import { Client, type ClientChannel, type ConnectConfig } from "ssh2";
import { StringDecoder } from "node:string_decoder";
import { config } from "../config";

interface SshHopOptions {
  host: string;
  port: number;
  username: string;
  credential:
    | { type: "password"; password: string }
    | { type: "privateKey"; privateKey: string; passphrase?: string }
    | { type: "certificate"; privateKey: string; passphrase?: string; certificate: string };
  knownHostFingerprint?: string;
}

export interface SshConnectOptions {
  host: string;
  port: number;
  username: string;
  credential:
    | { type: "password"; password: string }
    | { type: "privateKey"; privateKey: string; passphrase?: string }
    | { type: "certificate"; privateKey: string; passphrase?: string; certificate: string };
  jumpHost?: SshHopOptions;
  pty: { cols: number; rows: number };
  knownHostFingerprint?: string;
  onHostFingerprint?: (payload: { fingerprint: string; hostPort: string; role: "target" | "jump" }) => void;
  onStdout: (data: string) => void;
  onStderr: (data: string) => void;
  onClose: (reason: string) => void;
}

export interface ActiveSshSession {
  write(data: string, traceId?: number): void;
  resize(cols: number, rows: number): void;
  close(reason?: string): void;
}

/**
 * 初始化哨兵：用于标记“静默初始化命令”的开始与结束。
 */
const INIT_BEGIN = "__RCSBEGIN_7f3a__";
const INIT_DONE = "__RCSDONE_7f3a__";

/**
 * 初始化命令分三段写入：
 * 1) 关闭回显 + BEGIN 哨兵
 * 2) shell 兼容初始化
 * 3) 打开回显 + DONE 哨兵
 */
const SHELL_INIT_W1 = "stty -echo; echo '__RCSBEGIN_7f3a__'\r";
const SHELL_INIT_W2 = [
  "stty iutf8 2>/dev/null",
  '; [ -z "$LANG" ] && export LANG=zh_CN.UTF-8',
  '; [ -z "$LC_CTYPE" ] && export LC_CTYPE=zh_CN.UTF-8',
  '; [ -z "$LC_ALL" ] && export LC_ALL=zh_CN.UTF-8',
  "; setopt MULTIBYTE PRINT_EIGHT_BIT 2>/dev/null",
  "; unsetopt PROMPT_SP 2>/dev/null",
  "; PROMPT_EOL_MARK='' 2>/dev/null"
].join("") + "\r";
const SHELL_INIT_W3 = "stty echo; echo '__RCSDONE_7f3a__'\r";

/**
 * 这些特征行一旦出现在 stdout，说明是网关内部初始化泄漏，必须过滤。
 */
const INIT_LEAK_PATTERNS = [
  "stty -echo; echo '__RCSBEGIN_7f3a__'",
  "stty iutf8 2>/dev/null",
  "setopt MULTIBYTE PRINT_EIGHT_BIT",
  "unsetopt PROMPT_SP",
  "PROMPT_EOL_MARK=''",
  "stty echo; echo '__RCSDONE_7f3a__'",
  INIT_BEGIN,
  INIT_DONE
];

/** @internal 仅供测试调用。 */
export const INIT_BEGIN_FOR_TEST = INIT_BEGIN;
/** @internal 仅供测试调用。 */
export const INIT_DONE_FOR_TEST = INIT_DONE;

interface SentinelMatch {
  index: number;
  end: number;
}

/**
 * 输入去噪：去除 C1 控制字符（0x80-0x9F）。
 */
function stripC1Controls(data: string): string {
  return data.replace(/[\u0080-\u009F]/g, "");
}

/**
 * 判断字节串是否可无损按 UTF-8 解释。
 */
function isLosslessUtf8Bytes(bytes: Buffer): boolean {
  const decoded = bytes.toString("utf8");
  if (decoded.includes("\uFFFD")) {
    return false;
  }
  return Buffer.from(decoded, "utf8").equals(bytes);
}

function decodeByteRun(bytes: number[]): string {
  if (bytes.length === 0) {
    return "";
  }
  const buf = Buffer.from(bytes);
  if (isLosslessUtf8Bytes(buf)) {
    return buf.toString("utf8");
  }
  return String.fromCharCode(...bytes.filter((b) => (b >= 0x20 && b <= 0x7e) || b === 0x09));
}

/**
 * 混合输入归一：宽字符原样保留，单字节段按 UTF-8 尝试解码。
 */
function normalizeMixedInput(data: string): string {
  let output = "";
  let byteRun: number[] = [];

  const flushByteRun = (): void => {
    output += decodeByteRun(byteRun);
    byteRun = [];
  };

  for (const ch of data) {
    const codePoint = ch.codePointAt(0) ?? 0;
    if (codePoint <= 0xff) {
      byteRun.push(codePoint);
      continue;
    }
    flushByteRun();
    output += ch;
  }
  flushByteRun();
  return output;
}

/**
 * 将前端输入转换为 SSH 可写内容。
 */
export function encodeInputForSsh(data: string): string {
  let hasHighByte = false;
  let hasWideChar = false;

  for (let i = 0; i < data.length; i += 1) {
    const code = data.charCodeAt(i);
    if (code > 0xff) {
      hasWideChar = true;
      continue;
    }
    if (code >= 0x80) {
      hasHighByte = true;
    }
  }

  if (hasWideChar) {
    return normalizeMixedInput(data).replace(/\uFFFD/g, "");
  }

  if (!hasHighByte) {
    return data;
  }

  const bytes = Buffer.from(data, "latin1");
  if (isLosslessUtf8Bytes(bytes)) {
    return bytes.toString("utf8");
  }

  return stripC1Controls(data);
}

/**
 * 匹配哨兵真实输出行（SENTINEL + \n 或 \r\n）。
 * 注意：不会误匹配命令回显里的 `echo '__RCS...__'`（后面是单引号）。
 */
function findSentinelLine(buffer: string, sentinel: string): SentinelMatch | null {
  let from = 0;
  while (from < buffer.length) {
    const index = buffer.indexOf(sentinel, from);
    if (index < 0) {
      return null;
    }

    const next = buffer[index + sentinel.length];
    const nextNext = buffer[index + sentinel.length + 1];

    if (next === "\n") {
      return { index, end: index + sentinel.length + 1 };
    }
    if (next === "\r" && nextNext === "\n") {
      return { index, end: index + sentinel.length + 2 };
    }

    // 落在 chunk 边界，等下个 chunk 再判定。
    if (next === undefined || (next === "\r" && nextNext === undefined)) {
      return null;
    }

    from = index + 1;
  }

  return null;
}

/**
 * 兜底清理初始化泄漏内容，保留 banner 与提示符。
 */
function sanitizeInitLeakOutput(text: string): string {
  return text
    .split(/(\r\n|\n|\r)/)
    .reduce((acc, current, index, parts) => {
      if (index % 2 === 1) {
        return acc;
      }
      const shouldDrop = INIT_LEAK_PATTERNS.some((pattern) => current.includes(pattern));
      if (shouldDrop) {
        return acc;
      }
      return acc + current + (parts[index + 1] ?? "");
    }, "");
}

/**
 * 统一可读错误信息，便于前端提示用户。
 */
function normalizeSshError(error: Error): Error {
  const raw = String(error.message ?? "");
  if (raw.includes("All configured authentication methods failed")) {
    return new Error(
      `SSH 认证失败：用户名/密码不正确，或目标服务器要求额外认证（如 publickey + keyboard-interactive 多因子）。原始错误: ${raw}`
    );
  }
  if (raw.includes("Timed out while waiting for handshake")) {
    return new Error(`SSH 握手超时，请检查目标主机连通性与端口（原始错误: ${raw}）`);
  }
  return error;
}

function toPrivateKeyPayload(
  credential: Extract<SshHopOptions["credential"], { type: "privateKey" | "certificate" }>
): string {
  if (credential.type === "certificate") {
    return `${credential.privateKey}\n${credential.certificate}`;
  }
  return credential.privateKey;
}

/**
 * 统一构造 ssh2 connect 配置：
 * - 密码模式优先 keyboard-interactive，再回退 password；
 * - 私钥/证书模式直接走 publickey；
 * - hostVerifier 在每个 hop 独立上报指纹，便于前端分别确认。
 */
function buildSshConnectConfig(
  hop: SshHopOptions,
  onHostFingerprint: SshConnectOptions["onHostFingerprint"],
  role: "target" | "jump",
  sock?: ConnectConfig["sock"]
): ConnectConfig {
  const hostPort = `${hop.host}:${hop.port}`;
  const baseConfig: ConnectConfig = {
    host: hop.host,
    port: hop.port,
    username: hop.username,
    readyTimeout: config.sshReadyTimeoutMs,
    keepaliveInterval: config.sshKeepaliveIntervalMs,
    keepaliveCountMax: config.sshKeepaliveCountMax,
    hostHash: "sha256",
    ...(sock ? { sock } : {}),
    hostVerifier: (keyHash: string) => {
      onHostFingerprint?.({ fingerprint: keyHash, hostPort, role });
      return !hop.knownHostFingerprint || keyHash === hop.knownHostFingerprint;
    }
  };

  if (hop.credential.type === "password") {
    const authPassword = hop.credential.password;
    const authHandler = [
      {
        type: "keyboard-interactive",
        username: hop.username,
        prompt(
          _name: string,
          _instructions: string,
          _lang: string,
          prompts: Array<{ prompt: string; echo?: boolean }>,
          finish: (responses: string[]) => void
        ) {
          finish(prompts.map(() => authPassword));
        }
      },
      { type: "password", username: hop.username, password: authPassword }
    ] as unknown as ConnectConfig["authHandler"];

    return {
      ...baseConfig,
      password: authPassword,
      tryKeyboard: true,
      authHandler
    };
  }

  return {
    ...baseConfig,
    privateKey: toPrivateKeyPayload(hop.credential),
    passphrase: hop.credential.passphrase
  };
}

/**
 * 建立 SSH 会话并返回可操作句柄。
 * 仅保留已验证有效的链路：双哨兵过滤 + 超时兜底净化。
 */
export async function createSshSession(options: SshConnectOptions): Promise<ActiveSshSession> {
  const targetConn = new Client();
  const jumpConn = options.jumpHost ? new Client() : null;

  return await new Promise<ActiveSshSession>((resolve, reject) => {
    let streamRef: {
      write: (data: string | Buffer) => void;
      setWindow: (rows: number, cols: number, height: number, width: number) => void;
      close: () => void;
      on: (event: string, listener: (...args: unknown[]) => void) => void;
      stderr: { on: (event: string, listener: (chunk: Buffer) => void) => void };
    } | null = null;
    let closeReported = false;
    /**
     * 关闭原因只允许上报一次，避免 `close()` / `stream.close` / `conn.close`
     * 多路并发触发导致日志重复。
     */
    const reportCloseOnce = (reason: string): void => {
      if (closeReported) {
        return;
      }
      closeReported = true;
      options.onClose(reason);
    };

    const onError = (error: Error): void => {
      reject(normalizeSshError(error));
      targetConn.end();
      jumpConn?.end();
    };

    const openShell = (): void => {
      targetConn.shell(
        { cols: options.pty.cols, rows: options.pty.rows, term: "xterm-256color", modes: { ECHO: 0 } },
        (shellError: Error | undefined, stream: ClientChannel) => {
          if (shellError) {
            onError(shellError);
            return;
          }

          streamRef = stream as typeof streamRef;
          const stdoutDecoder = new StringDecoder("utf8");
          const stderrDecoder = new StringDecoder("utf8");

          let initState: "waiting_begin" | "waiting_done" | "done" = "waiting_begin";
          let initBuffer = "";
          const initTimeoutHandle = setTimeout(() => {
            if (initState !== "done") {
              initState = "done";
              const sanitized = sanitizeInitLeakOutput(initBuffer);
              if (sanitized) {
                options.onStdout(sanitized);
              }
              initBuffer = "";
            }
          }, 3000);

          stream.on("data", (chunk: Buffer) => {
            const text = stdoutDecoder.write(chunk);
            if (!text) {
              return;
            }

            if (initState === "done") {
              options.onStdout(text);
              return;
            }

            initBuffer += text;

            if (initState === "waiting_begin") {
              const beginMatch = findSentinelLine(initBuffer, INIT_BEGIN);
              if (!beginMatch) {
                return;
              }

              const rawBefore = initBuffer.slice(0, beginMatch.index);
              const echoIndex = rawBefore.lastIndexOf("stty -echo");
              const newlineBeforeEcho = echoIndex >= 0 ? rawBefore.lastIndexOf("\n", echoIndex) : -1;
              const before =
                echoIndex >= 0 ? (newlineBeforeEcho >= 0 ? rawBefore.slice(0, newlineBeforeEcho + 1) : "") : rawBefore;

              initBuffer = initBuffer.slice(beginMatch.end);
              initState = "waiting_done";

              const sanitizedBefore = sanitizeInitLeakOutput(before);
              if (sanitizedBefore) {
                options.onStdout(sanitizedBefore);
              }
            }

            if (initState === "waiting_done") {
              const doneMatch = findSentinelLine(initBuffer, INIT_DONE);
              if (!doneMatch) {
                const keepTail = INIT_DONE.length + 2;
                if (initBuffer.length > keepTail) {
                  initBuffer = initBuffer.slice(-keepTail);
                }
                return;
              }

              const after = sanitizeInitLeakOutput(initBuffer.slice(doneMatch.end));
              initBuffer = "";
              initState = "done";
              clearTimeout(initTimeoutHandle);

              if (after) {
                options.onStdout(after);
              }
            }
          });

          stream.stderr.on("data", (chunk: Buffer) => {
            const text = stderrDecoder.write(chunk);
            if (text) {
              options.onStderr(text);
            }
          });

          try {
            stream.write(Buffer.from(SHELL_INIT_W1, "utf8"));
            stream.write(Buffer.from(SHELL_INIT_W2, "utf8"));
            stream.write(Buffer.from(SHELL_INIT_W3, "utf8"));
          } catch {
            clearTimeout(initTimeoutHandle);
            initState = "done";
          }

          stream.on("close", () => {
            clearTimeout(initTimeoutHandle);
            const remainOut = stdoutDecoder.end();
            if (remainOut) {
              options.onStdout(remainOut);
            }
            const remainErr = stderrDecoder.end();
            if (remainErr) {
              options.onStderr(remainErr);
            }
            reportCloseOnce("shell_closed");
            targetConn.end();
            jumpConn?.end();
          });

          resolve({
            write(data: string, _traceId?: number) {
              const payload = encodeInputForSsh(data).replace(/\uFFFD/g, "");
              if (payload) {
                streamRef?.write(Buffer.from(payload, "utf8"));
              }
            },
            resize(cols: number, rows: number) {
              streamRef?.setWindow(rows, cols, 0, 0);
            },
            close(reason = "manual") {
              reportCloseOnce(reason);
              streamRef?.close();
              targetConn.end();
              jumpConn?.end();
            }
          });
        }
      );
    };

    targetConn.on("ready", openShell);
    targetConn.on("error", onError);
    targetConn.on("close", () => {
      reportCloseOnce("connection_closed");
    });

    const targetHop: SshHopOptions = {
      host: options.host,
      port: options.port,
      username: options.username,
      credential: options.credential,
      knownHostFingerprint: options.knownHostFingerprint
    };

    if (!options.jumpHost) {
      targetConn.connect(buildSshConnectConfig(targetHop, options.onHostFingerprint, "target"));
      return;
    }

    jumpConn?.on("error", onError);
    jumpConn?.on("close", () => {
      reportCloseOnce("jump_connection_closed");
    });

    jumpConn?.on("ready", () => {
      jumpConn.forwardOut("127.0.0.1", 0, options.host, options.port, (error, stream) => {
        if (error || !stream) {
          onError(error ?? new Error("jump forward stream missing"));
          return;
        }
        targetConn.connect(buildSshConnectConfig(targetHop, options.onHostFingerprint, "target", stream));
      });
    });

    jumpConn?.connect(buildSshConnectConfig(options.jumpHost, options.onHostFingerprint, "jump"));
  });
}