// main.go
// This program implements a login flow for "Retu Studio" users.
// It starts a local HTTP server, opens a browser for authentication,
// receives an access token via callback, and verifies the token.
package main

import (
	"bytes"
	"crypto/rand"
	"encoding/hex"
	"encoding/json"
	"flag"
	"fmt"
	"io"
	"log"
	"net"
	"net/http"
	"net/url"
	"os/exec"
	"runtime"
	"time"
)

// 配置常量 / Configuration constants
const apiBaseURL = "https://appapi.rtstudio.top"
const loginBaseURL = "https://apilogin.rtstudio.top"

// 命令行参数 / Command line arguments
var (
	loginType string // loginkey, token 或 name
	value     string // 登录key, 软件token或软件名称
)

// init 解析命令行参数 / Parse command line flags
func init() {
	flag.StringVar(&loginType, "type", "", "登录类型: loginkey (推荐), token (已弃用), name 或 get_login_token (仅获取登录Key) / Login type: loginkey (recommended), token (deprecated), name or get_login_token (only get login key)")
	flag.StringVar(&value, "v", "", "登录key/软件token/软件名称 / Login key, software token or software name")
}

// loginResponse 登录接口返回的结构 / Structure of login API response
type loginResponse struct {
	Type  string `json:"type"`
	V     string `json:"v"`
	State string `json:"state"`
}

// verifyResponse token验证接口返回的结构 / Structure of token verification API response
type verifyResponse struct {
	Success bool   `json:"success"`
	Data    any    `json:"data"`
	Message string `json:"message"`
}

// loginKeyResponse 获取登录Key接口返回的结构 / Structure of login key API response
type loginKeyResponse struct {
	Success bool `json:"success"`
	Data    struct {
		LoginKey  string `json:"login_key"`
		ExpiresAt string `json:"expires_at"`
	} `json:"data"`
	Message string `json:"message"`
}

func main() {
	flag.Parse()

	// 验证参数 / Validate arguments
	if loginType != "loginkey" && loginType != "token" && loginType != "name" && loginType != "get_login_token" {
		log.Fatal("错误: -type 必须是 'loginkey', 'token', 'name' 或 'get_login_token' / Error: -type must be 'loginkey', 'token', 'name' or 'get_login_token'")
	}
	if value == "" {
		log.Fatal("错误: -v 参数不能为空 / Error: -v argument cannot be empty")
	}

	// 如果是get_login_token模式，仅获取并输出登录Key
	if loginType == "get_login_token" {
		loginKey, err := getLoginKey(value)
		if err != nil {
			log.Fatalf("获取登录Key失败: %v / Failed to get login key: %v", err)
		}
		// 输出登录Key到stdout
		fmt.Print(loginKey)
		return
	}

	// 如果是token类型，提示已弃用 / Warn if using deprecated token type
	if loginType == "token" {
		log.Println("⚠️ 警告: type=token 已弃用，建议使用 type=loginkey 以保护软件Token安全")
		log.Println("⚠️ Warning: type=token is deprecated, use type=loginkey to protect your software token")
	}

	// loginkey模式直接使用传入的值，不再自动获取
	// loginkey mode uses the passed value directly, no auto-fetch
	actualLoginType := loginType
	actualValue := value

	// 启动登录流程 / Start the login flow
	token, err := startLoginFlow(actualLoginType, actualValue)
	if err != nil {
		log.Fatalf("登录失败: %v / Login failed: %v", err)
	}

	// 验证token有效性 / Verify the obtained token
	if err := verifyToken(token); err != nil {
		log.Fatalf("token验证失败: %v / Token verification failed: %v", err)
	}

	// 获取用户信息 / Get user info
	userResult, err := getUserByToken(token)
	if err != nil {
		log.Fatalf("获取用户信息失败: %v / Failed to get user info: %v", err)
	}

	if userResult.Success {
		log.Printf("登录成功，用户: %+v / Login successful, user: %+v", userResult.Data)
	}

	// 输出token到stdout (供父进程通过管道读取) / Output token to stdout for parent process to read
	fmt.Print(token)
}

// isLikelySoftwareToken 判断是否可能是软件Token（64位hex字符串）
// Checks if the value looks like a software token (64-char hex string)
func isLikelySoftwareToken(v string) bool {
	if len(v) != 64 {
		return false
	}
	_, err := hex.DecodeString(v)
	return err == nil
}

// getLoginKey 通过软件Token获取登录Key
// Get a login key by exchanging a software token (10-minute validity)
func getLoginKey(softwareToken string) (string, error) {
	reqURL := fmt.Sprintf("%s/login-token?token=%s", apiBaseURL, url.QueryEscape(softwareToken))
	resp, err := http.Get(reqURL)
	if err != nil {
		return "", fmt.Errorf("请求失败: %v / Request failed: %v", err)
	}
	defer resp.Body.Close()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return "", fmt.Errorf("读取响应失败: %v / Failed to read response: %v", err)
	}

	// 输出原始响应用于调试 / Output raw response for debugging
	log.Printf("API响应 (status %d): %s", resp.StatusCode, string(body))

	var result loginKeyResponse
	if err := json.Unmarshal(body, &result); err != nil {
		return "", fmt.Errorf("解析响应失败: %v / Failed to parse response: %v", err)
	}

	if !result.Success {
		return "", fmt.Errorf("%s", result.Message)
	}

	return result.Data.LoginKey, nil
}

// startLoginFlow 启动完整的登录流程 / Starts the complete login flow
// It generates a random state, finds an available port, starts a local HTTP server,
// opens the browser with the login URL, and waits for the callback.
func startLoginFlow(loginType, value string) (string, error) {
	// 1. 生成state参数 (16字节随机数，防CSRF) / Generate state parameter (16 random bytes for CSRF protection)
	state, err := generateState()
	if err != nil {
		return "", fmt.Errorf("生成state失败: %v / Failed to generate state: %v", err)
	}

	// 2. 寻找可用端口并启动本地服务器 / Find an available port and start the local server
	port, err := findAvailablePort()
	if err != nil {
		return "", fmt.Errorf("无法找到可用端口: %v / Cannot find available port: %v", err)
	}

	// 创建channel用于接收token或错误 / Create channels to receive token or error
	tokenChan := make(chan string, 1)
	errChan := make(chan error, 1)

	// 启动HTTP服务器 / Start HTTP server
	server := &http.Server{
		Addr:         fmt.Sprintf(":%d", port),
		ReadTimeout:  10 * time.Second,
		WriteTimeout: 10 * time.Second,
	}

	// 注册根路由处理器 / Register root route handler
	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		// 只处理GET请求 / Handle only GET requests
		if r.Method != http.MethodGet {
			http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
			return
		}

		query := r.URL.Query()
		callbackType := query.Get("type")
		callbackValue := query.Get("v")
		callbackState := query.Get("state")

		if callbackType == "success" {
			// 验证state参数，防止CSRF攻击 / Verify state parameter to prevent CSRF
			if callbackState != state {
				errChan <- fmt.Errorf("state参数验证失败，可能是CSRF攻击 / State parameter mismatch, possible CSRF attack")
				http.Error(w, "state验证失败 / State verification failed", http.StatusBadRequest)
				return
			}
			tokenChan <- callbackValue
			// 返回成功页面 / Return success page
			w.Header().Set("Content-Type", "text/html; charset=utf-8")
			w.WriteHeader(http.StatusOK)
			w.Write([]byte(`
✅ 登录完成
请关闭此窗口
`))
			// 延迟关闭服务器，确保响应发送完成 / Delay server shutdown to ensure response is sent
			go func() {
				time.Sleep(500 * time.Millisecond)
				server.Close()
			}()
		} else if callbackType == "error" {
			errChan <- fmt.Errorf("登录失败: %s / Login failed: %s", callbackValue)
			http.Error(w, "登录失败 / Login failed", http.StatusBadRequest)
			go func() {
				time.Sleep(500 * time.Millisecond)
				server.Close()
			}()
		} else {
			http.Error(w, "无效的回调类型 / Invalid callback type", http.StatusBadRequest)
		}
	})

	// 在goroutine中启动服务器 / Start server in a goroutine
	go func() {
		if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
			errChan <- fmt.Errorf("HTTP服务器错误: %v / HTTP server error: %v", err)
		}
	}()

	// 等待服务器启动完成 / Wait for server to start
	time.Sleep(100 * time.Millisecond)

	// 3. 构造登录URL并打开浏览器 / Build login URL and open browser
	loginURL := fmt.Sprintf("%s/?port=%d&type=%s&v=%s&state=%s&env=app",
		loginBaseURL, port, loginType, url.QueryEscape(value), state)
	log.Printf("构造的登录URL: %s", loginURL)
	if err := openBrowser(loginURL); err != nil {
		return "", fmt.Errorf("打开浏览器失败: %v / Failed to open browser: %v", err)
	}
	log.Printf("已打开浏览器，请登录 / Browser opened, please log in")
	log.Printf("等待登录回调... / Waiting for login callback...")

	// 等待登录结果 / Wait for login result
	select {
	case token := <-tokenChan:
		return token, nil
	case err := <-errChan:
		return "", err
	case <-time.After(5 * time.Minute):
		server.Close()
		return "", fmt.Errorf("登录超时（5分钟） / Login timeout (5 minutes)")
	}
}

// generateState 生成16字节随机数作为state参数 / Generate 16 random bytes as state parameter
func generateState() (string, error) {
	bytes := make([]byte, 16)
	if _, err := rand.Read(bytes); err != nil {
		return "", err
	}
	return hex.EncodeToString(bytes), nil
}

// findAvailablePort 寻找一个可用的TCP端口 / Find an available TCP port
// It binds to port 0 which lets the OS choose a free port, then returns that port number.
func findAvailablePort() (int, error) {
	listener, err := net.Listen("tcp", ":0")
	if err != nil {
		return 0, err
	}
	defer listener.Close()
	return listener.Addr().(*net.TCPAddr).Port, nil
}

// openBrowser 打开系统默认浏览器 / Open the system default browser
func openBrowser(url string) error {
	switch runtime.GOOS {
	case "windows":
		return exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start()
	case "darwin":
		return exec.Command("open", url).Start()
	default:
		return exec.Command("xdg-open", url).Start()
	}
}

// verifyToken 验证token有效性 / Verify the validity of the token by calling the API
func verifyToken(token string) error {
	reqBody := map[string]string{"token": token}
	jsonBody, err := json.Marshal(reqBody)
	if err != nil {
		return err
	}

	resp, err := http.Post(apiBaseURL+"/verify-access-token", "application/json", bytes.NewBuffer(jsonBody))
	if err != nil {
		return fmt.Errorf("API请求失败: %v / API request failed: %v", err)
	}
	defer resp.Body.Close()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return err
	}

	var result verifyResponse
	if err := json.Unmarshal(body, &result); err != nil {
		return err
	}

	if !result.Success {
		return fmt.Errorf("token无效: %s / Invalid token: %s", result.Message)
	}

	return nil
}

// getUserByToken 通过token获取用户信息 / Get user info by access token
func getUserByToken(token string) (*verifyResponse, error) {
	reqBody := map[string]string{"token": token}
	jsonBody, _ := json.Marshal(reqBody)

	resp, err := http.Post(apiBaseURL+"/get-user-by-token", "application/json", bytes.NewBuffer(jsonBody))
	if err != nil {
		return nil, fmt.Errorf("API请求失败: %v / API request failed: %v", err)
	}
	defer resp.Body.Close()

	body, _ := io.ReadAll(resp.Body)
	var result verifyResponse
	json.Unmarshal(body, &result)
	return &result, nil
}