package encrypt

import (
	"context"
	"crypto/aes"
	"crypto/cipher"
	"crypto/hmac"
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
	"encoding/hex"
	"io"
	"strings"

	"github.com/gogf/gf/v2/errors/gerror"
	"github.com/gogf/gf/v2/frame/g"
)

func fieldKey(ctx context.Context) ([]byte, error) {
	secret := strings.TrimSpace(g.Cfg().MustGet(ctx, "security.dataKey").String())
	if secret == "" {
		return nil, gerror.New("敏感字段加密密钥未配置")
	}
	sum := sha256.Sum256([]byte(secret))
	return sum[:], nil
}

// EncryptField encrypts one sensitive value with AES-256-GCM and a fresh nonce.
func EncryptField(ctx context.Context, plaintext string) (string, error) {
	if plaintext == "" {
		return "", nil
	}
	key, err := fieldKey(ctx)
	if err != nil {
		return "", err
	}
	block, err := aes.NewCipher(key)
	if err != nil {
		return "", gerror.Wrap(err, "初始化敏感字段加密失败")
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return "", gerror.Wrap(err, "初始化敏感字段加密失败")
	}
	nonce := make([]byte, gcm.NonceSize())
	if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
		return "", gerror.Wrap(err, "生成敏感字段随机数失败")
	}
	sealed := gcm.Seal(nonce, nonce, []byte(plaintext), nil)
	return base64.RawURLEncoding.EncodeToString(sealed), nil
}

func DecryptField(ctx context.Context, encoded string) (string, error) {
	if encoded == "" {
		return "", nil
	}
	raw, err := decodeFieldPayload(encoded)
	if err != nil {
		return "", err
	}
	if len(raw) < 12+16 {
		return "", gerror.New("敏感字段密文不完整")
	}
	keys := financeFieldReadKeys(ctx)
	if key, keyErr := fieldKey(ctx); keyErr == nil {
		keys = append(keys, key)
	}
	// Imported HotGo records can use an older dataKey; never use these keys for new writes.
	for _, secret := range g.Cfg().MustGet(ctx, "security.legacyDataKeys", []string{}).Strings() {
		if secret = strings.TrimSpace(secret); secret != "" {
			sum := sha256.Sum256([]byte(secret))
			keys = append(keys, sum[:])
		}
	}
	for _, key := range keys {
		block, keyErr := aes.NewCipher(key)
		if keyErr != nil {
			continue
		}
		gcm, keyErr := cipher.NewGCM(block)
		if keyErr != nil {
			continue
		}
		plain, decryptErr := gcm.Open(nil, raw[:gcm.NonceSize()], raw[gcm.NonceSize():], nil)
		if decryptErr == nil {
			return string(plain), nil
		}
	}
	return "", gerror.New("敏感字段解密失败，请核对当前及历史密钥配置")
}

// HashField creates a deterministic, non-reversible lookup key with a secret pepper.
func HashField(ctx context.Context, value string) (string, error) {
	key, err := fieldKey(ctx)
	if err != nil {
		return "", err
	}
	h := hmac.New(sha256.New, key)
	_, _ = h.Write([]byte(strings.TrimSpace(value)))
	return hex.EncodeToString(h.Sum(nil)), nil
}

func MaskMobile(value string) string {
	value = strings.TrimSpace(value)
	if len(value) < 7 {
		return "***"
	}
	return value[:3] + "****" + value[len(value)-4:]
}

func MaskName(value string) string {
	runes := []rune(strings.TrimSpace(value))
	if len(runes) == 0 {
		return ""
	}
	if len(runes) == 1 {
		return "*"
	}
	return string(runes[0]) + strings.Repeat("*", len(runes)-1)
}

func MaskAccount(value string) string {
	value = strings.TrimSpace(value)
	if len(value) <= 2 {
		return "****"
	}
	if len(value) <= 8 {
		return "****" + value[len(value)-2:]
	}
	return value[:4] + strings.Repeat("*", len(value)-8) + value[len(value)-4:]
}

func MaskAddress(value string) string {
	runes := []rune(strings.TrimSpace(value))
	if len(runes) <= 6 {
		return "******"
	}
	return string(runes[:6]) + "****"
}