.mtu > 0 {
        out.push_str(&format!("MTU = {}\n", cfg.mtu));
    }
    out.push_str(&format!(
        "\n[Peer]\nPublicKey = {}\nPresharedKey = {}\nEndpoint = {}\nAllowedIPs = {}\nPersistentKeepalive = {}\n",
        cfg.server_public_key, cfg.preshared_key, cfg.endpoint, cfg.allowed_ips, cfg.keepalive
    ));
    out
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct TunnelRecord {
    pub private_key: String,
    pub config: DeviceConfig,
}

/// 把含私钥的隧道记录写入本机数据目录（0600）。
pub fn save_record(dir: &Path, record: &TunnelRecord) -> Result<PathBuf, String> {
    std::fs::create_dir_all(dir).map_err(|err| format!("无法创建数据目录：{err}"))?;
    #[cfg(unix)]
    {
        use std::os::unix::fs::PermissionsExt;
        std::fs::set_permissions(dir, std::fs::Permissions::from_mode(0o700))
            .map_err(|err| format!("无法限制数据目录权限：{err}"))?;
    }
    let path = record_path(dir, record.config.tunnel_id);
    let raw = serde_json::to_string_pretty(record).map_err(|err| err.to_string())?;
    write_private(&path, raw.as_bytes())?;
    Ok(path)
}

fn record_path(dir: &Path, tunnel_id: u64) -> PathBuf {
    dir.join(format!("tunnel-{tunnel_id}.json"))
}

/// 不同服务器、用户的设备密钥各自保存，切换线路不会遗失原设备登记。
pub fn device_dir(dir: &Path, base_url: &str, username: &str) -> PathBuf {
    use sha2::{Digest, Sha256};
    let digest = Sha256::digest(format!("{base_url}\0{username}").as_bytes());
    let key: String = digest.iter().map(|b| format!("{b:02x}")).collect();
    dir.join("devices").join(key)
}

pub fn load_record_for(dir: &Path, tunnel_id: u64) -> Result<TunnelRecord, String> {
    let raw = std::fs::read_to_string(record_path(dir, tunnel_id))
        .map_err(|_| "本机没有已登记的隧道记录".to_string())?;
    serde_json::from_str(&raw).map_err(|err| format!("本机隧道记录损坏：{err}"))
}

pub fn clear_record_for(dir: &Path, tunnel_id: u64) {
    let _ = std::fs::remove_file(record_path(dir, tunnel_id));
}

pub fn clear_record(dir: &Path) {
    let _ = std::fs::remove_file(dir.join("tunnel.json"));
    let _ = std::fs::remove_file(dir.join("opsx-wg.conf"));
}

#[cfg(unix)]
fn write_private(path: &Path, bytes: &[u8]) -> Result<(), String> {
    use std::os::unix::fs::OpenOptionsExt;
    let mut file = std::fs::OpenOptions::new()
        .write(true)
        .create(true)
        .truncate(true)
        .mode(0o600)
        .open(path)
        .map_err(|err| format!("无法写入 {}：{err}", path.display()))?;
    use std::os::unix::fs::PermissionsExt;
    file.set_permissions(std::fs::Permissions::from_mode(0o600))
        .map_err(|err| format!("无法限制文件权限：{err}"))?;
    use std::io::Write;
    file.write_all(bytes)
        .map_err(|err| format!("写入失败：{err}"))
}

#[cfg(not(unix))]
fn write_private(path: &Path, bytes: &[u8]) -> Result<(), String> {
    std::fs::write(path, bytes).map_err(|err| format!("无法写入 {}：{err}", path.display()))
}

fn write_conf(dir: &Path, text: &str) -> Result<PathBuf, String> {
    std::fs::create_dir_all(dir).map_err(|err| format!("无法创建数据目录：{err}"))?;
    let path = dir.join("opsx-wg.conf");
    write_private(&path, text.as_bytes())?;
    Ok(path)
}

fn valid_key(value: &str) -> bool {
    use base64::Engine;
    base64::engine::general_purpose::STANDARD
        .decode(value)
        .is_ok_and(|v| v.len() == 32)
}

fn valid_cidrs(value: &str) -> bool {
    !value.is_empty()
        && value.split(',').all(|part| {
            let Some((ip, mask)) = part.trim().split_once('/') else {
                return false;
            };
            let Ok(address) = ip.parse::<std::net::IpAddr>() else {
                return false;
            };
            let Ok(prefix) = mask.parse::<u8>() else {
                return false;
            };
            prefix <= if address.is_ipv4() { 32 } else { 128 }
        })
}

fn validate_config(private_key: &str, cfg: &DeviceConfig) -> Result<(), String> {
    if !valid_key(private_key)
        || !valid_key(&cfg.server_public_key)
        || !valid_key(&cfg.preshared_key)
    {
        return Err("WireGuard 密钥格式无效".into());
    }
    if !valid_cidrs(&cfg.client_address) || !valid_cidrs(&cfg.allowed_ips) {
        return Err("服务端下发的地址或路由无效".into());
    }
    if !cfg.dns.is_empty()
        && !cfg
            .dns
            .split(',')
            .all(|ip| ip.trim().parse::<std::net::IpAddr>().is_ok())
    {
        return Err("服务端下发的 DNS 地址无效".into());
    }
    let Some((host, port)) = cfg.endpoint.rsplit_once(':') else {
        return Err("缺少 VPN 公网端点".into());
    };
    if host.is_empty()
        || host
            .chars()
            .any(|c| !(c.is_ascii_alphanumeric() || ".-[]:".contains(c)))
        || port.parse::<u16>().unwrap_or(0) == 0
    {
        return Err("VPN 公网端点格式无效".into());
    }
    if (cfg.mtu != 0 && !(576..=9000).contains(&cfg.mtu)) || cfg.keepalive > 65535 {
        return Err("服务端下发的 MTU 或保活参数无效".into());
    }
    Ok(())
}

fn find_binary(name: &str) -> Result<String, String> {
    std::env::split_paths(&std::env::var_os("PATH").unwrap_or_default())
        .map(|dir| dir.join(name))
        .find(|p| p.is_file())
        .map(|p| p.to_string_lossy().to_string())
        .ok_or_else(|| format!("未在本机 PATH 找到 {name}，请先安装 wireguard-tools"))
}

/// 以系统授权方式执行 wg-quick up/down。
/// 命令参数全部由本机生成，不拼接任何用户输入。
fn run_wg_quick(action: &str, conf: &Path) -> Result<(), String> {
    let wg_quick = find_binary("wg-quick")?;
    let conf_str = conf.to_string_lossy().to_string();
    #[cfg(target_os = "linux")]
    {
        let pkexec = find_binary("pkexec").map_err(|_| {
            "未找到 pkexec，无法安全提权；请安装 polkit 或手动配置 sudo 权限".to_string()
        })?;
        let status = std::process::Command::new(pkexec)
            .args([&wg_quick, action, &conf_str])
            .status()
            .map_err(|err| format!("无法启动提权授权：{err}"))?;
        return if status.success() {
            Ok(())
        } else {
            Err(format!(
                "wg-quick {action} 执行失败（可能被取消授权或系统策略拒绝）"
            ))
        };
    }
    #[cfg(target_os = "macos")]
    {
        if conf_str.chars().any(char::is_control) || wg_quick.chars().any(char::is_control) {
            return Err("配置路径包含非法字符".into());
        }
        let command = format!(
            "{} {} {}",
            shell_escape(&wg_quick),
            action,
            shell_escape(&conf_str)
        );
        let literal = command.replace('\\', "\\\\").replace('"', "\\\"");
        let script = format!("do shell script \"{literal}\" with administrator privileges");
        let status = std::process::Command::new("osascript")
            .args(["-e", &script])
            .status()
            .map_err(|err| format!("无法请求管理员授权：{err}"))?;
        return if status.success() {
            Ok(())
        } else {
            Err(format!("wg-quick {action} 执行失败（可能被取消授权）"))
        };
    }
    #[cfg(target_os = "windows")]
    {
        let _ = (wg_quick, conf_str);
        Err(
            "Windows 隧道提权通道尚未实现，请使用 WireGuard 官方客户端导入配置，或等待后续版本"
                .to_string(),
        )
    }
}

#[cfg(target_os = "macos")]
fn shell_escape(s: &str) -> String {
    format!("'{}'", s.replace('\'', "'\\''"))
}

/// 建立隧道：渲染配置 → 0600 落盘 → 提权 wg-quick up。
pub fn up(dir: &Path, private_key: &str, cfg: &DeviceConfig) -> Result<PathBuf, String> {
    validate_config(private_key, cfg)?;
    let path = write_conf(dir, &render_config(private_key, cfg))?;
    // 重复连接时先尽力清理旧接口，忽略失败（接口可能本就不存在）
    let _ = run_wg_quick("down", &path);
    run_wg_quick("up", &path)?;
    Ok(path)
}

/// 拆除隧道。配置文件可能已被清理，尽力而为。
pub fn down(dir: &Path) -> Result<(), String> {
    let path = dir.join("opsx-wg.conf");
    if !path.is_file() {
        return Ok(());
    }
    run_wg_quick("down", &path)
}

#[cfg(test)]
mod tests {
    use super::*;

    fn sample_config() -> DeviceConfig {
        DeviceConfig {
            device_id: 1,
            device_name: "测试设备".to_string(),
            tunnel_id: 4,
            tunnel_name: "测试专线".to_string(),
            peer_id: "dev-1".to_string(),
            client_address: "10.8.0.7/32".to_string(),
            server_public_key: "serverpub".to_string(),
            preshared_key: "psk".to_string(),
            endpoint: "vpn.example.com:51820".to_string(),
            allowed_ips: "0.0.0.0/0, ::/0".to_string(),
            dns: "223.5.5.5".to_string(),
            mtu: 1420,
            keepalive: 25,
        }
    }

    #[test]
    fn generated_keypair_is_base64_x25519() {
        let b64 = base64::engine::general_purpose::STANDARD;
        let (private_key, public_key) = generate_keypair().unwrap();
        assert_eq!(b64.decode(&private_key).unwrap().len(), 32);
        assert_eq!(b64.decode(&public_key).unwrap().len(), 32);
        // 同一私钥每次派生相同公钥，且两把私钥的公钥不同
        let (private2, public2) = generate_keypair().unwrap();
        assert_ne!(public_key, public2);
        assert_ne!(private_key, private2);
    }

    #[test]
    fn rendered_config_contains_all_fields() {
        let conf = render_config("private-key", &sample_config());
        for needle in [
            "PrivateKey = private-key",
            "Address = 10.8.0.7/32",
            "DNS = 223.5.5.5",
            "MTU = 1420",
            "PublicKey = serverpub",
            "PresharedKey = psk",
            "Endpoint = vpn.example.com:51820",
            "AllowedIPs = 0.0.0.0/0, ::/0",
            "PersistentKeepalive = 25",
        ] {
            assert!(conf.contains(needle), "配置缺少 {needle}:\n{conf}");
        }
    }

    #[test]
    fn rejects_injected_server_config_before_root_helper() {
        let key = base64::engine::general_purpose::STANDARD.encode([7_u8; 32]);
        let mut cfg = sample_config();
        cfg.server_public_key = key.clone();
        cfg.preshared_key = key.clone();
        assert!(validate_config(&key, &cfg).is_ok());
        cfg.dns = "1.1.1.1\nPostUp = touch /tmp/unsafe".into();
        assert!(validate_config(&key, &cfg).is_err());
        cfg.dns = "1.1.1.1".into();
        cfg.allowed_ips = "0.0.0.0/0\nPostUp = touch /tmp/unsafe".into();
        assert!(validate_config(&key, &cfg).is_err());
        cfg.allowed_ips = "0.0.0.0/0".into();
        cfg.endpoint = "vpn.example.com:51820\n[Interface]".into();
        assert!(validate_config(&key, &cfg).is_err());
    }

    #[test]
    fn record_roundtrip_and_clear() {
        let dir = std::env::temp_dir().join(format!("opsx-test-{}", std::process::id()));
        let record = TunnelRecord {
            private_key: "private".to_string(),
            config: sample_config(),
        };
        save_record(&dir, &record).unwrap();
        let loaded = load_record_for(&dir, sample_config().tunnel_id).unwrap();
        assert_eq!(loaded.private_key, "private");
        assert_eq!(loaded.config.client_address, "10.8.0.7/32");
        clear_record_for(&dir, sample_config().tunnel_id);
        assert!(load_record_for(&dir, sample_config().tunnel_id).is_err());
        let _ = std::fs::remove_dir_all(&dir);
    }
}