// === security/CodeObfuscation.ts ===
/**
 * 代码混淆不是万能药，但不可或缺。
 * 推荐在构建流程中集成 terser + javascript-obfuscator。
 */

interface ObfuscationConfig {
  compact: boolean;              // 压缩为一行
  controlFlowFlattening: boolean; // 控制流扁平化（使逻辑跳转复杂化）
  deadCodeInjection: boolean;    // 注入死代码
  debugProtection: boolean;      // 防调试（检测 DevTools）
  disableConsoleOutput: boolean; // 禁用 console（生产环境）
  identifierNamesGenerator: "hexadecimal" | "mangled" | "dictionary";
  renameGlobals: boolean;        // 重命名全局变量
  rotateStringArray: boolean;    // 字符串数组轮转
  selfDefending: boolean;        // 代码自保护（防格式化）
  splitStringsChunkLength: number; // 字符串分片长度
  stringArray: boolean;          // 提取字符串到数组
  transformObjectKeys: boolean;  // 变换对象键名
}

// 推荐配置（平衡安全与性能）
export const RecommendedObfuscation: ObfuscationConfig = {
  compact: true,
  controlFlowFlattening: true,
  deadCodeInjection: true,
  debugProtection: true,
  disableConsoleOutput: true,
  identifierNamesGenerator: "hexadecimal",
  renameGlobals: false, // 全局变量重命名可能导致第三方 SDK 出问题，谨慎开启
  rotateStringArray: true,
  selfDefending: true,
  splitStringsChunkLength: 2,
  stringArray: true,
  transformObjectKeys: false, // 影响运行时性能较高的属性访问，关闭
};

/**
 * 运行时检测是否被调试（防 Developer Tools）
 */
export function detectDevTools(): boolean {
  const threshold = 160; // DevTools 打开时 window.outerHeight 与 window.innerHeight 差值
  return (
    window.outerHeight - window.innerHeight > threshold ||
    window.outerWidth - window.innerWidth > threshold
  );
}

/**
 * 定时检测调试器，发现后执行防御动作
 */
export function startAntiDebug(defense: () => void, checkInterval: number = 2000): void {
  setInterval(() => {
    // 检测 debugger 断点陷阱
    const start = performance.now();
    // eslint-disable-next-line no-debugger
    debugger; // 如果 DevTools 打开，此行会暂停执行，导致时间差极大
    const end = performance.now();
    if (end - start > 100) {
      defense();
    }

    if (detectDevTools()) {
      defense();
    }
  }, checkInterval);
}

// === security/IntegrityChecker.ts ===
/**
 * 运行时校验关键函数未被篡改。
 * 原理：计算关键函数的源代码哈希，与构建时预计算的值比对。
 */
class IntegrityChecker {
  private checksums: Map<string, string> = new Map();
  private onTampered: () => void;

  constructor(checksums: Record<string, string>, onTampered: () => void) {
    for (const [name, hash] of Object.entries(checksums)) {
      this.checksums.set(name, hash);
    }
    this.onTampered = onTampered;
  }

  /**
   * 校验指定函数的完整性
   */
  verifyFunction(name: string, fn: Function): boolean {
    const expected = this.checksums.get(name);
    if (!expected) return true; // 未注册的不校验

    const actual = this.hashFunction(fn);
    if (actual !== expected) {
      console.warn(`[Integrity] Function '${name}' has been tampered!`);
      this.onTampered();
      return false;
    }
    return true;
  }

  /**
   * 计算函数源码的简单哈希（简化版，正式环境用 SHA-256）
   */
  private hashFunction(fn: Function): string {
    const source = fn.toString();
    let hash = 0;
    for (let i = 0; i < source.length; i++) {
      const char = source.charCodeAt(i);
      hash = ((hash << 5) - hash + char) | 0;
    }
    return hash.toString(16);
  }

  /**
   * 批量校验所有注册函数
   */
  verifyAll(functions: Record<string, Function>): boolean {
    let allPass = true;
    for (const [name, fn] of Object.entries(functions)) {
      if (!this.verifyFunction(name, fn)) allPass = false;
    }
    return allPass;
  }
}

// 使用示例
const criticalFunctions = {
  calculateScore: (combo: number, base: number) => base * combo * 1.5,
  validatePurchase: (itemId: string, price: number) => price > 0,
};

// 构建时预计算哈希，写入代码中
const BUILD_CHECKSUMS = {
  calculateScore: "a3f7c2e1",
  validatePurchase: "b8e1d4a9",
};

const checker = new IntegrityChecker(BUILD_CHECKSUMS, () => {
  // 校验失败：上报服务端 + 重置游戏状态 + 提示用户
  reportTampering();
  resetGameState();
});

// 每局开始或敏感操作前调用
checker.verifyAll(criticalFunctions);

// === security/AssetEncryption.ts ===
/**
 * 资源加密方案：构建时 XOR 加密，运行时内存中解密。
 * 注意：密钥必然存在于客户端，目的是提高逆向成本而非绝对安全。
 */
class AssetEncryption {
  private key: Uint8Array;

  constructor(keyString: string) {
    // 将字符串密钥转为 byte array（简化版）
    this.key = new TextEncoder().encode(keyString);
  }

  /**
   * XOR 加密/解密（对称操作）
   */
  encrypt(data: Uint8Array): Uint8Array {
    return this.xor(data);
  }

  decrypt(data: Uint8Array): Uint8Array {
    return this.xor(data);
  }

  private xor(data: Uint8Array): Uint8Array {
    const result = new Uint8Array(data.length);
    for (let i = 0; i < data.length; i++) {
      result[i] = data[i] ^ this.key[i % this.key.length];
    }
    return result;
  }

  /**
   * 解密图片并转为 Base64 Data URL（用于 HTMLImageElement）
   */
  async decryptImage(encryptedData: Uint8Array, mimeType: string = "image/png"): Promise<string> {
    const decrypted = this.decrypt(encryptedData);
    const blob = new Blob([decrypted], { type: mimeType });
    return URL.createObjectURL(blob);
  }

  /**
   * 解密 JSON 配置文件
   */
  decryptJSON(encryptedData: Uint8Array): any {
    const decrypted = this.decrypt(encryptedData);
    const text = new TextDecoder().decode(decrypted);
    return JSON.parse(text);
  }
}

// 构建时加密工具（Node.js）
// build-tools/encryptAssets.js
// const fs = require('fs');
// const key = 'MiniPlay2026SecretKey';
// const enc = new AssetEncryption(key);
// const raw = fs.readFileSync('player.png');
// fs.writeFileSync('player.enc', enc.encrypt(raw));

// === security/WeChatAssetLoader.ts ===
class WeChatAssetLoader {
  private encryption: AssetEncryption;

  constructor(key: string) {
    this.encryption = new AssetEncryption(key);
  }

  /**
   * 微信小游戏加载加密资源
   */
  async loadEncrypted(path: string): Promise<Uint8Array> {
    // 使用 wx.getFileSystemManager 读取本地加密文件
    const fs = wx.getFileSystemManager();
    const encrypted = fs.readFileSync(`${wx.env.USER_DATA_PATH}/${path}`);
    return this.encryption.decrypt(encrypted);
  }

  /**
   * 预加载并解密纹理图集
   */
  async preloadTextureAtlas(manifestPath: string): Promise<Map<string, HTMLImageElement>> {
    const manifest = this.encryption.decryptJSON(
      await this.loadEncrypted(manifestPath),
    );

    const textures = new Map<string, HTMLImageElement>();
    for (const entry of manifest.textures) {
      const decrypted = await this.loadEncrypted(entry.encryptedPath);
      const blob = new Blob([decrypted], { type: entry.mimeType });
      const url = URL.createObjectURL(blob);

      const img = new Image();
      img.src = url;
      await new Promise((resolve, reject) => {
        img.onload = resolve;
        img.onerror = reject;
      });
      textures.set(entry.name, img);
    }
    return textures;
  }
}

// === anti-cheat/InputAnalyzer.ts ===
/**
 * 分析用户输入序列，检测 Bot 特征。
 * 核心假设：人类输入具有不可压缩的随机性，Bot 输入具有规律性。
 */
interface InputEvent {
  type: "touch" | "tap" | "swipe" | "hold";
  x: number;
  y: number;
  timestamp: number; // ms
}

class InputAnalyzer {
  private events: InputEvent[] = [];
  private maxHistory: number = 1000;
  private suspiciousScore: number = 0;

  record(event: InputEvent): void {
    this.events.push(event);
    if (this.events.length > this.maxHistory) {
      this.events.shift();
    }
    this.analyze();
  }

  private analyze(): void {
    if (this.events.length < 50) return; // 样本不足

    const intervals = this.getTouchIntervals();
    const scores = {
      regularity: this.checkRegularity(intervals),     // 时间间隔规律性（Bot 偏高）
      speed: this.checkInhumanSpeed(),                  // 超人类速度（Bot 偏高）
      jitter: this.checkLackOfJitter(),                 // 缺乏微小抖动（Bot 偏高）
      entropy: this.checkLowEntropy(),                  // 输入熵值过低（Bot 偏高）
    };

    // 加权总分（0-100）
    this.suspiciousScore =
      scores.regularity * 0.25 +
      scores.speed * 0.30 +
      scores.jitter * 0.25 +
      scores.entropy * 0.20;
  }

  /** 检测时间间隔是否过于规律（人类点击间隔呈泊松分布） */
  private checkRegularity(intervals: number[]): number {
    if (intervals.length < 10) return 0;
    const mean = intervals.reduce((a, b) => a + b, 0) / intervals.length;
    const variance = intervals.reduce((sum, v) => sum + Math.pow(v - mean, 2), 0) / intervals.length;
    const cv = Math.sqrt(variance) / mean; // 变异系数
    // 人类 CV 通常在 0.3-1.0，Bot 接近 0
    return Math.max(0, (0.3 - cv) / 0.3 * 100);
  }

  /** 检测是否出现超人类反应速度 */
  private checkInhumanSpeed(): number {
    const reactionTimes: number[] = [];
    for (let i = 1; i < this.events.length; i++) {
      const dt = this.events[i].timestamp - this.events[i - 1].timestamp;
      if (dt > 50 && dt < 500) reactionTimes.push(dt);
    }
    if (reactionTimes.length < 5) return 0;
    const fastCount = reactionTimes.filter(t => t < 100).length;
    return (fastCount / reactionTimes.length) * 100;
  }

  /** 检测坐标的微小抖动（人类手指无法完全静止） */
  private checkLackOfJitter(): number {
    const moves = this.events.filter(e => e.type === "swipe" || e.type === "hold");
    if (moves.length < 20) return 0;

    let straightCount = 0;
    for (let i = 2; i < moves.length; i++) {
      const dx1 = moves[i - 1].x - moves[i - 2].x;
      const dy1 = moves[i - 1].y - moves[i - 2].y;
      const dx2 = moves[i].x - moves[i - 1].x;
      const dy2 = moves[i].y - moves[i - 1].y;
      // 检查三段是否共线（误差 < 2 像素）
      const cross = Math.abs(dx1 * dy2 - dx2 * dy1);
      if (cross < 2) straightCount++;
    }
    return (straightCount / (moves.length - 2)) * 100;
  }

  /** 计算输入序列的信息熵 */
  private checkLowEntropy(): number {
    const positions = this.events.map(e => `${Math.round(e.x / 10)},${Math.round(e.y / 10)}`);
    const freq = new Map<string, number>();
    positions.forEach(p => freq.set(p, (freq.get(p) || 0) + 1));

    let entropy = 0;
    const total = positions.length;
    for (const count of freq.values()) {
      const p = count / total;
      entropy -= p * Math.log2(p);
    }
    // 人类熵值通常 > 4，Bot < 2
    return Math.max(0, (4 - entropy) / 4 * 100);
  }

  private getTouchIntervals(): number[] {
    const touches = this.events.filter(e => e.type === "tap" || e.type === "touch");
    const intervals: number[] = [];
    for (let i = 1; i < touches.length; i++) {
      intervals.push(touches[i].timestamp - touches[i - 1].timestamp);
    }
    return intervals;
  }

  getSuspiciousScore(): number {
    return this.suspiciousScore;
  }

  isLikelyBot(threshold: number = 70): boolean {
    return this.suspiciousScore >= threshold;
  }
}

// === server/ServerAuthoritativeGame.ts ===
/**
 * 服务端权威模式的核心逻辑（Node.js / Cloudflare Workers）
 */
interface PlayerInput {
  playerId: string;
  frame: number;       // 输入对应的逻辑帧号
  actions: GameAction[];
  timestamp: number;   // 客户端发送时间（用于延迟补偿）
  signature: string;   // HMAC-SHA256 签名
}

interface GameAction {
  type: "move" | "jump" | "attack" | "use_item";
  params: Record<string, any>;
}

class ServerAuthoritativeGame {
  private players = new Map<string, PlayerState>();
  private frameNumber = 0;
  private frameInterval: number; // ms per frame
  private inputs = new Map<number, PlayerInput[]>(); // frame -> inputs

  constructor(fps: number = 30) {
    this.frameInterval = 1000 / fps;
    this.startGameLoop();
  }

  /**
   * 接收客户端输入
   */
  receiveInput(input: PlayerInput): ValidationResult {
    // 1. 校验签名
    if (!this.verifySignature(input)) {
      return { valid: false, reason: "Invalid signature" };
    }

    // 2. 校验帧号（不能是过去太远或未来的帧）
    if (input.frame < this.frameNumber - 10 || input.frame > this.frameNumber + 5) {
      return { valid: false, reason: "Frame out of range" };
    }

    // 3. 校验操作合法性（玩家是否拥有该道具/技能）
    const player = this.players.get(input.playerId);
    if (!player) return { valid: false, reason: "Player not found" };

    for (const action of input.actions) {
      if (!this.isActionValid(player, action)) {
        return { valid: false, reason: `Invalid action: ${action.type}` };
      }
    }

    // 4. 存储输入，等待帧处理
    if (!this.inputs.has(input.frame)) {
      this.inputs.set(input.frame, []);
    }
    this.inputs.get(input.frame)!.push(input);

    return { valid: true };
  }

  /**
   * 固定步长游戏循环
   */
  private startGameLoop(): void {
    setInterval(() => {
      this.processFrame();
      this.frameNumber++;
    }, this.frameInterval);
  }

  private processFrame(): void {
    const frameInputs = this.inputs.get(this.frameNumber) || [];

    // 收集所有玩家输入，按玩家 ID 去重（同帧取最后一个）
    const latestInputs = new Map<string, PlayerInput>();
    for (const input of frameInputs) {
      latestInputs.set(input.playerId, input);
    }

    // 对每个玩家执行输入对应的游戏逻辑
    for (const [playerId, input] of latestInputs) {
      const player = this.players.get(playerId);
      if (!player) continue;

      for (const action of input.actions) {
        this.executeAction(player, action);
      }
    }

    // 执行游戏世界逻辑（AI、物理、碰撞判定）
    this.updateWorld();

    // 广播状态给所有连接的客户端
    this.broadcastState();

    // 清理已处理的输入
    this.inputs.delete(this.frameNumber);
  }

  private verifySignature(input: PlayerInput): boolean {
    const secret = process.env.GAME_HMAC_SECRET!;
    const payload = `${input.playerId}:${input.frame}:${JSON.stringify(input.actions)}:${input.timestamp}`;
    const expected = this.hmac(payload, secret);
    return input.signature === expected;
  }

  private hmac(data: string, secret: string): string {
    // Node.js crypto
    const crypto = require("crypto");
    return crypto.createHmac("sha256", secret).update(data).digest("hex");
  }

  private isActionValid(player: PlayerState, action: GameAction): boolean {
    switch (action.type) {
      case "use_item":
        return player.inventory.includes(action.params.itemId);
      case "attack":
        return action.params.targetId !== player.id; // 不能攻击自己
      default:
        return true;
    }
  }

  private executeAction(player: PlayerState, action: GameAction): void {
    // 执行具体游戏逻辑：移动、攻击、使用道具等
    // 所有数值计算在服务端完成
  }

  private updateWorld(): void {
    // 服务端物理/AI/碰撞计算
  }

  private broadcastState(): void {
    // WebSocket 广播压缩后的世界状态
  }
}

interface ValidationResult {
  valid: boolean;
  reason?: string;
}

// === security/SignedOperation.ts ===
/**
 * 防重放与防篡改的敏感操作签名机制
 */
interface SignedPayload {
  operation: string;     // 操作类型
  params: string;        // 序列化参数
  nonce: string;         // 一次性随机数（防重放）
  timestamp: number;     // 时间戳（±60s 有效）
}

class OperationSigner {
  private secret: string;
  private usedNonces = new Set<string>();

  constructor(secret: string) {
    this.secret = secret;
  }

  /**
   * 生成操作的签名
   */
  sign(operation: string, params: any): { payload: SignedPayload; signature: string } {
    const payload: SignedPayload = {
      operation,
      params: JSON.stringify(params),
      nonce: this.generateNonce(),
      timestamp: Date.now(),
    };
    const signature = this.createSignature(payload);
    return { payload, signature };
  }

  /**
   * 验证操作签名（服务端调用）
   */
  verify(payload: SignedPayload, signature: string): boolean {
    // 1. 时间窗口检查
    const now = Date.now();
    if (Math.abs(now - payload.timestamp) > 60000) return false;

    // 2. nonce 唯一性检查
    if (this.usedNonces.has(payload.nonce)) return false;
    this.usedNonces.add(payload.nonce);

    // 3. 签名校验
    const expected = this.createSignature(payload);
    return signature === expected;
  }

  private createSignature(payload: SignedPayload): string {
    const data = `${payload.operation}:${payload.params}:${payload.nonce}:${payload.timestamp}`;
    return this.hmac(data);
  }

  private hmac(data: string): string {
    // 浏览器端可以用 Web Crypto API，服务端用 crypto
    return btoa(data); // 简化版，实际使用 HMAC-SHA256
  }

  private generateNonce(): string {
    return `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
  }
}

// === anti-cheat/LeaderboardAntiFraud.ts ===
interface ScoreSubmission {
  playerId: string;
  score: number;
  level: number;
  playTimeSeconds: number;
  inputSequenceHash: string; // 操作序列的哈希（用于回放验证）
  clientTimestamp: number;
}

class LeaderboardAntiFraud {
  private submissions: ScoreSubmission[] = [];
  private playerHistory = new Map<string, number[]>(); // 玩家历史分数

  /**
   * 提交分数前的多层验证
   */
  validateSubmission(sub: ScoreSubmission): { accepted: boolean; reason?: string } {
    // 1. 基础合理性检查
    if (sub.score < 0 || sub.playTimeSeconds < 0) {
      return { accepted: false, reason: "Invalid score or time" };
    }

    // 2. 分数-时间一致性（不可能在 10 秒内拿到 10000 分）
    const expectedMaxScore = sub.playTimeSeconds * 100; // 假设每秒最多 100 分
    if (sub.score > expectedMaxScore * 3) {
      return { accepted: false, reason: "Score-time mismatch" };
    }

    // 3. 进步速度异常检测（短期内分数暴增）
    const history = this.playerHistory.get(sub.playerId) || [];
    if (history.length >= 3) {
      const recentAvg = history.slice(-3).reduce((a, b) => a + b, 0) / 3;
      if (sub.score > recentAvg * 10) {
        return { accepted: false, reason: "Suspicious score improvement" };
      }
    }

    // 4. 同设备/同 IP 短时间内多次高分（需要关联设备指纹和 IP）
    const recentSubs = this.submissions.filter(
      s => s.playerId === sub.playerId &&
           Math.abs(s.clientTimestamp - sub.clientTimestamp) < 300000, // 5 分钟内
    );
    if (recentSubs.length > 5) {
      return { accepted: false, reason: "Too many submissions in short time" };
    }

    // 5. 冷却期（延迟发布）
    // 高分进入待审核队列，服务端在后台执行 replay validation
    if (sub.score > 50000) {
      this.queueForReview(sub);
      return { accepted: true, reason: "Pending review" };
    }

    this.recordSubmission(sub);
    return { accepted: true };
  }

  /**
   * 回放验证：用相同的输入序列重新跑一遍游戏逻辑
   */
  async replayValidate(sub: ScoreSubmission): Promise<boolean> {
    // 从存储中读取完整的操作序列
    const inputSequence = await this.loadInputSequence(sub.inputSequenceHash);

    // 在隔离环境中重新执行（相同的游戏逻辑 + 相同的随机种子）
    const result = await this.simulateGame(inputSequence, sub.level);

    // 比对最终分数
    const tolerance = 0.01; // 浮点误差容忍
    return Math.abs(result.score - sub.score) / sub.score < tolerance;
  }

  private recordSubmission(sub: ScoreSubmission): void {
    this.submissions.push(sub);
    if (!this.playerHistory.has(sub.playerId)) {
      this.playerHistory.set(sub.playerId, []);
    }
    this.playerHistory.get(sub.playerId)!.push(sub.score);
  }

  private queueForReview(sub: ScoreSubmission): void {
    // 放入审核队列，异步执行回放验证
    setTimeout(() => this.replayValidate(sub).then(valid => {
      if (!valid) this.removeScore(sub.playerId, sub.score);
    }), 0);
  }

  private async loadInputSequence(hash: string): Promise<any[]> {
    // 从对象存储（S3/R2）读取
    return [];
  }

  private async simulateGame(inputs: any[], level: number): Promise<{ score: number }> {
    // 服务端复用游戏逻辑计算分数
    return { score: 0 };
  }

  private removeScore(playerId: string, score: number): void {
    // 移除作弊分数并记录
  }
}