export async function rsaEncrypt(password: string, publicKey: string): Promise<string> {
  const timestamp = Date.now().toString();
  const salt = generateSalt(16);
  const requestId = generateRequestId();
  const dataToEncrypt = `${password}|${timestamp}|${salt}|${requestId}`;
  const publicKeyObj = forge.pki.publicKeyFromPem(
    `-----BEGIN PUBLIC KEY-----\n${publicKey}\n-----END PUBLIC KEY-----`,
  );
  const encrypted = publicKeyObj.encrypt(dataToEncrypt, "RSA-OAEP", {
    md: forge.md.sha256.create(),
    mgf1: {
      md: forge.md.sha256.create(),
    },
  });
  const encryptedData = forge.util.encode64(encrypted);
  const hmacKey = forge.md.sha256.create()
    .update(timestamp + salt)
    .digest()
    .toHex();
  const signature = computeHMAC(encryptedData, hmacKey);
  return `${encryptedData}$${signature}$${timestamp}$${requestId}`;
}

await authClient.signIn.email({
  email: formData.email,
  password: await rsaEncrypt(formData.password, publicKey),
  rememberMe,
  callbackURL: callbackUrl,
});

await authClient.signUp.email({
  email: formData.email,
  password: await rsaEncrypt(formData.password, publicKey),
  name: formData.name,
  organization: formData.organization,
  callbackURL: "/sign-up",
});

const rsaDecrypt = (encryptedData: string): string => {
  const encryptedBytes = forge.util.decode64(encryptedData);
  const privateKey = forge.pki.privateKeyFromPem(privateKeyText);
  const decryptedBytes = privateKey.decrypt(encryptedBytes, "RSA-OAEP", {
    md: forge.md.sha256.create(),
    mgf1: {
      md: forge.md.sha256.create(),
    },
  });
  return decryptedBytes;
};

export const rsaDecryptAndValidate = async (encryptedPackage: string): Promise<string> => {
  const parts = encryptedPackage.split("$");
  if (parts.length !== 4) {
    throw new Error("无效的数据包格式");
  }
  const [encryptedData, signature, timestampStr, requestId] = parts;
  if (!validateTimestamp(timestampStr)) {
    throw new Error("请求已过期，请重试");
  }
  const isNew = await validateRequestId(requestId);
  if (!isNew) {
    throw new Error("无效的请求，请重试");
  }
  const decryptedData = rsaDecrypt(encryptedData);
  const dataParts = decryptedData.split("|");
  if (dataParts.length !== 4) {
    throw new Error("无效的数据格式");
  }
  const [actualPassword, innerTimestamp, salt, innerRequestId] = dataParts;
  if (innerTimestamp !== timestampStr) {
    throw new Error("数据完整性验证失败");
  }
  if (innerRequestId !== requestId) {
    throw new Error("数据完整性验证失败");
  }
  const hmacKey = forge.md.sha256.create()
    .update(timestampStr + salt)
    .digest()
    .toHex();
  const expectedSignature = computeHMAC(encryptedData, hmacKey);
  if (signature !== expectedSignature) {
    throw new Error("数据完整性验证失败");
  }
  if (!actualPassword) {
    throw new Error("密码不能为空");
  }
  return actualPassword;
};

const result = await redisClient.set(key, "1", {
  NX: true,
  EX: REQUEST_ID_TTL,
});

export const auth = betterAuth({
  emailAndPassword: {
    enabled: true,
    minPasswordLength: 1,
    maxPasswordLength: 4096,
    requireEmailVerification: true,
    password: {
      hash: async (password) => {
        const decryptedPassword = await rsaDecryptAndValidate(password);
        return bcrypt.hash(decryptedPassword, 10);
      },
      verify: async ({ hash, password }) => {
        const decryptedPassword = await rsaDecryptAndValidate(password);
        return bcrypt.compare(decryptedPassword, hash);
      },
    },
  },
});

advanced: {
  disableCSRFCheck: false,
  useSecureCookies: isProduction,
  defaultCookieAttributes: {
    sameSite: "lax",
    httpOnly: true,
    secure: isProduction,
    path: "/",
  },
}

rateLimit: {
  enabled: isProduction,
  customRules: {
    "/sign-up/email": {
      window: 60,
      max: 1,
    },
    "/request-password-reset": {
      window: 60,
      max: 1,
    },
    "/sign-in/email": {
      window: 30,
      max: 5,
    },
  },
}