package app

import (
	"context"
	"crypto/x509"
	"errors"
	"io"
	"net"
	"net/http"
	"net/url"
	"strconv"
	"strings"
	"syscall"
	"time"
)

type connectivitySite struct {
	ID       string `json:"id"`
	Name     string `json:"name"`
	URL      string `json:"url"`
	Category string `json:"category"`
}

var connectivityCatalog = []connectivitySite{
	{"apple", "Apple", "https://www.apple.com/", "官方网站"},
	{"github", "GitHub", "https://github.com/", "开发工具"},
	{"google", "Google", "https://www.google.com/", "搜索"},
	{"netflix", "Netflix", "https://www.netflix.com/", "流媒体"},
	{"youtube", "YouTube", "https://www.youtube.com/", "流媒体"},
	{"chatgpt", "ChatGPT", "https://chatgpt.com/", "AI 服务"},
	{"claude", "Claude", "https://claude.ai/", "AI 服务"},
	{"grok", "Grok", "https://grok.com/", "AI 服务"},
	{"dockerhub", "Docker Hub", "https://hub.docker.com/", "开发工具"},
}

type connectivityResult struct {
	SiteID      string    `json:"siteId"`
	Status      string    `json:"status"`
	Detail      string    `json:"detail"`
	HTTPStatus  int       `json:"httpStatus"`
	DurationMS  int64     `json:"durationMS"`
	TLSVerified bool      `json:"tlsVerified"`
	CheckedAt   time.Time `json:"checkedAt"`
}

func (a *App) connectivitySites(w http.ResponseWriter, r *http.Request) {
	jsonResponse(w, 200, connectivityCatalog)
}

func (a *App) testConnectivity(w http.ResponseWriter, r *http.Request) {
	var input struct {
		SiteID string `json:"siteId"`
	}
	if err := decode(w, r, &input); err != nil {
		writeError(w, 400, err.Error())
		return
	}
	var site *connectivitySite
	for i := range connectivityCatalog {
		if connectivityCatalog[i].ID == input.SiteID {
			site = &connectivityCatalog[i]
			break
		}
	}
	if site == nil {
		writeError(w, 400, "请选择列表中的测试网站")
		return
	}
	select {
	case a.connectivitySlots <- struct{}{}:
		defer func() { <-a.connectivitySlots }()
	default:
		writeError(w, 429, "最多同时测试 3 个网站，请稍后重试")
		return
	}
	ctx, cancel := context.WithTimeout(r.Context(), 15*time.Second)
	defer cancel()
	var version map[string]any
	coreCtx, coreCancel := context.WithTimeout(ctx, 2*time.Second)
	err := a.core.Request(coreCtx, "GET", "/version", nil, &version)
	coreCancel()
	if err != nil {
		jsonResponse(w, 200, connectivityResult{SiteID: site.ID, Status: "failed", Detail: "Mihomo 内核未连接，请先启动内核", CheckedAt: time.Now().UTC()})
		return
	}
	a.mu.RLock()
	settings := a.state.Settings
	a.mu.RUnlock()
	client := connectivityClient(settings)
	defer client.CloseIdleConnections()
	jsonResponse(w, 200, probeConnectivity(ctx, client, *site))
}

func connectivityClient(settings Settings) *http.Client {
	host := settings.LANIP
	if host == "" {
		host = "127.0.0.1"
	}
	proxy := &url.URL{Scheme: "http", Host: net.JoinHostPort(host, strconv.Itoa(settings.MixedPort))}
	transport := http.DefaultTransport.(*http.Transport).Clone()
	// Always use this VM's Mihomo, even when the service has HTTP_PROXY/NO_PROXY.
	transport.Proxy = http.ProxyURL(proxy)
	transport.TLSHandshakeTimeout = 8 * time.Second
	return &http.Client{Transport: transport, Timeout: 12 * time.Second, CheckRedirect: func(req *http.Request, via []*http.Request) error {
		if len(via) >= 5 {
			return errors.New("网站重定向次数过多")
		}
		if req.URL.Scheme != "https" || req.URL.User != nil {
			return errors.New("网站重定向到非 HTTPS 地址")
		}
		if !connectivityRedirectAllowed(req.URL.Hostname(), via[0].URL.Hostname()) {
			return errors.New("网站重定向到测试范围外的域名")
		}
		return nil
	}}
}

func connectivityRedirectAllowed(host, original string) bool {
	// Only follow the selected site's domains, never a redirect into the LAN.
	host, original = strings.ToLower(host), strings.ToLower(original)
	for _, domain := range []string{"apple.com", "github.com", "google.com", "netflix.com", "youtube.com", "chatgpt.com", "claude.ai", "grok.com", "docker.com"} {
		if original == domain || strings.HasSuffix(original, "."+domain) {
			allowed := []string{domain}
			if domain == "claude.ai" {
				allowed = append(allowed, "claude.com")
			}
			if domain == "chatgpt.com" {
				allowed = append(allowed, "openai.com")
			}
			for _, candidate := range allowed {
				if host == candidate || strings.HasSuffix(host, "."+candidate) {
					return true
				}
			}
			return false
		}
	}
	return false
}

func probeConnectivity(ctx context.Context, client *http.Client, site connectivitySite) (result connectivityResult) {
	start := time.Now()
	result = connectivityResult{SiteID: site.ID, Status: "failed"}
	defer func() { result.DurationMS = time.Since(start).Milliseconds(); result.CheckedAt = time.Now().UTC() }()
	req, err := http.NewRequestWithContext(ctx, "GET", site.URL, nil)
	if err != nil {
		result.Detail = "测试地址无效"
		return
	}
	req.Header.Set("User-Agent", "Mozilla/5.0 (compatible; ClashWeb/1.0; connectivity-check)")
	req.Header.Set("Accept", "text/html,application/xhtml+xml")
	resp, err := client.Do(req)
	if err != nil {
		if resp != nil {
			// net/http retains the last response when a redirect is refused.
			result.HTTPStatus = resp.StatusCode
			result.TLSVerified = resp.TLS != nil && len(resp.TLS.VerifiedChains) > 0
			result.Status, result.Detail = "http_error", "网站已响应，但重定向超出测试范围或次数限制"
			return
		}
		result.Detail = connectivityError(err)
		return
	}
	defer resp.Body.Close()
	result.HTTPStatus = resp.StatusCode
	result.TLSVerified = resp.TLS != nil && len(resp.TLS.VerifiedChains) > 0
	body, err := io.ReadAll(io.LimitReader(resp.Body, 64<<10))
	if err != nil {
		result.Detail = "网站已响应，但读取响应失败或超时"
		return
	}
	sample := strings.ToLower(string(body))
	challenge := resp.Header.Get("Cf-Mitigated") == "challenge" || strings.Contains(sample, "cf-chl-") || (strings.Contains(sample, "just a moment") && strings.Contains(sample, "cloudflare"))
	switch {
	case challenge:
		result.Status, result.Detail = "challenge", "已连接网站，网站要求浏览器安全验证"
	case resp.StatusCode >= 200 && resp.StatusCode < 300:
		result.Status, result.Detail = "reachable", "HTTPS 主页响应正常"
	case resp.StatusCode == 403 || resp.StatusCode == 451:
		result.Status, result.Detail = "restricted", "网站拒绝访问，可能有出口地区或访问策略限制"
	case resp.StatusCode == 429:
		result.Status, result.Detail = "restricted", "网站请求频率受限，请稍后重试"
	default:
		result.Status, result.Detail = "http_error", "已连接网站，但返回异常 HTTP 状态"
	}
	return
}

func connectivityError(err error) string {
	var authority x509.UnknownAuthorityError
	var certificate x509.CertificateInvalidError
	var hostname x509.HostnameError
	var dns *net.DNSError
	var network net.Error
	switch {
	case errors.Is(err, context.Canceled):
		return "测试已取消"
	case errors.Is(err, context.DeadlineExceeded), errors.As(err, &network) && network.Timeout():
		return "连接超时，请检查当前节点和网络"
	case errors.As(err, &authority):
		return "TLS 证书不受信任，请检查 VM 的 CA 证书包"
	case errors.As(err, &certificate), errors.As(err, &hostname):
		return "TLS 证书校验失败，请检查 VM 时间及网站证书"
	case errors.As(err, &dns):
		return "域名解析失败，请检查 VM 或 Mihomo 的 DNS"
	case errors.Is(err, syscall.ECONNREFUSED):
		return "连接被拒绝，请检查 Mihomo 代理端口与网站状态"
	default:
		return "连接失败，请检查当前节点、网络和网站访问策略"
	}
}