import base64
import email.utils
import hashlib
import json
import os
from dataclasses import dataclass
from datetime import datetime, timezone
from typing import Any, Dict, List, Optional
from urllib.parse import quote

import requests
from Crypto.Cipher import AES


class TeleSecCryptoError(Exception):
    pass


class TeleSecCouchDBError(Exception):
    pass


def _pkcs7_pad(data: bytes, block_size: int = 16) -> bytes:
    pad_len = block_size - (len(data) % block_size)
    return data + bytes([pad_len]) * pad_len


def _pkcs7_unpad(data: bytes, block_size: int = 16) -> bytes:
    if not data or len(data) % block_size != 0:
        raise TeleSecCryptoError("Invalid padded data length")
    pad_len = data[-1]
    if pad_len < 1 or pad_len > block_size:
        raise TeleSecCryptoError("Invalid PKCS7 padding")
    if data[-pad_len:] != bytes([pad_len]) * pad_len:
        raise TeleSecCryptoError("Invalid PKCS7 padding bytes")
    return data[:-pad_len]


def _evp_bytes_to_key(passphrase: bytes, salt: bytes, key_len: int, iv_len: int) -> tuple[bytes, bytes]:
    d = b""
    prev = b""
    while len(d) < key_len + iv_len:
        prev = hashlib.md5(prev + passphrase + salt).digest()
        d += prev
    return d[:key_len], d[key_len : key_len + iv_len]


def _json_dumps_like_js(value: Any) -> str:
    return json.dumps(value, ensure_ascii=False, separators=(",", ":"))


def ts_encrypt(input_value: Any, secret: str) -> str:
    """
    Compatible with JS: CryptoJS.AES.encrypt(payload, secret).toString()
    wrapped as RSA{<ciphertext>}.
    """
    if secret is None or secret == "":
        if isinstance(input_value, str):
            return input_value
        return _json_dumps_like_js(input_value)

    payload = input_value
    if not isinstance(input_value, str):
        try:
            payload = _json_dumps_like_js(input_value)
        except Exception:
            payload = str(input_value)

    payload_bytes = payload.encode("utf-8")
    salt = os.urandom(8)
    key, iv = _evp_bytes_to_key(secret.encode("utf-8"), salt, 32, 16)
    cipher = AES.new(key, AES.MODE_CBC, iv=iv)
    encrypted = cipher.encrypt(_pkcs7_pad(payload_bytes, 16))
    openssl_blob = b"Salted__" + salt + encrypted
    b64 = base64.b64encode(openssl_blob).decode("utf-8")
    return f"RSA{{{b64}}}"


def ts_encrypt(input_value: Any, secret: str) -> str:
    if not isinstance(input_value, str):
        payload = json.dumps(input_value, separators=(",", ":"), ensure_ascii=False)
    else:
        payload = input_value

    payload_bytes = payload.encode("utf-8")
    salt = os.urandom(8)

    # OpenSSL EVP_BytesToKey (MD5)
    dx = b""
    salted = b""
    while len(salted) < 48:  # 32 key + 16 iv
        dx = hashlib.md5(dx + secret.encode() + salt).digest()
        salted += dx

    key = salted[:32]
    iv = salted[32:48]

    cipher = AES.new(key, AES.MODE_CBC, iv)
    encrypted = cipher.encrypt(_pkcs7_pad(payload_bytes, 16))

    openssl_blob = b"Salted__" + salt + encrypted
    b64 = base64.b64encode(openssl_blob).decode("utf-8")

    return f"RSA{{{b64}}}"

@dataclass
class TeleSecDoc:
    id: str
    data: Any
    raw: Dict[str, Any]


class TeleSecCouchDB:
    """
    Direct CouchDB client for TeleSec docs (_id = "<table>:<id>").
    No local replication layer.
    """

    def __init__(
        self,
        server_url: str,
        dbname: str,
        secret: Optional[str] = None,
        username: Optional[str] = None,
        password: Optional[str] = None,
        timeout: int = 30,
        session: Optional[requests.Session] = None,
    ) -> None:
        self.server_url = server_url.rstrip("/")
        self.dbname = dbname
        self.secret = secret or ""
        self.timeout = timeout
        self.base_url = f"{self.server_url}/{quote(self.dbname, safe='')}"
        self.session = session or requests.Session()
        self.session.headers.update({"Accept": "application/json"})
        if username is not None:
            self.session.auth = (username, password or "")

    def _iso_now(self) -> str:
        return datetime.now(timezone.utc).isoformat(timespec="milliseconds").replace("+00:00", "Z")

    def _doc_id(self, table: str, item_id: str) -> str:
        return f"{table}:{item_id}"

    def _request(self, method: str, path: str = "", **kwargs) -> requests.Response:
        url = self.base_url if not path else f"{self.base_url}/{path.lstrip('/')}"
        kwargs.setdefault("timeout", self.timeout)
        res = self.session.request(method=method, url=url, **kwargs)
        return res

    def get_server_datetime(self) -> datetime:
        """
        Returns server datetime using HTTP Date header from CouchDB.
        Avoids reliance on local machine clock.
        """
        candidates = [
            ("HEAD", self.base_url),
            ("GET", self.base_url),
            ("HEAD", self.server_url),
            ("GET", self.server_url),
        ]
        for method, url in candidates:
            try:
                res = self.session.request(method=method, url=url, timeout=self.timeout)
                date_header = res.headers.get("Date")
                if not date_header:
                    continue
                dt = email.utils.parsedate_to_datetime(date_header)
                if dt is None:
                    continue
                if dt.tzinfo is None:
                    dt = dt.replace(tzinfo=timezone.utc)
                return dt.astimezone(timezone.utc)
            except Exception:
                continue
        raise TeleSecCouchDBError("Unable to retrieve server time from CouchDB Date header")

    def iso_from_server_plus_minutes(self, minutes: int = 0) -> str:
        now = self.get_server_datetime()
        target = now.timestamp() + (minutes * 60)
        out = datetime.fromtimestamp(target, tz=timezone.utc)
        return out.isoformat(timespec="milliseconds").replace("+00:00", "Z")

    def check_connection(self) -> Dict[str, Any]:
        res = self._request("GET")
        if res.status_code >= 400:
            raise TeleSecCouchDBError(f"CouchDB connection failed: {res.status_code} {res.text}")
        return res.json()

    def get_raw(self, doc_id: str) -> Optional[Dict[str, Any]]:
        res = self._request("GET", quote(doc_id, safe=""))
        if res.status_code == 404:
            return None
        if res.status_code >= 400:
            raise TeleSecCouchDBError(f"GET doc failed: {res.status_code} {res.text}")
        return res.json()

    def put_raw(self, doc: Dict[str, Any]) -> Dict[str, Any]:
        if "_id" not in doc:
            raise ValueError("Document must include _id")
        res = self._request(
            "PUT",
            quote(doc["_id"], safe=""),
            headers={"Content-Type": "application/json"},
            data=_json_dumps_like_js(doc).encode("utf-8"),
        )
        if res.status_code >= 400:
            raise TeleSecCouchDBError(f"PUT doc failed: {res.status_code} {res.text}")
        return res.json()

    def delete_raw(self, doc_id: str) -> bool:
        doc = self.get_raw(doc_id)
        if not doc:
            return False
        res = self._request("DELETE", f"{quote(doc_id, safe='')}?rev={quote(doc['_rev'], safe='')}")
        if res.status_code >= 400:
            raise TeleSecCouchDBError(f"DELETE doc failed: {res.status_code} {res.text}")
        return True

    def put(self, table: str, item_id: str, data: Any, encrypt: bool = True) -> Dict[str, Any]:
        doc_id = self._doc_id(table, item_id)

        if data is None:
            self.delete_raw(doc_id)
            return {"ok": True, "id": doc_id, "deleted": True}

        existing = self.get_raw(doc_id)
        doc: Dict[str, Any] = existing if existing else {"_id": doc_id}

        to_store = data
        is_encrypted_string = isinstance(data, str) and data.startswith("RSA{") and data.endswith("}")
        if encrypt and self.secret and not is_encrypted_string:
            to_store = ts_encrypt(data, self.secret)

        doc["data"] = to_store
        doc["table"] = table
        doc["ts"] = self._iso_now()

        return self.put_raw(doc)

    def get(self, table: str, item_id: str, decrypt: bool = True) -> Optional[Any]:
        doc_id = self._doc_id(table, item_id)
        doc = self.get_raw(doc_id)
        if not doc:
            return None
        value = doc.get("data")
        if decrypt:
            return ts_decrypt(value, self.secret)
        return value

    def delete(self, table: str, item_id: str) -> bool:
        return self.delete_raw(self._doc_id(table, item_id))

    def list(self, table: str, decrypt: bool = True) -> List[TeleSecDoc]:
        params = {
            "include_docs": "true",
            "startkey": f'"{table}:"',
            "endkey": f'"{table}:\uffff"',
        }
        res = self._request("GET", "_all_docs", params=params)
        if res.status_code >= 400:
            raise TeleSecCouchDBError(f"LIST docs failed: {res.status_code} {res.text}")

        rows = res.json().get("rows", [])
        out: List[TeleSecDoc] = []
        for row in rows:
            doc = row.get("doc") or {}
            item_id = row.get("id", "").split(":", 1)[1] if ":" in row.get("id", "") else row.get("id", "")
            value = doc.get("data")
            if decrypt:
                value = ts_decrypt(value, self.secret)
            out.append(TeleSecDoc(id=item_id, data=value, raw=doc))
        return out