// 設備數字證書定義
interface DeviceCertificate {
    version: number;                    // 證書版本
    serialNumber: string;              // 序列號
    signatureAlgorithm: string;        // 簽名算法
    issuer: string;                   // 頒發機構
    validity: {
        notBefore: number;            // 生效時間
        notAfter: number;             // 過期時間
    };
    subject: {
        deviceId: string;             // 設備標識
        deviceType: DeviceType;       // 設備類型
        publicKey: string;            // 公鑰信息
    };
    extensions: {
        keyUsage: KeyUsage[];         // 密鑰用途
        extendedKeyUsage: string[];   // 擴展密鑰用途
    };
}

// 證書驗證管理器
class CertificateVerifier {
    private trustAnchors: Set<string>; // 信任錨點
    
    // 驗證證書鏈
    async verifyCertificateChain(chain: DeviceCertificate[]): Promise<VerificationResult> {
        // 1. 檢查證書有效期
        const validityResult = this.checkValidity(chain[0]);
        if (!validityResult.isValid) {
            return validityResult;
        }
        
        // 2. 驗證證書鏈完整性
        const chainResult = await this.verifyChainIntegrity(chain);
        if (!chainResult.isValid) {
            return chainResult;
        }
        
        // 3. 檢查證書撤銷狀態
        const revocationResult = await this.checkRevocationStatus(chain[0]);
        return revocationResult;
    }
    
    // 證書撤銷列表檢查
    private async checkRevocationStatus(cert: DeviceCertificate): Promise<VerificationResult> {
        try {
            const crl = await this.fetchCRL(cert.issuer);
            if (crl.isRevoked(cert.serialNumber)) {
                return {
                    isValid: false,
                    errorCode: 'CERT_REVOKED',
                    errorMessage: '證書已被撤銷'
                };
            }
            return { isValid: true };
        } catch (error) {
            console.error('CRL檢查失敗:', error);
            return {
                isValid: false,
                errorCode: 'CRL_FETCH_FAILED',
                errorMessage: '無法獲取證書撤銷列表'
            };
        }
    }
}

// 雙向認證協議實現
class MutualAuthenticationProtocol {
    private nonceGenerator: NonceGenerator;
    private crypto: CryptoManager;
    
    // 執行雙向認證
    async performMutualAuthentication(
        localDevice: DeviceInfo,
        remoteDevice: DeviceInfo
    ): Promise<AuthenticationResult> {
        try {
            // 1. 本地生成挑戰隨機數
            const localNonce = this.nonceGenerator.generateNonce();
            
            // 2. 發送認證請求
            const authRequest: AuthRequest = {
                localDeviceId: localDevice.deviceId,
                localCertificate: localDevice.certificate,
                nonce: localNonce,
                timestamp: Date.now()
            };
            
            // 添加本地簽名
            authRequest.signature = await this.crypto.sign(
                authRequest, 
                localDevice.privateKey
            );
            
            // 3. 接收並驗證遠程設備響應
            const authResponse = await this.sendAuthRequest(remoteDevice, authRequest);
            const responseValid = await this.verifyAuthResponse(authResponse, localNonce);
            if (!responseValid) {
                throw new Error('遠程設備認證響應驗證失敗');
            }
            
            // 4. 發送最終確認
            const ackMessage = await this.generateAckMessage(authResponse);
            await this.sendAck(remoteDevice, ackMessage);
            
            return {
                success: true,
                sessionKey: this.deriveSessionKey(authResponse),
                authenticatedDevice: remoteDevice
            };
            
        } catch (error) {
            console.error('雙向認證失敗:', error);
            return {
                success: false,
                error: error.message
            };
        }
    }
    
    // 驗證認證響應
    private async verifyAuthResponse(response: AuthResponse, expectedNonce: string): Promise<boolean> {
        // 驗證隨機數匹配
        if (response.respondedNonce !== expectedNonce) {
            return false;
        }
        
        // 驗證遠程設備證書
        const certResult = await this.verifier.verifyCertificateChain([response.remoteCertificate]);
        if (!certResult.isValid) {
            return false;
        }
        
        // 驗證簽名
        const remotePublicKey = this.extractPublicKey(response.remoteCertificate);
        return await this.crypto.verifySignature(response, response.signature, remotePublicKey);
    }
}

// 安全密鑰交換實現
class SecureKeyExchange {
    private static readonly CURVE = 'P-256'; // 使用NIST P-256曲線
    private ecdh: ECDH;
    
    // 執行密鑰交換
    async performKeyExchange(
        remotePublicKey: string, 
        localKeyPair: KeyPair
    ): Promise<KeyExchangeResult> {
        try {
            // 1. 生成臨時密鑰對（支持前向安全）
            const ephemeralKeyPair = await this.ecdh.generateKeyPair(this.CURVE);
            
            // 2. 計算共享密鑰
            const sharedSecret = await this.ecdh.computeSecret(
                ephemeralKeyPair.privateKey, 
                remotePublicKey
            );
            
            // 3. 密鑰派生函數
            const derivedKeys = await this.deriveEncryptionKeys(
                sharedSecret, 
                localKeyPair.publicKey, 
                remotePublicKey
            );
            
            return {
                success: true,
                encryptionKey: derivedKeys.encryptionKey,
                macKey: derivedKeys.macKey,
                iv: derivedKeys.iv
            };
            
        } catch (error) {
            console.error('密鑰交換失敗:', error);
            return {
                success: false,
                error: error.message
            };
        }
    }
    
    // 基於HKDF的密鑰派生
    private async deriveEncryptionKeys(
        sharedSecret: Buffer,
        localPublicKey: string,
        remotePublicKey: string
    ): Promise<DerivedKeys> {
        const salt = await this.crypto.hash(localPublicKey + remotePublicKey);
        const info = 'HarmonyOS_Distributed_Encryption';
        
        const hkdf = new HKDF('sha256', sharedSecret, salt, info);
        const keyMaterial = hkdf.expand(96); // 擴展為96字節
        
        return {
            encryptionKey: keyMaterial.slice(0, 32),  // AES-256密鑰
            macKey: keyMaterial.slice(32, 64),        // HMAC密鑰
            iv: keyMaterial.slice(64, 96)             // 初始向量
        };
    }
}

// 分層加密協議棧
class LayeredEncryptionStack {
    private recordLayer: RecordLayer;
    private sessionLayer: SessionLayer;
    private applicationLayer: ApplicationLayer;
    
    // 發送加密消息
    async sendEncryptedMessage(
        message: DistributedMessage,
        session: SecureSession
    ): Promise<void> {
        try {
            // 1. 應用層加密（業務數據）
            const appEncrypted = await this.applicationLayer.encrypt(
                message.payload, 
                session.appKeys
            );
            
            // 2. 記錄層加密（傳輸保障）
            const recordEncrypted = await this.recordLayer.encrypt(
                appEncrypted,
                session.recordKeys
            );
            
            // 3. 添加消息認證碼
            const mac = await this.calculateMAC(recordEncrypted, session.macKey);
            const packet = this.createPacket(recordEncrypted, mac, session.nextSequenceNumber());
            
            // 4. 發送數據包
            await this.transport.send(packet);
            session.incrementSequence();
            
        } catch (error) {
            console.error('消息加密發送失敗:', error);
            throw new Error(`安全傳輸失敗: ${error.message}`);
        }
    }
    
    // 接收和解密消息
    async receiveEncryptedMessage(packet: EncryptedPacket, session: SecureSession): Promise<DistributedMessage> {
        // 1. 驗證消息認證碼
        const expectedMac = await this.calculateMAC(packet.encryptedData, session.macKey);
        if (!this.crypto.timingSafeEqual(packet.mac, expectedMac)) {
            throw new Error('MAC驗證失敗，可能的消息篡改');
        }
        
        // 2. 驗證序列號（防重放攻擊）
        if (!session.validateSequenceNumber(packet.sequenceNumber)) {
            throw new Error('無效的序列號，可能的重複攻擊');
        }
        
        // 3. 記錄層解密
        const recordDecrypted = await this.recordLayer.decrypt(
            packet.encryptedData, 
            session.recordKeys
        );
        
        // 4. 應用層解密
        const messagePayload = await this.applicationLayer.decrypt(
            recordDecrypted, 
            session.appKeys
        );
        
        session.confirmSequenceNumber(packet.sequenceNumber);
        return messagePayload;
    }
}

// 自適應加密套件選擇器
class AdaptiveCipherSuite {
    private static readonly SUITES = {
        'HIGH': {
            keyExchange: 'ECDHE',
            encryption: 'AES-256-GCM',
            hash: 'SHA384',
            priority: 10
        },
        'MEDIUM': {
            keyExchange: 'ECDHE',
            encryption: 'AES-128-GCM', 
            hash: 'SHA256',
            priority: 20
        },
        'LOW': {
            keyExchange: 'PSK',
            encryption: 'CHACHA20-POLY1305',
            hash: 'SHA256',
            priority: 30
        }
    };
    
    // 根據設備能力選擇加密套件
    selectCipherSuite(localDevice: DeviceInfo, remoteDevice: DeviceInfo): CipherSuite {
        const localCapability = this.assessCryptoCapability(localDevice);
        const remoteCapability = this.assessCryptoCapability(remoteDevice);
        
        // 選擇雙方都支持的最強套件
        const commonSuites = this.findCommonSuites(localCapability, remoteCapability);
        const selectedSuite = this.optimizeForPerformance(commonSuites, {
            networkType: this.getNetworkType(),
            batteryLevel: this.getBatteryLevel(),
            dataSensitivity: this.assessDataSensitivity()
        });
        
        return selectedSuite;
    }
    
    // 性能優化選擇
    private optimizeForPerformance(
        suites: CipherSuite[], 
        context: PerformanceContext
    ): CipherSuite {
        return suites.reduce((best, current) => {
            const currentScore = this.calculateSuiteScore(current, context);
            const bestScore = this.calculateSuiteScore(best, context);
            return currentScore > bestScore ? current : best;
        });
    }
    
    private calculateSuiteScore(suite: CipherSuite, context: PerformanceContext): number {
        let score = suite.priority;
        
        // 網絡條件調整
        if (context.networkType === 'LOW_BANDWIDTH') {
            score -= suite.encryption.includes('256') ? 5 : 0;
        }
        
        // 電量考慮
        if (context.batteryLevel < 20) {
            score -= suite.encryption.includes('GCM') ? 3 : 0;
        }
        
        // 數據敏感性加權
        if (context.dataSensitivity === 'HIGH') {
            score += suite.encryption.includes('256') ? 10 : 0;
        }
        
        return score;
    }
}

// 安全會話管理器
class SecureSessionManager {
    private activeSessions: Map<string, SecureSession> = new Map();
    private sessionConfig: SessionConfig;
    
    // 創建新會話
    async createSession(
        localDevice: DeviceInfo,
        remoteDevice: DeviceInfo,
        authResult: AuthenticationResult
    ): Promise<SecureSession> {
        const sessionId = this.generateSessionId(localDevice.deviceId, remoteDevice.deviceId);
        
        const session: SecureSession = {
            sessionId,
            localDeviceId: localDevice.deviceId,
            remoteDeviceId: remoteDevice.deviceId,
            creationTime: Date.now(),
            lastActivity: Date.now(),
            sessionKeys: authResult.sessionKey,
            cipherSuite: this.suiteSelector.selectCipherSuite(localDevice, remoteDevice),
            sequenceNumber: 0,
            state: 'ACTIVE'
        };
        
        this.activeSessions.set(sessionId, session);
        
        // 啓動會話維護任務
        this.startSessionMaintenance(session);
        
        return session;
    }
    
    // 會話維護任務
    private startSessionMaintenance(session: SecureSession): void {
        // 定期密鑰更新
        const keyRotationTimer = setInterval(async () => {
            if (session.state === 'ACTIVE') {
                await this.rotateSessionKeys(session);
            }
        }, this.sessionConfig.keyRotationInterval);
        
        // 會話超時檢查
        const inactivityTimer = setInterval(() => {
            const inactiveTime = Date.now() - session.lastActivity;
            if (inactiveTime > this.sessionConfig.maxInactivityTime) {
                this.suspendSession(session.sessionId);
            }
        }, this.sessionConfig.healthCheckInterval);
        
        session.maintenanceTimers = [keyRotationTimer, inactivityTimer];
    }
    
    // 密鑰輪換
    private async rotateSessionKeys(session: SecureSession): Promise<void> {
        try {
            const newKeys = await this.performKeyUpdate(session);
            session.sessionKeys = newKeys;
            session.sequenceNumber = 0; // 重置序列號
            session.lastKeyRotation = Date.now();
            
            console.info(`會話 ${session.sessionId} 密鑰輪換成功`);
        } catch (error) {
            console.error(`會話 ${session.sessionId} 密鑰輪換失敗:`, error);
            // 密鑰輪換失敗不影響現有通信，但記錄告警
            this.monitor.recordSecurityEvent('KEY_ROTATION_FAILED', session);
        }
    }
}

// 安全通道監控器
class SecurityChannelMonitor {
    private metrics: SecurityMetrics;
    private alertSystem: AlertSystem;
    
    // 監控安全指標
    startSecurityMonitoring(session: SecureSession): void {
        const monitorConfig = this.getMonitorConfig(session);
        
        // 加密異常檢測
        this.monitorEncryptionAnomalies(session, monitorConfig);
        
        // 身份驗證狀態持續驗證
        this.monitorAuthenticationStatus(session, monitorConfig);
        
        // 網絡安全事件監聽
        this.monitorNetworkSecurity(session, monitorConfig);
    }
    
    // 加密異常檢測
    private monitorEncryptionAnomalies(session: SecureSession, config: MonitorConfig): void {
        const anomalyDetector = new EncryptionAnomalyDetector({
            maxDecryptionFailures: config.maxDecryptionFailures,
            expectedPacketSizeRange: config.packetSizeRange,
            timeWindow: config.detectionTimeWindow
        });
        
        session.on('encryptionError', (error) => {
            this.metrics.recordEncryptionError(session.sessionId, error);
            
            if (anomalyDetector.isPotentialAttack(error)) {
                this.alertSystem.raiseAlert(
                    'POTENTIAL_ENCRYPTION_ATTACK',
                    { sessionId: session.sessionId, error }
                );
                
                // 自動觸發安全響應
                this.triggerSecurityResponse(session, error);
            }
        });
    }
    
    // 安全自動響應
    private async triggerSecurityResponse(session: SecureSession, error: EncryptionError): Promise<void> {
        switch (error.severity) {
            case 'HIGH':
                // 嚴重安全事件，立即終止會話
                await this.terminateSession(session.sessionId, 'SECURITY_VIOLATION');
                break;
                
            case 'MEDIUM':
                // 中等風險，強制重新認證
                await this.forceReauthentication(session);
                break;
                
            case 'LOW':
                // 低風險，僅記錄和告警
                this.monitor.recordSecurityEvent('SUSPICIOUS_ACTIVITY', session, error);
                break;
        }
    }
    
    // 通道自愈處理
    async healSecurityChannel(session: SecureSession, failureType: FailureType): Promise<HealResult> {
        switch (failureType) {
            case 'NETWORK_INTERRUPTION':
                return await this.recoverFromNetworkOutage(session);
                
            case 'KEY_SYNC_FAILURE':
                return await this.recoverFromKeySyncFailure(session);
                
            case 'AUTHENTICATION_EXPIRED':
                return await this.recoverFromAuthExpiry(session);
                
            default:
                return await this.genericRecoveryProcedure(session);
        }
    }
}

// 安全文件傳輸系統
class SecureFileTransferSystem {
    private securityManager: SecurityManager;
    private transferSessions: Map<string, FileTransferSession> = new Map();
    
    // 初始化安全文件傳輸
    async initializeSecureTransfer(
        sourceDevice: DeviceInfo,
        targetDevice: DeviceInfo,
        fileMetadata: FileMetadata
    ): Promise<TransferSession> {
        try {
            // 1. 執行雙向身份認證
            const authResult = await this.securityManager.authenticateDevices(
                sourceDevice, 
                targetDevice
            );
            
            if (!authResult.success) {
                throw new Error(`設備認證失敗: ${authResult.error}`);
            }
            
            // 2. 建立安全會話
            const secureSession = await this.securityManager.createSecureSession(
                sourceDevice,
                targetDevice,
                authResult
            );
            
            // 3. 協商傳輸參數
            const transferParams = await this.negotiateTransferParameters(
                sourceDevice,
                targetDevice,
                fileMetadata
            );
            
            // 4. 創建傳輸會話
            const transferSession: FileTransferSession = {
                sessionId: this.generateSessionId(),
                secureSession,
                fileMetadata,
                transferParams,
                state: 'INITIALIZED',
                progress: 0
            };
            
            this.transferSessions.set(transferSession.sessionId, transferSession);
            
            // 5. 啓動傳輸監控
            this.startTransferMonitoring(transferSession);
            
            return transferSession;
            
        } catch (error) {
            console.error('安全傳輸初始化失敗:', error);
            throw new Error(`無法建立安全文件傳輸通道: ${error.message}`);
        }
    }
    
    // 分塊安全傳輸
    async transferFileChunk(
        sessionId: string,
        chunkIndex: number,
        chunkData: Buffer
    ): Promise<TransferResult> {
        const session = this.transferSessions.get(sessionId);
        if (!session) {
            throw new Error('傳輸會話不存在');
        }
        
        try {
            // 1. 加密數據塊
            const encryptedChunk = await this.securityManager.encryptData(
                chunkData,
                session.secureSession.sessionKeys
            );
            
            // 2. 添加完整性保護
            const protectedChunk = await this.addIntegrityProtection(encryptedChunk, session);
            
            // 3. 安全傳輸
            const transferResult = await this.sendSecureChunk(
                session.secureSession.remoteDeviceId,
                protectedChunk,
                chunkIndex
            );
            
            // 4. 更新傳輸進度
            session.progress = (chunkIndex + 1) / session.fileMetadata.totalChunks;
            session.lastActivity = Date.now();
            
            return {
                success: true,
                chunkIndex,
                nextChunk: chunkIndex + 1
            };
            
        } catch (error) {
            console.error(`數據塊 ${chunkIndex} 傳輸失敗:`, error);
            
            // 記錄安全事件
            this.securityManager.recordSecurityEvent(
                'TRANSFER_FAILURE',
                session.secureSession,
                { chunkIndex, error: error.message }
            );
            
            return {
                success: false,
                chunkIndex,
                error: error.message,
                retryable: this.isErrorRetryable(error)
            };
        }
    }
}

// 傳輸安全策略管理器
class TransferSecurityPolicy {
    private policies: SecurityPolicy[];
    
    // 根據文件敏感性制定安全策略
    createSecurityPolicy(fileMetadata: FileMetadata, context: TransferContext): SecurityPolicy {
        const sensitivity = this.assessFileSensitivity(fileMetadata);
        const riskLevel = this.assessTransferRisk(context);
        
        return {
            encryptionLevel: this.determineEncryptionLevel(sensitivity, riskLevel),
            integrityCheck: this.determineIntegrityCheck(sensitivity),
            keyRotation: this.determineKeyRotation(sensitivity, fileMetadata.size),
            timeoutPolicy: this.determineTimeoutPolicy(riskLevel),
            retryPolicy: this.determineRetryPolicy(sensitivity)
        };
    }
    
    // 動態安全策略調整
    adjustPolicyBasedOnConditions(
        policy: SecurityPolicy,
        currentConditions: NetworkConditions,
        securityEvents: SecurityEvent[]
    ): SecurityPolicy {
        let adjustedPolicy = { ...policy };
        
        // 根據網絡條件調整
        if (currentConditions.bandwidth < 100) { // 低帶寬
            adjustedPolicy.encryptionLevel = this.downgradeEncryptionIfSafe(adjustedPolicy.encryptionLevel);
        }
        
        // 根據安全事件調整
        if (this.hasSuspiciousActivity(securityEvents)) {
            adjustedPolicy.integrityCheck = 'ENHANCED';
            adjustedPolicy.keyRotation = Math.min(adjustedPolicy.keyRotation, 300000); // 5分鐘輪換
        }
        
        return adjustedPolicy;
    }
}

// 安全審計管理器
class SecurityAuditManager {
    private auditLogger: AuditLogger;
    private complianceChecker: ComplianceChecker;
    
    // 記錄安全事件
    async logSecurityEvent(event: SecurityAuditEvent): Promise<void> {
        const auditRecord: AuditRecord = {
            eventId: this.generateEventId(),
            timestamp: Date.now(),
            deviceId: event.deviceId,
            sessionId: event.sessionId,
            eventType: event.eventType,
            severity: event.severity,
            details: event.details,
            digitalSignature: await this.signAuditRecord(event)
        };
        
        // 本地存儲
        await this.auditLogger.writeRecord(auditRecord);
        
        // 分佈式同步（可選）
        if (this.requiresDistributedAuditing(event)) {
            await this.syncAuditRecord(auditRecord);
        }
        
        // 合規性檢查
        await this.complianceChecker.checkCompliance(auditRecord);
    }
    
    // 生成審計報告
    async generateSecurityReport(
        timeRange: TimeRange,
        deviceFilter?: string[]
    ): Promise<SecurityReport> {
        const records = await this.auditLogger.queryRecords(timeRange, deviceFilter);
        
        return {
            reportId: this.generateReportId(),
            generationTime: Date.now(),
            timeRange,
            summary: this.generateSummary(records),
            riskAssessment: this.assessRisks(records),
            complianceStatus: this.checkComplianceStatus(records),
            recommendations: this.generateRecommendations(records)
        };
    }
}