using System.Net;
using System.Net.NetworkInformation;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Authentication;
using System.Text;

namespace WpywMail.Native;

/// <summary>
/// 出站投递。支持两种模式：
///   direct —— 查 MX 直接投递（默认）
///   relay  —— 交给上游 SMTP 中继（可带认证与 STARTTLS）
///
/// 相比 v1 的关键修正：
///   DATA 阶段按「字节」写出（v1 用 Encoding.ASCII 的 StreamWriter，导致所有中文变成 '?'），
///   并显式处理 dot-stuffing 与行尾规范化。
/// </summary>
public sealed class DirectSmtpDelivery
{
    private readonly AppConfig config;
    private readonly IMailStore store;

    public DirectSmtpDelivery(AppConfig config, IMailStore store)
    {
        this.config = config;
        this.store = store;
    }

    public async Task DeliverAsync(MailMessage message, string[] recipients, byte[] raw, CancellationToken token)
    {
        if (recipients.Length == 0) throw new InvalidOperationException("没有可投递的收件人。");

        // 本地收件人直接入库，不必绕一圈 SMTP 连回自己（也避免自签名证书导致的 TLS 自校验失败）
        var local = recipients.Where(r => IsValidAddress(r) && store.IsLocalAddress(r)).ToArray();
        foreach (var recipient in local)
        {
            store.DeliverLocal(recipient, raw, message.From);
            AppLog.Info($"[发送] 本地投递完成：{recipient}");
        }

        var remote = recipients.Where(r => IsValidAddress(r) && !store.IsLocalAddress(r)).ToArray();
        if (remote.Length == 0) return;

        if (config.DeliveryMode.Equals("relay", StringComparison.OrdinalIgnoreCase))
        {
            var helo = string.IsNullOrWhiteSpace(config.DirectDelivery.HeloName) ? config.Hostname : config.DirectDelivery.HeloName;
            await SendAsync(config.Relay.Host, config.Relay.Port, message.From, remote, raw,
                startTls: config.Relay.EnableSsl, requireStartTls: config.Relay.EnableSsl,
                user: config.Relay.User, password: config.Relay.Password, helo: helo, token: token);
            return;
        }

        foreach (var group in remote.GroupBy(GetDomain, StringComparer.OrdinalIgnoreCase))
        {
            await DeliverDomainAsync(message.From, group.Key, group.ToArray(), raw, token);
        }
    }

    private async Task DeliverDomainAsync(string sender, string domain, string[] recipients, byte[] raw, CancellationToken token)
    {
        var mxHosts = await MxResolver.ResolveAsync(domain, config.DirectDelivery, token);
        if (mxHosts.Count == 0) throw new SmtpDeliveryException("MX 查询", 550, $"找不到 {domain} 的 MX 记录。", permanent: true);

        var helo = string.IsNullOrWhiteSpace(config.DirectDelivery.HeloName) ? config.Hostname : config.DirectDelivery.HeloName;
        Exception? last = null;

        foreach (var mxHost in mxHosts)
        {
            try
            {
                await SendAsync(mxHost, 25, sender, recipients, raw,
                    startTls: config.DirectDelivery.OpportunisticStartTls,
                    requireStartTls: config.DirectDelivery.RequireStartTls,
                    user: "", password: "", helo: helo, token: token);
                return;
            }
            catch (StartTlsFailedException ex) when (!config.DirectDelivery.RequireStartTls)
            {
                // 机会式 TLS：握手失败（例如对方证书不受信）时必须真正回退明文重连，
                // 否则一次证书问题就会导致永久投递失败。
                AppLog.Warn($"[发送] {mxHost} 的 STARTTLS 失败（{ex.Message}），改用明文重试同一 MX。");
                try
                {
                    await SendAsync(mxHost, 25, sender, recipients, raw,
                        startTls: false, requireStartTls: false,
                        user: "", password: "", helo: helo, token: token);
                    return;
                }
                catch (Exception inner) when (inner is IOException or SocketException or TimeoutException
                                              or InvalidOperationException or AuthenticationException or SmtpDeliveryException)
                {
                    last = inner;
                    AppLog.Warn($"[发送] MX {mxHost} 明文重试失败：{inner.Message}");
                }
            }
            catch (SmtpDeliveryException ex) when (ex.Permanent)
            {
                // 永久性拒绝：换下一个 MX 没有意义，直接上报
                throw;
            }
            catch (Exception ex) when (ex is IOException or SocketException or TimeoutException or InvalidOperationException
                                       or AuthenticationException or StartTlsFailedException)
            {
                last = ex;
                AppLog.Warn($"[发送] MX {mxHost} 失败：{ex.Message}");
            }
        }

        if (last is SmtpDeliveryException smtp) throw smtp;
        throw new SmtpDeliveryException("投递", 451, $"无法投递到 {domain}：{last?.Message ?? "所有 MX 服务器均失败"}", permanent: false);
    }

    /// <summary>与某个 SMTP 服务器完成一次投递事务。</summary>
    private async Task SendAsync(string host, int port, string sender, string[] recipients, byte[] raw,
        bool startTls, bool requireStartTls, string user, string password, string helo, CancellationToken token)
    {
        var connectionTimeout = TimeSpan.FromSeconds(Math.Max(5, config.DirectDelivery.ConnectionTimeoutSeconds));
        var commandTimeout = TimeSpan.FromSeconds(Math.Max(5, config.DirectDelivery.CommandTimeoutSeconds));

        using var client = new TcpClient { NoDelay = true };
        await client.ConnectAsync(host, port, token).AsTask().WaitAsync(connectionTimeout, token);

        Stream stream = client.GetStream();
        var reader = NewReader(stream);
        var writer = NewWriter(stream);

        try
        {
            Expect(await ReadReplyAsync(reader, commandTimeout, token), "连接欢迎语", 220);

            var hello = await CommandAsync(reader, writer, $"EHLO {helo}", commandTimeout, token);
            if (hello.Code is < 200 or >= 300)
                Expect(await CommandAsync(reader, writer, $"HELO {helo}", commandTimeout, token), "HELO", 250);
            else if (startTls && HasCapability(hello, "STARTTLS"))
            {
                var startTlsReply = await CommandAsync(reader, writer, "STARTTLS", commandTimeout, token);
                if (startTlsReply.Code == 220)
                {
                    try
                    {
                        var ssl = new SslStream(stream, leaveInnerStreamOpen: false, (_, _, _, errors) => errors == SslPolicyErrors.None);
                        await ssl.AuthenticateAsClientAsync(new SslClientAuthenticationOptions
                        {
                            TargetHost = host,
                            EnabledSslProtocols = SslProtocols.Tls12 | SslProtocols.Tls13,
                        }, token).WaitAsync(commandTimeout, token);
                        stream = ssl;
                        reader = NewReader(stream);
                        writer = NewWriter(stream);
                        hello = await CommandAsync(reader, writer, $"EHLO {helo}", commandTimeout, token);
                    }
                    catch (Exception ex) when (ex is AuthenticationException or IOException)
                    {
                        if (requireStartTls)
                            throw new SmtpDeliveryException("STARTTLS", 451, $"{host} 的 TLS 握手失败（要求加密）：{ex.Message}", permanent: false);
                        throw new StartTlsFailedException(ex.Message);
                    }
                }
                else if (requireStartTls)
                {
                    throw new SmtpDeliveryException("STARTTLS", startTlsReply.Code, "对方拒绝 STARTTLS。", permanent: false);
                }
            }
            else if (requireStartTls)
            {
                throw new SmtpDeliveryException("STARTTLS", 451, "对方未广告 STARTTLS。", permanent: false);
            }

            // 中继模式需要认证
            if (!string.IsNullOrWhiteSpace(user))
            {
                var authPayload = Convert.ToBase64String(Encoding.UTF8.GetBytes("\0" + user + "\0" + password));
                var auth = await CommandAsync(reader, writer, "AUTH PLAIN " + authPayload, commandTimeout, token);
                if (auth.Code != 235) throw new SmtpDeliveryException("AUTH", auth.Code, auth.Detail, auth.Code is >= 500 and < 600);
            }

            Expect(await CommandAsync(reader, writer, $"MAIL FROM:<{NormalizeAddress(sender)}>", commandTimeout, token), "MAIL FROM", 250, 251);

            var accepted = new List<string>();
            foreach (var recipient in recipients)
            {
                var reply = await CommandAsync(reader, writer, $"RCPT TO:<{NormalizeAddress(recipient)}>", commandTimeout, token);
                if (reply.Code is 250 or 251) { accepted.Add(recipient); continue; }
                // 收件人被拒：5xx 视为这封邮件对该收件人永久失败
                throw new SmtpDeliveryException($"RCPT TO {recipient}", reply.Code, reply.Detail, reply.Code is >= 500 and < 600);
            }
            if (accepted.Count == 0) throw new SmtpDeliveryException("RCPT TO", 550, "所有收件人都被拒绝。", permanent: true);

            Expect(await CommandAsync(reader, writer, "DATA", commandTimeout, token), "DATA", 354);
            await WriteDataAsync(stream, raw, token);
            var result = await ReadReplyAsync(reader, commandTimeout, token);
            if (result.Code != 250)
                throw new SmtpDeliveryException("邮件正文", result.Code, result.Detail, result.Code is >= 500 and < 600);

            await TryQuitAsync(reader, writer, token);
        }
        finally
        {
            await stream.DisposeAsync();
        }
    }

    /// <summary>
    /// 写出 DATA 段。
    ///
    /// 这里是 v1 中文变 '?' 的根因所在（v1 用 Encoding.ASCII 的 StreamWriter 写），
    /// 现在改为按字节写出，且除 dot-stuffing 外不改动任何字节——
    /// 行尾规范化已在签名之前完成（见 SmtpDataEncoder.Normalize），
    /// 若在此处再改行尾会让 DKIM 正文哈希对不上。
    /// </summary>
    private static async Task WriteDataAsync(Stream stream, byte[] raw, CancellationToken token)
    {
        var payload = SmtpDataEncoder.Encode(SmtpDataEncoder.Normalize(raw));
        await stream.WriteAsync(payload, token);
        await stream.FlushAsync(token);
    }

    // ---------------------------------------------------------------- SMTP 会话

    private async Task<SmtpReply> CommandAsync(StreamReader reader, StreamWriter writer, string command, TimeSpan timeout, CancellationToken token)
    {
        await writer.WriteLineAsync(command).WaitAsync(timeout, token);
        return await ReadReplyAsync(reader, timeout, token);
    }

    private static async Task<SmtpReply> ReadReplyAsync(StreamReader reader, TimeSpan timeout, CancellationToken token)
    {
        var lines = new List<string>();
        var first = await reader.ReadLineAsync(token).AsTask().WaitAsync(timeout, token)
            ?? throw new IOException("SMTP 连接提前关闭。");
        lines.Add(first);
        if (first.Length < 3 || !int.TryParse(first[..3], out var code))
            throw new InvalidOperationException($"SMTP 返回无效响应：{first}");
        if (first.Length > 3 && first[3] == '-')
        {
            while (true)
            {
                var line = await reader.ReadLineAsync(token).AsTask().WaitAsync(timeout, token)
                    ?? throw new IOException("SMTP 多行响应提前结束。");
                lines.Add(line);
                if (line.StartsWith($"{code:D3} ", StringComparison.Ordinal)) break;
            }
        }
        return new SmtpReply(code, lines);
    }

    private static bool HasCapability(SmtpReply reply, string capability) =>
        reply.Lines.Any(x => x.Length > 4 && x[4..].StartsWith(capability, StringComparison.OrdinalIgnoreCase));

    private static void Expect(SmtpReply reply, string step, params int[] expected)
    {
        if (!expected.Contains(reply.Code))
            throw new SmtpDeliveryException(step, reply.Code, reply.Detail, reply.Code is >= 500 and < 600);
    }

    private static async Task TryQuitAsync(StreamReader reader, StreamWriter writer, CancellationToken token)
    {
        try
        {
            await writer.WriteLineAsync("QUIT").WaitAsync(TimeSpan.FromSeconds(5), token);
            await reader.ReadLineAsync(token).AsTask().WaitAsync(TimeSpan.FromSeconds(5), token);
        }
        catch { }
    }

    // SMTP 控制通道只传 ASCII 命令，读响应也只需 ASCII；DATA 走字节通道，与此无关
    private static StreamReader NewReader(Stream stream) => new(stream, Encoding.ASCII, false, 8192, true);
    private static StreamWriter NewWriter(Stream stream) => new(stream, Encoding.ASCII, 8192, true) { AutoFlush = true, NewLine = "\r\n" };

    private static bool IsValidAddress(string value) =>
        value.Contains('@') && value.IndexOf('@') > 0 && value.IndexOf('@') < value.Length - 1;

    private static string GetDomain(string value) => value[(value.LastIndexOf('@') + 1)..].Trim().TrimEnd('.').ToLowerInvariant();
    private static string NormalizeAddress(string value) => value.Trim().Trim('<', '>');

    private sealed record SmtpReply(int Code, IReadOnlyList<string> Lines)
    {
        /// <summary>取最后一行去掉状态码后的文本，便于写入日志。</summary>
        public string Detail => Lines.Count == 0 ? "" : (Lines[^1].Length > 4 ? Lines[^1][4..] : Lines[^1]);
    }

    /// <summary>STARTTLS 握手失败（机会式 TLS 场景下应回退明文重连）。</summary>
    private sealed class StartTlsFailedException(string message) : Exception(message);
}

/// <summary>SMTP 阶段异常，带状态码与「是否永久失败」判定。</summary>
public sealed class SmtpDeliveryException : Exception
{
    public SmtpDeliveryException(string step, int code, string detail, bool permanent)
        : base($"{step} 失败：{code} {detail}")
    {
        Step = step;
        Code = code;
        Permanent = permanent;
    }

    public string Step { get; }
    public int Code { get; }
    public bool Permanent { get; }
}

/// <summary>极简 DNS MX 查询（不依赖第三方库，直接走 UDP 53）。</summary>
internal static class MxResolver
{
    public static async Task<IReadOnlyList<string>> ResolveAsync(string domain, DirectDeliveryConfig config, CancellationToken token)
    {
        foreach (var server in GetDnsServers(config.DnsServer))
        {
            try
            {
                var records = await QueryAsync(domain, server, config.DnsTimeoutSeconds, token);
                if (records.Count > 0) return records;
            }
            catch (Exception ex) when (ex is SocketException or TimeoutException or InvalidOperationException)
            {
                AppLog.Warn($"[DNS] 查询 {domain} 的 MX 失败（{server}）：{ex.Message}");
            }
        }

        // 没有 MX 记录时按 RFC 5321 回退到 A 记录
        try
        {
            var addresses = await Dns.GetHostAddressesAsync(domain, token);
            return addresses.Where(a => a.AddressFamily == AddressFamily.InterNetwork)
                            .Select(x => x.ToString()).Distinct(StringComparer.OrdinalIgnoreCase).ToArray();
        }
        catch { return []; }
    }

    private static async Task<IReadOnlyList<string>> QueryAsync(string domain, IPAddress server, int timeoutSeconds, CancellationToken token)
    {
        using var udp = new UdpClient(server.AddressFamily);
        var query = BuildQuery(domain, out var id);
        await udp.SendAsync(query, query.Length, new IPEndPoint(server, 53));
        var result = await udp.ReceiveAsync().WaitAsync(TimeSpan.FromSeconds(Math.Max(1, timeoutSeconds)), token);
        return ParseResponse(result.Buffer, id);
    }

    private static byte[] BuildQuery(string domain, out ushort id)
    {
        id = (ushort)Random.Shared.Next(1, ushort.MaxValue);
        using var stream = new MemoryStream();
        using var writer = new BinaryWriter(stream, Encoding.ASCII, leaveOpen: true);
        writer.Write(ToNetwork(id));
        writer.Write(ToNetwork((ushort)0x0100)); // 标准查询，期望递归
        writer.Write(ToNetwork((ushort)1));
        writer.Write(ToNetwork((ushort)0));
        writer.Write(ToNetwork((ushort)0));
        writer.Write(ToNetwork((ushort)0));
        foreach (var label in domain.TrimEnd('.').Split('.', StringSplitOptions.RemoveEmptyEntries))
        {
            var bytes = Encoding.ASCII.GetBytes(label);
            writer.Write((byte)bytes.Length);
            writer.Write(bytes);
        }
        writer.Write((byte)0);
        writer.Write(ToNetwork((ushort)15)); // MX
        writer.Write(ToNetwork((ushort)1));  // IN
        return stream.ToArray();
    }

    private static IReadOnlyList<string> ParseResponse(byte[] data, ushort expectedId)
    {
        if (data.Length < 12 || ReadUInt16(data, 0) != expectedId) return [];
        var flags = ReadUInt16(data, 2);
        if ((flags & 0x8000) == 0 || (flags & 0x000F) != 0) return [];
        var questions = ReadUInt16(data, 4);
        var answers = ReadUInt16(data, 6);
        var authority = ReadUInt16(data, 8);
        var additional = ReadUInt16(data, 10);
        var offset = 12;
        for (var i = 0; i < questions; i++) { ReadName(data, ref offset); offset += 4; }

        var records = new List<(ushort Preference, string Host)>();
        for (var i = 0; i < answers + authority + additional && offset < data.Length; i++)
        {
            ReadName(data, ref offset);
            if (offset + 10 > data.Length) break;
            var type = ReadUInt16(data, offset);
            var cls = ReadUInt16(data, offset + 2);
            var length = ReadUInt16(data, offset + 8);
            offset += 10;
            if (offset + length > data.Length) break;
            if (type == 15 && cls == 1 && length >= 3)
            {
                var preference = ReadUInt16(data, offset);
                var nameOffset = offset + 2;
                var host = ReadName(data, ref nameOffset);
                if (!string.IsNullOrWhiteSpace(host)) records.Add((preference, host.TrimEnd('.')));
            }
            offset += length;
        }
        return records.OrderBy(x => x.Preference).Select(x => x.Host).Distinct(StringComparer.OrdinalIgnoreCase).ToArray();
    }

    private static string ReadName(byte[] data, ref int offset)
    {
        var labels = new List<string>();
        var cursor = offset;
        var jumped = false;
        var next = offset;
        while (cursor < data.Length)
        {
            var length = data[cursor++];
            if (length == 0) { if (!jumped) next = cursor; break; }
            if ((length & 0xC0) == 0xC0)
            {
                if (cursor >= data.Length) throw new InvalidOperationException("DNS 名称指针无效。");
                var pointer = ((length & 0x3F) << 8) | data[cursor++];
                if (!jumped) next = cursor;
                cursor = pointer;
                jumped = true;
                continue;
            }
            if (length > 63 || cursor + length > data.Length) throw new InvalidOperationException("DNS 名称长度无效。");
            labels.Add(Encoding.ASCII.GetString(data, cursor, length));
            cursor += length;
        }
        offset = next;
        return string.Join('.', labels);
    }

    private static ushort ReadUInt16(byte[] data, int offset) => (ushort)((data[offset] << 8) | data[offset + 1]);
    private static ushort ToNetwork(ushort value) => (ushort)((value << 8) | (value >> 8));

    private static IReadOnlyList<IPAddress> GetDnsServers(string configured)
    {
        if (IPAddress.TryParse(configured, out var parsed)) return [parsed];
        var system = NetworkInterface.GetAllNetworkInterfaces()
            .Where(x => x.OperationalStatus == OperationalStatus.Up)
            .SelectMany(x => x.GetIPProperties().DnsAddresses)
            .Where(x => x.AddressFamily == AddressFamily.InterNetwork)
            .Distinct()
            .ToArray();
        return system.Length > 0 ? system : [IPAddress.Parse("223.5.5.5"), IPAddress.Parse("1.1.1.1")];
    }
}