import * as crypto from 'crypto';

// RSA 公钥（从许可证服务器获取，嵌入客户端）
const RSA_PUBLIC_KEY = process.env.LICENSE_PUBLIC_KEY?.replace(/\\n/g, '\n') || `-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwQNKx95FWT0XKXcskHhv
MmBluxHYpmPfKSPETyCO1cMDhf1TuFYggwP51b2BkkAiCS1sD3Hswb9VEzEJwbG/
nRF1cBNAGBLcDudnAWp5y8GTVr6voEEgsk88o0xVeQdNWwi3016XffB47Q235ixb
mr6cb0q9FEMMEQULKY9RFRcpVc2GvJup+c6/wIVV8Z0d7pGn+mD2eF+mucg+N+tJ
ocUfjgf9aE3dGitGYmA4xMU5OMEYXhydhNkOA+5YpHb7yrwQNuLAileGiq6aMp0i
RmWy9Pty+rygNRUK9kFDn0Fw4oZBNoVBkVebTqeeSZmrM8CJtE3KK0BrC5/TpFon
QQIDAQAB
-----END PUBLIC KEY-----`;

// 本地加密密钥（用于加密本地存储的数据）
const LOCAL_ENCRYPTION_KEY = process.env.LOCAL_ENCRYPTION_KEY || 'flnxi-local-encryption-key-32bytes!';

/**
 * 使用 RSA 公钥验证签名
 */
export function verifySignature(data: string, signature: string): boolean {
  try {
    const verify = crypto.createVerify('RSA-SHA256');
    verify.update(data);
    verify.end();
    return verify.verify(RSA_PUBLIC_KEY, signature, 'base64');
  } catch (error) {
    console.error('签名验证失败:', error);
    return false;
  }
}

/**
 * 验证签名后的许可证数据
 */
export function verifyLicenseSignature(licenseData: object, signature: string): boolean {
  const dataString = JSON.stringify(licenseData);
  return verifySignature(dataString, signature);
}

/**
 * 使用 AES-256-GCM 加密数据（用于本地存储）
 */
export function encryptLocal(plaintext: string): string {
  const iv = crypto.randomBytes(12);
  const key = crypto.scryptSync(LOCAL_ENCRYPTION_KEY, 'salt', 32);
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
  
  let encrypted = cipher.update(plaintext, 'utf8', 'base64');
  encrypted += cipher.final('base64');
  
  const authTag = cipher.getAuthTag();
  
  // 格式: iv:authTag:encrypted
  return `${iv.toString('base64')}:${authTag.toString('base64')}:${encrypted}`;
}

/**
 * 使用 AES-256-GCM 解密数据（用于本地存储）
 */
export function decryptLocal(ciphertext: string): string {
  try {
    const [ivBase64, authTagBase64, encrypted] = ciphertext.split(':');
    
    const iv = Buffer.from(ivBase64, 'base64');
    const authTag = Buffer.from(authTagBase64, 'base64');
    const key = crypto.scryptSync(LOCAL_ENCRYPTION_KEY, 'salt', 32);
    
    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
    decipher.setAuthTag(authTag);
    
    let decrypted = decipher.update(encrypted, 'base64', 'utf8');
    decrypted += decipher.final('utf8');
    
    return decrypted;
  } catch (error) {
    console.error('解密失败:', error);
    throw new Error('数据解密失败');
  }
}

/**
 * 计算数据哈希
 */
export function hashData(data: string): string {
  return crypto.createHash('sha256').update(data).digest('hex');
}

/**
 * 生成随机 ID
 */
export function generateId(): string {
  return crypto.randomBytes(16).toString('hex');
}