'use strict';

const crypto = require('crypto');
const fs = require('fs');
const path = require('path');
const { parseWorkflowMarker } = require('./gitea-workflow-codex');

const DEFAULT_MAX_BODY_BYTES = 2 * 1024 * 1024;
const DEFAULT_BOT_LOGIN = 'ccweb-bot';

function cloneJson(value) {
  if (value === undefined) return undefined;
  return JSON.parse(JSON.stringify(value));
}

function safeString(value) {
  return typeof value === 'string' ? value.trim() : '';
}

function escapeRegExp(value) {
  return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
}

function timingSafeHexEqual(expectedHex, receivedHex) {
  const expected = Buffer.from(String(expectedHex || '').toLowerCase(), 'hex');
  const received = Buffer.from(String(receivedHex || '').toLowerCase(), 'hex');
  return expected.length > 0
    && expected.length === received.length
    && crypto.timingSafeEqual(expected, received);
}

function normalizeSignature(value) {
  const raw = safeString(value).replace(/^sha256[=:]/i, '').trim();
  return /^[0-9a-f]{64}$/i.test(raw) ? raw.toLowerCase() : '';
}

function verifyWebhookSignature(rawBody, signature, secret) {
  const configuredSecret = String(secret || '');
  if (!configuredSecret) return false;
  const expected = crypto.createHmac('sha256', configuredSecret)
    .update(Buffer.isBuffer(rawBody) ? rawBody : Buffer.from(String(rawBody || '')))
    .digest('hex');
  return timingSafeHexEqual(expected, normalizeSignature(signature));
}

function getHeader(headers, names) {
  const source = headers || {};
  for (const name of names) {
    const value = source[name] ?? source[name.toLowerCase()];
    if (Array.isArray(value)) return safeString(value[0]);
    if (value !== undefined) return safeString(value);
  }
  const lowerNames = new Set(names.map((name) => name.toLowerCase()));
  for (const [name, value] of Object.entries(source)) {
    if (!lowerNames.has(name.toLowerCase())) continue;
    return Array.isArray(value) ? safeString(value[0]) : safeString(value);
  }
  return '';
}

function atomicWriteJson(filePath, value) {
  const target = path.resolve(filePath);
  fs.mkdirSync(path.dirname(target), { recursive: true });
  const tempPath = `${target}.${process.pid}.${crypto.randomBytes(5).toString('hex')}.tmp`;
  fs.writeFileSync(tempPath, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
  try {
    fs.renameSync(tempPath, target);
  } finally {
    try { if (fs.existsSync(tempPath)) fs.unlinkSync(tempPath); } catch {}
  }
}

class DeliveryStore {
  constructor(options = {}) {
    this.filePath = options.filePath ? path.resolve(options.filePath) : '';
    this.maxEntries = Number.isSafeInteger(options.maxEntries) && options.maxEntries > 0
      ? options.maxEntries : 10_000;
    this.entries = new Map();
    this.load();
  }

  load() {
    if (!this.filePath || !fs.existsSync(this.filePath)) return;
    try {
      const parsed = JSON.parse(fs.readFileSync(this.filePath, 'utf8'));
      const source = parsed && typeof parsed === 'object' && !Array.isArray(parsed)
        ? parsed.entries || parsed : {};
      for (const [key, value] of Object.entries(source)) {
        if (key && value && typeof value === 'object') this.entries.set(key, value);
      }
    } catch {
      // 损坏的去重文件不应阻止服务启动；新请求会覆盖为可恢复的合法文件。
      this.entries.clear();
    }
  }

  get(key) {
    const value = this.entries.get(String(key));
    return value ? cloneJson(value) : null;
  }

  has(key) {
    return this.entries.has(String(key));
  }

  put(key, value) {
    const normalizedKey = String(key);
    this.entries.set(normalizedKey, cloneJson(value));
    while (this.entries.size > this.maxEntries) {
      const oldest = this.entries.keys().next().value;
      this.entries.delete(oldest);
    }
    if (this.filePath) {
      atomicWriteJson(this.filePath, {
        schemaVersion: 1,
        entries: Object.fromEntries(this.entries),
      });
    }
  }

  claimDelivery(key, value = {}) {
    const existing = this.get(key);
    if (existing) return { duplicate: true, record: existing };
    this.put(key, value);
    return { duplicate: false, record: this.get(key) };
  }

  getDelivery(key) { return this.get(key); }
}

function repositoryFromPayload(payload) {
  const repository = payload?.repository || payload?.repo || {};
  const owner = repository.owner || repository.organization || {};
  const ownerName = typeof owner === 'string'
    ? safeString(owner)
    : safeString(owner.login || owner.username || owner.name || repository.owner_name);
  const repoName = safeString(repository.name || repository.repo_name);
  const fullName = safeString(repository.full_name || (ownerName && repoName ? `${ownerName}/${repoName}` : ''));
  const parts = fullName.split('/').filter(Boolean);
  const normalizedOwner = ownerName || parts.slice(0, -1).join('/');
  const normalizedRepo = repoName || parts.at(-1) || '';
  if (!normalizedOwner || !normalizedRepo || normalizedOwner.includes('/') || normalizedRepo.includes('/')) {
    return null;
  }
  return {
    owner: normalizedOwner,
    name: normalizedRepo,
    fullName: `${normalizedOwner}/${normalizedRepo}`,
    cloneUrl: safeString(repository.clone_url || repository.cloneUrl || repository.html_url || ''),
    defaultBranch: safeString(repository.default_branch || repository.defaultBranch || ''),
    private: repository.private === true,
  };
}

function resourceFromPayload(payload, eventName) {
  const issue = payload?.issue || payload?.pull_request || payload?.pullRequest || {};
  const pullRequest = payload?.pull_request || payload?.pullRequest || issue?.pull_request;
  const number = Number(issue.number || payload?.number || pullRequest?.number);
  if (!Number.isSafeInteger(number) || number <= 0) return null;
  const isPullRequest = eventName.includes('pull_request')
    || !!issue.pull_request
    || !!payload?.pull_request
    || !!payload?.pullRequest;
  const kind = isPullRequest ? 'pull_request' : 'issue';
  return {
    kind,
    number,
    key: `${kind}:${number}`,
    title: safeString(issue.title || pullRequest?.title),
    baseRef: safeString(pullRequest?.base?.ref || pullRequest?.base_ref),
    headRef: safeString(pullRequest?.head?.ref || pullRequest?.head_ref),
    headRepo: safeString(pullRequest?.head?.repo?.full_name || pullRequest?.head_repo),
  };
}

function commentFromPayload(payload) {
  const comment = payload?.comment || payload?.review?.comment || {};
  const body = typeof comment.body === 'string'
    ? comment.body
    : (typeof payload?.comment_body === 'string' ? payload.comment_body : '');
  if (!body) return null;
  const author = comment.user || comment.author || payload?.sender || payload?.user || {};
  return {
    id: String(comment.id || comment.number || payload?.comment_id || '').trim(),
    body,
    author: {
      id: author.id ?? null,
      login: safeString(author.login || author.username || author.name),
      type: safeString(author.type),
    },
    createdAt: safeString(comment.created_at || comment.createdAt || payload?.created_at),
    updatedAt: safeString(comment.updated_at || comment.updatedAt || payload?.updated_at),
  };
}

function normalizeEventName(headerValue, payload) {
  const header = safeString(headerValue).toLowerCase().replace(/[-\s]/g, '_');
  const action = safeString(payload?.action).toLowerCase();
  if (['issue_comment', 'issues_comment', 'pull_request_comment', 'pullrequest_comment'].includes(header)) {
    return header.includes('pull') ? 'pull_request_comment' : 'issue_comment';
  }
  // 某些 Gitea 版本把普通 Issue 评论复用为 issues + comment 字段；
  // 只有存在 comment 时才归一化，避免新建 Issue 被误触发。
  if (header === 'issues' && (action === 'comment' || payload?.comment)) return 'issue_comment';
  if (header === 'pull_request' && (['comment', 'review_comment'].includes(action) || payload?.comment)) return 'pull_request_comment';
  return header;
}

function parseBotMention(body, botLogin = DEFAULT_BOT_LOGIN) {
  const login = safeString(botLogin) || DEFAULT_BOT_LOGIN;
  const mention = new RegExp(`(^|[^\\w@])@${escapeRegExp(login)}(?=$|[^\\w-])`, 'i');
  const match = mention.exec(String(body || ''));
  if (!match) return null;
  const before = String(body).slice(0, match.index);
  const after = String(body).slice(match.index + match[0].length);
  const instruction = `${before}${after}`
    .replace(/^[\s:：,，、-]+/, '')
    .replace(/[\s]+$/, '')
    .trim();
  return {
    botLogin: login,
    mention: `@${login}`,
    instruction,
    index: match.index + match[1].length,
  };
}

function isBotAuthor(author, botIdentity = {}) {
  const login = safeString(author?.login).toLowerCase();
  const configuredLogin = safeString(botIdentity.login || botIdentity.username || DEFAULT_BOT_LOGIN).toLowerCase();
  if (login && configuredLogin && login === configuredLogin) return true;
  if (botIdentity.id !== undefined && botIdentity.id !== null && author?.id !== null && author?.id !== undefined) {
    return String(botIdentity.id) === String(author.id);
  }
  return false;
}

function normalizeWebhookEvent({ payload, headers = {}, instanceId = 'default', botIdentity }) {
  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
    return { ignored: true, reason: 'invalid_payload' };
  }
  const eventName = normalizeEventName(getHeader(headers, ['x-gitea-event', 'x-event-key', 'x-github-event']), payload);
  if (!['issue_comment', 'pull_request_comment'].includes(eventName)) {
    return { ignored: true, reason: 'unsupported_event', eventName };
  }
  const comment = commentFromPayload(payload);
  if (!comment) return { ignored: true, reason: 'not_comment', eventName };
  // 带完整关联标识的 cc-web 回帖即使 Gitea 版本未携带作者字段，也不得再次触发。
  if (parseWorkflowMarker(comment.body)) {
    return { ignored: true, reason: 'workflow_marker_comment', eventName, commentId: comment.id || null };
  }
  if (isBotAuthor(comment.author, botIdentity)) {
    return { ignored: true, reason: 'bot_self_comment', eventName, commentId: comment.id || null };
  }
  const mention = parseBotMention(comment.body, botIdentity?.login || DEFAULT_BOT_LOGIN);
  if (!mention) return { ignored: true, reason: 'missing_mention', eventName, commentId: comment.id || null };
  const repository = repositoryFromPayload(payload);
  if (!repository) return { ignored: true, reason: 'repository_unresolved', eventName, commentId: comment.id || null };
  const resource = resourceFromPayload(payload, eventName);
  if (!resource) return { ignored: true, reason: 'resource_unresolved', eventName, commentId: comment.id || null };
  const sender = payload.sender || payload.user || null;
  return {
    ignored: false,
    eventName,
    eventType: eventName,
    instanceId: safeString(instanceId) || 'default',
    deliveryId: getHeader(headers, ['x-gitea-delivery', 'x-delivery-id', 'x-github-delivery']) || safeString(payload.delivery_id),
    repository,
    repo: repository,
    resource,
    refs: { base: resource.baseRef || null, head: resource.headRef || null },
    comment,
    mention,
    sender,
    actor: {
      login: safeString(sender?.login || sender?.username || sender?.name),
      id: sender?.id ?? null,
      isBot: sender?.is_bot === true || String(sender?.type || '').toLowerCase() === 'bot',
    },
    receivedAt: new Date().toISOString(),
  };
}

function createTaskId(deliveryKey) {
  return `gitea-task-${crypto.createHash('sha256').update(String(deliveryKey)).digest('hex').slice(0, 24)}`;
}

function readRawBody(req, maxBytes = DEFAULT_MAX_BODY_BYTES) {
  return new Promise((resolve, reject) => {
    const chunks = [];
    let total = 0;
    let settled = false;
    const fail = (error) => {
      if (settled) return;
      settled = true;
      reject(error);
    };
    req.on('data', (chunk) => {
      if (settled) return;
      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
      total += buffer.length;
      if (total > maxBytes) {
        fail(Object.assign(new Error('Webhook 请求体过大。'), { code: 'body_too_large' }));
        try { req.destroy(); } catch {}
        return;
      }
      chunks.push(buffer);
    });
    req.on('end', () => {
      if (settled) return;
      settled = true;
      resolve(Buffer.concat(chunks));
    });
    req.on('error', fail);
  });
}

function readDeliveryRecord(store, key) {
  if (typeof store?.get === 'function') return store.get(key);
  if (typeof store?.getDelivery === 'function') return store.getDelivery(key);
  return null;
}

function claimDeliveryRecord(store, key, record) {
  if (typeof store?.claimDelivery === 'function') {
    return store.claimDelivery(key, record);
  }
  if (typeof store?.put === 'function') {
    store.put(key, record);
    return { duplicate: false, record };
  }
  throw new TypeError('deliveryStore 必须提供 get/put 或 getDelivery/claimDelivery。');
}

function createGiteaWebhookReceiver(options = {}) {
  let secret = options.secret ?? process.env.CC_WEB_GITEA_WEBHOOK_SECRET ?? '';
  let botToken = options.botToken ?? '';
  const instanceId = safeString(options.instanceId || process.env.CC_WEB_GITEA_INSTANCE_ID || process.env.GITEA_INSTANCE_ID) || 'default';
  const botIdentity = {
    login: safeString(options.botLogin || process.env.CC_WEB_GITEA_BOT_LOGIN || process.env.GITEA_BOT_LOGIN) || DEFAULT_BOT_LOGIN,
    id: options.botId ?? process.env.CC_WEB_GITEA_BOT_ID ?? process.env.GITEA_BOT_ID ?? null,
  };
  const maxBodyBytes = Number.isSafeInteger(options.maxBodyBytes) && options.maxBodyBytes > 0
    ? options.maxBodyBytes : DEFAULT_MAX_BODY_BYTES;
  const deliveryStore = options.deliveryStore || new DeliveryStore({
    filePath: options.deliveryFile || process.env.CC_WEB_GITEA_DELIVERY_FILE,
  });
  const onTask = typeof options.onTask === 'function' ? options.onTask : async () => {};
  const inflight = new Set();

  async function processWebhook({ headers = {}, rawBody }) {
    const body = Buffer.isBuffer(rawBody) ? rawBody : Buffer.from(String(rawBody || ''));
    if (options.requireBotToken && !String(botToken || '').trim()) {
      return { statusCode: 503, payload: { ok: false, error: 'gitea_workflow_not_configured' } };
    }
    const signature = getHeader(headers, ['x-gitea-signature', 'x-hub-signature-256', 'x-signature']);
    if (secret && !verifyWebhookSignature(body, signature, secret)) {
      return { statusCode: 401, payload: { ok: false, error: 'invalid_signature' } };
    }
    let payload;
    try {
      payload = JSON.parse(body.toString('utf8'));
    } catch {
      return { statusCode: 400, payload: { ok: false, error: 'invalid_json' } };
    }
    const deliveryId = getHeader(headers, ['x-gitea-delivery', 'x-delivery-id', 'x-github-delivery'])
      || safeString(payload.delivery_id);
    if (!deliveryId) return { statusCode: 400, payload: { ok: false, error: 'missing_delivery_id' } };
    const deliveryKey = `${instanceId}:${deliveryId}`;
    const existing = readDeliveryRecord(deliveryStore, deliveryKey);
    if (existing) {
      return {
        statusCode: 200,
        payload: { ok: true, duplicate: true, status: 'duplicate', deliveryId, taskId: existing.taskId || null, reason: existing.reason || null },
        record: existing,
      };
    }
    const event = normalizeWebhookEvent({ payload, headers, instanceId, botIdentity });
    event.deliveryId = deliveryId;
    const record = {
      deliveryKey,
      deliveryId,
      instanceId,
      taskId: event.ignored ? null : createTaskId(deliveryKey),
      status: event.ignored ? 'ignored' : 'accepted',
      reason: event.reason || null,
      eventName: event.eventName || null,
      receivedAt: event.receivedAt || new Date().toISOString(),
    };
    const claimed = claimDeliveryRecord(deliveryStore, deliveryKey, record);
    if (claimed?.duplicate) {
      const duplicateRecord = claimed.record || readDeliveryRecord(deliveryStore, deliveryKey) || record;
      return {
        statusCode: 200,
        payload: { ok: true, duplicate: true, status: 'duplicate', deliveryId, taskId: duplicateRecord.taskId || null },
        record: duplicateRecord,
      };
    }
    if (event.ignored) {
      return { statusCode: 200, payload: { ok: true, ignored: true, status: 'ignored', reason: event.reason }, record, event };
    }
    const task = {
      taskId: record.taskId,
      deliveryKey,
      deliveryId,
      instanceId,
      event,
      receivedAt: record.receivedAt,
    };
    // Webhook 先快速确认，工作区 clone/fetch 等副作用由上层异步处理。
    const taskPromise = Promise.resolve().then(() => onTask(cloneJson(task))).catch((error) => {
      if (typeof options.onTaskError === 'function') {
        try { options.onTaskError(error, task); } catch {}
      }
    }).finally(() => inflight.delete(taskPromise));
    inflight.add(taskPromise);
    return {
      statusCode: 202,
      payload: { ok: true, accepted: true, state: 'queued', status: 'accepted', deliveryId, taskId: record.taskId },
      record,
      event,
      task,
    };
  }

  async function handle(req, res) {
    let result;
    try {
      const rawBody = await readRawBody(req, maxBodyBytes);
      result = await processWebhook({ headers: req.headers || {}, rawBody });
    } catch (error) {
      const statusCode = error?.code === 'body_too_large' ? 413 : 400;
      result = { statusCode, payload: { ok: false, error: error?.code || 'invalid_request' } };
    }
    if (!res.headersSent) {
      res.writeHead(result.statusCode, {
        'Content-Type': 'application/json; charset=utf-8',
        'Cache-Control': 'no-cache',
      });
      res.end(JSON.stringify(result.payload));
    }
    return result;
  }

  async function drain() {
    await Promise.all(Array.from(inflight));
  }

  function updateConfig(next = {}) {
    if (Object.prototype.hasOwnProperty.call(next, 'secret')) secret = String(next.secret || '');
    if (Object.prototype.hasOwnProperty.call(next, 'botToken')) botToken = String(next.botToken || '');
    if (Object.prototype.hasOwnProperty.call(next, 'botLogin')) {
      botIdentity.login = safeString(next.botLogin) || DEFAULT_BOT_LOGIN;
    }
    if (Object.prototype.hasOwnProperty.call(next, 'botId')) botIdentity.id = next.botId ?? null;
    return {
      webhookSecretConfigured: Boolean(secret),
      botTokenConfigured: Boolean(botToken),
      botLogin: botIdentity.login,
      botId: botIdentity.id,
    };
  }

  return { handle, processWebhook, drain, updateConfig, deliveryStore, instanceId, botIdentity };
}

function createGiteaWebhookRoute(receiver, options = {}) {
  if (!receiver || typeof receiver.handle !== 'function') {
    throw new TypeError('receiver.handle 必须是函数。');
  }
  const endpoint = String(options.path || '/api/gitea/webhook');
  return function handleGiteaWebhookRoute(req, res, urlLike) {
    let pathname = typeof urlLike === 'string' ? urlLike : urlLike?.pathname;
    if (!pathname) {
      try { pathname = new URL(req.url || '/', 'http://localhost').pathname; } catch { pathname = ''; }
    }
    if (req.method !== 'POST' || pathname !== endpoint) return false;
    receiver.handle(req, res);
    return true;
  };
}

module.exports = {
  DEFAULT_MAX_BODY_BYTES,
  DeliveryStore,
  createDeliveryStore: (options) => new DeliveryStore(options),
  createGiteaWebhookRoute,
  createGiteaWebhookReceiver,
  createTaskId,
  normalizeWebhookEvent,
  parseBotMention,
  verifyWebhookSignature,
};