// Credentials never live in storebound.config.ts or in git. Sources, first hit wins:
//   1. environment: PLAY_SERVICE_ACCOUNT (path to the JSON key, or the JSON itself), ASC_KEY_ID, ASC_ISSUER_ID,
//      ASC_P8 (path to AuthKey_<id>.p8, or the PEM itself)
//   2. <project>/.storebound/credentials.json (gitignored), same names:
//      { "PLAY_SERVICE_ACCOUNT": "...", "ASC_KEY_ID": "...", "ASC_ISSUER_ID": "...", "ASC_P8": "...",
//        "reviewContact": { "firstName": "", "lastName": "", "phone": "", "email": "" },
//        "reviewDemoAccount": { "username": "", "password": "" } }
//      The demo account for App Review can also come from env: REVIEW_DEMO_USER, REVIEW_DEMO_PASSWORD.
//   3. ASC_P8 only: ~/.appstoreconnect/private_keys/AuthKey_<ASC_KEY_ID>.p8 (where Xcode / altool keep it)
// With a credential profile (`--profile <name>` or STOREBOUND_PROFILE), the profile comes before all of these:
//   ~/.storebound/credentials/<name>.json (same four names; relative paths are relative to that file; folder:
//   STOREBOUND_CREDENTIALS_DIR) or env STOREBOUND_PROFILE_<NAME>_<KEY> (NAME upper case, other characters as _).
//   Many studios / store accounts from one machine: one profile per account; storebound.workspace.json names them.
import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
import { homedir, tmpdir } from 'node:os';
import { isAbsolute, join, resolve } from 'node:path';

export interface ServiceAccount { client_email: string; private_key: string; token_uri?: string }
export interface AscKey { keyId: string; issuerId: string; pem: string }
export interface ReviewContact { firstName: string; lastName: string; phone: string; email: string }

type Store = Record<string, unknown>;

function fileStore(root: string): Store {
  const p = join(root, '.storebound', 'credentials.json');
  if (!existsSync(p)) return {};
  try { return JSON.parse(readFileSync(p, 'utf8')) as Store; } catch (e) { throw new Error(`${p}: ${(e as Error).message}`); }
}

/** One credential by name: env first, then .storebound/credentials.json. Never print the value. */
export function credentialValue(root: string, name: string): string | undefined { return value(root, name); }
/** The store credential names a profile holds (the same as the env names): per developer account, so the vendor number
 *  for reports too; an app's Android upload keystore stays in the project. */
export const PROFILE_KEYS = ['PLAY_SERVICE_ACCOUNT', 'ASC_KEY_ID', 'ASC_ISSUER_ID', 'ASC_P8', 'ASC_VENDOR_NUMBER'] as const;
export const PROFILE_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;

export const profileDir = (): string => process.env.STOREBOUND_CREDENTIALS_DIR || join(homedir(), '.storebound', 'credentials');
const profileEnvName = (profile: string, key: string): string => `STOREBOUND_PROFILE_${profile.toUpperCase().replace(/[^A-Z0-9]/g, '_')}_${key}`;

/**
 * The credentials of one profile as env values (never printed). Env STOREBOUND_PROFILE_<NAME>_<KEY> wins over the
 * profile file; a relative key path in the file is relative to the file. Throws on a bad name or an unreadable file.
 */
export function profileEnv(profile: string): Record<string, string> {
  if (!PROFILE_RE.test(profile)) throw new Error(`credential profile "${profile}": letters, digits, . _ - (max 64)`);
  const file = join(profileDir(), `${profile}.json`);
  let stored: Store = {};
  if (existsSync(file)) {
    try { stored = JSON.parse(readFileSync(file, 'utf8')) as Store; } catch (e) { throw new Error(`credential profile ${profile}: ${file}: ${(e as Error).message}`); }
  }
  const out: Record<string, string> = {};
  for (const k of PROFILE_KEYS) {
    const env = process.env[profileEnvName(profile, k)];
    const v = env || (typeof stored[k] === 'string' ? stored[k] as string : '');
    if (!v) continue;
    // a path in the file: relative to the profile folder (inline JSON / PEM stays as it is)
    const isPath = !env && !/^\s*\{/.test(v) && !/BEGIN PRIVATE KEY/.test(v) && (k === 'PLAY_SERVICE_ACCOUNT' || k === 'ASC_P8');
    out[k] = isPath && !isAbsolute(v) && !v.startsWith('~') ? resolve(profileDir(), v) : v;
  }
  return out;
}

/** Which stores a profile can reach, and where it comes from. No values. */
export function profileStatus(profile: string): { profile: string; source: 'file' | 'env' | 'missing' | 'invalid'; apple: boolean; play: boolean; error?: string } {
  try {
    const env = profileEnv(profile);
    const fromEnv = PROFILE_KEYS.some(k => !!process.env[profileEnvName(profile, k)]);
    const source = fromEnv ? 'env' : existsSync(join(profileDir(), `${profile}.json`)) ? 'file' : 'missing';
    return { profile, source, apple: !!(env.ASC_KEY_ID && env.ASC_ISSUER_ID), play: !!env.PLAY_SERVICE_ACCOUNT };
  } catch (e) {
    return { profile, source: 'invalid', apple: false, play: false, error: (e as Error).message };
  }
}

/**
 * A value that only looks like a credential: a template placeholder ("your-…", "YOUR_KEY_ID", "<KEY_ID>", "xxx",
 * "/absolute/path/to/…", the all-zero Apple Ads client id, "example" as a word unless it is a file that exists). Treated as
 * missing everywhere (check, apps check, doctor and every command), never sent to a store. `example: false` for the
 * review contact and demo account (an app's own backend can have a real demo@example.com account).
 */
export function isPlaceholder(v: string, o: { example?: boolean } = {}): boolean {
  const s = v.trim();
  if (!s || /BEGIN PRIVATE KEY/.test(s) || /^\s*\{/.test(s)) return false;
  if (/(^|[_\-\s/])your([_\-\s]|$)/i.test(s) || /<[^<>\n]+>/.test(s) || /(^|[^a-z0-9])x{3,}([^a-z0-9]|$)/i.test(s) || /(^|\/)path\/to\//.test(s)) return true;
  if (/^SEARCHADS\.0{8}-0{4}-0{4}-0{4}-0{12}$/i.test(s)) return true;
  if (o.example !== false && /(^|[^a-z0-9])example([^a-z0-9]|$)/i.test(s)) {
    try { return !existsSync(s.replace(/^~(?=\/)/, homedir())); } catch { return true; }
  }
  return false;
}

/** Credential names storebound reads (env, .storebound/credentials.json, a profile), for status reports. */
export const CREDENTIAL_KEYS = ['PLAY_SERVICE_ACCOUNT', 'ASC_KEY_ID', 'ASC_ISSUER_ID', 'ASC_P8', 'ASC_VENDOR_NUMBER', 'APPLE_ADS_CLIENT_ID', 'APPLE_ADS_TEAM_ID',
  'APPLE_ADS_KEY_ID', 'APPLE_ADS_PRIVATE_KEY', 'APPLE_ADS_ACCOUNT_ID', 'REVENUECAT_SECRET_KEY', 'ANDROID_KEYSTORE', 'ANDROID_KEYSTORE_PASSWORD', 'ANDROID_KEY_ALIAS', 'ANDROID_KEY_PASSWORD'] as const;

/** Where each known credential stands: set, missing, or placeholder (a template value, treated as missing). Never
 *  the values. */
export function credentialStatus(root: string): { key: string; status: 'set' | 'missing' | 'placeholder' }[] {
  let file: Store = {};
  try { file = fileStore(root); } catch { /* unreadable: reported by the commands that read it */ }
  const profile = process.env.STOREBOUND_PROFILE;
  let prof: Record<string, string> = {};
  try { if (profile) prof = profileEnv(profile); } catch { /* invalid profile */ }
  return CREDENTIAL_KEYS.map(key => {
    const raw = [prof[key], process.env[key], typeof file[key] === 'string' ? file[key] as string : undefined].filter((x): x is string => !!x && !!x.trim());
    return { key, status: raw.some(x => !isPlaceholder(x)) ? 'set' as const : raw.length ? 'placeholder' as const : 'missing' as const };
  });
}

function value(root: string, name: string): string | undefined {
  const real = (v: unknown): v is string => typeof v === 'string' && !!v && !isPlaceholder(v);
  const profile = process.env.STOREBOUND_PROFILE;
  if (profile) { const v = profileEnv(profile)[name]; if (real(v)) return v; }
  const env = process.env[name];
  if (real(env)) return env;
  const v = fileStore(root)[name];
  return real(v) ? v : undefined;
}

/** A path or the inline content itself. */
export const inline = (v: string, marker: RegExp): string => (marker.test(v) ? v : readFileSync(v.replace(/^~(?=\/)/, homedir()), 'utf8'));

export function parseServiceAccount(text: string): ServiceAccount {
  const j = JSON.parse(text) as Partial<ServiceAccount>;
  if (typeof j.client_email !== 'string' || typeof j.private_key !== 'string' || !j.private_key.includes('PRIVATE KEY'))
    throw new Error('not a Google service account JSON key (client_email / private_key missing)');
  return { client_email: j.client_email, private_key: j.private_key, token_uri: j.token_uri };
}

export function playServiceAccount(root: string): ServiceAccount {
  const v = value(root, 'PLAY_SERVICE_ACCOUNT');
  if (!v) throw new Error('PLAY_SERVICE_ACCOUNT is not set (env, or .storebound/credentials.json): path to the service account JSON key');
  return parseServiceAccount(inline(v, /^\s*\{/));
}

export function ascKey(root: string): AscKey {
  const keyId = value(root, 'ASC_KEY_ID');
  const issuerId = value(root, 'ASC_ISSUER_ID');
  if (!keyId || !issuerId) throw new Error('ASC_KEY_ID and ASC_ISSUER_ID are not set (env, or .storebound/credentials.json)');
  const p8 = value(root, 'ASC_P8') ?? join(homedir(), '.appstoreconnect/private_keys', `AuthKey_${keyId}.p8`);
  if (!/BEGIN PRIVATE KEY/.test(p8) && !existsSync(p8.replace(/^~(?=\/)/, homedir()))) throw new Error(`App Store Connect key not found: ${p8} (set ASC_P8)`);
  return { keyId, issuerId, pem: inline(p8, /BEGIN PRIVATE KEY/) };
}

/** App Review contact from .storebound/credentials.json (personal data, so never in the config). */
export function reviewContact(root: string): ReviewContact | null {
  const c = fileStore(root).reviewContact as Partial<ReviewContact> | undefined;
  if (!c?.email || isPlaceholder(c.email, { example: false })) return null;
  return { firstName: c.firstName ?? '', lastName: c.lastName ?? '', phone: c.phone ?? '', email: c.email };
}

export interface DemoAccount { username: string; password: string }

/** App Review demo account (sign-in for the reviewer): env REVIEW_DEMO_USER + REVIEW_DEMO_PASSWORD, else
 *  "reviewDemoAccount" in .storebound/credentials.json. Never in the config or the repo. */
export function reviewDemoAccount(root: string): DemoAccount | null {
  const eu = process.env.REVIEW_DEMO_USER, ep = process.env.REVIEW_DEMO_PASSWORD;
  if (eu && ep) return { username: eu, password: ep };
  const d = fileStore(root).reviewDemoAccount as Partial<DemoAccount> | undefined;
  if (typeof d?.username === 'string' && d.username && !isPlaceholder(d.username, { example: false }) && typeof d.password === 'string' && d.password) return { username: d.username, password: d.password };
  return null;
}

/** For logs: "d***@example.com" / "d***"; a password is never shown, only its length class. */
export const maskUser = (u: string): string => {
  const at = u.indexOf('@');
  return at > 0 ? `${u[0]}***${u.slice(at)}` : `${u[0] ?? ''}***`;
};
export const maskSecret = (s: string): string => (s ? '********' : '(empty)');

/** The App Store Connect key as a file, for tools that want a path (xcodebuild -authenticationKeyPath, altool).
 *  A path in ASC_P8 (or the usual ~/.appstoreconnect location) is used as is; inline PEM content goes to a private
 *  temporary folder (0700 / 0600) that `cleanup` removes. Commands show the path as $ASC_P8. */
export function ascKeyFile(root: string): { keyPath: string; keyId: string; issuerId: string; cleanup: () => void } {
  const k = ascKey(root);
  const raw = value(root, 'ASC_P8') ?? join(homedir(), '.appstoreconnect/private_keys', `AuthKey_${k.keyId}.p8`);
  if (!/BEGIN PRIVATE KEY/.test(raw)) return { keyPath: raw.replace(/^~(?=\/)/, homedir()), keyId: k.keyId, issuerId: k.issuerId, cleanup: () => {} };
  const dir = mkdtempSync(join(tmpdir(), 'storebound-key-'));
  chmodSync(dir, 0o700);
  const keyPath = join(dir, `AuthKey_${k.keyId}.p8`);
  writeFileSync(keyPath, k.pem, { mode: 0o600 });
  return { keyPath, keyId: k.keyId, issuerId: k.issuerId, cleanup: () => rmSync(dir, { recursive: true, force: true }) };
}

export interface AndroidSigning { storeFile: string; storePassword: string; keyAlias: string; keyPassword: string }

/** Android upload key for `play build` (env or .storebound/credentials.json): ANDROID_KEYSTORE (path to the .jks /
 *  .keystore), ANDROID_KEYSTORE_PASSWORD, ANDROID_KEY_ALIAS, ANDROID_KEY_PASSWORD (default: the keystore password).
 *  null when no keystore is set (the project's own signingConfig signs then, e.g. Flutter's key.properties). */
export function androidSigning(root: string): AndroidSigning | null {
  const storeFile = value(root, 'ANDROID_KEYSTORE');
  if (!storeFile) return null;
  const storePassword = value(root, 'ANDROID_KEYSTORE_PASSWORD'), keyAlias = value(root, 'ANDROID_KEY_ALIAS');
  if (!storePassword || !keyAlias) throw new Error('ANDROID_KEYSTORE is set but ANDROID_KEYSTORE_PASSWORD / ANDROID_KEY_ALIAS are not (env or .storebound/credentials.json)');
  const abs = storeFile.replace(/^~(?=\/)/, homedir());
  return { storeFile: abs.startsWith('/') ? abs : join(root, abs), storePassword, keyAlias, keyPassword: value(root, 'ANDROID_KEY_PASSWORD') ?? storePassword };
}

/** App Store Connect vendor number for sales and finance reports (Payments and Financial Reports, top left): the
 *  credential profile, env ASC_VENDOR_NUMBER, else "ASC_VENDOR_NUMBER" in .storebound/credentials.json. An account
 *  id, so never in the config. */
export function ascVendorNumber(root: string): string | null {
  const v = value(root, 'ASC_VENDOR_NUMBER');
  return v && /^\d{5,12}$/.test(v.trim()) ? v.trim() : null;
}