package router

import (
	"strings"

	"hfb_sys/backend/internal/config"
	smsintegration "hfb_sys/backend/internal/integrations/sms"
	"hfb_sys/backend/internal/modules/realname"
	"hfb_sys/backend/pkg/crypto"

	"go.uber.org/zap"
)

// NewSMSProvider 构造主站短信通道，供路由装配与后台任务（节点短信派发）共用。
func NewSMSProvider(cfg config.Config, logger *zap.Logger) smsintegration.Provider {
	switch strings.ToLower(strings.TrimSpace(cfg.SMS.Provider)) {
	case "aliyun":
		provider, err := smsintegration.NewAliyunProvider(smsintegration.AliyunConfig{
			AccessKeyID:       cfg.SMS.AliyunAccessKeyID,
			AccessKeySecret:   cfg.SMS.AliyunAccessKeySecret,
			Endpoint:          cfg.SMS.AliyunEndpoint,
			SignName:          cfg.SMS.AliyunSignName,
			LoginTemplateCode: cfg.SMS.AliyunLoginTemplateCode,
		}, logger)
		if err != nil {
			logger.Warn("阿里云短信服务初始化失败", zap.Error(err))
			return smsintegration.NewUnavailableProvider(err)
		}
		return provider
	default:
		return smsintegration.NewMockProvider(logger)
	}
}

// NewFieldEncryptor 构造业务字段加密器（实名、收款账号、分站短信密钥共用）。
// 主密钥与 legacy 回退并存，保证密钥轮换期间仍能解出旧密文。
func NewFieldEncryptor(cfg config.Config, logger *zap.Logger) crypto.Encryptor {
	var fieldEncryptor crypto.Encryptor
	primary := cfg.FieldEncryptionKey
	legacy := cfg.FieldEncryptionLegacyKey
	switch {
	case primary != "":
		encryptor, err := crypto.NewFieldEncryptor(primary, legacy)
		if err != nil {
			if config.IsProductionEnv(cfg.AppEnv) {
				logger.Fatal("业务字段加密密钥无效", zap.Error(err))
			}
			logger.Warn("业务字段加密密钥无效，已回退旧密钥", zap.Error(err))
			// primary 非法时退回 legacy 单密钥（若有），否则 MockEncryptor
			if legacy != "" {
				if e, eErr := crypto.NewFieldEncryptor(legacy); eErr == nil {
					fieldEncryptor = e
				}
			}
		} else {
			fieldEncryptor = encryptor
		}
	case legacy != "":
		// 开发态零配置：用 legacy 单密钥，能解历史存量密文。
		encryptor, err := crypto.NewFieldEncryptor(legacy)
		if err == nil {
			fieldEncryptor = encryptor
			logger.Debug("开发环境使用旧业务字段加密密钥")
		}
	}
	if fieldEncryptor == nil {
		if config.IsProductionEnv(cfg.AppEnv) {
			logger.Fatal("业务字段加密密钥未设置")
		}
		fieldEncryptor = &crypto.MockEncryptor{}
		logger.Debug("开发环境使用模拟业务字段加密器")
	}
	return fieldEncryptor
}

func newRealnameProvider(cfg config.Config, encryptor crypto.Encryptor, logger *zap.Logger) realname.Provider {
	switch strings.ToLower(strings.TrimSpace(cfg.Realname.Provider)) {
	case "cloudmarket", "aliyun_cloudmarket":
		provider, err := realname.NewCloudMarketProvider(realname.CloudMarketConfig{
			URL: cfg.Realname.CloudMarketURL, AppCode: cfg.Realname.CloudMarketAppCode, Encryptor: encryptor,
		})
		if err != nil {
			logger.Warn("实名认证服务初始化失败", zap.Error(err))
			return realname.NewUnavailableProvider(err)
		}
		return provider
	default:
		return realname.NewMockProvider(encryptor)
	}
}