package secloud

import (
	"context"
	"errors"
	"github.com/antihax/optional"
)

type KmsService struct {
	Base *BaseService
}

func NewKmsService() *KmsService {
	return &KmsService{
		Base: BaseSvc,
	}
}

type GenerateWorkingKeyOpts struct {
	GenerateAlgo optional.String `json:"generateAlgo"`
	GenerateType optional.String `json:"generateType"`
	KeyType      optional.String `json:"keyType"`
	EpkName      optional.String `json:"epkName"`
	Count        optional.Int    `json:"count"`
}

type DistributeKeysOpts struct {
	GenerateType optional.String `json:"generateType"`
	InvokeCount  optional.Int    `json:"invokeCount"`
}

type UpdateSecretOpts struct {
	KeyId   optional.String `json:"keyId"`
	KeyType optional.String `json:"keyType"`
	EpkName optional.String `json:"epkName"`
}

type ArchiveKeyOpts struct {
	KeyId         optional.String `json:"keyId"`
	ArchiveReason optional.String `json:"archiveReason"`
}

type DestroyKeyOpts struct {
	KeyId optional.String `json:"keyId"`
}

type ImportKeyOpts struct {
	Mode   optional.String `json:"mode"`
	Secret optional.String `json:"secret"`
	KeyId  optional.String `json:"keyId"`
}

type DestroyHandleOpts struct {
	Handle optional.String `json:"handle"`
}

func (ks *KmsService) GenerateWorkingKey(ctx context.Context, opts *GenerateWorkingKeyOpts) (*GenerateWorkingKeyRespData, error) {
	if ctx.Value(ContextAccessToken) == nil {
		return nil, errors.New("token为空！")
	}
	if opts.GenerateType.Value() == "EPK" && !opts.EpkName.IsSet() {
		return nil, errors.New("使用epk类型时必须指定epkName！")
	}
	if opts.GenerateType.Value() == "IPK" && !opts.KeyType.IsSet() {
		return nil, errors.New("使用ipk类型时必须指定keyType！")
	}

	var ret GenerateWorkingKeyResp
	_, err := ks.Base.C.R().
		SetHeader("Authorization", "Bearer "+ctx.Value(ContextAccessToken).(string)).
		SetBody(map[string]interface{}{
			"generateAlgo": opts.GenerateAlgo.Value(),
			"generateType": opts.GenerateType.Value(),
			"keyType":      opts.KeyType.Value(),
			"epkName":      opts.EpkName.Value(),
			"count":        opts.Count.Value(),
		}).
		SetResult(&ret).
		Post("/kms/generate")
	if err != nil {
		return nil, err
	}

	if ret.Code != 200 {
		return nil, errors.New(ret.Msg)
	}

	return ret.Data, nil
}

func (ks *KmsService) DistributeKeys(ctx context.Context, opts *DistributeKeysOpts) (*DistributeKeysRespData, error) {
	if ctx.Value(ContextAccessToken) == nil {
		return nil, errors.New("token为空！")
	}
	if !opts.GenerateType.IsSet() {
		return nil, errors.New("生成类型不得为空！")
	}
	if !opts.InvokeCount.IsSet() {
		return nil, errors.New("领用数量不得小于1！")
	}

	var ret DistributeKeysResp
	_, err := ks.Base.C.R().
		SetHeader("Authorization", "Bearer "+ctx.Value(ContextAccessToken).(string)).
		SetBody(map[string]interface{}{
			"generateType": opts.GenerateType.Value(),
			"invokeCount":  opts.InvokeCount.Value(),
		}).
		SetResult(&ret).
		Post("/kms/distributeKeys")
	if err != nil {
		return nil, err
	}

	if ret.Code != 200 {
		return nil, errors.New(ret.Msg)
	}

	return ret.Data, nil
}

func (ks *KmsService) UpdateSecret(ctx context.Context, opts *UpdateSecretOpts) (*UpdateSecretRespData, error) {
	if ctx.Value(ContextAccessToken) == nil {
		return nil, errors.New("token为空！")
	}
	if !opts.KeyId.IsSet() {
		return nil, errors.New("keyId不能为空！")
	}

	var ret UpdateSecretResp
	_, err := ks.Base.C.R().
		SetHeader("Authorization", "Bearer "+ctx.Value(ContextAccessToken).(string)).
		SetBody(map[string]interface{}{
			"keyId":   opts.KeyId.Value(),
			"keyType": opts.KeyType.Value(),
			"epkName": opts.EpkName.Value(),
		}).
		SetResult(&ret).
		Post("/kms/updateSecret")
	if err != nil {
		return nil, err
	}

	if ret.Code != 200 {
		return nil, errors.New(ret.Msg)
	}

	return ret.Data, nil
}

func (ks *KmsService) ArchiveKey(ctx context.Context, opts *ArchiveKeyOpts) (*ArchiveKeyRespData, error) {
	if ctx.Value(ContextAccessToken) == nil {
		return nil, errors.New("token为空！")
	}
	if !opts.KeyId.IsSet() {
		return nil, errors.New("keyId不能为空！")
	}

	var ret ArchiveKeyResp
	_, err := ks.Base.C.R().
		SetHeader("Authorization", "Bearer "+ctx.Value(ContextAccessToken).(string)).
		SetBody(map[string]interface{}{
			"keyId":         opts.KeyId.Value(),
			"archiveReason": opts.ArchiveReason.Value(),
		}).
		SetResult(&ret).
		Post("/kms/archiveKey")
	if err != nil {
		return nil, err
	}

	if ret.Code != 200 {
		return nil, errors.New(ret.Msg)
	}

	return ret.Data, nil
}

func (ks *KmsService) DestroyKey(ctx context.Context, opts *DestroyKeyOpts) (*DestroyKeyRespData, error) {
	if ctx.Value(ContextAccessToken) == nil {
		return nil, errors.New("token为空！")
	}
	if !opts.KeyId.IsSet() {
		return nil, errors.New("keyId不能为空！")
	}

	var ret DestroyKeyResp
	_, err := ks.Base.C.R().
		SetHeader("Authorization", "Bearer "+ctx.Value(ContextAccessToken).(string)).
		SetBody(map[string]interface{}{
			"keyId": opts.KeyId.Value(),
		}).
		SetResult(&ret).
		Post("/kms/destroyKey")
	if err != nil {
		return nil, err
	}

	if ret.Code != 200 {
		return nil, errors.New(ret.Msg)
	}

	return ret.Data, nil
}

func (ks *KmsService) Backup(ctx context.Context) (*BackupRespData, error) {
	if ctx.Value(ContextAccessToken) == nil {
		return nil, errors.New("token为空！")
	}

	var ret BackupResp
	_, err := ks.Base.C.R().
		SetHeader("Authorization", "Bearer "+ctx.Value(ContextAccessToken).(string)).
		SetResult(&ret).
		Post("/kms/backup")
	if err != nil {
		return nil, err
	}

	if ret.Code != 200 {
		return nil, errors.New(ret.Msg)
	}

	return ret.Data, nil
}

func (ks *KmsService) Recover(ctx context.Context) (*RecoverRespData, error) {
	if ctx.Value(ContextAccessToken) == nil {
		return nil, errors.New("token为空！")
	}

	var ret RecoverResp
	_, err := ks.Base.C.R().
		SetHeader("Authorization", "Bearer "+ctx.Value(ContextAccessToken).(string)).
		SetResult(&ret).
		Post("/kms/recover")
	if err != nil {
		return nil, err
	}

	if ret.Code != 200 {
		return nil, errors.New(ret.Msg)
	}

	return ret.Data, nil
}

func (ks *KmsService) ImportKey(ctx context.Context, opts *ImportKeyOpts) (*ImportKeyRespData, error) {
	if ctx.Value(ContextAccessToken) == nil {
		return nil, errors.New("token为空！")
	}
	if !opts.Mode.IsSet() {
		return nil, errors.New("导入模式不能为空！")
	}
	if !opts.KeyId.IsSet() && !opts.Secret.IsSet() {
		return nil, errors.New("keyId和secret不能同时为空！")
	}

	var ret ImportKeyResp
	_, err := ks.Base.C.R().
		SetHeader("Authorization", "Bearer "+ctx.Value(ContextAccessToken).(string)).
		SetBody(map[string]interface{}{
			"mode":   opts.Mode.Value(),
			"keyId":  opts.KeyId.Value(),
			"secret": opts.Secret.Value(),
		}).
		SetResult(&ret).
		Post("/kms/importKey")
	if err != nil {
		return nil, err
	}

	if ret.Code != 200 {
		return nil, errors.New(ret.Msg)
	}

	return ret.Data, nil
}

func (ks *KmsService) DestroyHandle(ctx context.Context, opts *DestroyHandleOpts) (*DestroyHandleRespData, error) {
	if ctx.Value(ContextAccessToken) == nil {
		return nil, errors.New("token为空！")
	}
	if !opts.Handle.IsSet() {
		return nil, errors.New("句柄不能为空！")
	}

	var ret DestroyHandleResp
	_, err := ks.Base.C.R().
		SetHeader("Authorization", "Bearer "+ctx.Value(ContextAccessToken).(string)).
		SetBody(map[string]interface{}{
			"handle": opts.Handle.Value(),
		}).
		SetResult(&ret).
		Post("/kms/destroyHandle")
	if err != nil {
		return nil, err
	}

	if ret.Code != 200 {
		return nil, errors.New(ret.Msg)
	}

	return ret.Data, nil
}