/**
 * IP 白名單檢查工具
 */

// 檢查IP是否在指定範圍內
function isIpInRange(ip: string, range: string): boolean {
  // 處理單一IP
  if (!range.includes('/')) {
    return ip === range;
  }

  // 處理CIDR範圍 (例如: 192.168.1.0/24)
  const [rangeIp, prefixLength] = range.split('/');
  const mask = parseInt(prefixLength);
  
  if (isNaN(mask) || mask < 0 || mask > 32) {
    return false;
  }

  const ipNum = ipToNumber(ip);
  const rangeNum = ipToNumber(rangeIp);
  const maskNum = (0xFFFFFFFF << (32 - mask)) >>> 0;

  return (ipNum & maskNum) === (rangeNum & maskNum);
}

// 將IP地址轉換為數字
function ipToNumber(ip: string): number {
  const parts = ip.split('.').map(part => parseInt(part));
  if (parts.length !== 4 || parts.some(part => isNaN(part) || part < 0 || part > 255)) {
    throw new Error(`Invalid IP address: ${ip}`);
  }
  return (parts[0] << 24) + (parts[1] << 16) + (parts[2] << 8) + parts[3];
}

// 檢查IP是否在白名單內
export function isIpAllowed(clientIp: string, allowedIps: string): boolean {
  if (!allowedIps || allowedIps.trim() === '') {
    return true; // 如果沒有設置白名單，允許所有IP
  }

  const allowedIpList = allowedIps.split(',').map(ip => ip.trim()).filter(ip => ip);
  
  for (const allowedIp of allowedIpList) {
    try {
      if (isIpInRange(clientIp, allowedIp)) {
        return true;
      }
    } catch (error) {
      console.error(`Invalid IP range: ${allowedIp}`, error);
    }
  }
  
  return false;
}

// 清理和驗證IP地址
function cleanIpAddress(ip: string): string | null {
  if (!ip) return null;
  
  // 移除空白字符
  ip = ip.trim();
  
  // 處理IPv6格式的IPv4地址 (例如: ::ffff:192.168.1.1)
  if (ip.startsWith('::ffff:')) {
    ip = ip.substring(7);
  }
  
  // 處理純IPv6本地回環地址
  if (ip === '::1') {
    return '127.0.0.1';
  }
  
  // 驗證IP格式
  if (!isValidIp(ip)) {
    return null;
  }
  
  return ip;
}

// 獲取客戶端真實IP
export function getClientIp(req: any): string {
  // 按優先順序檢查各種IP來源
  const ipSources = [
    // 1Panel 和常見代理伺服器轉發的IP (優先級最高)
    req.headers['x-forwarded-for'],
    req.headers['x-real-ip'],
    req.headers['x-client-ip'],
    req.headers['cf-connecting-ip'], // Cloudflare
    req.headers['x-original-forwarded-for'], // 某些代理伺服器
    req.headers['x-cluster-client-ip'], // 集群環境
    
    // 其他代理頭
    req.headers['x-forwarded'], // 舊版代理頭
    req.headers['forwarded-for'],
    req.headers['forwarded'],
    
    // 1Panel 特殊頭部
    req.headers['x-1panel-client-ip'], // 1Panel 可能使用的頭部
    req.headers['x-nginx-proxy-real-ip'], // Nginx 代理
    
    // 直接連接的IP
    req.connection?.remoteAddress,
    req.socket?.remoteAddress,
    req.ip,
  ];

  // 收集所有找到的IP用於調試
  const foundIps: string[] = [];

  for (const ipSource of ipSources) {
    if (ipSource) {
      // 處理多個IP的情況 (例如: "192.168.1.1, 10.0.0.1, 203.0.113.1")
      const ipList = ipSource.toString().split(',').map(ip => ip.trim());
      
      // 遍歷所有IP，找到第一個有效的公網IP
      for (const ip of ipList) {
        const cleanIp = cleanIpAddress(ip);
        if (cleanIp) {
          foundIps.push(cleanIp);
          // 檢查是否為公網IP，排除內部IP和1Panel代理IP
          if (isPublicIp(cleanIp) && !isInternalProxyIp(cleanIp)) {
            return cleanIp;
          }
        }
      }
    }
  }

  // 如果沒有找到有效的公網IP，返回第一個有效的IP
  for (const ipSource of ipSources) {
    if (ipSource) {
      const ipList = ipSource.toString().split(',').map(ip => ip.trim());
      for (const ip of ipList) {
        const cleanIp = cleanIpAddress(ip);
        if (cleanIp) {
          return cleanIp;
        }
      }
    }
  }

  // 在本地開發環境中，嘗試獲取本機IP
  if (process.env.NODE_ENV === 'development') {
    const localIp = getLocalIp();
    if (localIp && localIp !== '127.0.0.1') {
      return localIp;
    }
  }

  // 最後的備用方案
  return '127.0.0.1';
}

// 獲取本機IP地址（僅用於開發環境）
function getLocalIp(): string | null {
  try {
    const os = require('os');
    const interfaces = os.networkInterfaces();
    
    for (const name of Object.keys(interfaces)) {
      for (const networkInterface of interfaces[name]) {
        // 跳過內部（非IPv4）和回環地址
        if (networkInterface.family === 'IPv4' && !networkInterface.internal) {
          return networkInterface.address;
        }
      }
    }
  } catch (error) {
    console.error('Error getting local IP:', error);
  }
  
  return null;
}

// 檢查是否為公網IP
function isPublicIp(ip: string): boolean {
  // 私有IP範圍
  const privateRanges = [
    /^10\./,                    // 10.0.0.0/8
    /^172\.(1[6-9]|2[0-9]|3[0-1])\./, // 172.16.0.0/12
    /^192\.168\./,              // 192.168.0.0/16
    /^127\./,                   // 127.0.0.0/8
    /^169\.254\./,              // 169.254.0.0/16 (Link-local)
    /^0\./,                     // 0.0.0.0/8
    /^224\./,                   // 224.0.0.0/4 (Multicast)
    /^240\./,                   // 240.0.0.0/4 (Reserved)
  ];
  
  return !privateRanges.some(range => range.test(ip));
}

// 檢查是否為內部代理IP (如1Panel、Cloudflare等)
function isInternalProxyIp(ip: string): boolean {
  // 1Panel 和常見代理服務器的內部IP範圍
  const proxyRanges = [
    /^172\.70\./, // Cloudflare 內部IP (包含你遇到的 172.70.214.246)
    /^172\.71\./, // Cloudflare 內部IP
    /^172\.64\./, // Cloudflare 內部IP
    /^172\.65\./, // Cloudflare 內部IP
    /^172\.66\./, // Cloudflare 內部IP
    /^172\.67\./, // Cloudflare 內部IP
    /^172\.68\./, // Cloudflare 內部IP
    /^172\.69\./, // Cloudflare 內部IP
    /^172\.72\./, // Cloudflare 內部IP
    /^172\.73\./, // Cloudflare 內部IP
    /^172\.74\./, // Cloudflare 內部IP
    /^172\.75\./, // Cloudflare 內部IP
    /^172\.76\./, // Cloudflare 內部IP
    /^172\.77\./, // Cloudflare 內部IP
    /^172\.78\./, // Cloudflare 內部IP
    /^172\.79\./, // Cloudflare 內部IP
    /^172\.80\./, // Cloudflare 內部IP
    /^172\.81\./, // Cloudflare 內部IP
    /^172\.82\./, // Cloudflare 內部IP
    /^172\.83\./, // Cloudflare 內部IP
    /^172\.84\./, // Cloudflare 內部IP
    /^172\.85\./, // Cloudflare 內部IP
    /^172\.86\./, // Cloudflare 內部IP
    /^172\.87\./, // Cloudflare 內部IP
    /^172\.88\./, // Cloudflare 內部IP
    /^172\.89\./, // Cloudflare 內部IP
    /^172\.90\./, // Cloudflare 內部IP
    /^172\.91\./, // Cloudflare 內部IP
    /^172\.92\./, // Cloudflare 內部IP
    /^172\.93\./, // Cloudflare 內部IP
    /^172\.94\./, // Cloudflare 內部IP
    /^172\.95\./, // Cloudflare 內部IP
    /^172\.96\./, // Cloudflare 內部IP
    /^172\.97\./, // Cloudflare 內部IP
    /^172\.98\./, // Cloudflare 內部IP
    /^172\.99\./, // Cloudflare 內部IP
    /^172\.100\./, // Cloudflare 內部IP
    /^172\.101\./, // Cloudflare 內部IP
    /^172\.102\./, // Cloudflare 內部IP
    /^172\.103\./, // Cloudflare 內部IP
    /^172\.104\./, // Cloudflare 內部IP
    /^172\.105\./, // Cloudflare 內部IP
    /^172\.106\./, // Cloudflare 內部IP
    /^172\.107\./, // Cloudflare 內部IP
    /^172\.108\./, // Cloudflare 內部IP
    /^172\.109\./, // Cloudflare 內部IP
    /^172\.110\./, // Cloudflare 內部IP
    /^172\.111\./, // Cloudflare 內部IP
    /^172\.112\./, // Cloudflare 內部IP
    /^172\.113\./, // Cloudflare 內部IP
    /^172\.114\./, // Cloudflare 內部IP
    /^172\.115\./, // Cloudflare 內部IP
    /^172\.116\./, // Cloudflare 內部IP
    /^172\.117\./, // Cloudflare 內部IP
    /^172\.118\./, // Cloudflare 內部IP
    /^172\.119\./, // Cloudflare 內部IP
    /^172\.120\./, // Cloudflare 內部IP
    /^172\.121\./, // Cloudflare 內部IP
    /^172\.122\./, // Cloudflare 內部IP
    /^172\.123\./, // Cloudflare 內部IP
    /^172\.124\./, // Cloudflare 內部IP
    /^172\.125\./, // Cloudflare 內部IP
    /^172\.126\./, // Cloudflare 內部IP
    /^172\.127\./, // Cloudflare 內部IP
    /^172\.128\./, // Cloudflare 內部IP
    /^172\.129\./, // Cloudflare 內部IP
    /^172\.130\./, // Cloudflare 內部IP
    /^172\.131\./, // Cloudflare 內部IP
    /^172\.132\./, // Cloudflare 內部IP
    /^172\.133\./, // Cloudflare 內部IP
    /^172\.134\./, // Cloudflare 內部IP
    /^172\.135\./, // Cloudflare 內部IP
    /^172\.136\./, // Cloudflare 內部IP
    /^172\.137\./, // Cloudflare 內部IP
    /^172\.138\./, // Cloudflare 內部IP
    /^172\.139\./, // Cloudflare 內部IP
    /^172\.140\./, // Cloudflare 內部IP
    /^172\.141\./, // Cloudflare 內部IP
    /^172\.142\./, // Cloudflare 內部IP
    /^172\.143\./, // Cloudflare 內部IP
    /^172\.144\./, // Cloudflare 內部IP
    /^172\.145\./, // Cloudflare 內部IP
    /^172\.146\./, // Cloudflare 內部IP
    /^172\.147\./, // Cloudflare 內部IP
    /^172\.148\./, // Cloudflare 內部IP
    /^172\.149\./, // Cloudflare 內部IP
    /^172\.150\./, // Cloudflare 內部IP
    /^172\.151\./, // Cloudflare 內部IP
    /^172\.152\./, // Cloudflare 內部IP
    /^172\.153\./, // Cloudflare 內部IP
    /^172\.154\./, // Cloudflare 內部IP
    /^172\.155\./, // Cloudflare 內部IP
    /^172\.156\./, // Cloudflare 內部IP
    /^172\.157\./, // Cloudflare 內部IP
    /^172\.158\./, // Cloudflare 內部IP
    /^172\.159\./, // Cloudflare 內部IP
    /^172\.160\./, // Cloudflare 內部IP
    /^172\.161\./, // Cloudflare 內部IP
    /^172\.162\./, // Cloudflare 內部IP
    /^172\.163\./, // Cloudflare 內部IP
    /^172\.164\./, // Cloudflare 內部IP
    /^172\.165\./, // Cloudflare 內部IP
    /^172\.166\./, // Cloudflare 內部IP
    /^172\.167\./, // Cloudflare 內部IP
    /^172\.168\./, // Cloudflare 內部IP
    /^172\.169\./, // Cloudflare 內部IP
    /^172\.170\./, // Cloudflare 內部IP
    /^172\.171\./, // Cloudflare 內部IP
    /^172\.172\./, // Cloudflare 內部IP
    /^172\.173\./, // Cloudflare 內部IP
    /^172\.174\./, // Cloudflare 內部IP
    /^172\.175\./, // Cloudflare 內部IP
    /^172\.176\./, // Cloudflare 內部IP
    /^172\.177\./, // Cloudflare 內部IP
    /^172\.178\./, // Cloudflare 內部IP
    /^172\.179\./, // Cloudflare 內部IP
    /^172\.180\./, // Cloudflare 內部IP
    /^172\.181\./, // Cloudflare 內部IP
    /^172\.182\./, // Cloudflare 內部IP
    /^172\.183\./, // Cloudflare 內部IP
    /^172\.184\./, // Cloudflare 內部IP
    /^172\.185\./, // Cloudflare 內部IP
    /^172\.186\./, // Cloudflare 內部IP
    /^172\.187\./, // Cloudflare 內部IP
    /^172\.188\./, // Cloudflare 內部IP
    /^172\.189\./, // Cloudflare 內部IP
    /^172\.190\./, // Cloudflare 內部IP
    /^172\.191\./, // Cloudflare 內部IP
    /^172\.192\./, // Cloudflare 內部IP
    /^172\.193\./, // Cloudflare 內部IP
    /^172\.194\./, // Cloudflare 內部IP
    /^172\.195\./, // Cloudflare 內部IP
    /^172\.196\./, // Cloudflare 內部IP
    /^172\.197\./, // Cloudflare 內部IP
    /^172\.198\./, // Cloudflare 內部IP
    /^172\.199\./, // Cloudflare 內部IP
    /^172\.200\./, // Cloudflare 內部IP
    /^172\.201\./, // Cloudflare 內部IP
    /^172\.202\./, // Cloudflare 內部IP
    /^172\.203\./, // Cloudflare 內部IP
    /^172\.204\./, // Cloudflare 內部IP
    /^172\.205\./, // Cloudflare 內部IP
    /^172\.206\./, // Cloudflare 內部IP
    /^172\.207\./, // Cloudflare 內部IP
    /^172\.208\./, // Cloudflare 內部IP
    /^172\.209\./, // Cloudflare 內部IP
    /^172\.210\./, // Cloudflare 內部IP
    /^172\.211\./, // Cloudflare 內部IP
    /^172\.212\./, // Cloudflare 內部IP
    /^172\.213\./, // Cloudflare 內部IP
    /^172\.214\./, // Cloudflare 內部IP
    /^172\.215\./, // Cloudflare 內部IP
    /^172\.216\./, // Cloudflare 內部IP
    /^172\.217\./, // Cloudflare 內部IP
    /^172\.218\./, // Cloudflare 內部IP
    /^172\.219\./, // Cloudflare 內部IP
    /^172\.220\./, // Cloudflare 內部IP
    /^172\.221\./, // Cloudflare 內部IP
    /^172\.222\./, // Cloudflare 內部IP
    /^172\.223\./, // Cloudflare 內部IP
    /^172\.224\./, // Cloudflare 內部IP
    /^172\.225\./, // Cloudflare 內部IP
    /^172\.226\./, // Cloudflare 內部IP
    /^172\.227\./, // Cloudflare 內部IP
    /^172\.228\./, // Cloudflare 內部IP
    /^172\.229\./, // Cloudflare 內部IP
    /^172\.230\./, // Cloudflare 內部IP
    /^172\.231\./, // Cloudflare 內部IP
    /^172\.232\./, // Cloudflare 內部IP
    /^172\.233\./, // Cloudflare 內部IP
    /^172\.234\./, // Cloudflare 內部IP
    /^172\.235\./, // Cloudflare 內部IP
    /^172\.236\./, // Cloudflare 內部IP
    /^172\.237\./, // Cloudflare 內部IP
    /^172\.238\./, // Cloudflare 內部IP
    /^172\.239\./, // Cloudflare 內部IP
    /^172\.240\./, // Cloudflare 內部IP
    /^172\.241\./, // Cloudflare 內部IP
    /^172\.242\./, // Cloudflare 內部IP
    /^172\.243\./, // Cloudflare 內部IP
    /^172\.244\./, // Cloudflare 內部IP
    /^172\.245\./, // Cloudflare 內部IP
    /^172\.246\./, // Cloudflare 內部IP
    /^172\.247\./, // Cloudflare 內部IP
    /^172\.248\./, // Cloudflare 內部IP
    /^172\.249\./, // Cloudflare 內部IP
    /^172\.250\./, // Cloudflare 內部IP
    /^172\.251\./, // Cloudflare 內部IP
    /^172\.252\./, // Cloudflare 內部IP
    /^172\.253\./, // Cloudflare 內部IP
    /^172\.254\./, // Cloudflare 內部IP
    /^172\.255\./, // Cloudflare 內部IP
  ];
  
  return proxyRanges.some(range => range.test(ip));
}

// 驗證IP地址格式
export function isValidIp(ip: string): boolean {
  const ipRegex = /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/;
  return ipRegex.test(ip);
}

// 驗證CIDR格式
export function isValidCidr(cidr: string): boolean {
  const cidrRegex = /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\/([0-9]|[1-2][0-9]|3[0-2])$/;
  return cidrRegex.test(cidr);
}

// 獲取IP地理位置信息（可選功能）
export async function getIpLocation(ip: string): Promise<any> {
  try {
    const response = await fetch(`http://ip-api.com/json/${ip}?fields=status,message,country,countryCode,region,regionName,city,zip,lat,lon,timezone,isp,org,as,mobile,proxy,hosting,query`);
    if (response.ok) {
      return await response.json();
    }
  } catch (error) {
    console.error('Error fetching IP location:', error);
  }
  return null;
}

// 獲取詳細的IP檢測信息（用於調試）
export function getDetailedIpInfo(req: any): {
  detectedIp: string;
  allFoundIps: string[];
  ipSources: Record<string, string | null>;
  isLocalDevelopment: boolean;
  localIp: string | null;
} {
  const ipSources = {
    'x-forwarded-for': req.headers['x-forwarded-for'],
    'x-real-ip': req.headers['x-real-ip'],
    'x-client-ip': req.headers['x-client-ip'],
    'cf-connecting-ip': req.headers['cf-connecting-ip'],
    'x-forwarded': req.headers['x-forwarded'],
    'forwarded-for': req.headers['forwarded-for'],
    'forwarded': req.headers['forwarded'],
    'x-original-forwarded-for': req.headers['x-original-forwarded-for'],
    'x-cluster-client-ip': req.headers['x-cluster-client-ip'],
    'connection.remoteAddress': req.connection?.remoteAddress,
    'socket.remoteAddress': req.socket?.remoteAddress,
    'req.ip': req.ip,
  };

  const allFoundIps: string[] = [];
  let detectedIp = '127.0.0.1';

  // 收集所有IP
  Object.values(ipSources).forEach(ipSource => {
    if (ipSource) {
      const ipList = ipSource.toString().split(',').map(ip => ip.trim());
      ipList.forEach(ip => {
        const cleanIp = cleanIpAddress(ip);
        if (cleanIp && !allFoundIps.includes(cleanIp)) {
          allFoundIps.push(cleanIp);
        }
      });
    }
  });

  // 如果沒有找到任何IP，檢查是否有IPv6格式的地址
  if (allFoundIps.length === 0) {
    Object.values(ipSources).forEach(ipSource => {
      if (ipSource) {
        const ipList = ipSource.toString().split(',').map(ip => ip.trim());
        ipList.forEach(ip => {
          // 直接處理IPv6格式的IPv4地址
          if (ip.startsWith('::ffff:')) {
            const cleanIp = ip.substring(7);
            if (isValidIp(cleanIp) && !allFoundIps.includes(cleanIp)) {
              allFoundIps.push(cleanIp);
            }
          }
        });
      }
    });
  }

  // 選擇最佳IP
  for (const ip of allFoundIps) {
    if (isPublicIp(ip)) {
      detectedIp = ip;
      break;
    }
  }

  // 如果沒有公網IP，選擇第一個非回環IP
  if (detectedIp === '127.0.0.1') {
    for (const ip of allFoundIps) {
      if (ip !== '127.0.0.1' && ip !== '::1') {
        detectedIp = ip;
        break;
      }
    }
  }

  const isLocalDevelopment = process.env.NODE_ENV === 'development';
  const localIp = isLocalDevelopment ? getLocalIp() : null;

  return {
    detectedIp,
    allFoundIps,
    ipSources,
    isLocalDevelopment,
    localIp
  };
}