package cn.haidong.zzb.rmsys

/**
 * 国密算法（GB/T 32907 SM4、GB/T 32905 SM3）与数据包解密。
 *
 * 与后端 `Rmsys.Infrastructure/SmCrypto.cs`、`PackageCrypto.cs` **逐字节一致**：
 * 同一份算法按照同样的顺序实现，正确性由官方测试向量与「后端加密→本类解密」的交叉验证保证。
 * 刻意不引 BouncyCastle：纯 Kotlin 约 300 行，APK 不因此从 1.1MB 涨到 5-9MB。
 */
object Sm4 {

    /** S 盒（GB/T 32907 附录 A） */
    private val S = intArrayOf(
        0xd6, 0x90, 0xe9, 0xfe, 0xcc, 0xe1, 0x3d, 0xb7, 0x16, 0xb6, 0x14, 0xc2, 0x28, 0xfb, 0x2c, 0x05,
        0x2b, 0x67, 0x9a, 0x76, 0x2a, 0xbe, 0x04, 0xc3, 0xaa, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
        0x9c, 0x42, 0x50, 0xf4, 0x91, 0xef, 0x98, 0x7a, 0x33, 0x54, 0x0b, 0x43, 0xed, 0xcf, 0xac, 0x62,
        0xe4, 0xb3, 0x1c, 0xa9, 0xc9, 0x08, 0xe8, 0x95, 0x80, 0xdf, 0x94, 0xfa, 0x75, 0x8f, 0x3f, 0xa6,
        0x47, 0x07, 0xa7, 0xfc, 0xf3, 0x73, 0x17, 0xba, 0x83, 0x59, 0x3c, 0x19, 0xe6, 0x85, 0x4f, 0xa8,
        0x68, 0x6b, 0x81, 0xb2, 0x71, 0x64, 0xda, 0x8b, 0xf8, 0xeb, 0x0f, 0x4b, 0x70, 0x56, 0x9d, 0x35,
        0x1e, 0x24, 0x0e, 0x5e, 0x63, 0x58, 0xd1, 0xa2, 0x25, 0x22, 0x7c, 0x3b, 0x01, 0x21, 0x78, 0x87,
        0xd4, 0x00, 0x46, 0x57, 0x9f, 0xd3, 0x27, 0x52, 0x4c, 0x36, 0x02, 0xe7, 0xa0, 0xc4, 0xc8, 0x9e,
        0xea, 0xbf, 0x8a, 0xd2, 0x40, 0xc7, 0x38, 0xb5, 0xa3, 0xf7, 0xf2, 0xce, 0xf9, 0x61, 0x15, 0xa1,
        0xe0, 0xae, 0x5d, 0xa4, 0x9b, 0x34, 0x1a, 0x55, 0xad, 0x93, 0x32, 0x30, 0xf5, 0x8c, 0xb1, 0xe3,
        0x1d, 0xf6, 0xe2, 0x2e, 0x82, 0x66, 0xca, 0x60, 0xc0, 0x29, 0x23, 0xab, 0x0d, 0x53, 0x4e, 0x6f,
        0xd5, 0xdb, 0x37, 0x45, 0xde, 0xfd, 0x8e, 0x2f, 0x03, 0xff, 0x6a, 0x72, 0x6d, 0x6c, 0x5b, 0x51,
        0x8d, 0x1b, 0xaf, 0x92, 0xbb, 0xdd, 0xbc, 0x7f, 0x11, 0xd9, 0x5c, 0x41, 0x1f, 0x10, 0x5a, 0xd8,
        0x0a, 0xc1, 0x31, 0x88, 0xa5, 0xcd, 0x7b, 0xbd, 0x2d, 0x74, 0xd0, 0x12, 0xb8, 0xe5, 0xb4, 0xb0,
        0x89, 0x69, 0x97, 0x4a, 0x0c, 0x96, 0x77, 0x7e, 0x65, 0xb9, 0xf1, 0x09, 0xc5, 0x6e, 0xc6, 0x84,
        0x18, 0xf0, 0x7d, 0xec, 0x3a, 0xdc, 0x4d, 0x20, 0x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48
    )

    // Kotlin 不允许把 >0x7FFFFFFF 的十六进制字面量放进 IntArray，这里用字符串解析，
    // 好处是与 C# 侧逐字可比对。
    private val FK = hexInts("a3b1bac6,56aa3350,677d9197,b27022dc")

    private val CK = hexInts(
        "00070e15,1c232a31,383f464d,545b6269,70777e85,8c939aa1,a8afb6bd,c4cbd2d9," +
            "e0e7eef5,fc030a11,181f262d,343b4249,50575e65,6c737a81,888f969d,a4abb2b9," +
            "c0c7ced5,dce3eaf1,f8ff060d,141b2229,30373e45,4c535a61,686f767d,848b9299," +
            "a0a7aeb5,bcc3cad1,d8dfe6ed,f4fb0209,10171e25,2c333a41,484f565d,646b7279"
    )

    private fun hexInts(s: String): IntArray =
        s.split(",").map { it.trim().toLong(16).toInt() }.toIntArray()

    private fun rotl(x: Int, n: Int): Int = (x shl n) or (x ushr (32 - n))

    private fun tau(a: Int): Int =
        (S[(a ushr 24) and 0xff] shl 24) or
            (S[(a ushr 16) and 0xff] shl 16) or
            (S[(a ushr 8) and 0xff] shl 8) or
            S[a and 0xff]

    private fun tEnc(x: Int): Int {
        val b = tau(x)
        return b xor rotl(b, 2) xor rotl(b, 10) xor rotl(b, 18) xor rotl(b, 24)
    }

    private fun tKey(x: Int): Int {
        val b = tau(x)
        return b xor rotl(b, 13) xor rotl(b, 23)
    }

    private fun expandKey(key: ByteArray): IntArray {
        require(key.size == 16) { "SM4 密钥必须 16 字节，实际 ${key.size}" }
        val rk = IntArray(32)
        val kk = IntArray(36)
        for (i in 0 until 4) {
            kk[i] = (((key[i * 4].toInt() and 0xff) shl 24) or
                ((key[i * 4 + 1].toInt() and 0xff) shl 16) or
                ((key[i * 4 + 2].toInt() and 0xff) shl 8) or
                (key[i * 4 + 3].toInt() and 0xff)) xor FK[i]
        }
        for (i in 0 until 32) {
            kk[i + 4] = kk[i] xor tKey(kk[i + 1] xor kk[i + 2] xor kk[i + 3] xor CK[i])
            rk[i] = kk[i + 4]
        }
        return rk
    }

    private fun cryptBlock(rk: IntArray, block: ByteArray, decrypt: Boolean): ByteArray {
        val x = IntArray(36)
        for (i in 0 until 4) {
            x[i] = ((block[i * 4].toInt() and 0xff) shl 24) or
                ((block[i * 4 + 1].toInt() and 0xff) shl 16) or
                ((block[i * 4 + 2].toInt() and 0xff) shl 8) or
                (block[i * 4 + 3].toInt() and 0xff)
        }
        for (i in 0 until 32) {
            val k = if (decrypt) rk[31 - i] else rk[i]
            x[i + 4] = x[i] xor tEnc(x[i + 1] xor x[i + 2] xor x[i + 3] xor k)
        }
        val o = ByteArray(16)
        writeU32(o, 0, x[35]); writeU32(o, 4, x[34]); writeU32(o, 8, x[33]); writeU32(o, 12, x[32])
        return o
    }

    private fun writeU32(b: ByteArray, off: Int, v: Int) {
        b[off] = (v ushr 24).toByte()
        b[off + 1] = (v ushr 16).toByte()
        b[off + 2] = (v ushr 8).toByte()
        b[off + 3] = v.toByte()
    }

    fun encryptBlock(key: ByteArray, block: ByteArray): ByteArray =
        cryptBlock(expandKey(key), block, false)

    fun decryptBlock(key: ByteArray, block: ByteArray): ByteArray =
        cryptBlock(expandKey(key), block, true)

    /** SM4-CBC 加密（PKCS7 填充） */
    fun encryptCbc(key: ByteArray, iv: ByteArray, plain: ByteArray): ByteArray {
        val pad = 16 - plain.size % 16
        val buf = ByteArray(plain.size + pad)
        System.arraycopy(plain, 0, buf, 0, plain.size)
        for (i in plain.size until buf.size) buf[i] = pad.toByte()

        val rk = expandKey(key)
        var prev = iv.copyOf()
        val outp = ByteArray(buf.size)
        val block = ByteArray(16)
        var off = 0
        while (off < buf.size) {
            for (i in 0 until 16) block[i] = (buf[off + i].toInt() xor prev[i].toInt()).toByte()
            val cipher = cryptBlock(rk, block, false)
            System.arraycopy(cipher, 0, outp, off, 16)
            prev = cipher
            off += 16
        }
        return outp
    }

    /** SM4-CBC 解密（去 PKCS7 填充） */
    fun decryptCbc(key: ByteArray, iv: ByteArray, cipher: ByteArray): ByteArray {
        require(cipher.isNotEmpty() && cipher.size % 16 == 0) { "密文长度不是 16 的整数倍" }
        val rk = expandKey(key)
        var prev = iv.copyOf()
        val outp = ByteArray(cipher.size)
        val block = ByteArray(16)
        var off = 0
        while (off < cipher.size) {
            System.arraycopy(cipher, off, block, 0, 16)
            val plain = cryptBlock(rk, block, true)
            for (i in 0 until 16) outp[off + i] = (plain[i].toInt() xor prev[i].toInt()).toByte()
            prev = block.copyOf()
            off += 16
        }
        val pad = outp[outp.size - 1].toInt() and 0xff
        require(pad in 1..16) { "填充非法" }
        return outp.copyOf(outp.size - pad)
    }
}

/** SM3 杂凑（GB/T 32905） */
object Sm3 {

    private val IV = "7380166f,4914b2b9,172442d7,da8a0600,a96f30bc,163138aa,e38dee4d,b0fb0e4e"
        .split(",").map { it.toLong(16).toInt() }.toIntArray()

    private fun rotl(x: Int, n: Int): Int = Integer.rotateLeft(x, n)
    private fun p0(x: Int): Int = x xor rotl(x, 9) xor rotl(x, 17)
    private fun p1(x: Int): Int = x xor rotl(x, 15) xor rotl(x, 23)

    fun hash(data: ByteArray): ByteArray {
        val bitLen = data.size.toLong() * 8
        val padLen = if (data.size % 64 < 56) 56 - data.size % 64 else 120 - data.size % 64
        val buf = ByteArray(data.size + padLen + 8)
        System.arraycopy(data, 0, buf, 0, data.size)
        buf[data.size] = 0x80.toByte()
        for (i in 0 until 8) buf[buf.size - 1 - i] = (bitLen ushr (8 * i)).toByte()

        val v = IV.copyOf()
        val w = IntArray(68)
        val w1 = IntArray(64)

        var off = 0
        while (off < buf.size) {
            for (i in 0 until 16) {
                w[i] = ((buf[off + i * 4].toInt() and 0xff) shl 24) or
                    ((buf[off + i * 4 + 1].toInt() and 0xff) shl 16) or
                    ((buf[off + i * 4 + 2].toInt() and 0xff) shl 8) or
                    (buf[off + i * 4 + 3].toInt() and 0xff)
            }
            for (i in 16 until 68) {
                w[i] = p1(w[i - 16] xor w[i - 9] xor rotl(w[i - 3], 15)) xor rotl(w[i - 13], 7) xor w[i - 6]
            }
            for (i in 0 until 64) w1[i] = w[i] xor w[i + 4]

            var a = v[0]; var b = v[1]; var c = v[2]; var d = v[3]
            var e = v[4]; var f = v[5]; var g = v[6]; var h = v[7]
            for (j in 0 until 64) {
                val t = if (j < 16) 0x79cc4519 else 0x7a879d8a
                val ss1 = rotl(rotl(a, 12) + e + rotl(t, j % 32), 7)
                val ss2 = ss1 xor rotl(a, 12)
                val ff = if (j < 16) (a xor b xor c) else ((a and b) or (a and c) or (b and c))
                val gg = if (j < 16) (e xor f xor g) else ((e and f) or (e.inv() and g))
                val tt1 = ff + d + ss2 + w1[j]
                val tt2 = gg + h + ss1 + w[j]
                d = c; c = rotl(b, 9); b = a; a = tt1
                h = g; g = rotl(f, 19); f = e; e = p0(tt2)
            }
            v[0] = v[0] xor a; v[1] = v[1] xor b; v[2] = v[2] xor c; v[3] = v[3] xor d
            v[4] = v[4] xor e; v[5] = v[5] xor f; v[6] = v[6] xor g; v[7] = v[7] xor h
            off += 64
        }

        val o = ByteArray(32)
        for (i in 0 until 8) {
            o[i * 4] = (v[i] ushr 24).toByte()
            o[i * 4 + 1] = (v[i] ushr 16).toByte()
            o[i * 4 + 2] = (v[i] ushr 8).toByte()
            o[i * 4 + 3] = v[i].toByte()
        }
        return o
    }

    /** HMAC-SM3（RFC 2104，块长 64 字节） */
    fun hmac(key: ByteArray, data: ByteArray): ByteArray {
        val B = 64
        val k = if (key.size > B) hash(key) else key
        val ipad = ByteArray(B)
        val opad = ByteArray(B)
        for (i in 0 until B) {
            val kb = if (i < k.size) k[i].toInt() else 0
            ipad[i] = (kb xor 0x36).toByte()
            opad[i] = (kb xor 0x5c).toByte()
        }
        val inner = ByteArray(B + data.size)
        System.arraycopy(ipad, 0, inner, 0, B)
        System.arraycopy(data, 0, inner, B, data.size)
        val ih = hash(inner)

        val outer = ByteArray(B + 32)
        System.arraycopy(opad, 0, outer, 0, B)
        System.arraycopy(ih, 0, outer, B, 32)
        return hash(outer)
    }

    fun hex(b: ByteArray): String {
        val sb = StringBuilder(b.size * 2)
        for (x in b) sb.append(String.format("%02x", x.toInt() and 0xff))
        return sb.toString()
    }

    fun fromHex(s: String): ByteArray {
        val t = s.replace(" ", "").replace("-", "")
        require(t.length % 2 == 0) { "hex 长度必须为偶数" }
        val o = ByteArray(t.length / 2)
        for (i in o.indices) {
            o[i] = ((Character.digit(t[i * 2], 16) shl 4) or Character.digit(t[i * 2 + 1], 16)).toByte()
        }
        return o
    }
}

/**
 * 数据包解密（格式见后端 PackageCrypto.cs）。
 *
 * 头部 84 字节：
 *   0  magic "RMSPKG01" · 8 version · 9 flags · 10 reserved
 *   12 salt(16) · 28 iv(16) · 44 plainSize(8,大端) · 52 hmac(32) · 84 密文
 */
object PackageCrypto {

    private const val HEADER = 84
    private const val HMAC_OFF = 52
    private const val HMAC_LEN = 32
    private const val SALT_OFF = 12
    private const val SALT_LEN = 16
    private const val IV_OFF = 28
    private const val IV_LEN = 16
    private const val SIZE_OFF = 44
    private const val VERSION: Byte = 0x01

    val MAGIC = byteArrayOf(
        'R'.code.toByte(), 'M'.code.toByte(), 'S'.code.toByte(), 'P'.code.toByte(),
        'K'.code.toByte(), 'G'.code.toByte(), '0'.code.toByte(), '1'.code.toByte()
    )

    class PackageException(message: String) : Exception(message)

    fun isEncrypted(head: ByteArray): Boolean {
        if (head.size < MAGIC.size) return false
        for (i in MAGIC.indices) if (head[i] != MAGIC[i]) return false
        return true
    }

    private fun readInt64BE(b: ByteArray, off: Int): Long {
        var v = 0L
        for (i in 0 until 8) v = (v shl 8) or (b[off + i].toLong() and 0xff)
        return v
    }

    /** 只看头部，不解密（用于区分「格式不对」与「密钥不对」） */
    fun readHeader(pkg: ByteArray): Triple<Boolean, Byte, Long> {
        if (pkg.size < HEADER || !isEncrypted(pkg)) return Triple(false, 0, 0)
        return Triple(true, pkg[8], readInt64BE(pkg, SIZE_OFF))
    }

    /** 解密 .pkg → SQLite 明文字节。密钥错或被篡改都会抛 PackageException。 */
    fun decode(pkg: ByteArray, masterKey: ByteArray): ByteArray {
        if (masterKey.size != 32) throw PackageException("主密钥长度不正确")
        if (pkg.size < HEADER || !isEncrypted(pkg))
            throw PackageException("不是有效的数据包文件（文件头不匹配）")
        if (pkg[8] != VERSION)
            throw PackageException("数据包版本 ${pkg[8]} 不受支持（需要 $VERSION）")

        val plainSize = readInt64BE(pkg, SIZE_OFF)
        if (plainSize <= 0 || plainSize > 512L * 1024 * 1024)
            throw PackageException("头部记录的长度异常，文件可能已损坏")

        val salt = pkg.copyOfRange(SALT_OFF, SALT_OFF + SALT_LEN)
        val iv = pkg.copyOfRange(IV_OFF, IV_OFF + IV_LEN)
        val storedMac = pkg.copyOfRange(HMAC_OFF, HMAC_OFF + HMAC_LEN)
        val cipher = pkg.copyOfRange(HEADER, pkg.size)

        val (sm4Key, macKey) = deriveKeys(masterKey, salt)

        val macInput = ByteArray(HEADER - HMAC_LEN + cipher.size)
        System.arraycopy(pkg, 0, macInput, 0, HMAC_OFF)
        System.arraycopy(cipher, 0, macInput, HMAC_OFF, cipher.size)
        val mac = Sm3.hmac(macKey, macInput)
        if (!constantTimeEquals(mac, storedMac))
            throw PackageException("校验失败：密钥不匹配或数据包已被篡改")

        val plain = Sm4.decryptCbc(sm4Key, iv, cipher)
        if (plain.size.toLong() != plainSize)
            throw PackageException("长度校验失败：头部 $plainSize，实际 ${plain.size}")
        return plain
    }

    private fun constantTimeEquals(a: ByteArray, b: ByteArray): Boolean {
        if (a.size != b.size) return false
        var diff = 0
        for (i in a.indices) diff = diff or (a[i].toInt() xor b[i].toInt())
        return diff == 0
    }

    private fun deriveKeys(masterKey: ByteArray, salt: ByteArray): Pair<ByteArray, ByteArray> {
        val d1 = ByteArray(salt.size + 1)
        System.arraycopy(salt, 0, d1, 0, salt.size)
        d1[d1.size - 1] = 0x01
        val k1 = Sm3.hmac(masterKey, d1)

        val d2 = ByteArray(salt.size + 1)
        System.arraycopy(salt, 0, d2, 0, salt.size)
        d2[d2.size - 1] = 0x02
        val k2 = Sm3.hmac(masterKey, d2)

        return Pair(k1.copyOfRange(0, 16), k2)
    }
}