const http = require("http");
const fs = require("fs");
const path = require("path");
const url = require("url");

// 从 Docker Secrets 读取密码的函数
function getDockerSecret(secretName) {
  try {
    const secretPath = `/run/secrets/${secretName}`;
    if (fs.existsSync(secretPath)) {
      return fs.readFileSync(secretPath, "utf8").trim();
    }
  } catch (err) {
    console.warn(`Failed to read Docker secret '${secretName}':`, err.message);
  }
  return null;
}

// 配置信息
const UPLOAD_DIR = path.resolve("./uploads"); // 使用绝对路径
const PORT = process.env.PORT || 8080;
const SERVER_ENABLED = process.env.ENABLE_HTTP_SERVER === "true"; // 新增：控制服务器是否启用
// 优先从 Docker Secrets 读取密码，如果没有则回退到环境变量
const SERVER_PASSWORD_FILE = process.env.SERVER_PASSWORD_FILE || "my_secret";
const SERVER_PASSWORD =
  getDockerSecret(SERVER_PASSWORD_FILE) ||
  process.env.SERVER_PASSWORD ||
  "securePass123";
const VALID_CREDENTIALS = {
  username: process.env.SERVER_USERNAME || "admin",
  password: SERVER_PASSWORD,
};

// 验证密码来源
if (getDockerSecret(SERVER_PASSWORD_FILE)) {
  console.log("Using password from Docker Secret");
} else if (process.env.SERVER_PASSWORD) {
  console.warn("Using password from environment variable (less secure)");
} else {
  console.warn(
    "Warning: Using default password. Set Docker Secret or SERVER_PASSWORD environment variable for production."
  );
}

if (!process.env.SERVER_USERNAME) {
  console.warn(
    "Warning: Using default username. Set SERVER_USERNAME environment variable for production."
  );
}

// 检查服务器是否启用
if (!SERVER_ENABLED) {
  console.log(
    "HTTP Server is disabled. Set ENABLE_HTTP_SERVER=true to enable it."
  );
  process.exit(0);
}

// 创建上传目录（如果不存在）
if (!fs.existsSync(UPLOAD_DIR)) {
  fs.mkdirSync(UPLOAD_DIR, { recursive: true });
}

const server = http.createServer((req, res) => {
  // 设置CORS头部
  res.setHeader("Access-Control-Allow-Origin", "*");
  res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
  res.setHeader("Access-Control-Allow-Credentials", "true");

  // 处理预检请求
  if (req.method === "OPTIONS") {
    res.writeHead(200);
    return res.end();
  }
  // 认证检查
  if (!authenticate(req)) {
    res.writeHead(401, {
      "WWW-Authenticate": 'Basic realm="Secure File Server"',
      "Content-Type": "text/plain",
    });
    return res.end("Unauthorized");
  }

  // 路由处理
  const parsedUrl = url.parse(req.url, true);

  if (req.method === "POST" && parsedUrl.pathname === "/upload") {
    handleUpload(req, res, parsedUrl.query.dir || "");
  } else if (req.method === "GET" && parsedUrl.pathname === "/download") {
    handleDownload(req, res, parsedUrl.query.dir || "");
  } else if (req.method === "DELETE" && parsedUrl.pathname === "/delete") {
    handleDelete(req, res, parsedUrl.query.dir || "");
  } else if (req.method === "GET" && parsedUrl.pathname === "/list") {
    handleList(req, res, parsedUrl.query.dir || "");
  } else {
    res.writeHead(404, { "Content-Type": "text/plain" });
    res.end("Not Found");
  }
});

// 基本认证验证
function authenticate(req) {
  const authHeader = req.headers["authorization"];
  if (!authHeader) return false;

  const [scheme, credentials] = authHeader.split(" ");
  if (scheme !== "Basic") return false;

  const [username, password] = Buffer.from(credentials, "base64")
    .toString()
    .split(":");

  return (
    username === VALID_CREDENTIALS.username &&
    password === VALID_CREDENTIALS.password
  );
}

// 安全处理文件名
function sanitizeFilename(originalName) {
  // 移除路径部分，只保留文件名
  const base = path.basename(originalName);

  // 替换非法字符（Windows文件系统非法字符）
  return base.replace(/[\\/:*?"<>|]/g, "_");
}

// 安全路径解析（防止目录遍历攻击）
function resolveSafePath(...pathSegments) {
  const targetPath = path.resolve(UPLOAD_DIR, ...pathSegments);
  const relativePath = path.relative(UPLOAD_DIR, targetPath);

  // 检查路径是否试图访问UPLOAD_DIR之外
  if (relativePath.startsWith("..") || path.isAbsolute(relativePath)) {
    throw new Error("Invalid path");
  }

  return targetPath;
}

// 文件上传处理
function handleUpload(req, res, dirParam) {
  const contentType = req.headers["content-type"];
  if (!contentType || !contentType.includes("multipart/form-data")) {
    res.writeHead(400, { "Content-Type": "text/plain" });
    return res.end("Invalid Content-Type. Expected multipart/form-data");
  }

  const boundaryMatch = contentType.match(/boundary=(.+)$/);
  if (!boundaryMatch) {
    res.writeHead(400, { "Content-Type": "text/plain" });
    return res.end("Missing boundary in Content-Type");
  }

  const boundary = boundaryMatch[1];
  let body = [];

  req.on("data", (chunk) => body.push(chunk));
  req.on("end", () => {
    try {
      const buffer = Buffer.concat(body);
      const parts = parseMultipart(buffer, boundary);

      if (!parts.file || !parts.filename) {
        console.log("Parsed parts:", Object.keys(parts)); // 调试信息
        throw new Error("No valid file uploaded");
      }

      // 安全处理文件名
      const safeFilename = sanitizeFilename(parts.filename);

      // 验证文件名
      if (!safeFilename || safeFilename === "." || safeFilename === "..") {
        res.writeHead(400, { "Content-Type": "text/plain" });
        return res.end("Invalid filename");
      }

      // 解析并验证目标路径
      const targetDir = resolveSafePath(dirParam);
      const filePath = resolveSafePath(dirParam, safeFilename);

      // 确保目标目录存在
      if (!fs.existsSync(targetDir)) {
        fs.mkdirSync(targetDir, { recursive: true });
      }

      fs.writeFile(filePath, parts.file, (err) => {
        if (err) {
          console.error("File write error:", err);
          res.writeHead(500, { "Content-Type": "text/plain" });
          return res.end("Internal Server Error");
        }

        res.writeHead(200, { "Content-Type": "application/json" });
        res.end(
          JSON.stringify({
            success: true,
            filename: safeFilename,
            directory: dirParam,
            message: "File uploaded successfully",
          })
        );
      });
    } catch (err) {
      console.error("Upload error:", err);
      res.writeHead(400, { "Content-Type": "text/plain" });
      res.end(err.message);
    }
  });
}

// 解析multipart数据 - 改进版本
function parseMultipart(buffer, boundary) {
  const result = {};
  const boundaryBuffer = Buffer.from(`--${boundary}`);
  const parts = [];

  let start = 0;
  let end = buffer.indexOf(boundaryBuffer, start);

  while (end !== -1) {
    if (start !== 0) {
      // 跳过第一个边界前的内容
      parts.push(buffer.slice(start, end));
    }
    start = end + boundaryBuffer.length;
    end = buffer.indexOf(boundaryBuffer, start);
  }

  for (const part of parts) {
    if (part.length === 0) continue;

    // 查找头部结束位置
    const headerEndIndex = part.indexOf("\r\n\r\n");
    if (headerEndIndex === -1) continue;

    const headers = part.slice(0, headerEndIndex).toString();
    const content = part.slice(headerEndIndex + 4);

    // 移除结尾的 \r\n
    const actualContent = content.slice(0, content.length - 2);

    const nameMatch = headers.match(/name="([^"]+)"/);
    const filenameMatch = headers.match(/filename="([^"]+)"/);

    if (nameMatch) {
      const name = nameMatch[1];
      if (filenameMatch && filenameMatch[1]) {
        result.filename = filenameMatch[1];
        result.file = actualContent;
        console.log(
          `Found file: ${result.filename}, size: ${actualContent.length} bytes`
        ); // 调试信息
      } else {
        result[name] = actualContent.toString();
      }
    }
  }

  return result;
}
// 文件下载处理
function handleDownload(req, res, dirParam) {
  try {
    const parsedUrl = url.parse(req.url, true);
    const filename = parsedUrl.query.filename;

    if (!filename) {
      res.writeHead(400, { "Content-Type": "text/plain" });
      return res.end("Missing filename parameter");
    }

    // 安全处理文件名
    const safeFilename = sanitizeFilename(filename);

    // 验证文件名
    if (!safeFilename || safeFilename === "." || safeFilename === "..") {
      res.writeHead(400, { "Content-Type": "text/plain" });
      return res.end("Invalid filename");
    }

    // 解析并验证文件路径
    const filePath = resolveSafePath(dirParam, safeFilename);

    // 检查文件是否存在
    if (!fs.existsSync(filePath)) {
      res.writeHead(404, { "Content-Type": "text/plain" });
      return res.end("File not found");
    }

    const stat = fs.statSync(filePath);

    // 设置下载文件名
    const encodedFilename = encodeURIComponent(safeFilename);
    res.writeHead(200, {
      "Content-Type": "application/octet-stream",
      "Content-Length": stat.size,
      "Content-Disposition": `attachment; filename="${encodedFilename}"; filename*=UTF-8''${encodedFilename}`,
    });

    fs.createReadStream(filePath).pipe(res);
  } catch (err) {
    console.error("Download error:", err);
    res.writeHead(400, { "Content-Type": "text/plain" });
    res.end(err.message);
  }
}
function handleDelete(req, res, dirParam) {
  try {
    const parsedUrl = url.parse(req.url, true);
    const filename = parsedUrl.query.filename;

    if (!filename) {
      res.writeHead(400, { "Content-Type": "text/plain" });
      return res.end("Missing filename parameter");
    }

    // 安全处理文件名
    const safeFilename = sanitizeFilename(filename);

    // 验证文件名
    if (!safeFilename || safeFilename === "." || safeFilename === "..") {
      res.writeHead(400, { "Content-Type": "text/plain" });
      return res.end("Invalid filename");
    }

    // 解析并验证文件路径
    const filePath = resolveSafePath(dirParam, safeFilename);

    // 检查文件是否存在
    if (!fs.existsSync(filePath)) {
      res.writeHead(404, { "Content-Type": "text/plain" });
      return res.end("File not found");
    }

    // 检查是否为文件（非目录）
    const stat = fs.statSync(filePath);
    if (!stat.isFile()) {
      res.writeHead(400, { "Content-Type": "text/plain" });
      return res.end("Target is not a file");
    }

    // 删除文件
    fs.unlink(filePath, (err) => {
      if (err) {
        console.error("File delete error:", err);
        res.writeHead(500, { "Content-Type": "text/plain" });
        return res.end("Internal Server Error");
      }

      res.writeHead(200, { "Content-Type": "application/json" });
      res.end(
        JSON.stringify({
          success: true,
          filename: safeFilename,
          directory: dirParam,
          message: "File deleted successfully",
        })
      );
    });
  } catch (err) {
    console.error("Delete error:", err);
    res.writeHead(400, { "Content-Type": "text/plain" });
    res.end(err.message);
  }
}

// 目录列表处理
function handleList(req, res, dirParam) {
  try {
    // 解析并验证目录路径
    const targetDir = resolveSafePath(dirParam);

    // 检查目录是否存在
    if (!fs.existsSync(targetDir)) {
      res.writeHead(404, { "Content-Type": "text/plain" });
      return res.end("Directory not found");
    }

    // 检查是否为目录
    const stat = fs.statSync(targetDir);
    if (!stat.isDirectory()) {
      res.writeHead(400, { "Content-Type": "text/plain" });
      return res.end("Target is not a directory");
    }

    // 读取目录内容
    fs.readdir(targetDir, { withFileTypes: true }, (err, entries) => {
      if (err) {
        console.error("Directory read error:", err);
        res.writeHead(500, { "Content-Type": "text/plain" });
        return res.end("Internal Server Error");
      }

      const fileList = entries.map((entry) => {
        const stat = fs.statSync(path.join(targetDir, entry.name));
        return {
          name: entry.name,
          type: entry.isDirectory() ? "directory" : "file",
          size: entry.isFile() ? stat.size : null,
          modifiedTime: stat.mtime.toISOString(),
          createdTime: stat.birthtime.toISOString(),
        };
      });

      // 按类型和名称排序（目录在前，然后按名称排序）
      fileList.sort((a, b) => {
        if (a.type !== b.type) {
          return a.type === "directory" ? -1 : 1;
        }
        return a.name.localeCompare(b.name);
      });

      res.writeHead(200, { "Content-Type": "application/json" });
      res.end(
        JSON.stringify({
          success: true,
          directory: dirParam,
          files: fileList,
          totalCount: fileList.length,
        })
      );
    });
  } catch (err) {
    console.error("List error:", err);
    res.writeHead(400, { "Content-Type": "text/plain" });
    res.end(err.message);
  }
}

// 启动服务器
server.listen(PORT, () => {
  console.log(`Secure File Server running at http://localhost:${PORT}`);
  console.log(`Username: ${VALID_CREDENTIALS.username}`);
  console.log("Password: [HIDDEN FOR SECURITY]");
});