package certificate

import (
	"bytes"
	"context"
	"crypto/sha256"
	"crypto/x509"
	"encoding/hex"
	"encoding/json"
	"encoding/pem"
	"errors"
	"fmt"
	"io"
	"os"
	"path/filepath"
	"sort"
	"strings"
)

type historyEntry struct {
	saved    SavedResource
	resource Resource
}

var errHistoryOtherType = errors.New("归档属于其他证书类型")

// openHistoryRoot 拒绝符号链接目录，并将所有后续读取限制在已打开的存储根内。
func openHistoryRoot(path string) (*os.Root, error) {
	if strings.TrimSpace(path) == "" {
		return nil, errors.New("证书存储根目录不能为空")
	}
	absolute, err := filepath.Abs(path)
	if err != nil {
		return nil, err
	}
	for current := absolute; ; current = filepath.Dir(current) {
		info, err := os.Lstat(current)
		if err != nil {
			return nil, err
		}
		if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
			return nil, errors.New("证书存储路径必须为真实目录")
		}
		if filepath.Dir(current) == current {
			break
		}
	}
	return os.OpenRoot(absolute)
}

func openHistoryDirectory(root *os.Root, relative string) (*os.Root, error) {
	if !filepath.IsLocal(relative) {
		return nil, errors.New("证书历史路径超出存储目录")
	}
	current := ""
	for _, part := range strings.Split(filepath.Clean(relative), string(filepath.Separator)) {
		current = filepath.Join(current, part)
		info, err := root.Lstat(current)
		if err != nil {
			return nil, err
		}
		if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
			return nil, errors.New("证书历史目录不允许符号链接")
		}
	}
	return root.OpenRoot(relative)
}

func readHistoryFile(root *os.Root, name string) ([]byte, error) {
	info, err := root.Lstat(name)
	if err != nil {
		return nil, err
	}
	const maximumFileSize = 4 << 20
	if !info.Mode().IsRegular() || info.Size() > maximumFileSize {
		return nil, errors.New("证书历史文件必须为大小受限的普通文件")
	}
	file, err := root.Open(name)
	if err != nil {
		return nil, err
	}
	defer file.Close()
	data, err := io.ReadAll(io.LimitReader(file, maximumFileSize+1))
	if err != nil {
		return nil, err
	}
	if len(data) > maximumFileSize {
		return nil, errors.New("证书历史文件超过大小限制")
	}
	return data, nil
}

func readHistoryEntry(root *os.Root, relative, domain, certificateType string) (historyEntry, error) {
	directory, err := openHistoryDirectory(root, relative)
	if err != nil {
		return historyEntry{}, err
	}
	defer directory.Close()
	metadata, err := readHistoryFile(directory, "metadata.json")
	if err != nil {
		return historyEntry{}, err
	}
	var saved SavedResource
	if err := json.Unmarshal(metadata, &saved); err != nil {
		return historyEntry{}, fmt.Errorf("解析历史证书元数据失败：%w", err)
	}
	if saved.CertificateType != certificateType {
		return historyEntry{}, errHistoryOtherType
	}
	if directoryName(saved.Domain) != directoryName(domain) {
		return historyEntry{}, errors.New("历史证书归属域名不匹配")
	}
	if saved.Version != "" {
		if err := validateCertificateVersion(saved.Version); err != nil {
			return historyEntry{}, err
		}
	}
	certificateData, err := readHistoryFile(directory, "cert.pem")
	if err != nil {
		return historyEntry{}, err
	}
	chain, err := readHistoryFile(directory, "fullchain.pem")
	if err != nil {
		return historyEntry{}, err
	}
	key, err := readHistoryFile(directory, "key.pem")
	if err != nil {
		return historyEntry{}, err
	}
	names := saved.SANs
	if len(names) == 0 {
		names = []string{domain}
	}
	chainLeafData, issuerData, err := splitCertificateChain(chain)
	if err != nil {
		return historyEntry{}, err
	}
	resource, err := ValidateResource(Resource{Domains: names, Certificate: certificateData, IssuerCertificate: issuerData, PrivateKey: key})
	if err != nil {
		return historyEntry{}, err
	}
	leaf, err := parseLeafCertificate(certificateData)
	if err != nil {
		return historyEntry{}, err
	}
	chainLeaf, err := parseLeafCertificate(chainLeafData)
	if err != nil || !bytes.Equal(leaf.Raw, chainLeaf.Raw) {
		return historyEntry{}, errors.New("历史证书与完整链的叶子证书不一致")
	}
	for _, name := range append(append([]string(nil), resource.Domains...), domain) {
		probe := strings.Replace(name, "*.", "scert-wildcard-probe.", 1)
		if err := leaf.VerifyHostname(probe); err != nil {
			return historyEntry{}, fmt.Errorf("历史证书不覆盖域名 %s：%w", name, err)
		}
	}
	remaining := chain
	chainLength := 0
	for len(bytes.TrimSpace(remaining)) > 0 {
		block, rest := pem.Decode(remaining)
		if block == nil || block.Type != "CERTIFICATE" {
			return historyEntry{}, errors.New("历史证书完整链格式无效")
		}
		if _, err := x509.ParseCertificate(block.Bytes); err != nil {
			return historyEntry{}, fmt.Errorf("解析历史证书链失败：%w", err)
		}
		chainLength++
		remaining = rest
	}
	// 元数据中的路径、指纹、有效期均不可信，必须从实际文件重新生成。
	saved.Domain = domain
	saved.SANs = append([]string(nil), resource.Domains...)
	saved.NotBefore, saved.NotAfter = leaf.NotBefore, leaf.NotAfter
	saved.SerialNumber = leaf.SerialNumber.Text(16)
	saved.FingerprintSHA256 = fmt.Sprintf("%X", sha256.Sum256(leaf.Raw))
	saved.ChainLength = chainLength
	saved.CertificateIdentifier = ""
	if certificateType == "san" {
		saved.CertificateIdentifier = sanCertificateIdentifier(resource.Domains)
	}
	saved.Directory = filepath.Join(root.Name(), relative)
	saved.CertificatePath = filepath.Join(saved.Directory, "cert.pem")
	saved.FullChainPath = filepath.Join(saved.Directory, "fullchain.pem")
	saved.PrivateKeyPath = filepath.Join(saved.Directory, "key.pem")
	saved.BackupDirectory = ""
	saved.Current = false
	identity := fmt.Sprintf("%s\n%s\n%s\n%s\n%x", directoryName(domain), certificateType, saved.Version, strings.Join(resource.Domains, ","), sha256.Sum256(chain))
	saved.HistoryID = fmt.Sprintf("history-%x", sha256.Sum256([]byte(identity)))
	return historyEntry{saved: saved, resource: resource}, nil
}

func splitCertificateChain(data []byte) ([]byte, []byte, error) {
	block, rest := pem.Decode(data)
	if block == nil || block.Type != "CERTIFICATE" {
		return nil, nil, errors.New("历史证书完整链缺少叶子证书")
	}
	if _, err := x509.ParseCertificate(block.Bytes); err != nil {
		return nil, nil, fmt.Errorf("解析历史证书叶子失败：%w", err)
	}
	issuer := append([]byte(nil), rest...)
	if len(bytes.TrimSpace(issuer)) == 0 {
		issuer = nil
	}
	return pem.EncodeToMemory(block), issuer, nil
}

func (s FileStore) historyEntries(ctx context.Context, domain, certificateType string) ([]historyEntry, error) {
	if err := ctx.Err(); err != nil {
		return nil, err
	}
	current, err := s.CurrentDirectory(domain, certificateType)
	if err != nil {
		return nil, err
	}
	domain = strings.ToLower(strings.TrimSpace(domain))
	certificateType = strings.ToLower(strings.TrimSpace(certificateType))
	entries := make([]historyEntry, 0)
	seen := make(map[string]bool)
	appendEntry := func(entry historyEntry) {
		if !seen[entry.saved.HistoryID] {
			seen[entry.saved.HistoryID] = true
			entries = append(entries, entry)
		}
	}
	root, err := openHistoryRoot(s.Root)
	if err != nil && !errors.Is(err, os.ErrNotExist) {
		return nil, err
	}
	if err == nil {
		defer root.Close()
		absolute, err := filepath.Abs(current)
		if err != nil {
			return nil, err
		}
		relative, err := filepath.Rel(root.Name(), absolute)
		if err != nil {
			return nil, err
		}
		entry, err := readHistoryEntry(root, relative, domain, certificateType)
		if err == nil {
			entry.saved.Current = true
			appendEntry(entry)
		} else if !errors.Is(err, os.ErrNotExist) {
			return nil, fmt.Errorf("读取当前证书版本失败：%w", err)
		}
	}
	if strings.TrimSpace(s.BackupRoot) == "" {
		return entries, nil
	}
	backups, err := openHistoryRoot(s.BackupRoot)
	if errors.Is(err, os.ErrNotExist) {
		return entries, nil
	}
	if err != nil {
		return nil, err
	}
	defer backups.Close()
	directory, err := openHistoryDirectory(backups, directoryName(domain))
	if errors.Is(err, os.ErrNotExist) {
		return entries, nil
	}
	if err != nil {
		return nil, err
	}
	defer directory.Close()
	file, err := directory.Open(".")
	if err != nil {
		return nil, err
	}
	children, err := file.ReadDir(-1)
	_ = file.Close()
	if err != nil {
		return nil, err
	}
	for _, child := range children {
		if err := ctx.Err(); err != nil {
			return nil, err
		}
		if child.Type()&os.ModeSymlink != 0 {
			return nil, errors.New("历史证书归档不允许符号链接")
		}
		if !child.IsDir() {
			continue
		}
		entry, err := readHistoryEntry(directory, child.Name(), domain, certificateType)
		if errors.Is(err, errHistoryOtherType) {
			continue
		}
		if err != nil {
			return nil, fmt.Errorf("读取历史证书归档失败：%w", err)
		}
		appendEntry(entry)
	}
	sort.SliceStable(entries, func(i, j int) bool {
		if entries[i].saved.Current != entries[j].saved.Current {
			return entries[i].saved.Current
		}
		if !entries[i].saved.SavedAt.Equal(entries[j].saved.SavedAt) {
			return entries[i].saved.SavedAt.After(entries[j].saved.SavedAt)
		}
		return entries[i].saved.HistoryID < entries[j].saved.HistoryID
	})
	return entries, nil
}

func (s FileStore) loadHistoryVersion(ctx context.Context, domain, certificateType, version string) (SavedResource, Resource, error) {
	if strings.HasPrefix(version, "history-") {
		digest, err := hex.DecodeString(strings.TrimPrefix(version, "history-"))
		if err != nil || len(digest) != sha256.Size {
			return SavedResource{}, Resource{}, errors.New("证书历史标识无效")
		}
	} else if err := validateCertificateVersion(version); err != nil {
		return SavedResource{}, Resource{}, err
	}
	entries, err := s.historyEntries(ctx, domain, certificateType)
	if err != nil {
		return SavedResource{}, Resource{}, err
	}
	var selected *historyEntry
	for index := range entries {
		entry := &entries[index]
		if entry.saved.HistoryID != version && entry.saved.Version != version {
			continue
		}
		if selected != nil {
			return SavedResource{}, Resource{}, errors.New("证书版本号存在歧义，请使用历史标识恢复")
		}
		selected = entry
	}
	if selected == nil {
		return SavedResource{}, Resource{}, errors.New("未找到指定证书历史版本")
	}
	resource, err := ValidateResourceForDomains(selected.resource, selected.resource.Domains)
	if err != nil {
		return SavedResource{}, Resource{}, fmt.Errorf("历史证书不可恢复：%w", err)
	}
	return selected.saved, resource, nil
}