import Foundation
import NetworkExtension
import WireGuardKit

/// PCA Phobos packet tunnel:
/// WireGuard (userspace) -> 127.0.0.1:13255 wg-obfuscator -> 127.0.0.1:13258 pcarelay -> server (UDP or TCP).
/// providerConfiguration: "conf" (phobos:// payload), "ruDirect" (Bool), "transport" ("auto"|"udp"|"tcp").
final class PacketTunnelProvider: NEPacketTunnelProvider {
    private static let wgPort = 13255, relayPort = 13258
    private static var obfuscatorStarted = false   // one wg-obfuscator per process (it forks for more)

    private lazy var adapter = WireGuardAdapter(with: self) { _, message in NSLog("wg: %@", message) }

    override func startTunnel(options: [String: NSObject]?, completionHandler: @escaping (Error?) -> Void) {
        let pc = (protocolConfiguration as? NETunnelProviderProtocol)?.providerConfiguration ?? [:]
        guard let conf = pc["conf"] as? String, !conf.isEmpty else {
            completionHandler(NSError(domain: "PCAPhobos", code: 1, userInfo: [NSLocalizedDescriptionKey: "нет профиля"]))
            return
        }
        let ruDirect = pc["ruDirect"] as? Bool ?? true
        let transport = pc["transport"] as? String ?? "auto"
        let profile = PhobosProfile(conf)

        guard let host = profile.targetHost, let udpPort = profile.targetPort else {
            completionHandler(NSError(domain: "PCAPhobos", code: 2, userInfo: [NSLocalizedDescriptionKey: "в профиле нет адреса сервера"]))
            return
        }
        let tcpPort = profile.tcpPort ?? 0
        if transport == "tcp" && tcpPort == 0 {
            completionHandler(NSError(domain: "PCAPhobos", code: 3, userInfo: [NSLocalizedDescriptionKey: "на сервере нет TCP-канала"]))
            return
        }

        pcarelay_use_tcp(transport == "tcp" ? 1 : 0)
        if !Self.obfuscatorStarted {
            Self.obfuscatorStarted = true
            pcarelay_start(Int32(Self.relayPort), host, Int32(udpPort), Int32(tcpPort))
            let path = NSTemporaryDirectory() + "obf.conf"
            try? profile.obfuscatorConfig(listen: Self.wgPort, target: "127.0.0.1:\(Self.relayPort)")
                .write(toFile: path, atomically: true, encoding: .utf8)
            Thread.detachNewThread {
                var args: [UnsafeMutablePointer<CChar>?] = ["wg-obfuscator", "-c", path].map { strdup($0) }
                _ = wgobf_main(Int32(args.count), &args)
            }
        }

        let allowed = ruDirect ? Self.ruBypassAllowedIPs() : nil
        let wgText = profile.wireGuardConfig(endpoint: "127.0.0.1:\(Self.wgPort)", allowedIPs: allowed)
        let tunnelConfig: TunnelConfiguration
        do {
            tunnelConfig = try TunnelConfiguration(fromWgQuickConfig: wgText, called: "phobos")
        } catch {
            completionHandler(error)
            return
        }
        adapter.start(tunnelConfiguration: tunnelConfig) { [weak self] error in
            completionHandler(error)
            if error == nil && transport == "auto" && tcpPort != 0 { self?.watchUdp() }
        }
    }

    /// Auto: nothing came back over UDP within 15 s -> UDP is cut, move the relay to TCP.
    private func watchUdp() {
        DispatchQueue.global().asyncAfter(deadline: .now() + 15) {
            if pcarelay_is_tcp() == 0 && pcarelay_rx_bytes() == 0 {
                NSLog("PCAPhobos: no UDP answer in 15 s -> TCP")
                pcarelay_use_tcp(1)
            }
        }
    }

    override func stopTunnel(with reason: NEProviderStopReason, completionHandler: @escaping () -> Void) {
        adapter.stop { _ in
            completionHandler()
            // the obfuscator thread cannot be stopped cleanly; a fresh process starts next time
            exit(0)
        }
    }

    /// App asks for status: {"transport": "UDP"|"TCP", "rx": bytes}
    override func handleAppMessage(_ messageData: Data, completionHandler: ((Data?) -> Void)?) {
        let status: [String: Any] = ["transport": pcarelay_is_tcp() != 0 ? "TCP" : "UDP",
                                     "rx": pcarelay_rx_bytes()]
        completionHandler?(try? JSONSerialization.data(withJSONObject: status))
    }

    private static func ruBypassAllowedIPs() -> String? {
        guard let url = Bundle.main.url(forResource: "ru_bypass", withExtension: "txt"),
              let text = try? String(contentsOf: url, encoding: .utf8) else { return nil }
        return text.split(separator: "\n").first { !$0.hasPrefix("#") && $0.contains("/") }.map(String.init)
    }
}