// ---------------- 公共结构体 ----------------
type APIRequest struct {
	Host     string `json:"host"`
	Username string `json:"username"`
	Command  string `json:"command"`
}

// ---------------- 计算签名 ----------------
type SignResult struct {
	XTimestamp string
	XPublicKey string
	XSignature string
	SignedBody []byte
}

func MakeEd25519Headers(privBase64 string, body APIRequest) (*SignResult, error) {
	const (
		privDERLen      = 48
		seedStartIdx    = 16
		pubPrefix       = "MCowBQYDK2VwAyEA" // 12 B 固定前缀的 base64 表示
		timestampFmt    = "20060102150405"
	)
	der, err := base64.StdEncoding.DecodeString(privBase64)
	if err != nil || len(der) != privDERLen {
		return nil, fmt.Errorf("decode priv base64: %w", err)
	}
	seed := der[seedStartIdx:]
	privKey := ed25519.NewKeyFromSeed(seed)
	pubKey := privKey.Public().(ed25519.PublicKey)

	bodyBytes, _ := json.Marshal(body)
	ts := time.Now().UTC().Format(timestampFmt)
	msg := append([]byte(ts), bodyBytes...)

	sig := ed25519.Sign(privKey, msg)
	pubDER, _ := base64.StdEncoding.DecodeString(pubPrefix)
	pubDER = append(pubDER, pubKey...)

	return &SignResult{
		XTimestamp: ts,
		XPublicKey: base64.StdEncoding.EncodeToString(pubDER),
		XSignature: base64.StdEncoding.EncodeToString(sig),
		SignedBody: bodyBytes,
	}, nil
}

// ---------------- 发送 HTTP ----------------
func SendSignedRequest(url string, body APIRequest, sig *SignResult) (string, string, error) {
	j, _ := json.Marshal(body)
	req, _ := http.NewRequest("POST", url, bytes.NewReader(j))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("X-Timestamp", sig.XTimestamp)
	req.Header.Set("X-Public-Key", sig.XPublicKey)
	req.Header.Set("X-Signature", sig.XSignature)

	cli := &http.Client{Timeout: 8 * time.Second}
	resp, err := cli.Do(req)
	if err != nil {
		return "", "", err
	}
	defer resp.Body.Close()
	b, _ := io.ReadAll(resp.Body)
	return resp.Status, string(b), nil
}

func verifyEd25519(next http.Handler) http.Handler {
	const skew = 30 * time.Second
	const pubPrefixLen = 12

	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		tsStr := r.Header.Get("X-Timestamp")
		pubStr := r.Header.Get("X-Public-Key")
		sigStr := r.Header.Get("X-Signature")
		if tsStr == "" || pubStr == "" || sigStr == "" {
			http.Error(w, "missing hdr", 401); return
		}

		// 1. 时钟偏移
		ts, _ := time.ParseInLocation("20060102150405", tsStr, time.UTC)
		if d := time.Since(ts); d > skew || d < -skew {
			http.Error(w, "expired", 401); return
		}

		// 2. 公钥 & 签名还原
		pubDER, _ := base64.StdEncoding.DecodeString(pubStr)
		if len(pubDER) <= pubPrefixLen {
			http.Error(w, "pub too short", 401); return
		}
		pubKey := ed25519.PublicKey(pubDER[pubPrefixLen:])
		sig, _ := base64.StdEncoding.DecodeString(sigStr)

		// 3. 读取 body & 验签
		body, _ := io.ReadAll(r.Body)
		msg := append([]byte(tsStr), body...)
		if !ed25519.Verify(pubKey, msg, sig) {
			http.Error(w, "bad signature", 401); return
		}

		// 4. 复写 body 继续业务
		r.Body = io.NopCloser(bytes.NewReader(body))
		next.ServeHTTP(w, r)
	})
}

// go get github.com/golang-jwt/jwt/v5
func IssueJWT(privBase64, subject string, ttl time.Duration) (string, error) {
	const privDERLen = 48
	const seedStartIdx = 16

	der, _ := base64.StdEncoding.DecodeString(privBase64)
	if len(der) != privDERLen {
		return "", errors.New("bad key len")
	}
	seed := der[seedStartIdx:]
	priv := ed25519.NewKeyFromSeed(seed)

	claims := jwt.RegisteredClaims{
		Subject:   subject,
		ExpiresAt: jwt.NewNumericDate(time.Now().Add(ttl)),
		Issuer:    "cli-tool",
	}
	tok := jwt.NewWithClaims(jwt.SigningMethodEdDSA, claims)
	return tok.SignedString(priv)
}

func SendJWTRequest(url, jwtToken string, body APIRequest) (string, string, error) {
	j, _ := json.Marshal(body)
	req, _ := http.NewRequest("POST", url, bytes.NewReader(j))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer "+jwtToken)

	cli := &http.Client{Timeout: 8 * time.Second}
	resp, err := cli.Do(req)
	if err != nil {
		return "", "", err
	}
	defer resp.Body.Close()
	b, _ := io.ReadAll(resp.Body)
	return resp.Status, string(b), nil
}

func jwtMiddleware(pubDERBase64 string, next http.Handler) http.Handler {
	const pubPrefixLen = 12
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		auth := r.Header.Get("Authorization")
		if !strings.HasPrefix(auth, "Bearer ") {
			http.Error(w, "missing bearer", 401); return
		}
		tokenStr := strings.TrimPrefix(auth, "Bearer ")

		// 1. 解析公钥
		pubDER, _ := base64.StdEncoding.DecodeString(pubDERBase64)
		if len(pubDER) <= pubPrefixLen {
			http.Error(w, "bad pub", 401); return
		}
		pubKey := ed25519.PublicKey(pubDER[pubPrefixLen:])

		// 2. Parse & Validate
		t, err := jwt.Parse(tokenStr, func(tok *jwt.Token) (any, error) {
			if tok.Method != jwt.SigningMethodEdDSA {
				return nil, fmt.Errorf("unexpected alg")
			}
			return pubKey, nil
		})
		if err != nil || !t.Valid {
			http.Error(w, "unauthorized: "+err.Error(), 401); return
		}

		// 3. 可把 claims 放进 ctx
		ctx := context.WithValue(r.Context(), "claims", t.Claims)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}