import { readFile } from 'node:fs/promises'
import { resolve } from 'node:path'

const PACKAGE_NAME = 'com.d3ro.voice'
const REQUIRED_RELATION = 'delegate_permission/common.handle_all_urls'
const LIVE_URL = 'https://d3ro.chanpaca.net/.well-known/assetlinks.json'
const COMPROMISED_SIGNER_SHA256 = '06eec757722ee7cd3dfbc53202d974aaf0417a7d397f9ef1e5611088ebb2e481'
const SOURCE_PATHS = [
  'site/public/.well-known/assetlinks.json',
  'apps/web/public/.well-known/assetlinks.json',
  'apps/api-server/wwwroot/.well-known/assetlinks.json',
]
const releaseIdentity = JSON.parse(
  await readFile(resolve('release/android-release-identity.json'), 'utf8'),
)

function fail(message) {
  throw new Error(`android_app_links_invalid:${message}`)
}

function normalizeFingerprint(value) {
  if (typeof value !== 'string') fail('certificate_fingerprint_not_string')
  const normalized = value.replace(/:/g, '').toUpperCase()
  if (!/^[0-9A-F]{64}$/.test(normalized)) fail('certificate_fingerprint_format')
  return normalized
}

function rejectCompromisedFingerprint(value, label) {
  const normalized = normalizeFingerprint(value)
  if (normalized === COMPROMISED_SIGNER_SHA256.toUpperCase()) {
    fail(`${label}_compromised_certificate`)
  }
  return normalized
}

function parseArguments(argv) {
  const options = {}
  for (let index = 0; index < argv.length; index += 1) {
    const current = argv[index]
    if (!current.startsWith('--')) fail(`unexpected_argument_${current}`)
    const value = argv[index + 1]
    if (!value || value.startsWith('--')) fail(`missing_value_${current.slice(2)}`)
    options[current.slice(2)] = value
    index += 1
  }
  const allowed = new Set([
    'expected-play-app-signing-cert-sha256',
    'forbidden-upload-cert-sha256',
    'live-url',
  ])
  for (const name of Object.keys(options)) {
    if (!allowed.has(name)) fail(`unexpected_argument_${name}`)
  }
  return options
}

function fingerprintsFromDocument(document, label) {
  if (!Array.isArray(document)) fail(`${label}_root_not_array`)
  const matchingEntries = document.filter((entry) => (
    entry?.target?.namespace === 'android_app'
    && entry?.target?.package_name === PACKAGE_NAME
  ))
  if (matchingEntries.length !== 1) fail(`${label}_package_entry_count_${matchingEntries.length}`)
  const entry = matchingEntries[0]
  if (!Array.isArray(entry.relation) || !entry.relation.includes(REQUIRED_RELATION)) {
    fail(`${label}_required_relation_missing`)
  }
  if (!Array.isArray(entry.target.sha256_cert_fingerprints)) {
    fail(`${label}_fingerprints_missing`)
  }
  const fingerprints = new Set(entry.target.sha256_cert_fingerprints.map((fingerprint) => (
    rejectCompromisedFingerprint(fingerprint, label)
  )))
  if (fingerprints.size === 0) fail(`${label}_fingerprints_empty`)
  if (fingerprints.size !== entry.target.sha256_cert_fingerprints.length) {
    fail(`${label}_duplicate_fingerprints`)
  }
  return [...fingerprints].sort()
}

function rejectUploadCertificateAssociation(fingerprints, uploadFingerprint, label) {
  if (uploadFingerprint && fingerprints.includes(uploadFingerprint)) {
    fail(`${label}_contains_upload_certificate`)
  }
}

function requireExactPlayCertificate(fingerprints, expectedFingerprint, label) {
  if (!expectedFingerprint) return
  if (fingerprints.length !== 1 || fingerprints[0] !== expectedFingerprint) {
    fail(`${label}_play_certificate_set_mismatch`)
  }
}

function validateLiveResponseMetadata(response, requestedUrl) {
  if (response.status !== 200) fail(`live_http_${response.status}`)
  if (response.redirected) fail('live_redirected')
  if (new URL(response.url).href !== new URL(requestedUrl).href) {
    fail('live_final_url_mismatch')
  }
  const contentType = response.headers.get('content-type') ?? ''
  if (!/^application\/json(?:\s*;|$)/i.test(contentType)) {
    fail('live_content_type')
  }
}

function runSelfTest() {
  const safeFingerprint = '4FAC6924821C50DAABED764932A53C486F8C6C5F34B9F18DB920AA4099152B54'
  const safeDocument = [{
    relation: [REQUIRED_RELATION],
    target: {
      namespace: 'android_app',
      package_name: PACKAGE_NAME,
      sha256_cert_fingerprints: [safeFingerprint],
    },
  }]
  if (fingerprintsFromDocument(safeDocument, 'self_test')[0] !== safeFingerprint) {
    fail('self_test_safe_fingerprint_mismatch')
  }
  const uploadFingerprint = '7A'.repeat(32)
  rejectUploadCertificateAssociation([safeFingerprint], uploadFingerprint, 'self_test_safe')
  let uploadAssociationRejected = false
  try {
    rejectUploadCertificateAssociation([uploadFingerprint], uploadFingerprint, 'self_test')
  } catch (error) {
    uploadAssociationRejected = error instanceof Error
      && error.message.includes('self_test_contains_upload_certificate')
  }
  if (!uploadAssociationRejected) fail('self_test_upload_certificate_association_not_rejected')
  let compromisedRejected = false
  try {
    fingerprintsFromDocument([{
      ...safeDocument[0],
      target: {
        ...safeDocument[0].target,
        sha256_cert_fingerprints: [COMPROMISED_SIGNER_SHA256],
      },
    }], 'self_test')
  } catch (error) {
    compromisedRejected = error instanceof Error
      && error.message.includes('self_test_compromised_certificate')
  }
  if (!compromisedRejected) fail('self_test_compromised_certificate_not_rejected')
  let legacyArgumentRejected = false
  try {
    parseArguments(['--expected-cert-sha256', safeFingerprint])
  } catch (error) {
    legacyArgumentRejected = error instanceof Error
      && error.message.includes('unexpected_argument_expected-cert-sha256')
  }
  if (!legacyArgumentRejected) fail('self_test_legacy_certificate_argument_not_rejected')
  requireExactPlayCertificate([safeFingerprint], safeFingerprint, 'self_test_safe')
  let extraCertificateRejected = false
  try {
    requireExactPlayCertificate([safeFingerprint, uploadFingerprint].sort(), safeFingerprint, 'self_test')
  } catch (error) {
    extraCertificateRejected = error instanceof Error
      && error.message.includes('self_test_play_certificate_set_mismatch')
  }
  if (!extraCertificateRejected) fail('self_test_extra_certificate_not_rejected')
  validateLiveResponseMetadata({
    status: 200,
    redirected: false,
    url: LIVE_URL,
    headers: new Headers({ 'content-type': 'application/json; charset=utf-8' }),
  }, LIVE_URL)
  for (const [label, response] of [
    ['redirect', {
      status: 302,
      redirected: false,
      url: LIVE_URL,
      headers: new Headers({ 'content-type': 'application/json' }),
    }],
    ['mime', {
      status: 200,
      redirected: false,
      url: LIVE_URL,
      headers: new Headers({ 'content-type': 'text/plain' }),
    }],
    ['final_url', {
      status: 200,
      redirected: true,
      url: `${LIVE_URL}?redirected=1`,
      headers: new Headers({ 'content-type': 'application/json' }),
    }],
  ]) {
    let rejected = false
    try {
      validateLiveResponseMetadata(response, LIVE_URL)
    } catch (error) {
      rejected = error instanceof Error && error.message.startsWith('android_app_links_invalid:')
    }
    if (!rejected) fail(`self_test_${label}_metadata_not_rejected`)
  }
  process.stdout.write(`${JSON.stringify({
    ok: true,
    compromisedCertificateRejected: true,
    exactPlayCertificateRequired: true,
    liveHttpMetadataRequired: true,
    uploadCertificateAssociationRejected: true,
  })}\n`)
}

const cliArguments = process.argv.slice(2)
if (cliArguments.length === 1 && cliArguments[0] === '--self-test') {
  runSelfTest()
  process.exit(0)
}

const options = parseArguments(cliArguments)
if (
  releaseIdentity.schemaVersion !== 1
  || releaseIdentity.packageName !== PACKAGE_NAME
  || typeof releaseIdentity.playConsoleAppId !== 'string'
  || !/^\d+$/.test(releaseIdentity.playConsoleAppId)
) {
  fail('release_identity_invalid')
}
const canonicalExpectedFingerprint = rejectCompromisedFingerprint(
  releaseIdentity.playAppSigningCertificateSha256,
  'release_identity_play_app_signing',
)
const expectedFingerprint = options['expected-play-app-signing-cert-sha256']
  ? rejectCompromisedFingerprint(
    options['expected-play-app-signing-cert-sha256'],
    'expected_play_app_signing',
  )
  : canonicalExpectedFingerprint
if (expectedFingerprint !== canonicalExpectedFingerprint) {
  fail('expected_play_certificate_identity_mismatch')
}
const canonicalUploadFingerprint = rejectCompromisedFingerprint(
  releaseIdentity.uploadCertificateSha256,
  'release_identity_upload',
)
const forbiddenUploadFingerprint = options['forbidden-upload-cert-sha256']
  ? rejectCompromisedFingerprint(options['forbidden-upload-cert-sha256'], 'upload')
  : canonicalUploadFingerprint
if (forbiddenUploadFingerprint !== canonicalUploadFingerprint) {
  fail('upload_certificate_identity_mismatch')
}
if (expectedFingerprint && expectedFingerprint === forbiddenUploadFingerprint) {
  fail('play_and_upload_certificates_must_differ')
}

const sourceEvidence = []
for (const path of SOURCE_PATHS) {
  const document = JSON.parse(await readFile(resolve(path), 'utf8'))
  const fingerprints = fingerprintsFromDocument(document, path)
  rejectUploadCertificateAssociation(fingerprints, forbiddenUploadFingerprint, path)
  sourceEvidence.push({ path, fingerprints })
}
const canonicalFingerprints = sourceEvidence[0].fingerprints
for (const evidence of sourceEvidence.slice(1)) {
  if (JSON.stringify(evidence.fingerprints) !== JSON.stringify(canonicalFingerprints)) {
    fail(`source_fingerprint_drift_${evidence.path}`)
  }
}
if (expectedFingerprint && !canonicalFingerprints.includes(expectedFingerprint)) {
  fail('release_certificate_missing_from_source_assetlinks')
}
requireExactPlayCertificate(canonicalFingerprints, expectedFingerprint, 'source')

const liveUrl = options['live-url'] ?? LIVE_URL
const response = await fetch(liveUrl, {
  headers: { accept: 'application/json' },
  redirect: 'manual',
  signal: AbortSignal.timeout(15_000),
})
validateLiveResponseMetadata(response, liveUrl)
let liveDocument
try {
  liveDocument = await response.json()
} catch {
  fail('live_invalid_json')
}
const liveFingerprints = fingerprintsFromDocument(liveDocument, 'live')
rejectUploadCertificateAssociation(liveFingerprints, forbiddenUploadFingerprint, 'live')
if (JSON.stringify(liveFingerprints) !== JSON.stringify(canonicalFingerprints)) {
  fail('live_source_fingerprint_drift')
}
if (expectedFingerprint && !liveFingerprints.includes(expectedFingerprint)) {
  fail('release_certificate_missing_from_live_assetlinks')
}
requireExactPlayCertificate(liveFingerprints, expectedFingerprint, 'live')

console.log(JSON.stringify({
  packageName: PACKAGE_NAME,
  relation: REQUIRED_RELATION,
  liveUrl,
  fingerprints: canonicalFingerprints,
  playConsoleAppId: releaseIdentity.playConsoleAppId,
  expectedPlayAppSigningCertificateVerified: true,
  uploadCertificateExcluded: true,
  sourcePaths: SOURCE_PATHS,
}, null, 2))