import type { Request } from 'express';

// Source-IP trust policy for the dashboard session gate.
//
// The dashboard is a single-user tool, so by default we trust any caller whose
// source IP is on the local machine or on the local network. Remote callers
// still need a session token (i.e. they have to log in).
//
// "Local" is defined as:
//   - 127.0.0.0/8           IPv4 loopback
//   - ::1                   IPv6 loopback
//   - 10.0.0.0/8            RFC1918 private
//   - 172.16.0.0/12         RFC1918 private
//   - 192.168.0.0/16        RFC1918 private
//   - 169.254.0.0/16        IPv4 link-local
//   - fc00::/7              IPv6 unique local (ULA)
//   - fe80::/10             IPv6 link-local
//
// This is a usability feature, not a security boundary. Anyone who can already
// send packets from your LAN has the same access as you do, so if the box is
// exposed on an untrusted LAN (guest WiFi, shared datacenter) treat the
// dashboard as effectively public. The intended deploy is the dev machine or
// a trusted home network.
//
// Trusted-by-default source IP detection is paired with a separate
// `TRUST_PROXY=1` env var that lets Express trust `X-Forwarded-For` from the
// upstream reverse proxy — without it, `req.ip` always reflects the TCP
// peer, which is the only safe posture when there's no proxy in front.

interface Ipv4Cidr { bytes: [number, number, number, number]; prefix: number }

const IPV4_CIDRS: ReadonlyArray<Ipv4Cidr> = [
  { bytes: [127, 0, 0, 0], prefix: 8 },         // 127.0.0.0/8
  { bytes: [10, 0, 0, 0], prefix: 8 },          // 10.0.0.0/8
  { bytes: [172, 16, 0, 0], prefix: 12 },       // 172.16.0.0/12
  { bytes: [192, 168, 0, 0], prefix: 16 },      // 192.168.0.0/16
  { bytes: [169, 254, 0, 0], prefix: 16 },      // 169.254.0.0/16
];

function matchIpv4Cidr(addr: [number, number, number, number], cidr: Ipv4Cidr): boolean {
  let bitsLeft = cidr.prefix;
  for (let i = 0; i < 4; i++) {
    if (bitsLeft <= 0) break;
    if (bitsLeft >= 8) {
      if (addr[i] !== cidr.bytes[i]) return false;
      bitsLeft -= 8;
    } else {
      const mask = (0xff << (8 - bitsLeft)) & 0xff;
      if ((addr[i] & mask) !== (cidr.bytes[i] & mask)) return false;
      bitsLeft = 0;
    }
  }
  return true;
}

function ipv4Trusted(addr: [number, number, number, number]): boolean {
  for (const cidr of IPV4_CIDRS) {
    if (matchIpv4Cidr(addr, cidr)) return true;
  }
  return false;
}

function parseIpv4(s: string): [number, number, number, number] | null {
  const parts = s.split('.');
  if (parts.length !== 4) return null;
  const out: number[] = [];
  for (const p of parts) {
    if (p.length === 0 || p.length > 3) return null;
    if (!/^\d+$/.test(p)) return null;
    const n = Number(p);
    if (n < 0 || n > 255) return null;
    out.push(n);
  }
  // Reject leading zeros ("01.2.3.4") — Node's net.isIPv4 does the same and
  // it's the only way to disambiguate octal from decimal.
  for (const p of parts) {
    if (p.length > 1 && p[0] === '0') return null;
  }
  return out as [number, number, number, number];
}

type Hextets = [number, number, number, number, number, number, number, number];

function parseHextet(s: string): number | null {
  if (s.length === 0 || s.length > 4) return null;
  if (!/^[0-9a-fA-F]+$/.test(s)) return null;
  const n = parseInt(s, 16);
  if (!Number.isFinite(n) || n < 0 || n > 0xffff) return null;
  return n;
}

/** Parse a pure-IPv6 string (no embedded IPv4) into 8 hextets, or null. */
function parseIpv6(s: string): Hextets | null {
  if (s.length === 0) return null;
  // Strip a "%zone" suffix; we don't inspect the zone, but the rest of the
  // string is the actual address.
  const zoneIdx = s.indexOf('%');
  if (zoneIdx >= 0) s = s.slice(0, zoneIdx);
  if (s.length === 0) return null;

  const doubleColonIdx = s.indexOf('::');
  if (doubleColonIdx >= 0) {
    if (s.indexOf('::', doubleColonIdx + 1) >= 0) return null; // >1 "::"
    const left = s.slice(0, doubleColonIdx);
    const right = s.slice(doubleColonIdx + 2);
    const head = left.length === 0 ? [] : left.split(':');
    const tail = right.length === 0 ? [] : right.split(':');
    if (head.length + tail.length > 8) return null;
    const hextets: number[] = [];
    for (const h of head) {
      const n = parseHextet(h);
      if (n === null) return null;
      hextets.push(n);
    }
    const zerosNeeded = 8 - head.length - tail.length;
    for (let i = 0; i < zerosNeeded; i++) hextets.push(0);
    for (const h of tail) {
      const n = parseHextet(h);
      if (n === null) return null;
      hextets.push(n);
    }
    if (hextets.length !== 8) return null;
    return hextets as Hextets;
  }
  const parts = s.split(':');
  if (parts.length !== 8) return null;
  const out: number[] = [];
  for (const p of parts) {
    const n = parseHextet(p);
    if (n === null) return null;
    out.push(n);
  }
  return out as Hextets;
}

/** Test that the top `prefix` bits of `addr` match the top `prefix` bits of
 * `expected`. For prefixes that fit in the top hextet (<=16), `expected` is
 * a 16-bit value; for longer prefixes, it's a 128-bit value with the relevant
 * bits placed in the corresponding hextets. The remaining bits of `addr` are
 * not constrained — RFC 4291's fe80::/10 and fc00::/7 allow arbitrary values
 * in the bottom bits. */
function ipv6MatchesPrefix(addr: Hextets, prefix: number, expected: number): boolean {
  if (prefix < 0 || prefix > 128) return false;
  if (prefix === 0) return true; // every address matches a /0.
  if (prefix <= 16) {
    const mask = prefix === 16 ? 0xffff : (0xffff << (16 - prefix)) & 0xffff;
    return (addr[0]! & mask) === (expected & mask);
  }
  // For prefixes that span more than one hextet, the 128-bit `expected` value
  // needs shifts ≥ 32, which wrap modulo 32 in plain JS. Use BigInt to dodge
  // that — the only callsite in this file passes small integers (1 for ::1,
  // 0 for ::, larger 128-bit values for `expected` is actually never used
  // because all the trusted ranges fit in prefix ≤ 16).
  const fullHextets = Math.floor(prefix / 16);
  const exp = BigInt(expected);
  for (let i = 0; i < fullHextets; i++) {
    const shiftBits = BigInt((8 - 1 - i) * 16);
    const e = Number((exp >> shiftBits) & 0xffffn);
    if (addr[i] !== e) return false;
  }
  const tailBits = prefix - fullHextets * 16;
  if (tailBits > 0) {
    const mask = (0xffff << (16 - tailBits)) & 0xffff;
    const shiftBits = BigInt((8 - 1 - fullHextets) * 16);
    const e = Number((exp >> shiftBits) & 0xffffn);
    if ((addr[fullHextets]! & mask) !== (e & mask)) return false;
  }
  return true;
}

/** Test an IPv6 against the trusted IPv6 ranges. */
function ipv6Trusted(addr: Hextets): boolean {
  // ::1 loopback
  if (ipv6MatchesPrefix(addr, 128, 1)) return true;
  // :: unspecified — not a real client, do not auto-trust.
  if (ipv6MatchesPrefix(addr, 128, 0)) return false;
  // fc00::/7 — top 7 bits are 1111110. The pattern in the top hextet is 0xfc00.
  if (ipv6MatchesPrefix(addr, 7, 0xfc00)) return true;
  // fe80::/10 — top 10 bits are 1111111010. Pattern in the top hextet is 0xfe80.
  if (ipv6MatchesPrefix(addr, 10, 0xfe80)) return true;
  return false;
}

/**
 * Normalize an address that may be in the form "::ffff:1.2.3.4" (IPv4-mapped
 * IPv6) into a tuple of hextets. Returns null if unparseable.
 */
function ipv6FromPossiblyMapped(s: string): Hextets | null {
  if (!s.includes('.')) return parseIpv6(s);
  const dot = s.indexOf('.');
  const lastColon = s.lastIndexOf(':');
  if (lastColon < 0 || dot < lastColon) return null;
  const ipv4Str = s.slice(lastColon + 1);
  const ipv4 = parseIpv4(ipv4Str);
  if (!ipv4) return null;
  // Drop the trailing ':' so parseIpv6 sees "::ffff" (no empty tail hextet).
  const hex = s.slice(0, lastColon);
  const parsed = parseIpv6(hex || '::');
  if (!parsed) return null;
  // Sanity: the parsed low hextets should be 0, otherwise the input wasn't
  // actually an IPv4-mapped address.
  if (!(parsed[0] === 0 && parsed[1] === 0 && parsed[2] === 0 && parsed[3] === 0
        && parsed[4] === 0 && parsed[5] === 0 && parsed[6] === 0)) {
    return null;
  }
  parsed[6] = (ipv4[0] << 8) | ipv4[1];
  parsed[7] = (ipv4[2] << 8) | ipv4[3];
  return parsed;
}

/** Returns true if the address belongs to a range we auto-trust. */
export function isTrustedSourceIp(addr: string | null | undefined): boolean {
  if (!addr) return false;
  const trimmed = addr.trim();
  if (trimmed.length === 0) return false;

  // Strip a "[…]:port" suffix for IPv6 literals.
  if (trimmed.startsWith('[')) {
    const end = trimmed.indexOf(']');
    if (end >= 0) {
      const inner = trimmed.slice(1, end);
      if (isTrustedSourceIp(inner)) return true;
    }
    return false;
  }

  // Distinguish "10.0.0.1:51234" (IPv4 with port — no embedded colon in the
  // host portion) from "::1" or "::ffff:1.2.3.4" (IPv6 with colons).
  if (trimmed.includes(':') && !trimmed.includes('.')) {
    const v6 = parseIpv6(trimmed);
    return v6 ? ipv6Trusted(v6) : false;
  }
  if (trimmed.includes(':') && trimmed.includes('.')) {
    // Could be either "10.0.0.1:51234" (host:port) or "::ffff:1.2.3.4" (mapped).
    // If the substring before the last colon parses as IPv4, treat as host:port.
    const lastColon = trimmed.lastIndexOf(':');
    const host = trimmed.slice(0, lastColon);
    const v4 = parseIpv4(host);
    if (v4) return ipv4Trusted(v4);
    // Otherwise assume it's the IPv4-mapped form.
    const v6 = ipv6FromPossiblyMapped(trimmed);
    if (!v6) return false;
    return ipv4Trusted([
      (v6[6] >> 8) & 0xff,
      v6[6] & 0xff,
      (v6[7] >> 8) & 0xff,
      v6[7] & 0xff,
    ]);
  }

  // No colons, no brackets: pure IPv4.
  const v4 = parseIpv4(trimmed);
  if (v4) return ipv4Trusted(v4);
  return false;
}

/**
 * Best-effort resolution of the client IP, honoring `X-Forwarded-For` when
 * Express has been configured with `trust proxy`. Falls back to
 * `req.socket.remoteAddress`.
 */
export function getClientIp(req: Pick<Request, 'ip' | 'socket'>): string | null {
  if (req.ip && req.ip.length > 0) return req.ip;
  const sock = req.socket as { remoteAddress?: string | null } | undefined;
  return sock?.remoteAddress ?? null;
}

/**
 * True when the request comes from a source we treat as already
 * authenticated (loopback, RFC1918, IPv6 ULA / link-local). Routes that
 * expose auth state — like `/api/auth/status` — call this so they report
 * `authenticated: true` for the LAN case; the gate middleware uses the same
 * check to skip session validation for those callers.
 */
export function isTrustedRequest(req: Pick<Request, 'ip' | 'socket'>): boolean {
  return isTrustedSourceIp(getClientIp(req));
}