use hmac::{Hmac, Mac};
use sha1::Sha1;

use super::crypto::{constant_time_eq, now_secs, random_bytes};
use crate::errors::{AuthError, AuthResult};

pub const TOTP_ISSUER: &str = "Auth service";
pub const TOTP_PERIOD_SECS: u64 = 30;
pub const TOTP_DIGITS: u32 = 6;
pub const TOTP_SECRET_BYTES: usize = 20;
pub const TOTP_WINDOW: [i64; 3] = [0, -1, 1];

/// MFA 注册入口由外部账户服务负责（本服务仅验证/兑换，
/// `generate_secret`/`otpauth_uri`/`encrypt_secret` 供其复用）。
const BASE32_ALPHABET: &[u8; 32] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";

pub fn base32_encode(data: &[u8]) -> String {
    let mut output = String::with_capacity(data.len() * 8 / 5 + 1);
    let mut buffer = 0u32;
    let mut bits = 0u32;
    for &byte in data {
        buffer = (buffer << 8) | byte as u32;
        bits += 8;
        while bits >= 5 {
            bits -= 5;
            output.push(BASE32_ALPHABET[((buffer >> bits) & 0x1f) as usize] as char);
        }
    }
    if bits > 0 {
        output.push(BASE32_ALPHABET[((buffer << (5 - bits)) & 0x1f) as usize] as char);
    }
    output
}

pub fn base32_decode(input: &str) -> Option<Vec<u8>> {
    let mut output = Vec::with_capacity(input.len() * 5 / 8);
    let mut buffer = 0u32;
    let mut bits = 0u32;
    for raw in input.chars() {
        let c = raw.to_ascii_uppercase();
        let value = match c {
            'A'..='Z' => c as u32 - b'A' as u32,
            '2'..='7' => c as u32 - b'2' as u32 + 26,
            '=' | ' ' | '-' => continue,
            _ => return None,
        };
        buffer = (buffer << 5) | value;
        bits += 5;
        if bits >= 8 {
            bits -= 8;
            output.push(((buffer >> bits) & 0xff) as u8);
        }
    }
    Some(output)
}

pub fn generate_secret() -> String {
    base32_encode(&random_bytes(TOTP_SECRET_BYTES))
}

pub fn hotp(secret: &[u8], counter: u64) -> AuthResult<u32> {
    let mut mac = Hmac::<Sha1>::new_from_slice(secret)
        .map_err(|err| AuthError::internal(format!("totp secret is unusable: {err}")))?;
    mac.update(&counter.to_be_bytes());
    let digest = mac.finalize().into_bytes();
    let offset = (digest[19] & 0x0f) as usize;
    Ok(((digest[offset] as u32 & 0x7f) << 24)
        | ((digest[offset + 1] as u32) << 16)
        | ((digest[offset + 2] as u32) << 8)
        | (digest[offset + 3] as u32))
}

pub fn format_code(code: u32) -> String {
    let truncated = code % 10u32.pow(TOTP_DIGITS);
    format!("{truncated:0width$}", width = TOTP_DIGITS as usize)
}

pub fn current_step() -> u64 {
    now_secs() / TOTP_PERIOD_SECS
}

pub fn code_at(secret: &[u8], step: u64) -> AuthResult<String> {
    Ok(format_code(hotp(secret, step)?))
}

pub fn verify_totp_code(
    secret: &str,
    code: &str,
    last_step: Option<i64>,
) -> AuthResult<(u64, i64)> {
    let code = code.trim();
    if code.len() as u32 != TOTP_DIGITS || !code.bytes().all(|byte| byte.is_ascii_digit()) {
        return Err(AuthError::TotpCodeInvalid);
    }
    let secret_bytes =
        base32_decode(secret).ok_or_else(|| AuthError::internal("totp secret is not base32"))?;
    if secret_bytes.is_empty() {
        return Err(AuthError::internal("totp secret is empty"));
    }
    let step = current_step();
    let mut reused = false;
    for offset in TOTP_WINDOW {
        let candidate = (step as i64 + offset).max(0) as u64;
        let expected = code_at(&secret_bytes, candidate)?;
        if constant_time_eq(expected.as_bytes(), code.as_bytes()) {
            if last_step.is_some_and(|last| candidate as i64 <= last) {
                reused = true;
                continue;
            }
            return Ok((candidate, candidate as i64));
        }
    }
    if reused {
        return Err(AuthError::TotpStepReused);
    }
    Err(AuthError::TotpCodeInvalid)
}

pub fn otpauth_uri(secret: &str, account: &str) -> String {
    let encoded = account
        .replace('%', "%25")
        .replace(':', "%3A")
        .replace('/', "%2F")
        .replace('?', "%3F")
        .replace('&', "%26")
        .replace('=', "%3D");
    format!(
        "otpauth://totp/{issuer}:{account}?secret={secret}&issuer={issuer}&algorithm=SHA1&digits={digits}&period={period}",
        issuer = TOTP_ISSUER,
        account = encoded,
        digits = TOTP_DIGITS,
        period = TOTP_PERIOD_SECS,
    )
}

pub const SECRET_CIPHERTEXT_PREFIX: &str = "v1:";

fn encryption_key(material: Option<&str>) -> AuthResult<Vec<u8>> {
    let Some(material) = material else {
        return Err(AuthError::internal(
            "auth.totp_encryption_key is required to handle totp secrets",
        ));
    };
    super::crypto::decode_base64_key(material)
}

pub fn decrypt_secret(material: Option<&str>, stored: &str) -> AuthResult<String> {
    let key = encryption_key(material)?;
    let sealed = stored
        .trim()
        .strip_prefix(SECRET_CIPHERTEXT_PREFIX)
        .ok_or_else(|| {
            AuthError::internal("totp secret is stored without encryption and must be re-enrolled")
        })?;
    super::crypto::aes_decrypt(&key, "mfa.totp.secret.v1", sealed)
}

pub fn encrypt_secret(material: Option<&str>, secret: &str) -> AuthResult<String> {
    let key = encryption_key(material)?;
    Ok(format!(
        "{SECRET_CIPHERTEXT_PREFIX}{}",
        super::crypto::aes_encrypt(&key, "mfa.totp.secret.v1", secret)?
    ))
}