use aes_gcm::{Aes256Gcm, KeyInit, aead::{Aead, Nonce}};
use zeroize::Zeroizing;
use rand::Rng;

fn get_encryption_key(env_var: &str) -> Result<[u8; 32], InklogError> {
    // 使用 Zeroizing 保护环境变量值
    let env_value = Zeroizing::new(std::env::var(env_var)?);

    // 支持 Base64 编码格式
    if let Ok(decoded) = general_purpose::STANDARD.decode(env_value.as_str()) {
        if decoded.len() == 32 {
            let mut result = [0u8; 32];
            result.copy_from_slice(&decoded);
            return Ok(result);
        }
    }

    // 支持原始 32 字节格式
    let raw_bytes = env_value.as_bytes();
    if raw_bytes.len() >= 32 {
        let mut result = [0u8; 32];
        result.copy_bytes[..32]);
_from_slice(&raw        return Ok(result);
    }

    Err(InklogError::ConfigError(
        "Key must be 32 bytes (256 bits)".into()
    ))
}

fn encrypt_file(&self, path: &PathBuf) -> Result<PathBuf, InklogError> {
    let encrypted_path = path.with_extension("enc");

    // 1. 安全获取密钥
    let key = self.get_encryption_key()?;

    // 2. 生成随机 nonce (12 字节)
    let nonce: [u8; 12] = rand::thread_rng().gen();

    // 3. 读取明文
    let plaintext = std::fs::read_to_string(path)?;

    // 4. 使用 AES-256-GCM 加密
    let cipher = Aes256Gcm::new((&key).into());
    let nonce_slice = aes_gcm::Nonce::from_slice(&nonce);
    let ciphertext = cipher
        .encrypt(nonce_slice, plaintext.as_ref())
        .map_err(|e| InklogError::EncryptionError(e.to_string()))?;

    // 5. 写入加密文件
    let mut output_file = File::create(&encrypted_path)?;

    // 文件头: [8字节 MAGIC][2字节版本][2字节算法][12字节 nonce]
    output_file.write_all(MAGIC_HEADER)?;           // "ENCLOG1\0"
    output_file.write_all(&1u16.to_le_bytes())?;    // 版本 = 1
    output_file.write_all(&1u16.to_le_bytes())?;    // 算法 = 1 (AES-256-GCM)
    output_file.write_all(&nonce)?;                  // 12 字节 nonce
    output_file.write_all(&ciphertext)?;             // 加密数据

    // 6. 设置安全权限
    let mut perms = metadata.permissions();
    perms.set_mode(0o600);  // 仅所有者可读写
    file.set_permissions(perms)?;

    Ok(encrypted_path)
}

use inklog::{FileSinkConfig, InklogConfig, LoggerManager};

// 配置加密日志
std::env::set_var("INKLOG_ENCRYPTION_KEY", "base64-encoded-32-byte-key");

let config = InklogConfig {
    file_sink: Some(FileSinkConfig {
        enabled: true,
        path: "logs/secure.log".into(),
        encrypt: true,
        encryption_key_env: Some("INKLOG_ENCRYPTION_KEY".into()),
        compress: false,  // 加密和压缩互斥
        ..Default::default()
    }),
    global: GlobalConfig {
        masking_enabled: true,  // 同时启用数据脱敏
        ..Default::default()
    },
    ..Default::default()
};

let logger = LoggerManager::with_config(config).await?;

// 日志将自动加密并脱敏
log::info!("User email: user@example.com");
// 输出: logs/secure.log.enc (加密 + 脱敏后)

r"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}"

impl MaskRule {
    fn new_email_rule() -> Self {
        Self {
            pattern: LazyLock::new(|| {
                Regex::new(r"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}").unwrap()
            }),
            replacement: "***@***.***".to_string(),
        }
    }
}

r"\b1[3-9]\d{9}\b"

r"^(\d{6})(\d{8})(\d{3}[\dX])$"

r"(\d{4})(\d+)(\d{4})"

r"(?i)(api[_-]?key[^\s:=]*\s*[=:]\s*[a-zA-Z0-9_-]{20,})"

r"(?i)(AKIA|ABIA|ACCA|ASIA)[0-9A-Z]{16}"

r"(?i)eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]*"

r"(?i)([^\s:=]*(?:token|secret|key|password|passwd|pwd|credential)s?[^\s:=]*\s*[=:]\s*)([a-zA-Z0-9_\-\+]{16,})"

static SENSITIVE_FIELDS: &[&str] = &[
    // 认证凭据
    "password", "token", "secret", "key", "credential", "auth",

    // API 密钥
    "api_key", "api_key_id", "api_secret", "access_key", "access_key_id",
    "secret_key", "private_key", "public_key", "encryption_key",
    "decryption_key", "master_key", "session_key",

    // OAuth 相关
    "oauth", "oauth_token", "oauth_secret", "bearer", "bearer_token",
    "jwt", "session_id", "session_token",

    // AWS 凭据
    "aws_secret", "aws_key", "aws_credentials",

    // 数据库连接
    "database_url", "db_password", "db_user", "connection_string",

    // 支付和个人身份信息
    "credit_card", "card_number", "cvv", "ssn", "social_security",

    // 其他敏感信息
    "client_secret", "client_id", "refresh_token", "pin", "pin_code",
    "two_factor", "totp", "backup_code", "recovery_code",
];

impl DataMasker {
    pub fn is_sensitive_field(field_name: &str) -> bool {
        let lower_name = field_name.to_lowercase();
        SENSITIVE_FIELDS
            .iter()
            .any(|sensitive| lower_name.contains(*sensitive))
    }
}

impl DataMasker {
    pub fn new() -> Self {
        let rules = vec![
            // 内置规则
            MaskRule::new_email_rule(),
            MaskRule::new_phone_rule(),

            // 添加自定义规则
            MaskRule {
                pattern: LazyLock::new(|| {
                    Regex::new(r"CUSTOM_PATTERN").unwrap()
                }),
                replacement: "***CUSTOM***".to_string(),
            },
        ];
        Self { rules }
    }
}

impl LogRecord {
    pub fn from_event(event: &Event) -> Self {
        let mut record = /* ... */;

        // 创建日志记录时自动应用脱敏
        if config.global.masking_enabled {
            record.mask_sensitive_fields();
        }

        record
    }

    fn mask_sensitive_fields(&mut self) {
        let masker = DataMasker::new();

        // 1. 脱敏日志消息 (正则模式)
        self.message = masker.mask(&self.message);

        // 2. 递归脱敏所有字段值
        for (_, v) in self.fields.iter_mut() {
            masker.mask_value(v);
        }

        // 3. 敏感字段完全脱敏 (字段名检测)
        for (k, v) in self.fields.iter_mut() {
            if Self::is_sensitive_key(k) {
                *v = Value::String("***MASKED***".to_string());
            }
        }
    }
}

use inklog::{InklogConfig, config::GlobalConfig, LoggerManager};

let config = InklogConfig {
    global: GlobalConfig {
        masking_enabled: true,  // 启用脱敏
        ..Default::default()
    },
    ..Default::default()
};

let logger = LoggerManager::with_config(config).await?;

// 自动脱敏
log::info!("User login: user@example.com, phone: 13812345678");
// 输出: User login: ***@***.***, phone: 138****5678

log::info!("API key: AKIAIOSFODNN7EXAMPLE");
// 输出: API key: ***REDACTED***

log::info!("Password: secret123");
// 输出: Password: ***MASKED***

use inklog::masking::DataMasker;

let masker = DataMasker::new();

// 字符串脱敏
let masked = masker.mask("Contact admin@example.com at 13812345678");
// 结果: "Contact ***@***.*** at 138****5678"

// JSON 结构递归脱敏
use serde_json::json;

let mut data = json!({
    "email": "admin@company.org",
    "phone": "13912345678",
    "password": "secret123",
    "contacts": ["user1@test.com", "13811112222"]
});

masker.mask_value(&mut data);
// 结果: {
//   "email": "***@***.***",
//   "phone": "138****5678",
//   "password": "***MASKED***",
//   "contacts": ["***@***.***", "138****2222"]
// }

use zeroize::{Zeroize, Zeroizing};

/// 敏感字符串包装器
/// - 在 Drop 时自动清零
/// - 序列化时跳过敏感数据
#[derive(Debug, Clone, Default)]
pub struct SecretString(Option<Zeroizing<String>>);

impl SecretString {
    pub fn new(value: String) -> Self {
        Self(Some(Zeroizing::new(value)))
    }

    /// 安全获取字符串引用 (不消耗值)
    pub fn as_str_safe(&self) -> Option<&str> {
        self.0.as_deref()
    }

    /// 带审计日志的安全获取 (仅调试模式)
    pub fn take_audited(&mut self, event: &str) -> Option<String> {
        #[cfg(feature = "debug")]
        tracing::debug!(
            event = event,
            "Sensitive data accessed via SecretString::take_audited()"
        );
        self.0.take()
    }
}

impl Drop for SecretString {
    fn drop(&mut self) {
        if let Some(s) = &mut self.0 {
            s.zeroize();  // 自动清零内存
        }
    }
}

// 序列化时跳过敏感值
impl Serialize for SecretString {
    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
    where
        S: serde::Serializer,
    {
        serializer.serialize_none()  // 不序列化敏感数据
    }
}

fn get_encryption_key(env_var: &str) -> Result<[u8; 32], InklogError> {
    // 使用 Zeroizing 包装环境变量值
    let env_value = Zeroizing::new(std::env::var(env_var)?);

    // ... 处理密钥 ...

    // env_value 超出作用域时自动清零
}

use inklog::archive::SecretString;

// 安全存储 AWS 凭据
let config = S3ArchiveConfig {
    access_key_id: SecretString::new("AKIAIOSFODNN7EXAMPLE".to_string()),
    secret_access_key: SecretString::new("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY".to_string()),
    ..Default::default()
};

// 安全使用
if let Some(key_id) = config.access_key_id.as_str_safe() {
    println!("Access Key ID: {}", key_id);
}

// config 超出作用域时,所有密钥自动清零

use zeroize::Zeroizing;

fn encrypt_sensitive_data(data: &[u8]) -> Result<Vec<u8>> {
    // 从环境变量安全读取密钥
    let key_bytes = Zeroizing::new(
        std::env::var("ENCRYPTION_KEY")?
    );

    // 使用密钥加密
    let encrypted = /* ... */;

    // key_bytes 超出作用域时自动清零
    Ok(encrypted)
}

// src/sink/file.rs:284-287
let mut perms = metadata.permissions();
perms.set_mode(0o600);  // rw------- (仅所有者可读写)
if let Err(e) = file.set_permissions(perms) {
    eprintln!("Failed to set file permissions: {}", e);
}

fn create_log_file(path: &PathBuf) -> Result<File, InklogError> {
    // 1. 验证路径不在系统目录
    validate_path_not_in_system_dirs(path)?;

    // 2. 确保父目录存在且安全
    if let Some(parent) = path.parent() {
        std::fs::create_dir_all(parent)?;
        set_secure_permissions(parent)?;
    }

    // 3. 创建文件
    let file = File::options()
        .write(true)
        .create_new(true)  // 防止覆盖现有文件
        .open(path)?;

    // 4. 设置安全权限
    let mut perms = file.metadata()?.permissions();
    perms.set_mode(0o600);
    file.set_permissions(perms)?;

    Ok(file)
}

// src/sink/database.rs:267-271
let mut opt = ConnectOptions::new(url);
opt.max_connections(pool_size)      // 最大连接数限制
   .min_connections(2)            // 最小连接数
   .connect_timeout(Duration::from_secs(5))  // 连接超时
   .idle_timeout(Duration::from_secs(8));    // 空闲超时

Database::connect(opt).await

/// 验证表名是否安全（防止 SQL 注入）
/// 只允许字母、数字、下划线,且必须以字母或下划线开头
fn validate_table_name(name: &str) -> Result<String, InklogError> {
    if name.is_empty() {
        return Err(InklogError::DatabaseError(
            "Table name cannot be empty".to_string(),
        ));
    }

    if name.len() > 128 {
        return Err(InklogError::DatabaseError(
            "Table name too long".to_string(),
        ));
    }

    // 验证首字符
    let first_char = name.chars().next()
        .ok_or_else(|| InklogError::DatabaseError("Empty name".to_string()))?;
    if !first_char.is_ascii_alphabetic() && first_char != '_' {
        return Err(InklogError::DatabaseError(
            "Table name must start with letter or underscore".to_string()
        ));
    }

    // 验证所有字符
    if !name.chars().all(|c| c.is_ascii_alphanumeric() || c == '_') {
        return Err(InklogError::DatabaseError(
            "Table name contains invalid characters".to_string()
        ));
    }

    Ok(name.to_string())
}

/// 验证分区名称格式 (必须是 logs_YYYY_MM 格式)
fn validate_partition_name(partition_name: &str) -> Result<String, InklogError> {
    if !partition_name.starts_with("logs_") {
        return Err(InklogError::DatabaseError(
            "Partition name must start with 'logs_'".to_string()
        ));
    }

    // 验证日期部分格式 YYYY_MM
    let date_part = &partition_name[5..];
    if date_part.len() != 7 || date_part.chars().nth(4) != Some('_') {
        return Err(InklogError::DatabaseError(
            "Invalid partition date format, expected YYYY_MM".to_string()
        ));
    }

    let year = &date_part[..4];
    let month = &date_part[5..];

    // 验证年份和月份为有效数字
    if !year.chars().all(|c| c.is_ascii_digit()) {
        return Err(InklogError::DatabaseError("Invalid year".to_string()));
    }

    let month_num: u32 = month.parse().unwrap_or(0);
    if month_num == 0 || month_num > 12 {
        return Err(InklogError::DatabaseError("Invalid month".to_string()));
    }

    Ok(partition_name.to_string())
}

// 使用验证后的名称构建 SQL (避免 SQL 注入)
let validated_table = validate_table_name(&self.config.table_name)?;
let quoted_table = format!("\"{}\"", validated_table);  // PostgreSQL 引用
let quoted_partition = format!("\"{}\"", validated_partition);

let sql = format!(
    "CREATE TABLE IF NOT EXISTS {} PARTITION OF {} FOR VALUES FROM ('{}') TO ('{}')",
    quoted_table, quoted_partition, start_date, next_month
);

let stmt = Statement::from_string(db.get_database_backend(), sql);
db.execute_unprepared(&stmt.sql).await?;

// Sea-ORM 自动使用参数化查询,防止 SQL 注入
Entity::insert_many(logs).exec(db).await

// 转换为: INSERT INTO logs (...) VALUES ($1, $2, $3), ...

// 使用 IAM 角色而非访问密钥 (推荐)
let aws_config = aws_config::from_env()
    .region(Region::new(region.clone()))
    .load()
    .await;

// 或使用最小权限的访问密钥
let config = S3ArchiveConfig {
    bucket: "my-log-bucket".to_string(),
    region: "us-west-2".to_string(),
    access_key_id: SecretString::new("AKIA...".to_string()),
    secret_access_key: SecretString::new("...".to_string()),
    ..Default::default()
};

// src/cli/decrypt.rs
fn validate_file_path(input_path: &Path, base_dir: &Path) -> Result<PathBuf> {
    // 规范化路径 (解析 ../ 和 ./)
    let canonical_input = std::fs::canonicalize(input_path)
        .map_err(|e| anyhow!("Failed to canonicalize input path: {}", e))?;
    let canonical_base = std::fs::canonicalize(base_dir)
        .map_err(|e| anyhow!("Failed to canonicalize base dir: {}", e))?;

    // 验证路径在基础目录内
    if !canonical_input.starts_with(&canonical_base) {
        return Err(anyhow!(
            "Path traversal detected: {} is outside of base directory {}",
            input_path.display(),
            base_dir.display()
        ));
    }

    Ok(canonical_input)
}

// AWS SDK 默认使用 HTTPS
let aws_config = aws_config::from_env()
    .region(Region::new(region.clone()))
    .load()
    .await;

let client = aws_sdk_s3::Client::new(&aws_config);

// 所有请求自动使用 HTTPS
client.put_object()
    .bucket(bucket)
    .key(key)
    .body(data.into())
    .send()
    .await?;  // 通过 HTTPS/TLS 传输

pub enum EncryptionAlgorithm {
    Aes256,        // SSE-S3: AWS 托管密钥
    AwsKms,        // SSE-KMS: KMS 托管密钥
    CustomerKey,    // SSE-C: 客户提供密钥 (待实现)
}

pub struct EncryptionConfig {
    pub algorithm: EncryptionAlgorithm,
    pub kms_key_id: Option<String>,      // KMS 密钥 ID
    pub customer_key: SecretString,       // 客户密钥 (SSE-C)
}

let url = "postgres://user:pass@localhost/logs?sslmode=require".to_string();
// sslmode 选项:
// - disable: 禁用 SSL (不推荐)
// - allow: 优先 SSL,失败则不加密
// - prefer: 优先 SSL,失败则明文
// - require: 必须使用 SSL (推荐)
// - verify-ca: 验证 CA 证书
// - verify-full: 验证 CA 和主机名 (最安全)

let url = "mysql://user:pass@localhost/logs?ssl_mode=REQUIRED".to_string();

let mut opt = ConnectOptions::new(url);
opt.connect_timeout(Duration::from_secs(5))   // 连接超时 5 秒
   .idle_timeout(Duration::from_secs(8))      // 空闲超时 8 秒
   .max_lifetime(Duration::from_secs(3600))   // 连接最大生存时间 1 小时
   .acquire_timeout(Duration::from_secs(30)); // 获取连接超时 30 秒

// 配置 VPC 端点访问 S3 (私有网络)
let config = aws_config::from_env()
    .region(Region::new(region.clone()))
    .endpoint_url("https://vpce-xxxxx-s3.us-west-2.vpce.amazonaws.com")  // VPC 端点
    .load()
    .await;

// 自动脱敏 GDPR 敏感数据
log::info!("User registration: email=user@example.com, phone=13812345678");
// 输出: User registration: email=***@***.***, phone=138****5678

// 清理过期日志 (超过保留期限)
pub async fn cleanup_old_logs(
    db: &DatabaseConnection,
    cutoff_date: DateTime<Utc>,
) -> Result<u64, InklogError> {
    Entity::delete_many()
        .filter(Column::Timestamp.lt(cutoff_date))
        .exec(db)
        .await
        .map_err(|e| InklogError::DatabaseError(e.to_string()))?;

    Ok(rows_affected)
}

// 导出特定用户的日志
pub async fn export_user_logs(
    user_id: &str,
    start_date: DateTime<Utc>,
    end_date: DateTime<Utc>,
) -> Result<Vec<LogRecord>, InklogError> {
    Entity::find()
        .filter(Column::Fields.contains(format!("\"user_id\":\"{}\"", user_id)))
        .filter(Column::Timestamp.gte(start_date))
        .filter(Column::Timestamp.lt(end_date))
        .all(db)
        .await
}

// 仅记录必要的日志级别
let config = InklogConfig {
    global: GlobalConfig {
        level: "warn".to_string(),  // 不记录 DEBUG/TRACE 信息
        masking_enabled: true,      // 自动脱敏 PII
        ..Default::default()
    },
    ..Default::default()
};

// 扩展脱敏规则以包含 PHI 字段
const HIPAA_SENSITIVE_FIELDS: &[&str] = &[
    "patient_id", "medical_record", "diagnosis", "treatment",
    "medication", "ssn", "insurance_number"
];

// 日志中自动脱敏 PHI
log::info!("Patient admitted: patient_id=123456, diagnosis=condition_X");
// 输出: Patient admitted: patient_id=******, diagnosis=*******

// Cargo.toml
[dependencies]
inklog = { version = "0.1", features = ["debug"] }

// 记录敏感操作
#[cfg(feature = "debug")]
tracing::debug!(
    event = "data_export",
    user_id = user_id,
    records = count,
    "PHI data exported for audit"
);

// 自动脱敏信用卡号
log::info!("Payment processed: card_number=6222021234567890123");
// 输出: Payment processed: card_number=****-****-****-0123

// ✅ 正确的做法
log::info!("Payment authorized: card_last4=0123, amount=100.00");

// ❌ 错误的做法
log::info!("Payment: card_number=6222021234567890123, cvv=123");
// 这将自动脱敏为: Payment: card_number=****-****-****-0123, cvv=***

// 配置 KMS 加密 (推荐)
let config = S3ArchiveConfig {
    enabled: true,
    bucket: "my-log-bucket".to_string(),
    region: "us-west-2".to_string(),
    encryption: Some(EncryptionConfig {
        algorithm: EncryptionAlgorithm::AwsKms,
        kms_key_id: Some("arn:aws:kms:...".to_string()),
        customer_key: SecretString::new("".to_string()),
    }),
    ..Default::default()
};

// 每 90 天轮换密钥
const KEY_ROTATION_DAYS: u64 = 90;

let key_created_at = get_key_creation_date()?;
if Utc::now().signed_duration_since(key_created_at).num_days() > KEY_ROTATION_DAYS as i64 {
    rotate_encryption_key()?;
}

// ❌ 不要硬编码密钥
const ENCRYPTION_KEY: &[u8; 32] = &[0x01, 0x02, ...];

// ❌ 不要在日志中输出密钥
log::debug!("Encryption key: {:?}", key);

// ❌ 不要使用弱密钥
let weak_key = "password123";  // 容易被破解

// 敏感文件设置为 0o600 (仅所有者可读写)
std::fs::set_permissions("logs/encrypted.log.enc", PermissionsExt::from_mode(0o600))?;

// 目录设置为 0o700 (仅所有者可访问)
std::fs::set_permissions("logs/", PermissionsExt::from_mode(0o700))?;

// 强制使用 SSL 连接
let url = "postgres://user:pass@localhost/logs?sslmode=verify-full".to_string();

let opt = ConnectOptions::new(url);
opt.ssl_mode(ssl_mode::Require);

// 配置 CA 证书路径
let mut opt = ConnectOptions::new("postgres://...");
opt.ssl_options(ssl::SslConnector::builder()
    .ca_file("/path/to/ca.crt")
    .build()?);

// 从实例元数据获取临时凭证 (无需硬编码)
let config = aws_config::from_env()
    .region(Region::new("us-west-2".to_string()))
    .load()
    .await;

let client = aws_sdk_s3::Client::new(&config);

let config = InklogConfig {
    global: GlobalConfig {
        level: "info".to_string(),  // 不记录 DEBUG/TRACE
        ..Default::default()
    },
    ..Default::default()
};

use inklog::LoggerManager;

let logger = LoggerManager::with_config(config).await?;

// 定期检查日志系统健康状态
tokio::spawn(async move {
    loop {
        let health = logger.get_health_status();
        if !health.sinks[&"file"].is_healthy {
            eprintln!("WARNING: File sink is unhealthy!");
        }
        tokio::time::sleep(Duration::from_secs(60)).await;
    }
});

// 启用 debug feature
#[cfg(feature = "debug")]
{
    tracing::debug!(
        event = "encryption_key_used",
        key_env = "INKLOG_ENCRYPTION_KEY",
        timestamp = Utc::now(),
        "Encryption operation performed"
    );
}

// 数据库故障时回退到文件
pub fn fallback_to_file(&mut self) -> Result<(), InklogError> {
    if let Some(sink) = &mut self.fallback_sink {
        for record in &self.buffer {
            let _ = sink.write(record);
        }
    }
    Ok(())
}

// 不记录敏感信息到错误消息
log::error!(
    "Failed to decrypt file: {}. Error: {}",
    file_path.display(),  // ✅ 记录文件路径
    // ❌ 不要记录密钥或敏感数据
);