// Copyright 2022 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
//go:build plus

package nodes

import (
	"context"
	"encoding/base64"
	"github.com/TeaOSLab/EdgeCommon/pkg/iputils"
	"github.com/TeaOSLab/EdgeCommon/pkg/nodeconfigs"
	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
	"github.com/TeaOSLab/EdgeNode/internal/remotelogs"
	"github.com/TeaOSLab/EdgeNode/internal/utils/encrypt"
	"github.com/TeaOSLab/EdgeNode/internal/utils/fasttime"
	setutils "github.com/TeaOSLab/EdgeNode/internal/utils/sets"
	"github.com/iwind/TeaGo/lists"
	"github.com/iwind/TeaGo/rands"
	"github.com/iwind/TeaGo/types"
	stringutil "github.com/iwind/TeaGo/utils/string"
	"net"
	"sync"
	"time"
)

const (
	LNKeyHeader            = "X-Edge-Ln-Key"
	LNExpiresHeader        = "X-Edge-Ln-Expires"
	LnExpiresSeconds int64 = 30
)

var lnOriginConfigsMap = map[string]*serverconfigs.OriginConfig{}
var lnEncryptMethodMap = map[string]encrypt.MethodInterface{}
var lnRequestIdSet = setutils.NewFixedSet(32 * 1024)

var lnNodeIPMap = map[string]bool{} // node ip => bool
var lnNodeIPLocker = &sync.RWMutex{}

var lnLocker = &sync.RWMutex{}

func existsLnNodeIP(nodeIP string) bool {
	lnNodeIPLocker.RLock()
	defer lnNodeIPLocker.RUnlock()
	return lnNodeIPMap[nodeIP]
}

func (this *HTTPRequest) checkLnRequest() bool {
	var keyString = this.RawReq.Header.Get(LNKeyHeader)
	if len(keyString) <= 20 {
		return false
	}

	// 删除
	this.RawReq.Header.Del(LNKeyHeader)

	// 当前连接IP
	connIP, _, _ := net.SplitHostPort(this.RawReq.RemoteAddr)
	var realIP = this.RawReq.Header.Get("X-Real-Ip")
	if len(realIP) > 0 && !iputils.IsValid(realIP) {
		realIP = ""
	}

	// 如果是在已经识别的L[n-1]节点IP列表中，无需再次验证
	if existsLnNodeIP(connIP) && len(realIP) > 0 {
		this.tags = append(this.tags, "L"+types.String(this.nodeConfig.Level))
		this.lnRemoteAddr = realIP
		return true
	}

	// 如果已经在允许的IP中，则直接允许通过，无需再次验证
	// 这个需要放在 existsLnNodeIP() 检查之后
	if this.nodeConfig != nil && this.nodeConfig.IPIsAutoAllowed(connIP) && len(realIP) > 0 {
		this.tags = append(this.tags, "L"+types.String(this.nodeConfig.Level))
		this.lnRemoteAddr = realIP
		lnNodeIPLocker.Lock()
		lnNodeIPMap[connIP] = true
		lnNodeIPLocker.Unlock()
		return true
	}

	// 检查Key
	keyEncodedData, err := base64.StdEncoding.DecodeString(keyString)
	if err != nil {
		return false
	}

	var secret = this.nodeConfig.SecretHash()
	lnLocker.Lock()
	method, ok := lnEncryptMethodMap[secret]
	if !ok {
		method, err = encrypt.NewMethodInstance("aes-192-cfb", secret, secret)
		if err != nil {
			lnLocker.Unlock()
			return false
		}
	}
	lnLocker.Unlock()

	keyData, err := method.Decrypt(keyEncodedData)
	if err != nil {
		return false
	}

	var key = &LnRequestKey{}
	err = UnmarshalLnRequestKey(keyData, key)
	if err != nil {
		return false
	}

	// Method和URL需要一致
	if key.URLMd5 != stringutil.Md5(this.URL()) || key.Method != this.Method() {
		return false
	}

	// N秒钟过期，这里要求两个节点时间相差不能超过此时间
	var currentUnixTime = fasttime.Now().Unix()
	if key.Timestamp < currentUnixTime-LnExpiresSeconds {
		return false
	}

	// 检查请求ID唯一性
	// TODO 因为FixedSet是有限的，这里仍然无法避免重放攻击
	// TODO 而RequestId是并发的，并不能简单的对比大小
	// TODO 所以为了绝对的安全，需要使用HTTPS并检查子节点的IP
	if lnRequestIdSet.Has(key.RequestId) {
		return false
	}
	lnRequestIdSet.Push(key.RequestId)

	this.lnRemoteAddr = key.RemoteAddr

	this.tags = append(this.tags, "L"+types.String(this.nodeConfig.Level))

	// 当前连接IP
	if len(connIP) > 0 {
		lnNodeIPLocker.Lock()
		lnNodeIPMap[connIP] = true
		lnNodeIPLocker.Unlock()
	}

	return true
}

func (this *HTTPRequest) getLnOrigin(excludingNodeIds []int64, urlHash uint64) (originConfig *serverconfigs.OriginConfig, lnNodeId int64, hasMultipleNodes bool) {
	var parentNodesMap = this.nodeConfig.ParentNodes // 需要复制，防止运行过程中修改
	if len(parentNodesMap) == 0 {
		return nil, 0, false
	}

	parentNodes, ok := parentNodesMap[this.ReqServer.ClusterId]
	var countParentNodes = len(parentNodes)
	if ok && countParentNodes > 0 {
		var parentNode *nodeconfigs.ParentNodeConfig

		// 尝试顺序读取
		if len(excludingNodeIds) > 0 {
			for _, node := range parentNodes {
				if !lists.ContainsInt64(excludingNodeIds, node.Id) {
					parentNode = node
					break
				}
			}
		}

		// 尝试随机读取
		if parentNode == nil {
			if countParentNodes == 1 {
				parentNode = parentNodes[0]
			} else {
				var method = serverconfigs.LnRequestSchedulingMethodURLMapping
				if this.nodeConfig != nil {
					var globalServerConfig = this.nodeConfig.GlobalServerConfig // copy
					if globalServerConfig != nil {
						method = globalServerConfig.HTTPAll.LnRequestSchedulingMethod
					}
				}

				switch method {
				case serverconfigs.LnRequestSchedulingMethodRandom:
					// 随机选取一个L2节点，有利于流量均衡，但同一份缓存可能会存在多个L2节点上，占用更多的空间
					parentNode = parentNodes[rands.Int(0, countParentNodes-1)]
				default:
					// 从固定的L2节点读取内容，优点是能够提升缓存命中率，缺点是可能会导致多个L2节点流量不均衡
					parentNode = parentNodes[urlHash%uint64(countParentNodes)]
				}
			}
		}

		lnNodeId = parentNode.Id

		var countAddrs = len(parentNode.Addrs)
		if countAddrs == 0 {
			return nil, 0, false
		}

		var addr = parentNode.Addrs[rands.Int(0, countAddrs-1)]

		var protocol = this.requestScheme() // http|https TODO 需要可以设置是否强制HTTPS回二级节点
		var portString = types.String(this.requestServerPort())
		var originKey = protocol + "@" + addr + "@" + portString
		lnLocker.RLock()
		config, ok := lnOriginConfigsMap[originKey]
		lnLocker.RUnlock()

		if !ok {
			config = &serverconfigs.OriginConfig{
				Id:   0,
				IsOn: true,
				Addr: &serverconfigs.NetworkAddressConfig{
					Protocol:  serverconfigs.Protocol(protocol),
					Host:      addr,
					PortRange: portString,
				},
				IsOk: true,
			}

			err := config.Init(context.Background())
			if err != nil {
				remotelogs.Error("HTTP_REQUEST", "create ln origin config failed: "+err.Error())
				return nil, 0, false
			}

			lnLocker.Lock()
			lnOriginConfigsMap[originKey] = config
			lnLocker.Unlock()
		}

		// 添加Header
		this.RawReq.Header.Set(LNKeyHeader, this.encodeLnKey(parentNode.SecretHash))

		return config, lnNodeId, len(parentNodes) > 0
	}

	return nil, 0, false
}

func (this *HTTPRequest) encodeLnKey(secretHash string) string {
	var key = &LnRequestKey{
		NodeId:     this.nodeConfig.Id,
		RequestId:  this.requestId,
		Timestamp:  time.Now().Unix(),
		RemoteAddr: this.RemoteAddr(),
		URLMd5:     stringutil.Md5(this.URL()),
		Method:     this.Method(),
	}

	data, err := key.AsPB()
	if err != nil {
		remotelogs.Error("HTTP_REQUEST", "ln request: encode key failed: "+err.Error())
		return ""
	}

	lnLocker.Lock()
	method, ok := lnEncryptMethodMap[secretHash]
	if !ok {
		method, err = encrypt.NewMethodInstance("aes-192-cfb", secretHash, secretHash)
		if err != nil {
			remotelogs.Error("HTTP_REQUEST", "ln request: create encrypt method failed: "+err.Error())
			lnLocker.Unlock()
			return ""
		}
		lnEncryptMethodMap[secretHash] = method
	}
	lnLocker.Unlock()

	dst, err := method.Encrypt(data)
	if err != nil {
		remotelogs.Error("HTTP_REQUEST", "ln request: encode key failed: "+err.Error())
		return ""
	}
	return base64.StdEncoding.EncodeToString(dst)
}