namespace Dpz.Core.Service.RepositoryServiceImpl;

/// <summary>
/// SecurityStamp服务实现
/// 提供安全的SecurityStamp生成和验证功能
/// </summary>
public class SecurityStampService : ISecurityStampService
{
    /// <summary>
    /// 生成新的SecurityStamp
    /// 使用加密安全的随机数生成器，确保不可预测性
    /// </summary>
    /// <returns>格式为 XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX 的SecurityStamp</returns>
    public string GenerateSecurityStamp()
    {
        // 使用加密安全的随机数生成器
        using var rng = RandomNumberGenerator.Create();

        // 生成16字节的随机数据
        var randomBytes = new byte[16];
        rng.GetBytes(randomBytes);

        // 转换为Guid格式的字符串（保持与现有系统的兼容性）
        var guid = new Guid(randomBytes);
        return guid.ToString().ToUpperInvariant();
    }

    /// <summary>
    /// 验证SecurityStamp格式是否有效
    /// </summary>
    /// <param name="securityStamp">要验证的SecurityStamp</param>
    /// <returns>是否有效</returns>
    public bool IsValidSecurityStamp(string securityStamp)
    {
        return !string.IsNullOrWhiteSpace(securityStamp) && Guid.TryParse(securityStamp, out _);
    }
}

/// <summary>
/// SecurityStamp服务的扩展方法
/// 提供更高级的SecurityStamp操作
/// </summary>
public static class SecurityStampServiceExtensions
{
    /// <summary>
    /// 生成基于时间戳的SecurityStamp（用于特殊场景）
    /// </summary>
    /// <param name="service">SecurityStamp服务</param>
    /// <param name="userId">用户ID</param>
    /// <returns>包含时间戳信息的SecurityStamp</returns>
    public static string GenerateTimestampedSecurityStamp(
        this ISecurityStampService service,
        string userId
    )
    {
        // 生成基础的随机SecurityStamp
        var baseStamp = service.GenerateSecurityStamp();

        // 添加时间戳信息（用于审计和调试）
        var timestamp = DateTimeOffset.UtcNow.ToUnixTimeSeconds();

        // 使用HMAC确保完整性
        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes($"SecurityStamp-{userId}"));
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes($"{baseStamp}-{timestamp}"));

        // 返回组合的SecurityStamp
        return $"{baseStamp}-{Convert.ToHexString(hash)[..8]}";
    }

    /// <summary>
    /// 验证基于时间戳的SecurityStamp
    /// </summary>
    /// <param name="service">SecurityStamp服务</param>
    /// <param name="securityStamp">要验证的SecurityStamp</param>
    /// <param name="userId">用户ID</param>
    /// <returns>是否有效</returns>
    public static bool IsValidTimestampedSecurityStamp(
        this ISecurityStampService service,
        string securityStamp,
        string userId
    )
    {
        if (string.IsNullOrWhiteSpace(securityStamp) || string.IsNullOrWhiteSpace(userId))
        {
            return false;
        }

        var parts = securityStamp.Split('-');
        // GUID格式 + 额外的哈希部分
        if (parts.Length < 6)
        {
            return false;
        }

        // 重构基础GUID部分
        var guidPart = string.Join("-", parts[..5]);
        return service.IsValidSecurityStamp(guidPart);
    }
}