package payment

import (
	"context"
	"crypto"
	"crypto/rand"
	"crypto/rsa"
	"crypto/sha256"
	"crypto/x509"
	"encoding/base64"
	"encoding/pem"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"os"
	"sort"
	"strconv"
	"strings"
	"time"

	"server/models"

	pkcs12 "software.sslmate.com/src/go-pkcs12"
)

// UnionPayChannel 银联全渠道（PC 网关支付 / 手机控件支付）
//
// 银联没有官方 Go SDK，这里按「全渠道支付平台产品接口规范」实现签名与请求：
//   - 签名：SHA256withRSA，字段按 key ASCII 升序拼 key=value&... 后私钥签名，base64 放入 signature；
//   - 下单：POST /gateway/api/frontTransReq.do（前台跳转，返回自动提交表单）；
//   - 查询：POST /gateway/api/queryTrans.do（txnType=00）；
//   - 退货：POST /gateway/api/backTransReq.do（txnType=04）。
//
// 渠道参数（config_json）：
//
//	mer_id        商户号
//	acq_ins_code  收单机构代码
//	cert_password 商户证书密码
//	is_production  "1" 生产网关 / 其他为测试网关
//
// 证书（cert_json）：
//
//	cert_path     商户证书（.pfx / .p12，或 .cer + .pem 私钥组合）
type UnionPayChannel struct{}

func (c *UnionPayChannel) Code() string { return ChannelUnionPay }
func (c *UnionPayChannel) Name() string { return "银联" }

const (
	unionPayGatewayProd    = "https://gateway.95516.com"
	unionPayGatewayTest    = "https://gateway.test.95516.com"
	unionPayVersion        = "5.1.0"
	unionPayCurrencyCNY    = "156"
	unionPayDefaultBizType = "000201" // B2C 网关支付
)

func unionPayGateway(cfg *ChannelConfig) string {
	if cfg.Get("is_production") == "1" {
		return unionPayGatewayProd
	}
	return unionPayGatewayTest
}

// unionPayKey 加载商户私钥与证书（支持 .pfx/.p12 与 .pem+.cer 两种形式）
func unionPayKey(cfg *ChannelConfig) (*rsa.PrivateKey, *x509.Certificate, error) {
	certPath := cfg.CertPaths["cert_path"]
	if certPath == "" {
		return nil, nil, fmt.Errorf("银联缺少商户证书：请先上传商户证书")
	}
	data, err := os.ReadFile(certPath)
	if err != nil {
		return nil, nil, fmt.Errorf("读取银联证书失败: %w", err)
	}
	if block, _ := pem.Decode(data); block != nil && strings.Contains(block.Type, "PRIVATE KEY") {
		keyData, kerr := os.ReadFile(cfg.CertPaths["key_path"])
		if kerr != nil {
			return nil, nil, fmt.Errorf("读取银联私钥失败: %w", kerr)
		}
		priv, perr := parsePKCS1Or8(string(keyData))
		if perr != nil {
			return nil, nil, perr
		}
		cert, cerr := loadCertFile(certPath)
		if cerr != nil {
			return nil, nil, cerr
		}
		return priv, cert, nil
	}

	privAny, cert, err := pkcs12.Decode(data, cfg.Get("cert_password"))
	if err != nil {
		return nil, nil, fmt.Errorf("解析银联 .pfx 证书失败（密码是否正确）: %w", err)
	}
	priv, ok := privAny.(*rsa.PrivateKey)
	if !ok {
		return nil, nil, fmt.Errorf("银联证书私钥不是 RSA 私钥")
	}
	if cert == nil {
		return nil, nil, fmt.Errorf("银联证书缺少证书信息")
	}
	return priv, cert, nil
}

func parsePKCS1Or8(pemStr string) (*rsa.PrivateKey, error) {
	block, _ := pem.Decode([]byte(pemStr))
	if block == nil {
		return nil, fmt.Errorf("私钥不是有效的 PEM")
	}
	if key, err := x509.ParsePKCS1PrivateKey(block.Bytes); err == nil {
		return key, nil
	}
	key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
	if err != nil {
		return nil, fmt.Errorf("解析私钥失败: %w", err)
	}
	rsaKey, ok := key.(*rsa.PrivateKey)
	if !ok {
		return nil, fmt.Errorf("私钥不是 RSA 私钥")
	}
	return rsaKey, nil
}

func loadCertFile(path string) (*x509.Certificate, error) {
	data, err := os.ReadFile(path)
	if err != nil {
		return nil, err
	}
	block, _ := pem.Decode(data)
	if block == nil {
		return nil, fmt.Errorf("证书不是有效的 PEM")
	}
	return x509.ParseCertificate(block.Bytes)
}

// unionPayCertID 银联证书序列号（SerialNumber 十六进制大写）
func unionPayCertID(cert *x509.Certificate) string {
	return strings.ToUpper(fmt.Sprintf("%x", cert.SerialNumber))
}

// unionPaySign 银联签名：key 升序拼 key=value&... 后 SHA256withRSA
func unionPaySign(params map[string]string, key *rsa.PrivateKey) (string, error) {
	keys := make([]string, 0, len(params))
	for k, v := range params {
		if k == "signature" || v == "" {
			continue
		}
		keys = append(keys, k)
	}
	sort.Strings(keys)
	pairs := make([]string, 0, len(keys))
	for _, k := range keys {
		pairs = append(pairs, k+"="+params[k])
	}
	digest := sha256.Sum256([]byte(strings.Join(pairs, "&")))
	sig, err := rsa.SignPKCS1v15(rand.Reader, key, crypto.SHA256, digest[:])
	if err != nil {
		return "", err
	}
	return base64.StdEncoding.EncodeToString(sig), nil
}

// unionPaySigned 组装带签名与 certId 的请求参数
func unionPaySigned(cfg *ChannelConfig, priv *rsa.PrivateKey, cert *x509.Certificate, extra map[string]string) (map[string]string, error) {
	params := map[string]string{
		"version":    unionPayVersion,
		"encoding":   "UTF-8",
		"signMethod": "01",
		"accessType": "0",
		"merId":      cfg.Get("mer_id"),
	}
	for k, v := range extra {
		if v != "" {
			params[k] = v
		}
	}
	sig, err := unionPaySign(params, priv)
	if err != nil {
		return nil, fmt.Errorf("银联签名失败: %w", err)
	}
	params["signature"] = sig
	params["certId"] = unionPayCertID(cert)
	return params, nil
}

// unionPayPostRaw 提交表单并返回原始响应
func unionPayPostRaw(ctx context.Context, endpoint string, params map[string]string) (string, error) {
	form := url.Values{}
	for k, v := range params {
		form.Set(k, v)
	}
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, strings.NewReader(form.Encode()))
	if err != nil {
		return "", err
	}
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded;charset=UTF-8")
	resp, err := (&http.Client{Timeout: 20 * time.Second}).Do(req)
	if err != nil {
		return "", fmt.Errorf("请求银联网关失败: %w", err)
	}
	defer func() { _ = resp.Body.Close() }()
	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return "", err
	}
	if resp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("银联网关返回 HTTP %d: %s", resp.StatusCode, truncateStr(string(body), 200))
	}
	return string(body), nil
}

// unionPayPostForm 解析 form-urlencoded 响应（queryTrans / backTransReq.do）
func unionPayPostForm(ctx context.Context, endpoint string, params map[string]string) (url.Values, error) {
	body, err := unionPayPostRaw(ctx, endpoint, params)
	if err != nil {
		return nil, err
	}
	vals, perr := url.ParseQuery(body)
	if perr != nil || len(vals) == 0 {
		return nil, fmt.Errorf("银联响应不是有效的表单数据: %s", truncateStr(body, 200))
	}
	return vals, nil
}

func truncateStr(s string, n int) string {
	if len(s) <= n {
		return s
	}
	return s[:n] + "..."
}

func (c *UnionPayChannel) Prepay(ctx context.Context, order *models.PlatformPaymentOrder, cfg *ChannelConfig, opt PrepayOption) (*PayParams, error) {
	priv, cert, err := unionPayKey(cfg)
	if err != nil {
		return nil, err
	}
	extra := map[string]string{
		"txnType":      "01",
		"txnSubType":   "01",
		"bizType":      unionPayDefaultBizType,
		"orderId":      order.PayNo,
		"txnTime":      time.Now().Format("20060102150405"),
		"txnAmt":       strconv.FormatInt(order.Amount, 10),
		"currencyCode": unionPayCurrencyCNY,
		"backUrl":      cfg.CallbackURL,
		"frontUrl":     order.ReturnURL,
	}
	params, err := unionPaySigned(cfg, priv, cert, extra)
	if err != nil {
		return nil, err
	}
	// 前台跳转：银联返回自动提交表单，前端写入页面即可拉起收银台
	html, err := unionPayPostRaw(ctx, unionPayGateway(cfg)+"/gateway/api/frontTransReq.do", params)
	if err != nil {
		return nil, fmt.Errorf("银联下单失败: %w", err)
	}
	payType := PayTypeWeb
	if strings.EqualFold(opt.PayType, PayTypeH5) {
		payType = PayTypeH5
	}
	return &PayParams{Channel: ChannelUnionPay, PayType: payType, Form: html}, nil
}

func (c *UnionPayChannel) Query(ctx context.Context, order *models.PlatformPaymentOrder, cfg *ChannelConfig) (*ChannelState, error) {
	priv, cert, err := unionPayKey(cfg)
	if err != nil {
		return nil, err
	}
	extra := map[string]string{
		"txnType":    "00",
		"txnSubType": "00",
		"bizType":    unionPayDefaultBizType,
		"orderId":    order.PayNo,
		"txnTime":    order.CreateTime.Format("20060102150405"),
	}
	params, err := unionPaySigned(cfg, priv, cert, extra)
	if err != nil {
		return nil, err
	}
	// TODO(银联): 查询响应字段（origRespCode/origTxnAmt/queryId 等）以入网时下发的接口文档为准，联调时校准。
	vals, err := unionPayPostForm(ctx, unionPayGateway(cfg)+"/gateway/api/queryTrans.do", params)
	if err != nil {
		return nil, err
	}
	state := &ChannelState{Raw: fmt.Sprint(vals)}
	if vals.Get("queryId") != "" {
		state.ChannelTradeNo = vals.Get("queryId")
	}
	if vals.Get("origRespCode") == "00" {
		state.TradeState = StateSuccess
		if amt, aerr := strconv.ParseInt(vals.Get("origTxnAmt"), 10, 64); aerr == nil {
			state.Amount = amt
		}
		now := time.Now()
		state.PaidAt = &now
	} else {
		state.TradeState = StatePending
	}
	return state, nil
}

func (c *UnionPayChannel) ParseNotify(ctx context.Context, r *http.Request, cfg *ChannelConfig) (*NotifyResult, error) {
	priv, _, err := unionPayKey(cfg)
	if err != nil {
		return nil, err
	}
	if err := r.ParseForm(); err != nil {
		return nil, fmt.Errorf("解析银联通知失败: %w", err)
	}
	form := map[string]string{}
	for k := range r.Form {
		form[k] = r.Form.Get(k)
	}
	expect, err := unionPaySign(form, priv)
	if err != nil {
		return nil, err
	}
	if expect != r.Form.Get("signature") {
		return nil, fmt.Errorf("银联通知验签失败")
	}

	result := &NotifyResult{
		EventType: "UNIONPAY.NOTIFY",
		AckBody:   "ok",
		Raw:       fmt.Sprint(r.Form),
	}
	result.PayNo = form["orderId"]
	result.OutTradeNo = form["orderId"]
	result.ChannelTradeNo = form["queryId"]
	if amt, aerr := strconv.ParseInt(form["txnAmt"], 10, 64); aerr == nil {
		result.Amount = amt
	}
	if form["respCode"] == "00" {
		result.TradeState = StateSuccess
		result.Paid = true
	} else {
		result.TradeState = StateFailed
	}
	return result, nil
}

func (c *UnionPayChannel) Refund(ctx context.Context, order *models.PlatformPaymentOrder, refundNo string, amount int64, reason string, cfg *ChannelConfig) (string, error) {
	if order.ChannelTradeNo == "" {
		return "", fmt.Errorf("银联退回需要原交易流水号，请先执行「手动查询渠道状态」")
	}
	priv, cert, err := unionPayKey(cfg)
	if err != nil {
		return "", err
	}
	extra := map[string]string{
		"txnType":    "04",
		"txnSubType": "00",
		"bizType":    unionPayDefaultBizType,
		"orderId":    refundNo,
		"txnTime":    time.Now().Format("20060102150405"),
		"txnAmt":     strconv.FormatInt(amount, 10),
		"origQryId":  order.ChannelTradeNo,
		"backUrl":    cfg.CallbackURL,
	}
	params, err := unionPaySigned(cfg, priv, cert, extra)
	if err != nil {
		return "", err
	}
	// TODO(银联): 退货响应字段与重试策略以入网时下发的接口文档为准，联调时校准。
	vals, err := unionPayPostForm(ctx, unionPayGateway(cfg)+"/gateway/api/backTransReq.do", params)
	if err != nil {
		return "", err
	}
	if vals.Get("respCode") != "00" {
		return "", fmt.Errorf("银联退回失败: %s %s", vals.Get("respCode"), vals.Get("respMsg"))
	}
	return vals.Get("queryId"), nil
}

func (c *UnionPayChannel) TestConnect(ctx context.Context, cfg *ChannelConfig) (string, error) {
	priv, cert, err := unionPayKey(cfg)
	if err != nil {
		return "", err
	}
	if _, err := unionPaySign(map[string]string{"merId": cfg.Get("mer_id"), "orderId": "__connect_test__"}, priv); err != nil {
		return "", err
	}
	// TODO(银联): 如需校验网关连通性，可在入网报备后用一笔查询交易确认。
	return fmt.Sprintf("连接成功：证书加载与签名校验通过（证书序列号 %s，网关 %s）", unionPayCertID(cert), unionPayGateway(cfg)), nil
}

// CloudPayChannel 云闪付：走银联通道，商户参数与证书完全复用银联配置；
// 收银台是否展示云闪付标识由 extra_json.show_logo 控制（由前端收银台读取），适配器层面与银联一致。
type CloudPayChannel struct {
	UnionPayChannel
}

func (c *CloudPayChannel) Code() string { return ChannelCloudPay }
func (c *CloudPayChannel) Name() string { return "云闪付" }