package com.igo.user.network

import android.util.Log
import cn.sinata.xldutils.utils.LanguageUtil
import cn.sinata.xldutils.utils.SPUtils
import com.igo.user.BuildConfig
import com.igo.user.IGoApplication
import com.igo.user.R
import com.igo.user.utils.Const
import okhttp3.FormBody
import okhttp3.OkHttpClient
import retrofit2.Retrofit
import retrofit2.adapter.rxjava2.RxJava2CallAdapterFactory
import java.security.KeyStore
import java.security.cert.CertificateFactory
import java.security.cert.X509Certificate
import javax.net.ssl.SSLContext
import javax.net.ssl.SSLSocketFactory
import javax.net.ssl.TrustManagerFactory
import javax.net.ssl.X509TrustManager

/**
 * 网络请求retrofit初始化。
 */
class RRetrofit(val isUseCert: Boolean = true, val isTrustAll: Boolean = false) {

    private val loggingInterceptor by lazy {
        LoggingInterceptor()
    }

    /**
     * 创建只信任指定证书文件的TrustManager
     * @param certificateResId 证书资源ID (放在 res/raw/ 目录下)
     */
    fun createTrustManager(certificateResId: Int): X509TrustManager? {
        val certificateFactory = CertificateFactory.getInstance("X.509")

        // 读取证书文件
        IGoApplication.appContext?.resources?.openRawResource(certificateResId)?.use {
            val certificate = certificateFactory.generateCertificate(it) as X509Certificate
            // 创建包含该证书的KeyStore
            val keyStore = KeyStore.getInstance(KeyStore.getDefaultType()).apply {
                load(null, null)
                setCertificateEntry("server", certificate)
            }

            // 创建TrustManager
            val trustManagerFactory = TrustManagerFactory.getInstance(
                TrustManagerFactory.getDefaultAlgorithm()
            ).apply {
                init(keyStore)
            }
            return trustManagerFactory.trustManagers.first() as X509TrustManager
        }
        return null
    }

    private fun getSSLSocketFactory(trustManager: X509TrustManager): SSLSocketFactory {
        return SSLContext.getInstance("TLS").apply {
            init(null, arrayOf(trustManager), null)
        }.socketFactory
    }

    private val retrofit: Retrofit = Retrofit.Builder()
        .baseUrl(BuildConfig.BASE_URL)
        .addConverterFactory(JsonConverterFactory.create())
        .addCallAdapterFactory(RxJava2CallAdapterFactory.create())
        .client(
            OkHttpClient.Builder()
                .addInterceptor { chain ->
                    var request = chain.request()
                    if (request.method() == "POST" && !request.url().toString()
                            .contains("base/user/image")
                    ) {
                        val bodyBuilder = FormBody.Builder()
                        var formBody: FormBody
                        if (request.body() is FormBody) {
                            formBody = request.body() as FormBody
                            (0 until formBody.size()).forEach {
                                bodyBuilder.addEncoded(
                                    formBody.encodedName(it), formBody.encodedValue(
                                        it
                                    )
                                )
                            }
                        }
                        var language = request.header("language")
                        language = if (language.isNullOrEmpty()) {
                            LanguageUtil.getLanguage()!!
                        } else {
                            language
                        }
                        //1=简体中文，2=英语，3=法语
                        formBody = bodyBuilder.addEncoded("language", getLanguageType(language)).build()
                        request = request.newBuilder().post(formBody).build()
                    }
                    chain.proceed(request)
                }
                .addInterceptor { chain ->
                    val token = SPUtils.instance().getString(Const.User.TOKEN)
                    val request =
                        if (token.isEmpty()) chain.request() else
                            chain.request().newBuilder().addHeader("Authorization", "Bearer $token")
                                .build()
                    Log.e(Const.Tag, request.headers().toString())
                    chain.proceed(request)
                }
                .apply {
                    if (isUseCert) {
                        createTrustManager(R.raw.star_gopost_ci)?.also {
                            sslSocketFactory(getSSLSocketFactory(it), it)
                        }
                    } else {
                        if (isTrustAll) {
                            val trustManager = object : X509TrustManager {
                                override fun checkClientTrusted(chain: Array<out X509Certificate>?, authType: String?) {}
                                override fun checkServerTrusted(chain: Array<out X509Certificate>?, authType: String?) {}
                                override fun getAcceptedIssuers(): Array<X509Certificate> = arrayOf()
                            }
                            sslSocketFactory(getSSLSocketFactory(trustManager), trustManager)
                        }
                    }
                    if (BuildConfig.DEBUG) {
                        addInterceptor(loggingInterceptor)
                    }
                }
                .build())
        .build()

    companion object {
        fun instance(isUseCert: Boolean = true, isTrustAll: Boolean = false) = RRetrofit(isUseCert, isTrustAll)
        fun getLanguageType(language: String): String {
            return when (language) {
                Const.Language.CHINESE -> "1"
                Const.Language.FRENCH -> "3"
                else -> "2"
            }
        }
    }

    fun <T> create(clazz: Class<T>): T = retrofit.create(clazz)
}