<?php

declare(strict_types=1);

namespace app\common\service\wechat;

use FFI;
use think\facade\Log;

/**
 * 仅为 IDE/静态分析"看见" FFI::cdef 绑定的 C 函数，不会在运行时使用；
 * 运行时 $this->ffi 是真正的 FFI 实例，方法是 FFI::cdef 动态注入。
 *
 * @method \FFI\CData NewSdk()
 * @method int Init(\FFI\CData $sdk, string $corpid, string $secret)
 * @method void DestroySdk(\FFI\CData $sdk)
 * @method int GetChatData(\FFI\CData $sdk, int $seq, int $limit, string $proxy, string $passwd, int $timeout, \FFI\CData $out)
 * @method int DecryptData(string $encryptKey, string $encryptMsg, \FFI\CData $out)
 * @method int GetMediaData(\FFI\CData $sdk, string $indexbuf, string $sdkFileid, string $proxy, string $passwd, int $timeout, \FFI\CData $out)
 * @method \FFI\CData NewSlice()
 * @method void FreeSlice(\FFI\CData $slice)
 * @method \FFI\CData GetContentFromSlice(\FFI\CData $slice)
 * @method int GetSliceLen(\FFI\CData $slice)
 * @method \FFI\CData NewMediaData()
 * @method void FreeMediaData(\FFI\CData $md)
 * @method \FFI\CData GetOutIndexBuf(\FFI\CData $md)
 * @method \FFI\CData GetData(\FFI\CData $md)
 * @method int GetIndexLen(\FFI\CData $md)
 * @method int GetDataLen(\FFI\CData $md)
 * @method int IsMediaDataFinish(\FFI\CData $md)
 */
interface WeComFinanceSdkBinding
{
}

/**
 * 企业微信「会话内容存档」官方 C SDK 的 PHP FFI 封装
 *
 * @see https://developer.work.weixin.qq.com/document/path/91774 会话存档开发接入指南
 *
 * 官方动态库（需自行下载后放到服务器）：
 *   Linux:   libWeWorkFinanceSdk_C.so
 *   Windows: WeWorkFinanceSdk.dll
 *
 * 下载地址：https://developer.work.weixin.qq.com/document/path/91883
 *
 * 关键点：
 *   1. 调用 GetChatData 获取一批 encrypt_random_key + encrypt_chat_msg
 *   2. encrypt_random_key 是 RSA 公钥加密的，需用企业后台上传公钥对应的私钥解出 AES 密钥
 *   3. AES 密钥 + encrypt_chat_msg 调 DecryptData 得到最终明文 JSON
 *   4. 消息 msgtype 为 image/voice/video/file/emotion/chatrecord(含 voip_doc_share) 时需额外调 GetMediaData
 *      可能分片返回（is_finish=0 时带 out_index_buf 继续下一片）
 *
 * 本类对「SDK 未安装 / 未启用」场景做了 noop 兼容：构造时若 `msgaudit_enabled=false`
 * 或动态库路径为空，则 isAvailable() 返回 false，所有操作返回安全空结构，不抛异常。
 * 上层（Archive 拉取命令）按 isAvailable() 分支。
 */
class WeComFinanceSdkClient
{
    /** @var FFI&WeComFinanceSdkBinding|null */
    private $ffi = null;

    /** @var \FFI\CData|null NewSdk() 的返回值 */
    private $sdk = null;

    private bool $inited = false;
    private bool $available = false;

    private string $corpId = '';
    private string $secret = '';
    private string $libPath = '';
    private string $proxy = '';
    private string $proxyPasswd = '';
    private int $timeout = 60;
    private int $limit = 500;

    /** @var array<int, string> 私钥 PEM，按 public_key_ver 索引（允许配置多版本轮换） */
    private array $privateKeys = [];

    private string $lastError = '';

    public function __construct()
    {
        $enabled = (bool) config('pay.wechat_work.msgaudit_enabled', false);
        $this->corpId = (string) config('pay.wechat_work.corp_id', '');
        $this->secret = (string) config('pay.wechat_work.msgaudit_secret', '');
        $this->libPath = (string) config('pay.wechat_work.msgaudit_sdk_lib_path', '');
        $this->proxy = (string) config('pay.wechat_work.msgaudit_proxy', '');
        $this->proxyPasswd = (string) config('pay.wechat_work.msgaudit_proxy_passwd', '');
        $this->timeout = (int) config('pay.wechat_work.msgaudit_timeout', 60);
        $this->limit = (int) config('pay.wechat_work.msgaudit_limit', 500);

        $this->privateKeys = $this->loadPrivateKeys();

        if (!$enabled) {
            $this->lastError = 'msgaudit not enabled';

            return;
        }
        if ($this->corpId === '' || $this->secret === '' || $this->libPath === '') {
            $this->lastError = 'msgaudit config incomplete (corp_id / msgaudit_secret / msgaudit_sdk_lib_path)';

            return;
        }
        if (!extension_loaded('ffi')) {
            $this->lastError = 'php ffi extension not loaded';

            return;
        }
        if (!is_file($this->libPath)) {
            $this->lastError = 'msgaudit sdk lib not found: ' . $this->libPath;

            return;
        }
        if (empty($this->privateKeys)) {
            $this->lastError = 'msgaudit private key not configured';

            return;
        }

        try {
            $this->ffi = FFI::cdef($this->cdef(), $this->libPath);
            $this->sdk = $this->ffi->NewSdk();
            $ret = $this->ffi->Init($this->sdk, $this->corpId, $this->secret);
            if ($ret !== 0) {
                $this->lastError = 'SDK Init failed, ret=' . $ret;
                $this->ffi->DestroySdk($this->sdk);
                $this->sdk = null;

                return;
            }
            $this->inited = true;
            $this->available = true;
        } catch (\Throwable $e) {
            $this->lastError = 'FFI error: ' . $e->getMessage();
            $this->sdk = null;
        }
    }

    public function __destruct()
    {
        try {
            if ($this->sdk !== null && $this->ffi !== null) {
                $this->ffi->DestroySdk($this->sdk);
            }
        } catch (\Throwable $e) {
            // 忽略析构异常
        }
    }

    public function isAvailable(): bool
    {
        return $this->available;
    }

    public function getLastError(): string
    {
        return $this->lastError;
    }

    public function getTimeout(): int
    {
        return $this->timeout;
    }

    public function getLimit(): int
    {
        return $this->limit;
    }

    /**
     * 拉取一批消息；返回解密后的明文数组（每条含 msgid、action、msgtype、content-like 字段等）
     *
     * @param int $seq   上次拉取到的最大 seq，首次传 0
     * @param int $limit 单次条数，官方上限 1000
     *
     * @return array{
     *   ok: bool,
     *   error: string,
     *   messages: array<int, array<string, mixed>>,
     *   next_seq: int,
     * }
     */
    public function pullChatData(int $seq = 0, ?int $limit = null): array
    {
        if (!$this->available) {
            return [
                'ok' => false,
                'error' => $this->lastError !== '' ? $this->lastError : 'sdk unavailable',
                'messages' => [],
                'next_seq' => $seq,
            ];
        }

        $limit = $limit === null ? $this->limit : $limit;
        $limit = (int) min(1000, max(1, $limit));

        $slice = null;
        try {
            $slice = $this->ffi->NewSlice();
            $ret = $this->ffi->GetChatData(
                $this->sdk,
                $seq,
                $limit,
                $this->proxy,
                $this->proxyPasswd,
                $this->timeout,
                $slice
            );
            if ($ret !== 0) {
                return [
                    'ok' => false,
                    'error' => 'GetChatData failed, ret=' . $ret,
                    'messages' => [],
                    'next_seq' => $seq,
                ];
            }

            $json = $this->sliceToString($slice);
            $decoded = json_decode($json, true);
            if (!is_array($decoded) || !isset($decoded['chatdata']) || !is_array($decoded['chatdata'])) {
                return [
                    'ok' => true,
                    'error' => '',
                    'messages' => [],
                    'next_seq' => $seq,
                ];
            }

            $messages = [];
            $nextSeq = $seq;
            foreach ($decoded['chatdata'] as $entry) {
                if (!is_array($entry)) {
                    continue;
                }
                $curSeq = isset($entry['seq']) ? (int) $entry['seq'] : 0;
                if ($curSeq > $nextSeq) {
                    $nextSeq = $curSeq;
                }

                $plain = $this->decryptChatItem($entry);
                if ($plain === null) {
                    continue;
                }
                $plain['__seq'] = $curSeq;
                $plain['__msgid_sdk'] = (string) ($entry['msgid'] ?? ($plain['msgid'] ?? ''));
                $plain['__publickey_ver'] = (int) ($entry['publickey_ver'] ?? 0);
                $messages[] = $plain;
            }

            return [
                'ok' => true,
                'error' => '',
                'messages' => $messages,
                'next_seq' => $nextSeq,
            ];
        } catch (\Throwable $e) {
            return [
                'ok' => false,
                'error' => 'exception: ' . $e->getMessage(),
                'messages' => [],
                'next_seq' => $seq,
            ];
        } finally {
            if ($slice !== null) {
                try {
                    $this->ffi->FreeSlice($slice);
                } catch (\Throwable $e) {
                    // ignore
                }
            }
        }
    }

    /**
     * 下载媒体（image/voice/video/file/emotion）到本地文件
     *
     * @param string $sdkFileid 消息明文里的 sdkfileid
     * @param string $destPath  目标绝对路径
     *
     * @return array{ok: bool, error: string, size: int}
     */
    public function downloadMedia(string $sdkFileid, string $destPath): array
    {
        if (!$this->available) {
            return ['ok' => false, 'error' => $this->lastError !== '' ? $this->lastError : 'sdk unavailable', 'size' => 0];
        }
        if ($sdkFileid === '') {
            return ['ok' => false, 'error' => 'empty sdkfileid', 'size' => 0];
        }

        $dir = dirname($destPath);
        if (!is_dir($dir) && !mkdir($dir, 0755, true) && !is_dir($dir)) {
            return ['ok' => false, 'error' => 'mkdir failed: ' . $dir, 'size' => 0];
        }

        $fp = @fopen($destPath, 'wb');
        if ($fp === false) {
            return ['ok' => false, 'error' => 'fopen failed: ' . $destPath, 'size' => 0];
        }

        $indexBuf = '';
        $totalSize = 0;
        $chunkCount = 0;
        $maxChunks = 10000; // 安全上限，防止 SDK 异常时死循环

        try {
            while ($chunkCount++ < $maxChunks) {
                $mediaData = $this->ffi->NewMediaData();
                try {
                    $ret = $this->ffi->GetMediaData(
                        $this->sdk,
                        $indexBuf,
                        $sdkFileid,
                        $this->proxy,
                        $this->proxyPasswd,
                        $this->timeout,
                        $mediaData
                    );
                    if ($ret !== 0) {
                        fclose($fp);
                        @unlink($destPath);

                        return ['ok' => false, 'error' => 'GetMediaData failed, ret=' . $ret . ' chunk=' . $chunkCount, 'size' => 0];
                    }

                    $dataLen = (int) $this->ffi->GetDataLen($mediaData);
                    if ($dataLen > 0) {
                        $dataPtr = $this->ffi->GetData($mediaData);
                        $chunk = FFI::string($dataPtr, $dataLen);
                        fwrite($fp, $chunk);
                        $totalSize += strlen($chunk);
                    }

                    $isFinish = (int) $this->ffi->IsMediaDataFinish($mediaData);
                    if ($isFinish === 1) {
                        break;
                    }

                    $indexLen = (int) $this->ffi->GetIndexLen($mediaData);
                    if ($indexLen > 0) {
                        $indexPtr = $this->ffi->GetOutIndexBuf($mediaData);
                        $indexBuf = FFI::string($indexPtr, $indexLen);
                    } else {
                        // 无 index 又 not finish，保护性退出
                        break;
                    }
                } finally {
                    $this->ffi->FreeMediaData($mediaData);
                }
            }

            fclose($fp);

            return ['ok' => true, 'error' => '', 'size' => $totalSize];
        } catch (\Throwable $e) {
            if (is_resource($fp)) {
                fclose($fp);
            }
            @unlink($destPath);

            return ['ok' => false, 'error' => 'exception: ' . $e->getMessage(), 'size' => 0];
        }
    }

    /**
     * 单条消息解密：encrypt_random_key（RSA）-> AES key -> DecryptData 明文
     *
     * @return array<string, mixed>|null
     */
    private function decryptChatItem(array $entry): ?array
    {
        $encryptRandomKeyB64 = (string) ($entry['encrypt_random_key'] ?? '');
        $encryptChatMsg = (string) ($entry['encrypt_chat_msg'] ?? '');
        $publicKeyVer = (int) ($entry['publickey_ver'] ?? 0);

        if ($encryptRandomKeyB64 === '' || $encryptChatMsg === '') {
            return null;
        }

        $privateKey = $this->privateKeys[$publicKeyVer] ?? null;
        if ($privateKey === null) {
            // 尝试唯一配置的私钥兜底
            $privateKey = reset($this->privateKeys) ?: null;
        }
        if ($privateKey === null) {
            Log::warning(sprintf('会话存档-无匹配私钥 publickey_ver=%d', $publicKeyVer));

            return null;
        }

        $encryptRandomKey = base64_decode($encryptRandomKeyB64, true);
        if ($encryptRandomKey === false) {
            return null;
        }

        $aesKey = null;
        // 企微会话存档默认 RSA-PKCS1 填充；部分版本可能使用 OAEP，兼容尝试
        if (openssl_private_decrypt($encryptRandomKey, $decrypted, $privateKey, OPENSSL_PKCS1_PADDING)) {
            $aesKey = $decrypted;
        } elseif (openssl_private_decrypt($encryptRandomKey, $decrypted, $privateKey, OPENSSL_PKCS1_OAEP_PADDING)) {
            $aesKey = $decrypted;
        } else {
            Log::warning(sprintf(
                '会话存档-RSA 解密失败 publickey_ver=%d err=%s',
                $publicKeyVer,
                (string) openssl_error_string()
            ));

            return null;
        }

        $slice = null;
        try {
            $slice = $this->ffi->NewSlice();
            $ret = $this->ffi->DecryptData($aesKey, $encryptChatMsg, $slice);
            if ($ret !== 0) {
                Log::warning('会话存档-DecryptData 失败 ret=' . $ret);

                return null;
            }
            $plain = $this->sliceToString($slice);
            $json = json_decode($plain, true);
            if (!is_array($json)) {
                return null;
            }

            return $json;
        } finally {
            if ($slice !== null) {
                try {
                    $this->ffi->FreeSlice($slice);
                } catch (\Throwable $e) {
                    // ignore
                }
            }
        }
    }

    private function sliceToString(\FFI\CData $slice): string
    {
        $len = (int) $this->ffi->GetSliceLen($slice);
        if ($len <= 0) {
            return '';
        }
        $buf = $this->ffi->GetContentFromSlice($slice);

        return FFI::string($buf, $len);
    }

    /**
     * @return array<int, string> publickey_ver => pem
     */
    private function loadPrivateKeys(): array
    {
        $ver = (int) config('pay.wechat_work.msgaudit_public_key_ver', 0);
        $pemFromPath = '';
        $path = (string) config('pay.wechat_work.msgaudit_private_key_path', '');
        if ($path !== '' && is_file($path) && is_readable($path)) {
            $pemFromPath = (string) file_get_contents($path);
        }
        $pemInline = (string) config('pay.wechat_work.msgaudit_private_key', '');
        $pem = $pemFromPath !== '' ? $pemFromPath : $pemInline;
        if ($pem === '') {
            return [];
        }
        // 允许配置里是 \n 转义；标准化换行
        $pem = str_replace(["\r\n", "\\n"], ["\n", "\n"], $pem);
        if (strpos($pem, '-----BEGIN') === false) {
            // 容忍纯 base64：按 64 列切并补头尾
            $pem = "-----BEGIN RSA PRIVATE KEY-----\n" . chunk_split(trim($pem), 64, "\n") . "-----END RSA PRIVATE KEY-----\n";
        }

        // 支持未来扩展多版本；目前只有一把，默认索引为配置的 ver（>=1），若为 0 则归到 key=0
        return [$ver => $pem];
    }

    /**
     * 官方 C SDK 头文件的 FFI cdef；与 libWeWorkFinanceSdk_C 头文件完全对应。
     *
     * 官方定义（简化）：
     *   struct Slice_t { char* buf; int len; };
     *   struct MediaData_t { char* outindexbuf; char* data; int data_len; int is_finish; };
     */
    private function cdef(): string
    {
        return <<<'CDEF'
typedef struct Slice {
    char *buf;
    int len;
} Slice_t;

typedef struct MediaData {
    char *outindexbuf;
    int outindexbuf_len;
    char *data;
    int data_len;
    int is_finish;
} MediaData_t;

typedef void WeWorkFinanceSdk_t;

WeWorkFinanceSdk_t* NewSdk();
int  Init(WeWorkFinanceSdk_t* sdk, const char* corpid, const char* secret);
void DestroySdk(WeWorkFinanceSdk_t* sdk);

int  GetChatData(WeWorkFinanceSdk_t* sdk, unsigned long long seq, unsigned int limit,
                 const char* proxy, const char* passwd, int timeout, Slice_t* chatData);

int  DecryptData(const char* encrypt_key, const char* encrypt_msg, Slice_t* msg);

int  GetMediaData(WeWorkFinanceSdk_t* sdk, const char* indexbuf, const char* sdkFileid,
                  const char* proxy, const char* passwd, int timeout, MediaData_t* mediaData);

Slice_t*  NewSlice();
void      FreeSlice(Slice_t* slice);
char*     GetContentFromSlice(Slice_t* slice);
int       GetSliceLen(Slice_t* slice);

MediaData_t* NewMediaData();
void         FreeMediaData(MediaData_t* mediaData);
char*        GetOutIndexBuf(MediaData_t* mediaData);
char*        GetData(MediaData_t* mediaData);
int          GetIndexLen(MediaData_t* mediaData);
int          GetDataLen(MediaData_t* mediaData);
int          IsMediaDataFinish(MediaData_t* mediaData);
CDEF;
    }
}