using System.Buffers.Binary;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using WebDrop.Core;

namespace WebDrop.Core.Tests;

/// <summary>
/// 用 test-vectors/vectors.json 校验服务端这一侧能复现协议的每个字节。
/// 向量由 node:crypto 独立生成,这里用 .NET 的 HKDF / AesGcm / SHA256 再算一遍;
/// 两套互不相干的实现一致,才说明 protocol.md 没有歧义。
/// </summary>
public class VectorTests
{
    private static readonly JsonElement V = JsonDocument.Parse(File.ReadAllText(Path.Combine(AppContext.BaseDirectory, "vectors.json"))).RootElement;

    private static byte[] H(JsonElement e) => Convert.FromHexString(e.GetString()!);
    private static byte[] H(string s) => Convert.FromHexString(s);

    private static byte[] Hkdf(byte[] ikm, byte[] salt, string info) =>
        HKDF.DeriveKey(HashAlgorithmName.SHA256, ikm, 32, salt, Encoding.UTF8.GetBytes(info));

    private static byte[] ChannelId => H(V.GetProperty("inputs").GetProperty("channel_id"));
    private static byte[] KEnc => Hkdf(H(V.GetProperty("inputs").GetProperty("k")), ChannelId, "webdrop/v1/enc");

    private static byte[] ItemKey(byte[] itemId) => Hkdf(KEnc, itemId, "webdrop/v1/item");

    private static byte[] Aad(byte[] channelId, byte[] envelope)
    {
        // "WD1" ‖ channel_id ‖ envelope[0..22)
        var aad = new byte[3 + 16 + 22];
        "WD1"u8.CopyTo(aad);
        channelId.CopyTo(aad, 3);
        envelope.AsSpan(0, 22).CopyTo(aad.AsSpan(19));
        return aad;
    }

    /// <summary>用 AES-GCM 解密一帧,返回明文;认证失败抛 CryptographicException。</summary>
    private static byte[] Open(byte[] channelId, byte[] envelope)
    {
        Assert.True(Envelope.TryParse(envelope, out var env));
        var iv = new byte[12];
        BinaryPrimitives.WriteUInt32BigEndian(iv.AsSpan(8), env.FrameIndex);
        var payload = envelope.AsSpan(Envelope.HeaderSize);
        var plain = new byte[payload.Length - 16];
        using var gcm = new AesGcm(ItemKey(env.ItemId.ToArray()), 16);
        gcm.Decrypt(iv, payload[..^16], payload[^16..], plain, Aad(channelId, envelope));
        return plain;
    }

    [Fact]
    public void KeyDerivationMatchesTheVectors()
    {
        var inputs = V.GetProperty("inputs");
        var kdf = V.GetProperty("kdf");
        var k = H(inputs.GetProperty("k"));
        var a = H(inputs.GetProperty("a"));

        Assert.Equal(H(kdf.GetProperty("k_enc")), Hkdf(k, ChannelId, "webdrop/v1/enc"));
        Assert.Equal(H(kdf.GetProperty("t_read")), Hkdf(k, ChannelId, "webdrop/v1/token/read"));
        Assert.Equal(H(kdf.GetProperty("t_write")), Hkdf(k, ChannelId, "webdrop/v1/token/write"));
        Assert.Equal(H(kdf.GetProperty("t_owner")), Hkdf(a, ChannelId, "webdrop/v1/token/owner"));
        Assert.Equal(H(kdf.GetProperty("k_label")), Hkdf(KEnc, ChannelId, "webdrop/v1/label"));

        foreach (var item in V.GetProperty("item_keys").EnumerateArray())
            Assert.Equal(H(item.GetProperty("k_item")), ItemKey(H(item.GetProperty("item_id"))));
    }

    [Fact]
    public void SignatureFramingAndEcdsaMatchTheVectors()
    {
        var vector = V.GetProperty("signatures");
        static byte[] B64Url(string value) => Convert.FromBase64String(value.Replace('-', '+').Replace('_', '/') + new string('=', (4 - value.Length % 4) % 4));
        var x = B64Url(vector.GetProperty("x").GetString()!);
        var y = B64Url(vector.GetProperty("y").GetString()!);
        var payload = H(vector.GetProperty("payload"));
        var kind = vector.GetProperty("kind").GetString()!;
        var signature = H(vector.GetProperty("signature"));
        Assert.Equal(H(vector.GetProperty("message")), SignatureCodec.BuildMessage(kind, payload));
        Assert.True(SignatureCodec.VerifyP256(x, y, kind, payload, signature));
        Assert.False(SignatureCodec.VerifyP256(x, y, "chat.edit", payload, signature));
        payload[0] ^= 1;
        Assert.False(SignatureCodec.VerifyP256(x, y, kind, payload, signature));
    }

    [Fact]
    public void ContentEventPayloadAndFrameManifestMatchTheVectors()
    {
        var vector = V.GetProperty("content_event");
        var digests = vector.GetProperty("frame_digests").EnumerateArray().Select(H).ToList();
        var manifest = SignatureCodec.FrameManifestHash(digests);
        Assert.Equal(H(vector.GetProperty("manifest_hash")), manifest);
        byte[] id(string property) => H(vector.GetProperty(property));
        Assert.Equal(H(vector.GetProperty("payload")), SignatureCodec.ContentEventPayload(
            id("space_id"), vector.GetProperty("channel_id").GetString()!, vector.GetProperty("username").GetString()!,
            vector.GetProperty("device_id").GetString()!, id("event_id"), vector.GetProperty("kind").GetString()!, CryptoDomain.Chat,
            vector.GetProperty("epoch").GetInt32(), id("item_id"), vector.GetProperty("frame_count").GetInt32(), manifest, id("target_item_id")));
    }

    [Fact]
    public void ServerTokenHashMatchesTheStoredHashes()
    {
        // 服务端存的是令牌的 SHA-256;向量里的 *_hash 必须与 TokenHash.Compute 一致,
        // 客户端才能发出服务端认得的哈希
        var kdf = V.GetProperty("kdf");
        foreach (var (token, hash) in new[] { ("t_read", "read_hash"), ("t_write", "write_hash"), ("t_owner", "owner_hash"), ("raw_write_token", "raw_write_hash") })
        {
            byte[] t = H(kdf.GetProperty(token));
            Assert.Equal(H(kdf.GetProperty(hash)), TokenHash.Compute(t));
            Assert.True(TokenHash.Matches(t, H(kdf.GetProperty(hash))));
        }
    }

    [Fact]
    public void IvAndAadMatchTheVectors()
    {
        foreach (var iv in V.GetProperty("iv").EnumerateArray())
        {
            var expected = new byte[12];
            BinaryPrimitives.WriteUInt32BigEndian(expected.AsSpan(8), (uint)iv.GetProperty("index").GetInt64());
            Assert.Equal(H(iv.GetProperty("iv")), expected);
        }

        foreach (var c in V.GetProperty("aad").EnumerateArray())
        {
            // 用一个只含头部的封装(payload_len = 0)构造 AAD 的前 22 字节
            var env = new byte[Envelope.HeaderSize];
            env[0] = 1;
            env[1] = (byte)c.GetProperty("flags").GetInt32();
            H(c.GetProperty("item_id")).CopyTo(env, 2);
            BinaryPrimitives.WriteUInt32BigEndian(env.AsSpan(18), (uint)c.GetProperty("index").GetInt64());
            Assert.Equal(H(c.GetProperty("aad")), Aad(ChannelId, env));
        }
    }

    [Fact]
    public void PaddingTiersMatchThePolicy()
    {
        foreach (var p in V.GetProperty("padding").EnumerateArray())
        {
            int len = p.GetProperty("data_len").GetInt32();
            int tier = p.GetProperty("plaintext_len").GetInt32();
            Assert.True(PayloadTiers.IsValidEncPayloadLength(tier + 16), $"data_len={len}");
            Assert.True(tier >= 4 + len);
        }
    }

    [Fact]
    public void EveryFrameVectorDecryptsToTheExpectedPlaintextAndPassesServerValidation()
    {
        foreach (var f in V.GetProperty("frames").EnumerateArray())
        {
            string name = f.GetProperty("name").GetString()!;
            byte[] envelope = H(f.GetProperty("envelope"));

            // 服务端的封装解析与校验:这些帧就是合法客户端会发出的
            Assert.True(Envelope.TryParse(envelope, out var env), name);
            Assert.Equal((FrameFlags)f.GetProperty("flags").GetInt32(), env.Flags);
            Assert.Equal((uint)f.GetProperty("index").GetInt64(), env.FrameIndex);
            Assert.True(env.IsEnc, name);
            Assert.True(PayloadTiers.IsValidEncPayloadLength(env.PayloadLength), name);

            // 解密得到的明文(含 padding)必须逐字节一致
            byte[] plaintext = Open(ChannelId, envelope);
            Assert.Equal(H(f.GetProperty("plaintext")), plaintext);

            // 明文布局:u32 data_len ‖ data ‖ 零填充
            int dataLen = (int)BinaryPrimitives.ReadUInt32BigEndian(plaintext);
            Assert.Equal(H(f.GetProperty("data")), plaintext.AsSpan(4, dataLen).ToArray());
            Assert.All(plaintext.AsSpan(4 + dataLen).ToArray(), b => Assert.Equal(0, b));
        }
    }

    [Fact]
    public void ItemVectorsFollowTheServerFramingRules()
    {
        foreach (var item in V.GetProperty("items").EnumerateArray())
        {
            string name = item.GetProperty("name").GetString()!;
            bool gated = item.GetProperty("gated").GetBoolean();
            var frames = item.GetProperty("frames").EnumerateArray().Select(e => H(e)).ToList();

            var content = new List<byte>();
            for (int i = 0; i < frames.Count; i++)
            {
                Assert.True(Envelope.TryParse(frames[i], out var env), name);
                Assert.Equal((uint)i, env.FrameIndex);
                Assert.Equal(gated, env.IsGated);
                Assert.Equal(item.GetProperty("snapshot").GetBoolean(), env.IsSnapshot);
                Assert.Equal(i == frames.Count - 1, env.IsFinal);

                byte[] plain = Open(ChannelId, frames[i]);
                int dataLen = (int)BinaryPrimitives.ReadUInt32BigEndian(plain);
                var data = plain.AsSpan(4, dataLen).ToArray();
                if (i == 0)
                {
                    // 第 0 帧:u16 meta_len ‖ meta_json ‖ 内容
                    int metaLen = BinaryPrimitives.ReadUInt16BigEndian(data);
                    Assert.Equal(item.GetProperty("meta_json").GetString(), Encoding.UTF8.GetString(data.AsSpan(2, metaLen)));
                    content.AddRange(data.AsSpan(2 + metaLen).ToArray());
                }
                else
                {
                    content.AddRange(data);
                }
            }
            Assert.Equal(H(item.GetProperty("content")), content.ToArray());

            // 非 GATED 条目必须是单帧且 FINAL,这是服务端强制的规则
            if (!gated) Assert.Single(frames);
        }
    }

    [Fact]
    public void RawFrameVectorsParse()
    {
        foreach (var f in V.GetProperty("raw_frames").EnumerateArray())
        {
            Assert.True(Envelope.TryParse(H(f.GetProperty("envelope")), out var env));
            Assert.False(env.IsEnc);
            Assert.Equal((FrameFlags)f.GetProperty("flags").GetInt32(), env.Flags);
            Assert.Equal(H(f.GetProperty("payload")).Length, env.PayloadLength);
        }
    }

    [Fact]
    public void LabelVectorsDecryptWithTheDerivedKey()
    {
        byte[] kLabel = Hkdf(KEnc, ChannelId, "webdrop/v1/label");
        foreach (var l in V.GetProperty("labels").EnumerateArray())
        {
            byte[] blob = H(l.GetProperty("blob"));
            Assert.True(blob.Length <= 256, "设备名总长不得超过 256 字节(服务端上限)");

            var plain = new byte[blob.Length - 12 - 16];
            using var gcm = new AesGcm(kLabel, 16);
            gcm.Decrypt(blob.AsSpan(0, 12), blob.AsSpan(12, plain.Length), blob.AsSpan(blob.Length - 16), plain, H(l.GetProperty("aad")));
            Assert.Equal(l.GetProperty("name").GetString(), Encoding.UTF8.GetString(plain));
        }
    }

    [Fact]
    public void LogRecordVectorsMatchTheServerEncoders()
    {
        foreach (var r in V.GetProperty("log_records").EnumerateArray())
        {
            var parsed = r.GetProperty("parsed");
            long seq = parsed.GetProperty("seq").GetInt64();
            byte[] expected = H(r.GetProperty("hex"));

            switch (parsed.GetProperty("kind").GetString())
            {
                case "tombstone":
                    var item = Id16.FromBytes(H(parsed.GetProperty("item_id")));
                    Assert.Equal(expected, LogRecord.EncodeTombstone(seq, item, (TombstoneReason)parsed.GetProperty("reason").GetInt32()));
                    break;
                case "announce":
                    Assert.Equal(expected, LogRecord.EncodeAnnounce(seq, Id16.FromBytes(H(parsed.GetProperty("item_id"))),
                        (FrameFlags)parsed.GetProperty("flags").GetInt32(), parsed.GetProperty("created_at").GetInt64()));
                    break;
                case "frame":
                    Assert.Equal(expected, LogRecord.Encode(seq, LogKind.Frame, H(parsed.GetProperty("envelope"))));
                    break;
            }
        }
    }

    [Fact]
    public void LinkIdsAreCanonicalForTheServer()
    {
        string id = V.GetProperty("inputs").GetProperty("channel_id_b64").GetString()!;
        Assert.True(Id16.TryParse(id, out var parsed));
        Assert.Equal(ChannelId, parsed.ToArray());
        Assert.False(Id16.TryParse("AAAAAAAAAAAAAAAAAAAAAB", out _)); // 非规范编码,对应向量 non_canonical_id
    }

    [Fact]
    public void NegativeVectorsAreRejectedByTheServerSideChecksOrByAuthentication()
    {
        byte[] original = ChannelId;
        foreach (var n in V.GetProperty("negative").EnumerateArray())
        {
            string name = n.GetProperty("name").GetString()!;
            string expect = n.GetProperty("expect").GetString()!;
            byte[] envelope = H(n.GetProperty("envelope"));
            byte[] channel = n.TryGetProperty("channel_id", out var c) ? H(c) : original;

            switch (expect)
            {
                case "bad_envelope":
                    Assert.False(Envelope.TryParse(envelope, out _), name);
                    break;
                case "auth_failed":
                    // 结构合法,但 GCM 认证必须失败(篡改、换头部、换频道都被 AAD 抓住)
                    Assert.True(Envelope.TryParse(envelope, out _), name);
                    Assert.ThrowsAny<CryptographicException>(() => Open(channel, envelope));
                    break;
                case "wrong_mode":
                    // 没有 ENC 标志的帧:封装合法,但在 enc 频道上服务端会以 mode_mismatch 拒绝
                    Assert.True(Envelope.TryParse(envelope, out var env), name);
                    Assert.False(env.IsEnc, name);
                    break;
                default:
                    Assert.Fail($"未知的期望类型 {expect}");
                    break;
            }
        }
    }
}