import { SignJWT, jwtVerify, type JWTPayload } from "jose";
import { JWT_EXPIRY_SECONDS } from "@/lib/constants/auth";
import { unauthorized } from "@/modules/auth/errors";

export const EMBED_DEMO_ROLE = "embed_demo" as const;
export const EMBED_DEMO_COOKIE = "embed_demo_session";
export const EMBED_DEMO_DEFAULT_PASSWORD = "123456";

/**
 * 嵌入 Cookie 选项：生产环境 iframe（跨站宿主如 CC）须 SameSite=None + Secure，
 * 否则第三方 iframe 内登录态无法写入/回传。
 */
export function embedDemoCookieOptions(maxAgeSeconds?: number): {
  httpOnly: boolean;
  secure: boolean;
  sameSite: "lax" | "none";
  path: string;
  maxAge?: number;
} {
  const isProd = process.env.NODE_ENV === "production";
  const forceNone =
    process.env.EMBED_COOKIE_SAMESITE?.trim().toLowerCase() === "none";
  const useNone = isProd || forceNone;
  return {
    httpOnly: true,
    secure: useNone ? true : isProd,
    sameSite: useNone ? "none" : "lax",
    path: "/",
    ...(typeof maxAgeSeconds === "number" ? { maxAge: maxAgeSeconds } : {}),
  };
}

/** 登录类型：账号密码 / API Key */
export type EmbedDemoLoginType = "password" | "api_key";

export type EmbedDemoJwtPayload = {
  sub: string;
  role: typeof EMBED_DEMO_ROLE;
  loginType: EmbedDemoLoginType;
};

function normalizeLoginType(raw: unknown): EmbedDemoLoginType {
  // 兼容旧 Cookie（无 lt 声明）：默认按账号密码处理
  return raw === "api_key" ? "api_key" : "password";
}

function getJwtSecret(): Uint8Array {
  const secret = process.env.JWT_SECRET;
  if (!secret) {
    throw new Error("JWT_SECRET 未配置");
  }
  return new TextEncoder().encode(secret);
}

export function getEmbedDemoPassword(): string {
  return process.env.EMBED_DEMO_PASSWORD?.trim() || EMBED_DEMO_DEFAULT_PASSWORD;
}

function toEmbedPayload(payload: JWTPayload): EmbedDemoJwtPayload {
  if (typeof payload.sub !== "string" || payload.role !== EMBED_DEMO_ROLE) {
    throw unauthorized("无效的演示会话");
  }
  return {
    sub: payload.sub,
    role: EMBED_DEMO_ROLE,
    loginType: normalizeLoginType(payload.lt),
  };
}

export async function signEmbedDemoToken(
  customerId: string,
  loginType: EmbedDemoLoginType = "password",
): Promise<string> {
  return new SignJWT({ role: EMBED_DEMO_ROLE, lt: loginType })
    .setProtectedHeader({ alg: "HS256" })
    .setSubject(customerId)
    .setIssuedAt()
    .setExpirationTime(`${JWT_EXPIRY_SECONDS}s`)
    .sign(getJwtSecret());
}

export async function verifyEmbedDemoToken(
  token: string,
): Promise<EmbedDemoJwtPayload> {
  try {
    const { payload } = await jwtVerify(token, getJwtSecret(), {
      algorithms: ["HS256"],
    });
    return toEmbedPayload(payload);
  } catch {
    throw unauthorized("演示会话无效或已过期");
  }
}