package logcodec

import (
	"crypto/cipher"
	"crypto/des"
	"encoding/base64"
	"errors"
	"fmt"
)

var (
	policyKey = []byte("hyhccdtm")
	policyIV  = []byte{0x12, 0x34, 0x56, 0x78, 0x90, 0xAB, 0xCD, 0xEF}
)

func DecryptLine(ciphertextBase64 string) (string, error) {
	ciphertext, err := base64.StdEncoding.DecodeString(ciphertextBase64)
	if err != nil {
		return "", fmt.Errorf("decode base64 log line: %w", err)
	}
	if len(ciphertext) == 0 || len(ciphertext)%des.BlockSize != 0 {
		return "", fmt.Errorf("ciphertext length %d is not a positive DES block multiple", len(ciphertext))
	}

	block, err := des.NewCipher(policyKey)
	if err != nil {
		return "", fmt.Errorf("create DES cipher: %w", err)
	}
	plain := make([]byte, len(ciphertext))
	cipher.NewCBCDecrypter(block, policyIV).CryptBlocks(plain, ciphertext)
	plain, err = unpadPKCS7(plain, des.BlockSize)
	if err != nil {
		return "", err
	}
	return string(plain), nil
}

func unpadPKCS7(data []byte, blockSize int) ([]byte, error) {
	if len(data) == 0 || len(data)%blockSize != 0 {
		return nil, errors.New("pkcs7 data is empty or not block aligned")
	}
	pad := int(data[len(data)-1])
	if pad == 0 || pad > blockSize || pad > len(data) {
		return nil, fmt.Errorf("invalid pkcs7 padding length %d", pad)
	}
	for i := len(data) - pad; i < len(data); i++ {
		if int(data[i]) != pad {
			return nil, errors.New("invalid pkcs7 padding bytes")
		}
	}
	return data[:len(data)-pad], nil
}