using System.Data.OleDb;
using System.Text.Json;
using MailKit.Net.Smtp;
using MailKit.Security;
using MimeKit;
using Omika.Core.Security;

// ============================================================
// OMIKA SMTP PROBE — READ-ONLY DB + (optionnel) SMTP connect/auth/send
// Modes :
//   --audit [--db OMIKA_TEST|BATIK_TEST]
//        Scan de TOUTES les configs EMAIL_ENVOI% : classification + structure
//        + déchiffrement (composant DE PRODUCTION SmtpPasswordStandardDecryptor).
//        Ne modifie aucune donnée.
//   <PU_Code> <PU_IDUtilisateur> [--db ...] [--send]
//        Audit d'une configuration unique + SMTP connect/auth (+envoi si --send).
// Ne JAMAIS afficher sMdp / sMdpStandard / plaintext / login / clé.
// ============================================================

const string server = "127.0.0.1";
const int port = 4900;
const string user = "susana";
const string pass = "123";

// ProtectionStd (ParametreUtilisateur) par base de test.
var dbMap = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
{
    ["OMIKA_TEST"] = "A1BAF17C65BC565F2927BF1A85DAFEED",
    ["BATIK_TEST"] = "E2FC3072E6145E1B20DA7321755CD607",
};

bool audit = args.Contains("--audit");
int dbIdx = Array.IndexOf(args, "--db");
string db = dbIdx >= 0 && dbIdx + 1 < args.Length ? args[dbIdx + 1] : "OMIKA_TEST";
if (!dbMap.TryGetValue(db, out string? stdPwd))
{
    Console.Error.WriteLine($"ERROR: unknown database '{db}' (known: OMIKA_TEST, BATIK_TEST).");
    return 2;
}

string connStr =
    $"Provider=PCSOFT.HFSQL;Data Source={server}:{port};Initial Catalog={db};" +
    $"User ID={user};Password={pass};" +
    $"Extended Properties=\"Password=ParametreUtilisateur:{stdPwd}\"";

var decryptor = new SmtpPasswordStandardDecryptor();

if (audit)
{
    return RunAudit(connStr, db, decryptor);
}

// --- Mode config unique ---
string code = args.Where(a => !a.StartsWith("--")).ElementAtOrDefault(0) ?? "EMAIL_ENVOI_5";
string idUserText = args.Where(a => !a.StartsWith("--")).ElementAtOrDefault(1) ?? "7";
bool send = args.Contains("--send");

if (code.Any(c => !(char.IsLetterOrDigit(c) || c == '_')) || !long.TryParse(idUserText, out long idUser))
{
    Console.Error.WriteLine("USAGE: Omika.SmtpRealProbe <PU_Code> <PU_IDUtilisateur> [--db DB] [--send]");
    return 2;
}

string? json = null;
try
{
    using var conn = new OleDbConnection(connStr);
    conn.Open();
    using var cmd = conn.CreateCommand();
    cmd.CommandText = $"SELECT PU_Valeur FROM ParametreUtilisateur WHERE PU_Code = '{code}' AND PU_IDUtilisateur = {idUser}";
    json = cmd.ExecuteScalar() as string;
}
catch (Exception ex)
{
    Console.WriteLine($"SMTP CONFIG FOUND = NO (DB read failed: {ex.GetType().Name})");
    return 3;
}

Console.WriteLine("SMTP CONFIG FOUND = " + (string.IsNullOrWhiteSpace(json) ? "NO" : "YES"));
Console.WriteLine("SOURCE TABLE      = ParametreUtilisateur");
Console.WriteLine($"PU_CODE           = {code}");
Console.WriteLine($"PU_IDUTILISATEUR  = {idUser}");

if (string.IsNullOrWhiteSpace(json)) return 4;

var cfg = ExtractFirst(json);
if (cfg is null) { Console.WriteLine("JSON PARSE = FAILED"); return 5; }

Console.WriteLine("sMdp PRESENT          = " + (string.IsNullOrWhiteSpace(cfg.SMdp) ? "NO" : "YES"));
Console.WriteLine("sMdpStandard PRESENT  = " + (string.IsNullOrWhiteSpace(cfg.SMdpStandard) ? "NO" : "YES"));
Console.WriteLine("sMdpStandard EMPTY    = " + (string.IsNullOrWhiteSpace(cfg.SMdpStandard) ? "YES" : "NO"));
Console.WriteLine("SMTP HOST             = " + (string.IsNullOrWhiteSpace(cfg.Host) ? "(absent)" : cfg.Host));
Console.WriteLine("SMTP PORT             = " + (string.IsNullOrWhiteSpace(cfg.Port) ? "(absent)" : cfg.Port));
Console.WriteLine("SMTP SECURITY MODE    = " + cfg.Cryptage switch { 1 => "AUCUN", 2 => "TLS/STARTTLS", 3 => "SSL", _ => $"INCONNU({cfg.Cryptage})" });

if (string.IsNullOrWhiteSpace(cfg.SMdpStandard))
{
    Console.WriteLine("REAL STANDARD PASSWORD DECRYPT = NOT TESTED (sMdpStandard absent)");
    return 6;
}

return TestSingle(decryptor, cfg, send);

// ============================================================

static int RunAudit(string connStr, string db, SmtpPasswordStandardDecryptor decryptor)
{
    Console.WriteLine("DATABASE = " + db);
    Console.WriteLine("IS OMIKA DATABASE = " + (db.Equals("OMIKA_TEST", StringComparison.OrdinalIgnoreCase) ? "YES" : "NO"));

    var rows = new List<(string Code, string IdUser, string? Valeur)>();
    try
    {
        using var conn = new OleDbConnection(connStr);
        conn.Open();
        using var cmd = conn.CreateCommand();
        cmd.CommandText = "SELECT PU_Code, PU_IDUtilisateur, PU_Valeur FROM ParametreUtilisateur WHERE PU_Code LIKE 'EMAIL_ENVOI%'";
        using var reader = cmd.ExecuteReader();
        while (reader.Read())
        {
            string c = (reader.GetValue(0)?.ToString() ?? "").Trim();
            string i = (reader.GetValue(1)?.ToString() ?? "").Trim();
            string? v = reader.IsDBNull(2) ? null : reader.GetValue(2)?.ToString();
            rows.Add((c, i, v));
        }
    }
    catch (Exception ex)
    {
        Console.WriteLine("QUERY FAILED = " + ex.GetType().Name);
        return 3;
    }

    int emailEnvoi = 0, emailEnvoiSoc = 0, emailEnvoiPerso = 0;
    int invalidJson = 0, legacyBinary = 0, emptyValue = 0;
    int withMdp = 0, withStd = 0, withoutStd = 0, emptyStd = 0;
    int base64Valid = 0, base64Invalid = 0;
    int decryptPass = 0, decryptFail = 0, plaintextEmpty = 0;

    foreach (var row in rows)
    {
        if (row.Code == "EMAIL_ENVOI") emailEnvoi++;
        else if (System.Text.RegularExpressions.Regex.IsMatch(row.Code, @"^EMAIL_ENVOI_\d+$")) emailEnvoiSoc++;
        else if (row.Code.Contains("Perso")) emailEnvoiPerso++;

        if (string.IsNullOrWhiteSpace(row.Valeur)) { emptyValue++; continue; }

        var configs = ExtractAll(row.Valeur);
        if (configs is null)
        {
            // Non-JSON : legacy/binaire ou JSON invalide.
            bool looksBinary = row.Valeur.Any(c => c < 32 && c != '\t' && c != '\n' && c != '\r');
            bool startsJson = row.Valeur.TrimStart().StartsWith('{') || row.Valeur.TrimStart().StartsWith('[');
            if (startsJson && !looksBinary) invalidJson++;
            else legacyBinary++;
            continue;
        }

        foreach (var cfg in configs)
        {
            if (!string.IsNullOrWhiteSpace(cfg.SMdp)) withMdp++;
            if (!string.IsNullOrWhiteSpace(cfg.SMdpStandard))
            {
                withStd++;
                byte[]? payload = TryBase64(cfg.SMdpStandard);
                if (payload is null) base64Invalid++;
                else
                {
                    base64Valid++;
                    try
                    {
                        string pt = decryptor.Decrypt(cfg.SMdpStandard);
                        decryptPass++;
                        if (string.IsNullOrEmpty(pt)) plaintextEmpty++;
                    }
                    catch (SmtpStandardPasswordException) { decryptFail++; }
                }
            }
            else
            {
                withoutStd++;
                if (cfg.SMdpStandard is not null) emptyStd++; // champ présent mais vide
            }
        }
    }

    Console.WriteLine("TOTAL EMAIL CONFIGS    = " + rows.Count);
    Console.WriteLine("EMAIL_ENVOI            = " + emailEnvoi);
    Console.WriteLine("EMAIL_ENVOI_<idSoc>    = " + emailEnvoiSoc);
    Console.WriteLine("EMAIL_ENVOI_Perso_N    = " + emailEnvoiPerso);
    Console.WriteLine("EMPTY VALUE            = " + emptyValue);
    Console.WriteLine("INVALID JSON           = " + invalidJson);
    Console.WriteLine("LEGACY/BINARY          = " + legacyBinary);
    Console.WriteLine("CONFIGS WITH sMdp      = " + withMdp);
    Console.WriteLine("CONFIGS WITH sMdpStandard   = " + withStd);
    Console.WriteLine("CONFIGS WITHOUT sMdpStandard= " + withoutStd);
    Console.WriteLine("CONFIGS WITH EMPTY sMdpStandard = " + emptyStd);
    Console.WriteLine("STANDARD BASE64 VALID  = " + (base64Valid > 0 ? (base64Invalid > 0 ? "PARTIAL" : "YES") : "NOT AVAILABLE"));
    Console.WriteLine("REAL OMIKA CONFIGS TESTED = " + (base64Valid + base64Invalid));
    Console.WriteLine("DECRYPT PASS           = " + decryptPass);
    Console.WriteLine("DECRYPT FAIL           = " + decryptFail);
    Console.WriteLine("PLAINTEXT EMPTY        = " + plaintextEmpty);
    Console.WriteLine("LEGACY sMdp USED BY OMIKA = NO (audit read-only, sMdp non déchiffré)");
    return 0;
}

static int TestSingle(SmtpPasswordStandardDecryptor decryptor, SmtpConfig cfg, bool send)
{
    byte[] payload;
    try { payload = Convert.FromBase64String(cfg.SMdpStandard!.Trim()); }
    catch { Console.WriteLine("STANDARD BASE64 VALID = NO"); return 7; }
    int ctLen = payload.Length - 16;
    Console.WriteLine("STANDARD BASE64 VALID   = YES");
    Console.WriteLine($"PAYLOAD LENGTH          = {payload.Length}");
    Console.WriteLine("IV LENGTH               = 16");
    Console.WriteLine($"CIPHERTEXT LENGTH       = {ctLen}");
    Console.WriteLine("CIPHERTEXT BLOCK VALID  = " + (ctLen > 0 && ctLen % 16 == 0 ? "YES" : "NO"));

    string plaintext;
    try
    {
        plaintext = decryptor.Decrypt(cfg.SMdpStandard);
        Console.WriteLine("REAL STANDARD PASSWORD DECRYPT = PASS");
        Console.WriteLine("PLAINTEXT EMPTY                = " + (string.IsNullOrEmpty(plaintext) ? "YES" : "NO"));
        Console.WriteLine($"PLAINTEXT LENGTH               = {plaintext.Length}");
    }
    catch (SmtpStandardPasswordException ex)
    {
        Console.WriteLine($"REAL STANDARD PASSWORD DECRYPT = FAIL ({ex.LogCode})");
        return 8;
    }

    Console.WriteLine("LEGACY sMdp USED BY OMIKA = NO");
    Console.WriteLine("PASSWORD LOGGED           = NO");

    if (string.IsNullOrWhiteSpace(cfg.Host)) { Console.WriteLine("SMTP CONNECT = NOT TESTED (host absent)"); return 9; }

    int smtpPort = int.TryParse(cfg.Port, out int p) ? p : 25;
    SecureSocketOptions secure = cfg.Cryptage switch
    {
        2 => SecureSocketOptions.StartTls,
        >= 3 => SecureSocketOptions.SslOnConnect,
        _ => SecureSocketOptions.None
    };

    try
    {
        using var client = new SmtpClient();
        client.Connect(cfg.Host, smtpPort, secure);
        Console.WriteLine("SMTP CONNECT = PASS");

        if (!string.IsNullOrWhiteSpace(cfg.Login))
        {
            try
            {
                client.Authenticate(cfg.Login, plaintext);
                Console.WriteLine("SMTP AUTH = PASS");
                Console.WriteLine("PASSWORD SOURCE = sMdpStandard");
                if (send)
                {
                    var message = new MimeMessage();
                    message.From.Add(MailboxAddress.Parse(cfg.Login));
                    message.To.Add(MailboxAddress.Parse(cfg.Login));
                    message.Subject = "Omika SMTP validation test";
                    message.Body = new TextPart("plain") { Text = "Test automatique Omika de validation SMTP (sMdpStandard)." };
                    client.Send(message);
                    Console.WriteLine("SMTP SEND = PASS");
                    Console.WriteLine("MESSAGE ACCEPTED BY SMTP SERVER = YES");
                }
                else Console.WriteLine("SMTP SEND = NOT TESTED (--send non fourni)");
            }
            catch (AuthenticationException ex)
            {
                Console.WriteLine("SMTP AUTH = FAIL");
                Console.WriteLine("AUTH ERROR TYPE = " + ex.GetType().Name);
                Console.WriteLine("AUTH ERROR MESSAGE SANITIZED = " + Sanitize(ex.Message, cfg.Login));
            }
        }
        else Console.WriteLine("SMTP AUTH = NOT TESTED (login absent)");

        try { client.Disconnect(true); } catch { }
    }
    catch (SslHandshakeException ex)
    {
        Console.WriteLine("SMTP CONNECT = FAIL");
        Console.WriteLine("ERROR TYPE = " + ex.GetType().Name);
        Console.WriteLine("ERROR MESSAGE SANITIZED = " + Sanitize(ex.Message, cfg.Login));
    }
    catch (System.Net.Sockets.SocketException ex)
    {
        Console.WriteLine("SMTP CONNECT = FAIL");
        Console.WriteLine("ERROR TYPE = " + ex.GetType().Name);
        Console.WriteLine("ERROR MESSAGE SANITIZED = " + Sanitize(ex.Message, cfg.Login));
    }
    catch (Exception ex)
    {
        Console.WriteLine("SMTP CONNECT = FAIL");
        Console.WriteLine("ERROR TYPE = " + ex.GetType().Name);
        Console.WriteLine("ERROR MESSAGE SANITIZED = " + Sanitize(ex.Message, cfg.Login));
    }

    return 0;
}

static byte[]? TryBase64(string s)
{
    try { return Convert.FromBase64String(s.Trim()); }
    catch { return null; }
}

static SmtpConfig? ExtractFirst(string json)
{
    var all = ExtractAll(json);
    return all is { Count: > 0 } ? all[0] : null;
}

static List<SmtpConfig>? ExtractAll(string json)
{
    try
    {
        using JsonDocument doc = JsonDocument.Parse(json);
        JsonElement root = doc.RootElement;
        var result = new List<SmtpConfig>();

        IEnumerable<JsonElement> elements = root.ValueKind == JsonValueKind.Array
            ? root.EnumerateArray()
            : [root];

        foreach (JsonElement element in elements)
        {
            if (!element.TryGetProperty("SMTP", out JsonElement smtp) || smtp.ValueKind != JsonValueKind.Object)
                continue;
            var cfg = new SmtpConfig();
            if (smtp.TryGetProperty("sLogin", out JsonElement e) && e.ValueKind == JsonValueKind.String) cfg.Login = e.GetString();
            if (smtp.TryGetProperty("sMdp", out e) && e.ValueKind == JsonValueKind.String) cfg.SMdp = e.GetString();
            if (smtp.TryGetProperty("sMdpStandard", out e) && e.ValueKind == JsonValueKind.String) cfg.SMdpStandard = e.GetString();
            if (smtp.TryGetProperty("sAdresseServeur", out e) && e.ValueKind == JsonValueKind.String) cfg.Host = e.GetString();
            if (smtp.TryGetProperty("sPortServeur", out e) && e.ValueKind == JsonValueKind.String) cfg.Port = e.GetString();
            if (smtp.TryGetProperty("nCryptage", out e) && e.ValueKind == JsonValueKind.Number) cfg.Cryptage = e.GetInt32();
            result.Add(cfg);
        }
        return result;
    }
    catch (JsonException) { return null; }
}

static string Sanitize(string message, string? login)
{
    string s = message ?? string.Empty;
    if (!string.IsNullOrWhiteSpace(login)) s = s.Replace(login, "<login>");
    s = System.Text.RegularExpressions.Regex.Replace(s, "(?i)(password|pwd|sMdpStandard|sMdp)\\s*[:=]\\s*\\S+", "$1=<redacted>");
    return s.Length > 200 ? s[..200] : s;
}

sealed class SmtpConfig
{
    public string? Login;
    public string? SMdp;
    public string? SMdpStandard;
    public string? Host;
    public string? Port;
    public int Cryptage;
}