/**
 * Crypto - Metona 会话加密模块
 *
 * 文件格式: [8B magic "METONA1\0"][16B salt][12B IV][AES-256-GCM ciphertext]
 * 后缀: .metona
 * 安全上下文(HTTPS)下使用 AES-256-GCM，否则降级为 XOR 混淆
 */

const MAGIC = new TextEncoder().encode('METONA1\0');
const PASSPHRASE = 'metona-ollama-v2';
const PBKDF2_ITERATIONS = 100000;

const SECURE = !!(globalThis.crypto && globalThis.crypto.subtle);

/**
 * SHA-256 哈希 (降级模式用)
 */
async function sha256(data) {
    if (SECURE) {
        const buf = await crypto.subtle.digest('SHA-256', data);
        return new Uint8Array(buf);
    }
    // 纯 JS SHA-256
    return sha256js(data);
}

/**
 * 纯 JS SHA-256 实现 (兼容非安全上下文)
 */
function sha256js(message) {
    const K = new Uint32Array([
        0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
        0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
        0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
        0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
        0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
        0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
        0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
        0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
    ]);

    const bytes = message instanceof Uint8Array ? message : new Uint8Array(message);
    const bitLen = bytes.length * 8;

    // 预处理: padding
    const paddedLen = Math.ceil((bytes.length + 9) / 64) * 64;
    const padded = new Uint8Array(paddedLen);
    padded.set(bytes);
    padded[bytes.length] = 0x80;
    const view = new DataView(padded.buffer);
    view.setUint32(paddedLen - 4, bitLen, false);

    let h0 = 0x6a09e667, h1 = 0xbb67ae85, h2 = 0x3c6ef372, h3 = 0xa54ff53a;
    let h4 = 0x510e527f, h5 = 0x9b05688c, h6 = 0x1f83d9ab, h7 = 0x5be0cd19;

    const w = new Uint32Array(64);

    for (let offset = 0; offset < paddedLen; offset += 64) {
        for (let i = 0; i < 16; i++) {
            w[i] = view.getUint32(offset + i * 4, false);
        }
        for (let i = 16; i < 64; i++) {
            const s0 = (w[i - 15] >>> 7 | w[i - 15] << 25) ^ (w[i - 15] >>> 18 | w[i - 15] << 14) ^ (w[i - 15] >>> 3);
            const s1 = (w[i - 2] >>> 17 | w[i - 2] << 15) ^ (w[i - 2] >>> 19 | w[i - 2] << 13) ^ (w[i - 2] >>> 10);
            w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0;
        }

        let a = h0, b = h1, c = h2, d = h3, e = h4, f = h5, g = h6, h = h7;

        for (let i = 0; i < 64; i++) {
            const S1 = (e >>> 6 | e << 26) ^ (e >>> 11 | e << 21) ^ (e >>> 25 | e << 7);
            const ch = (e & f) ^ (~e & g);
            const temp1 = (h + S1 + ch + K[i] + w[i]) >>> 0;
            const S0 = (a >>> 2 | a << 30) ^ (a >>> 13 | a << 19) ^ (a >>> 22 | a << 10);
            const maj = (a & b) ^ (a & c) ^ (b & c);
            const temp2 = (S0 + maj) >>> 0;

            h = g; g = f; f = e;
            e = (d + temp1) >>> 0;
            d = c; c = b; b = a;
            a = (temp1 + temp2) >>> 0;
        }

        h0 = (h0 + a) >>> 0; h1 = (h1 + b) >>> 0; h2 = (h2 + c) >>> 0; h3 = (h3 + d) >>> 0;
        h4 = (h4 + e) >>> 0; h5 = (h5 + f) >>> 0; h6 = (h6 + g) >>> 0; h7 = (h7 + h) >>> 0;
    }

    const result = new Uint8Array(32);
    const rv = new DataView(result.buffer);
    rv.setUint32(0, h0, false); rv.setUint32(4, h1, false);
    rv.setUint32(8, h2, false); rv.setUint32(12, h3, false);
    rv.setUint32(16, h4, false); rv.setUint32(20, h5, false);
    rv.setUint32(24, h6, false); rv.setUint32(28, h7, false);
    return result;
}

/**
 * 从 passhprase + salt 派生密钥 (PBKDF2 或降级多次哈希)
 */
async function deriveKeyBytes(salt) {
    const passBytes = new TextEncoder().encode(PASSPHRASE);
    const input = new Uint8Array(passBytes.length + salt.length);
    input.set(passBytes);
    input.set(salt, passBytes.length);

    if (SECURE) {
        const keyMaterial = await crypto.subtle.importKey('raw', passBytes, 'PBKDF2', false, ['deriveKey']);
        const key = await crypto.subtle.deriveKey(
            { name: 'PBKDF2', salt, iterations: PBKDF2_ITERATIONS, hash: 'SHA-256' },
            keyMaterial,
            { name: 'AES-GCM', length: 256 },
            true,
            ['encrypt', 'decrypt']
        );
        const raw = await crypto.subtle.exportKey('raw', key);
        return new Uint8Array(raw);
    }

    // 降级: 多次哈希模拟密钥派生
    let key = input;
    for (let i = 0; i < 10000; i++) {
        key = await sha256(key);
    }
    return key;
}

/**
 * XOR 加密/解密 (降级模式)
 */
function xorBytes(data, keyBytes) {
    const out = new Uint8Array(data.length);
    for (let i = 0; i < data.length; i++) {
        out[i] = data[i] ^ keyBytes[i % keyBytes.length];
    }
    return out;
}

/**
 * 加密 JSON 数据 → .metona 二进制格式
 */
export async function encryptData(data) {
    const json = new TextEncoder().encode(JSON.stringify(data));
    const salt = crypto.getRandomValues(new Uint8Array(16));
    const iv = crypto.getRandomValues(new Uint8Array(12));
    const keyBytes = await deriveKeyBytes(salt);

    let payload;
    if (SECURE) {
        const key = await crypto.subtle.importKey('raw', keyBytes, 'AES-GCM', false, ['encrypt']);
        const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, json);
        payload = new Uint8Array(ciphertext);
    } else {
        // 降级: XOR 混淆，前 4 字节存原始长度
        const lenBytes = new Uint32Array([json.length]);
        const withLen = new Uint8Array(4 + json.length);
        withLen.set(new Uint8Array(lenBytes.buffer));
        withLen.set(json, 4);
        payload = xorBytes(withLen, keyBytes);
    }

    // 标记加密模式: SECURE=0x01, FALLBACK=0x00
    const flag = new Uint8Array([SECURE ? 1 : 0]);

    return new Blob([MAGIC, salt, iv, flag, payload]);
}

/**
 * 解密 .metona 文件 → JSON 对象
 */
export async function decryptData(buffer) {
    const data = new Uint8Array(buffer);

    // 校验 magic
    for (let i = 0; i < 8; i++) {
        if (data[i] !== MAGIC[i]) throw new Error('不是有效的 .metona 文件');
    }

    const salt = data.slice(8, 24);
    const iv = data.slice(24, 36);
    const mode = data[36];
    const payload = data.slice(37);
    const keyBytes = await deriveKeyBytes(salt);

    let jsonBytes;
    if (mode === 1) {
        // AES-GCM
        const key = await crypto.subtle.importKey('raw', keyBytes, 'AES-GCM', false, ['decrypt']);
        const decrypted = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, payload);
        jsonBytes = new Uint8Array(decrypted);
    } else {
        // XOR 降级
        const withLen = xorBytes(payload, keyBytes);
        const len = new DataView(withLen.buffer).getUint32(0, true);
        jsonBytes = withLen.slice(4, 4 + len);
    }

    return JSON.parse(new TextDecoder().decode(jsonBytes));
}

/**
 * 检查文件是否为 .metona 格式
 */
export function isMetonaFile(file) {
    return file.name.endsWith('.metona');
}