package encipher

import (
	"bytes"
	"crypto/aes"
	"crypto/cipher"
	"encoding/base64"
	"encoding/json"
	"strings"
	"time"

	"git.apinb.com/bsm-sdk/engine/env"
	"git.apinb.com/bsm-sdk/engine/exception"
	"git.apinb.com/bsm-sdk/engine/types"
	"git.apinb.com/bsm-sdk/engine/vars"
)

var (
	certBytes    *types.CertFileBytes = nil
	JwtSecret    []byte
	JwtSecretLen int
)

func New() {
	JwtSecret = []byte(env.MeshEnv.JwtSecretKey)
	JwtSecretLen = len(env.MeshEnv.JwtSecretKey)
}

func GenerateTokenAes(id uint, identity, client, role string, owner any, extend map[string]string) (string, error) {
	if (JwtSecretLen == 16 || JwtSecretLen == 24 || JwtSecretLen == 32) == false {
		return "", exception.ErrAuthSecret
	}
	expireTime := time.Now().Add(vars.JwtExpireDay)
	claims := types.JwtClaims{
		ID:        id,
		Identity:  identity,
		Client:    client,
		Extend:    extend,
		Owner:     owner,
		Role:      role,
		ExpiresAt: expireTime.Unix(),
	}

	byte, err := json.Marshal(claims)
	if err != nil {
		return "", exception.ErrJsonEncode
	}

	token, err := AesEncryptCBC(byte)
	if err != nil {
		return "", err
	}
	return token, nil
}

func AesEncryptCBC(plan []byte) (string, error) {

	// 分组秘钥
	// NewCipher该函数限制了输入k的长度必须为16, 24或者32
	block, err := aes.NewCipher(JwtSecret)
	if err != nil {
		return "", exception.ErrAuthSecret
	}
	// 获取秘钥块的长度
	blockSize := block.BlockSize()
	// 补全码
	plan = PKCS7Padding(plan, blockSize)
	// 加密模式
	blockMode := cipher.NewCBCEncrypter(block, JwtSecret[:blockSize])
	// 创建数组
	cryted := make([]byte, len(plan))
	// 加密
	blockMode.CryptBlocks(cryted, plan)
	return base64.StdEncoding.EncodeToString(cryted), nil
}

func AesDecryptCBC(cryted string) (b []byte, err error) {
	if (JwtSecretLen == 16 || JwtSecretLen == 24 || JwtSecretLen == 32) == false {
		return nil, exception.ErrAuthSecret
	}
	// 转成字节数组
	crytedByte, err := base64.StdEncoding.DecodeString(cryted)
	if err != nil {
		return nil, exception.ErrBase64Decode
	}
	// 分组秘钥
	block, err := aes.NewCipher(JwtSecret)
	if err != nil {
		return nil, exception.ErrAuthSecret
	}
	// 获取秘钥块的长度
	blockSize := block.BlockSize()
	// 加密模式
	blockMode := cipher.NewCBCDecrypter(block, JwtSecret[:blockSize])
	// 创建数组
	orig := make([]byte, len(crytedByte))
	// 解密
	blockMode.CryptBlocks(orig, crytedByte)
	// 去补全码
	orig = PKCS7UnPadding(orig, blockSize)
	if orig == nil {
		return nil, exception.ErrAuthParseFail
	}
	return orig, nil
}

func PKCS7Padding(ciphertext []byte, blocksize int) []byte {
	padding := blocksize - len(ciphertext)%blocksize
	padtext := bytes.Repeat([]byte{byte(padding)}, padding)
	return append(ciphertext, padtext...)
}

// 去码
// bug:runtime error: slice bounds out of range [:-22]
func PKCS7UnPadding(origData []byte, blocksize int) []byte {
	if blocksize <= 0 {
		return nil
	}
	if origData == nil || len(origData) == 0 {
		return nil
	}
	if len(origData)%blocksize != 0 {
		return nil
	}

	length := len(origData)
	unpadding := int(origData[length-1])

	if length-unpadding <= 0 {
		return nil
	}
	return origData[:(length - unpadding)]
}

func ParseTokenAes(token string) (*types.JwtClaims, error) {
	token = strings.TrimSpace(token)
	data, err := AesDecryptCBC(token)
	if err != nil {
		return nil, err
	}

	var ac *types.JwtClaims
	err = json.Unmarshal(data, &ac)
	if err != nil {
		return nil, exception.ErrAuthParseFail
	}

	expireTime := time.Now().Unix()
	if expireTime > ac.ExpiresAt {
		return nil, exception.ErrAuthExpire
	}

	return ac, nil
}