import { importResources, importResourceDeletes, listAllResources, listResourceDeletes, setResourceChangeListener, setResourceScope, type SavedResource } from '../database';
import { apiFetch } from './http';
import { clearResourceSessions, getSession } from './sessions';
import { setAccountIdentity, requireAccount } from './accountSession';
import { b64, unb64, deriveAccountKeys, sealJson, openJson, generateInvitationKeys, generateAccountSigningKeys } from './accountCrypto';
import { mergeVault, validateVault, type VaultProfile } from './accountVault';
import { joinChannel } from './channelResources';
import { openChannelGrant, peekChannelGrant, sealChannelGrant } from './channelGrant';
import { recoverAccountChannels } from './accountChannels';
import { forgetAccount, localAccountDevice, rememberedAccount, rememberAccount, saveDeviceName, saveLoginFields, forgetLoginFields, savedLoginFields } from './accountPersistence';
import type { AccountVaultBody, AccountSaltBody, AccountSessionBody, PublicKeyBody, InvitationBody, InvitationCryptoPlan, AccountDeviceBody, AccountRegisterRequest, AccountSessionRequest } from '../generated/api';

import { loadPersonal, personalProfile } from './accountProfile';
import type { AccountProfile, AccountProfileRequest } from '../generated/api';

import type { PersonalProfile } from '../protocol/account';
import { passkeyUnlockUsername, clearPasskeyState } from './passkeys';
import { packageInvitationDomains } from './channelDataKeys';
import { clearDeviceSigner, ensureDeviceSigning } from './accountSigning';

type VaultBody = AccountVaultBody;
interface AccountSession {
  username: string; token: string; key: CryptoKey; profile: VaultProfile; revision: number;
  deviceSigning?: CryptoKeyPair;
  remember: boolean; personal?: PersonalProfile;
  controller: AbortController; dirty: boolean; syncing?: Promise<void>; error?: string;
  timer?: ReturnType<typeof setTimeout>; polling?: ReturnType<typeof setInterval>;
}
export type Invitation = InvitationBody & { channelName?: string; invitedBy?: string };
let account: AccountSession | undefined;
export function unlockedAccount() {
  if (!account) throw new Error('请先登录账号');
  return account;
}
let restoration: Promise<void> | undefined;
export function usernameOf(input: string): string {
  const username = input.trim().toLowerCase();
  if (!/^[a-z0-9_-]{3,32}$/.test(username)) throw new Error('账号 ID 需为 3–32 位字母、数字、下划线或短横线');
  return username;
}
function headers(session: Pick<AccountSession, 'token'>): Record<string, string> { return { 'X-WD-Account': session.token }; }
function stillActive(session: AccountSession): void {
  if (account !== session || session.controller.signal.aborted) throw new Error('账号已切换，操作已停止');
}
async function applyProfile(profile: VaultProfile): Promise<void> {
  await importResources(profile.resources.map((row) => ({ ...row, endpointSecret: new Uint8Array(32) } as SavedResource)));
  await importResourceDeletes(profile.deletes);
}
async function persistSession(session: AccountSession, value: VaultBody): Promise<void> {
  if (session.remember) await rememberAccount({ username: session.username, token: session.token, key: session.key, personal: session.personal, ...value });
  else await forgetAccount();
}
async function syncVault(): Promise<void> {
  if (!account) throw new Error('请先登录账号');
  const session = account;
  if (session.syncing) { session.dirty = true; return session.syncing; }
  session.syncing = (async () => {
    session.personal = await loadPersonal(session.token);
    await recoverAccountChannels(session.username, session.profile.keys, session.controller.signal);
    do {
      session.dirty = false;
      for (let attempt = 0; attempt < 3; attempt++) {
        const remote = await apiFetch('/accounts/vault', { headers: headers(session), signal: session.controller.signal }).then((r) => r.json() as Promise<VaultBody>);
        const profile = validateVault(await openJson(remote.vault, session.key));
        if (profile.keys.publicKey.x !== session.profile.keys.publicKey.x || profile.keys.publicKey.y !== session.profile.keys.publicKey.y) throw new Error('账号邀请密钥发生冲突，已停止同步');
        const remoteSigning = profile.keys.signing.publicKey; const localSigning = session.profile.keys.signing.publicKey;
        if (remoteSigning.x !== localSigning.x || remoteSigning.y !== localSigning.y)
          throw new Error('账号签名密钥发生冲突，已停止同步');
        const merged = mergeVault(profile, await listAllResources(), await listResourceDeletes());
        if (JSON.stringify(merged) === JSON.stringify(profile)) {
          stillActive(session); await applyProfile(merged);
          session.profile = merged; session.revision = remote.revision; session.error = undefined;
          setAccountIdentity(session, merged.keys.publicKey, session.personal);
          await persistSession(session, remote);
          break;
        }
        const vault = await sealJson(merged, session.key);
        stillActive(session);
        try {
          const result = await apiFetch('/accounts/vault', { method: 'PUT', headers: { ...headers(session), 'Content-Type': 'application/json' },
            signal: session.controller.signal, body: JSON.stringify({ revision: remote.revision, vault }) }).then((r) => r.json() as Promise<VaultBody>);
          stillActive(session);
          await applyProfile(merged);
          session.profile = merged; session.revision = result.revision; session.error = undefined;
          setAccountIdentity(session, merged.keys.publicKey, session.personal);
          await persistSession(session, { vault, revision: result.revision });
          break;
        } catch (error) {
          if (attempt === 2 || !(error instanceof Error && 'status' in error && error.status === 409)) throw error;
        }
      }
    } while (session.dirty && account === session);
  })().catch((error: unknown) => {
    if (account === session) session.error = error instanceof Error ? error.message : '同步失败';
    if (account === session && error instanceof Error && 'status' in error && error.status === 401) {
      clearDeviceSigner();
      account = undefined; clearTimeout(session.timer); clearInterval(session.polling); session.controller.abort();
      setResourceChangeListener(undefined); setAccountIdentity(undefined); clearResourceSessions(); setResourceScope(null);
      void forgetAccount();
      void forgetLoginFields();
    }
    throw error;
  }).finally(() => { session.syncing = undefined; });
  return session.syncing;
}

async function activate(identity: { username: string; token: string }, key: CryptoKey, remote: VaultBody, remember = true, cachedPersonal?: PersonalProfile): Promise<AccountSession> {
  const profile = validateVault(await openJson(remote.vault, key));
  // 设备签名密钥与个人资料互不依赖,同时请求,冷启动少等一个往返
  const [deviceSigning, personal] = await Promise.all([
    ensureDeviceSigning(identity.username, identity.token, profile.keys.signing),
    loadPersonal(identity.token).catch((error: unknown) => {
      if (!(error instanceof Error && error.message === '网络连接失败')) throw error;
      return cachedPersonal;
    }),
  ]);
  clearResourceSessions(); setResourceScope(identity.username);
  const session: AccountSession = { ...identity, key, profile, revision: remote.revision, remember, controller: new AbortController(), dirty: false, deviceSigning };
  session.personal = personal;
  account = session; setAccountIdentity(identity, profile.keys.publicKey, session.personal);
  await applyProfile(mergeVault(profile, await listAllResources(), await listResourceDeletes()));
  setResourceChangeListener(scheduleSync);
  session.polling = setInterval(scheduleSync, 20_000);
  return session;
}

export function restoreAccount(): Promise<void> {
  restoration ??= (async () => {
    const saved = await rememberedAccount();
    if (!saved || account) return;
    let remote: VaultBody;
    try {
      remote = await apiFetch('/accounts/vault', { headers: headers(saved) }).then((r) => r.json() as Promise<VaultBody>);
    } catch (error) {
      if (error instanceof Error && 'status' in error && error.status === 401) { await forgetAccount(); await forgetLoginFields(); return; }
      remote = saved;
    }
    try {
      const session = await activate(saved, saved.key, remote, true, saved.personal);
      setAccountIdentity(session, session.profile.keys.publicKey, session.personal);
      // 保险库已在 activate 里并入本机资源,完整同步(约 4 次往返)放到后台,不挡住打开页面
      void syncVault().catch(() => {});
    } catch (error) { await logoutAccount(); throw error; }
  })().catch((error: unknown) => { restoration = undefined; throw error; });
  return restoration;
}
function scheduleSync(): void {
  if (!account) return;
  account.dirty = true; clearTimeout(account.timer);
  account.timer = setTimeout(() => { void syncVault().catch(() => {}); }, 700);
}

export async function registerAccount(input: string, password: string, remember = true): Promise<Awaited<ReturnType<typeof accountStatus>>> {
  if (account) throw new Error('请先退出当前账号');
  const username = usernameOf(input);
  if (password.length < 12 || password.length > 1024) throw new Error('密码长度需为 12–1024 个字符');
  const salt = crypto.getRandomValues(new Uint8Array(16));
  const { verifier, key } = await deriveAccountKeys(password, salt);
  const invitationKeys = await generateInvitationKeys(); const signing = await generateAccountSigningKeys();
  const profile: VaultProfile = { v: 3, keys: { ...invitationKeys, signing }, resources: [], deletes: [] };
  try {
    await apiFetch('/accounts', { method: 'POST', headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ username, salt: b64(salt), verifier: b64(verifier), public_key: JSON.stringify(profile.keys.publicKey),
        signing_public_key: JSON.stringify(signing.publicKey), vault: await sealJson(profile, key) } satisfies AccountRegisterRequest) });
  } finally { verifier.fill(0); }
  return loginAccount(username, password, remember);
}
export async function loginAccount(input: string, password: string, remember = true): Promise<Awaited<ReturnType<typeof accountStatus>>> {
  if (account) throw new Error('请先退出当前账号');
  const username = usernameOf(input);
  const challenge = await apiFetch('/accounts/salt', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ username }) })
    .then((r) => r.json() as Promise<AccountSaltBody>);
  const { verifier, key } = await deriveAccountKeys(password, unb64(challenge.salt));
  let identity: AccountSessionBody;
  try {
    const device = await localAccountDevice();
    identity = await apiFetch('/accounts/session', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ username, verifier: b64(verifier), device_id: device.id, device_name: device.name } satisfies AccountSessionRequest) })
      .then((r) => r.json() as Promise<AccountSessionBody>);
  } finally { verifier.fill(0); }
  const status = await unlockAuthenticatedAccount(identity, key, remember);
  if (remember) await saveLoginFields(username, password); else await forgetLoginFields();
  return status;
}
export async function unlockAuthenticatedAccount(identity: AccountSessionBody, key: CryptoKey, remember = true): Promise<Awaited<ReturnType<typeof accountStatus>>> {
  if (account) throw new Error('请先退出当前账号');
  try {
    const remote = await apiFetch('/accounts/vault', { headers: headers(identity) }).then(r => r.json() as Promise<VaultBody>);
    const profile = validateVault(await openJson(remote.vault, key));
    const publicKey = await apiFetch('/accounts/users/' + identity.username + '/key', { headers: headers(identity) }).then(r => r.json() as Promise<PublicKeyBody>);
    const published = JSON.parse(publicKey.public_key) as JsonWebKey;
    if (published.x !== profile.keys.publicKey.x || published.y !== profile.keys.publicKey.y) throw new Error('账号邀请公钥与保险库不匹配');
    if (!publicKey.signing_public_key) throw new Error('账号签名公钥不存在。');
    const publishedSigning = JSON.parse(publicKey.signing_public_key) as JsonWebKey;
    if (publishedSigning.x !== profile.keys.signing.publicKey.x || publishedSigning.y !== profile.keys.signing.publicKey.y)
      throw new Error('账号签名公钥与保险库不匹配');
    const session = await activate(identity, key, remote, remember);
    await persistSession(session, remote);
    await syncVault().catch(() => {});
    return accountStatus();
  } catch (error) {
    await logoutAccount();
    void apiFetch('/accounts/session', { method: 'DELETE', headers: headers(identity) }).catch(() => {});
    throw error;
  }
}
export async function accountStatus(): Promise<{ username: string | null; revision: number; remembered: boolean; personal?: PersonalProfile; error?: string; unlockUsername?: string }> {
  return { username: account?.username ?? null, revision: account?.revision ?? 0,
    remembered: account?.remember ?? false, unlockUsername: passkeyUnlockUsername(),
    ...(account?.personal ? { personal: account.personal } : {}),
    ...(account?.error ? { error: '账号资源同步失败，请重试。' } : {}) };
}
export async function logoutAccount(): Promise<void> {
  clearDeviceSigner();
  clearPasskeyState();
  const session = account; account = undefined;
  if (session) { clearTimeout(session.timer); clearInterval(session.polling); session.controller.abort(); await session.syncing?.catch(() => {}); }
  setResourceChangeListener(undefined); setAccountIdentity(undefined); clearResourceSessions(); setResourceScope(null);
  await forgetAccount();
  if (session) void apiFetch('/accounts/session', { method: 'DELETE', headers: headers(session) }).catch(() => {});
}
export async function syncAccount(): Promise<void> { await syncVault(); }
export async function getSavedLogin(): Promise<{ username: string; password: string; saved: boolean }> {
  if (account) return { username: '', password: '', saved: false };
  const fields = await savedLoginFields(); return fields ? { ...fields, saved: true } : { username: '', password: '', saved: false };
}
export async function clearSavedLogin(): Promise<void> {
  if (account) {
    account.remember = false;
    await account.syncing?.catch(() => {});
  }
  await forgetAccount(); await forgetLoginFields();
}
export async function updatePersonal(displayName: string, avatar?: string): Promise<void> {
  if (!account) throw new Error('请先登录账号');
  const session = account;
  const value = await apiFetch('/accounts/profile', { method: 'PATCH', headers: { ...headers(session), 'Content-Type': 'application/json' },
    body: JSON.stringify({ displayName, avatar } satisfies AccountProfileRequest) }).then(r => r.json() as Promise<AccountProfile>);
  stillActive(session);
  session.personal = personalProfile(value);
  setAccountIdentity(session, session.profile.keys.publicKey, session.personal);
  await persistSession(session, { vault: await sealJson(session.profile, session.key), revision: session.revision });
}
export async function listAccountDevices(): Promise<AccountDeviceBody[]> { requireAccount(); return apiFetch('/accounts/devices').then((r) => r.json() as Promise<AccountDeviceBody[]>); }
export async function renameAccountDevice(id: string, name: string): Promise<void> {
  requireAccount(); await apiFetch(`/accounts/devices/${id}`, { method: 'PATCH', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ name }) });
  if ((await localAccountDevice()).id === id) await saveDeviceName(name.trim());
}
export async function revokeAccountDevice(id: string): Promise<void> {
  requireAccount(); await apiFetch(`/accounts/devices/${id}`, { method: 'DELETE' });
  if ((await localAccountDevice()).id === id) await logoutAccount();
}
export async function listAccountInvitations(): Promise<Invitation[]> {
  requireAccount();
  const rows = await apiFetch('/accounts/invitations').then((r) => r.json() as Promise<InvitationBody[]>);
  const session = account;
  return Promise.all(rows.map(async (row): Promise<Invitation> => {
    const meta = session ? await peekChannelGrant(row.payload, session.username, row.channel_id, session.profile.keys.privateKey) : {};
    return { ...row, ...(meta.name ? { channelName: meta.name } : {}), ...(meta.invitedBy ? { invitedBy: meta.invitedBy } : {}) };
  }));
}
export async function acceptInvitation(channelId: string): Promise<void> {
  if (!account) throw new Error('请先登录账号');
  const session = account;
  const invitation = (await listAccountInvitations()).find((row) => row.channel_id === channelId);
  if (!invitation) throw new Error('邀请已失效');
  const link = await openChannelGrant(invitation.payload, session.username, channelId, session.profile.keys.privateKey, 'member', self.location.origin);
  // 保险库同步(约 5 次往返)放到后台,不让用户等着:频道资源已在本机保存,可以直接打开
  stillActive(session); await joinChannel({ link }); scheduleSync();
}
export async function inviteChannelUser(channelId: string, input: string): Promise<void> {
  requireAccount(); const username = usernameOf(input); const { session, resource } = await getSession(channelId);
  if (!session.can('owner')) throw new Error('只有空间主可以邀请用户');
  const plan = await apiFetch(`/channels/${channelId}/invitations/${username}/crypto-plan`, { headers: session.authHeaders('owner') })
    .then(r => r.json() as Promise<InvitationCryptoPlan>);
  const body = await apiFetch(`/accounts/users/${username}/key`).then((r) => r.json() as Promise<PublicKeyBody>);
  const payload = await sealChannelGrant(resource.link, username, JSON.parse(body.public_key) as JsonWebKey, { name: resource.name, invitedBy: account?.username });
  const domainEnvelopes = await packageInvitationDomains(resource, session, plan);
  await apiFetch(`/channels/${channelId}/invitations`, { method: 'POST', headers: { ...session.authHeaders('owner'), 'Content-Type': 'application/json' }, body: JSON.stringify({ username, payload, domain_envelopes: domainEnvelopes }) });
}
export async function listChannelInvitations(channelId: string): Promise<Invitation[]> {
  const { session } = await getSession(channelId); return apiFetch(`/channels/${channelId}/invitations`, { headers: session.authHeaders('owner') }).then((r) => r.json() as Promise<Invitation[]>);
}
export async function revokeChannelInvitation(channelId: string, input: string): Promise<void> {
  const { session } = await getSession(channelId); await apiFetch(`/channels/${channelId}/invitations/${usernameOf(input)}`, { method: 'DELETE', headers: session.authHeaders('owner') });
}