#!/usr/bin/env node
/**
 * OCS 5.0 行为模拟器（测试专用，不是产品代码）
 * ================================================
 * 为保证「我们生成的题库配置 / 实际收到的 payload」与 OCS 真实行为一致，本脚本把
 * OCS 5.0 源码里的关键纯函数逐段移植到可执行 JS，并用 Node 真实执行（保留 JS 的
 * RegExp / Function / Object.values / JSON 往返语义，比 Python 复刻更接近 OCS）。
 *
 * 移植来源（本地解压源码 v5.0）：
 *   packages/scripts/src/utils/answerer-env.ts
 *       - IMAGE_URL_REGEX (L190)
 *       - createImageSuggestion (L192-284)
 *       - buildAnswererEnv (L299-342)
 *       - IMAGE_OPTIMIZE_PLACEHOLDERS (L345)
 *       - IMAGE_ENV_REF_PATTERN (L348)
 *       - isAnswererWrapperSupportImageOptimize / isAnswererWrappersSupportImageOptimize (L367-391)
 *   packages/core/src/core/answer-wrapper/answer.wrapper.handler.ts
 *       - env 默认值 (L74-82)
 *       - POST data 字段解析：data 字段 handler 用 Function() 执行 / 字符串走
 *         resolvePlaceHolder (L123-144, L216-232)
 *   packages/core/src/core/answer-wrapper/answer.wrapper.parser.ts
 *       - fromObject 校验 (L8-50)；from(string) 只做 JSON.parse (L52-79)
 *   packages/scripts/src/utils/answer-wrapper-security.ts
 *       - stripCommentsAndStrings / DANGEROUS_PATTERNS / detectHandlerRisks /
 *         scanAnswerWrapperRisks (L20-178)
 *
 * 未移植（与本测试无关，测试图片均满足前提）：
 *   * imageToBase64 的浏览器/Node 网络分支 —— 测试里通过 imagePayloads 注入转换结果，
 *     等价于 OCS 在浏览器中成功把图片转成 base64 的结果；
 *   * getImageSize / upscalePngDataUrl 的 <14px 放大分支 —— 测试图片均远大于 14px。
 *
 * 用法（stdin 传 JSON，stdout 返回 JSON）：
 *   node ocs5_emulator.mjs < request.json
 *   request.op = "detect"  : 检测题库配置（图片题优化支持性 + 可疑代码扫描 + parser 校验）
 *   request.op = "build"   : 模拟 buildAnswererEnv + POST data 解析，产出真实 OCS 会发出的请求体
 */

const IMAGE_OPTIMIZE_PLACEHOLDERS = ['${images}', '${suggestion_title}', '${suggestion_options}'];
const IMAGE_ENV_REF_PATTERN = /(^|[^\w$])(images|suggestion_title|suggestion_options)(?![\w$])/;
// 源码 L190：仅匹配带图片扩展名的 URL（DOM 调用方会直接传 titleImages/optionsImages，绕过该正则）
const IMAGE_URL_REGEX =
  /https?:\/\/[^\s\u4e00-\u9fff\uff00-\uffef]+?\.(?:png|jpe?g|gif|bmp|webp|svg)(?:\?[^\s\u4e00-\u9fff\uff00-\uffef]*)?/gi;

// ─────────────────────────── answerer-env.ts ───────────────────────────

function isAnswererWrapperSupportImageOptimize(wrapper) {
  // L367-383 原样移植
  if (!wrapper || String(wrapper.method || 'get').toLowerCase() !== 'post') {
    return false;
  }
  for (const value of Object.values(wrapper.data || {})) {
    if (typeof value === 'string') {
      if (IMAGE_OPTIMIZE_PLACEHOLDERS.some((placeholder) => value.includes(placeholder))) {
        return true;
      }
    } else if (value && typeof value === 'object' && typeof value.handler === 'string') {
      if (IMAGE_ENV_REF_PATTERN.test(value.handler)) {
        return true;
      }
    }
  }
  return false;
}

function isAnswererWrappersSupportImageOptimize(wrappers) {
  return wrappers.some(isAnswererWrapperSupportImageOptimize);
}

function normalizeToPngDataUrl(dataUrl) {
  // L178-181
  const m = dataUrl.match(/^data:[^;,]+.*?;base64,(.+)$/);
  return `data:image/png;base64,${m ? m[1] : dataUrl}`;
}

/** 模拟 imageToBase64：data: 原样返回；否则用注入的转换结果（等价浏览器 canvas 成功转换） */
function imageToBase64(url, imagePayloads) {
  if (url.startsWith('data:')) {
    return Promise.resolve(url);
  }
  if (imagePayloads && typeof imagePayloads[url] === 'string') {
    return Promise.resolve(imagePayloads[url]);
  }
  // 未注入时生成确定性占位 base64（只用于结构测试，不是合法图片）
  return Promise.resolve(`data:image/png;base64,${Buffer.from('OCS_EMULATOR:' + url).toString('base64')}`);
}

/** L192-284 移植（跳过 <14px upscale 分支，见文件头说明） */
async function createImageSuggestion(title, options, titleImages, optionImages, imagePayloads) {
  const titleUrls = titleImages && titleImages.length ? titleImages.slice() : title.match(IMAGE_URL_REGEX) || [];
  const optionUrls = optionImages && optionImages.length ? optionImages.slice() : options?.match(IMAGE_URL_REGEX) || [];

  if (titleUrls.length === 0 && optionUrls.length === 0) return undefined;

  const allUrls = [];
  const seen = new Set();
  for (const url of [...titleUrls, ...optionUrls]) {
    if (!seen.has(url)) {
      seen.add(url);
      allUrls.push(url);
    }
  }

  const base64Map = new Map();
  await Promise.all(
    allUrls.map(async (url) => {
      try {
        base64Map.set(url, await imageToBase64(url, imagePayloads));
      } catch {
        // 转换失败跳过（与源码一致）
      }
    })
  );
  if (base64Map.size === 0) return undefined;

  const images = [];
  const urls = [];
  const placeholderMap = new Map();
  for (const url of allUrls) {
    const base64 = base64Map.get(url);
    if (!base64) continue;
    // L241-243：统一重写为 data:image/png;base64,{b64}
    const normalized = normalizeToPngDataUrl(base64);
    // L253：' [图片N] '，左右各一个空格（注意源码注释写“两个空格”，实际模板各一个）
    placeholderMap.set(url, ` [图片${images.length + 1}] `);
    images.push(normalized);
    urls.push(url);
  }
  if (images.length === 0) return undefined;

  let suggestionTitle = title;
  for (const [url, placeholder] of placeholderMap) {
    suggestionTitle = suggestionTitle.split(url).join(placeholder);
  }

  let suggestionOptions;
  if (options) {
    const hasOptionImages = optionUrls.some((url) => base64Map.has(url));
    if (hasOptionImages) {
      suggestionOptions = options;
      for (const [url, placeholder] of placeholderMap) {
        suggestionOptions = suggestionOptions.split(url).join(placeholder);
      }
    }
  }

  return {
    images,
    urls,
    suggestion_title: suggestionTitle,
    ...(suggestionOptions !== undefined ? { suggestion_options: suggestionOptions } : {})
  };
}

/** L286-297 按行去重 */
function dedupeLines(str) {
  const seen = new Set();
  const result = [];
  for (const line of str.split('\n')) {
    if (!seen.has(line)) {
      seen.add(line);
      result.push(line);
    }
  }
  return result.join('\n');
}

/** L299-342 移植 */
async function buildAnswererEnv(params, imagePayloads) {
  const rawOptions = Array.isArray(params.options)
    ? params.options.filter((o) => o != null && o !== '').join('\n')
    : params.options ?? '';
  const options = dedupeLines(rawOptions);
  const env = {
    type: params.type || 'unknown',
    title: params.title,
    options
  };
  let imageUrls = [];
  if (params.enableImageOptimize) {
    const suggestion = await createImageSuggestion(
      params.title,
      options,
      params.titleImages,
      params.optionsImages,
      imagePayloads
    );
    if (suggestion) {
      env.images = suggestion.images;
      imageUrls = suggestion.urls;
      env.suggestion_title = suggestion.suggestion_title;
      if (suggestion.suggestion_options !== undefined) {
        env.suggestion_options = dedupeLines(suggestion.suggestion_options);
      }
    }
  }
  return { env, imageUrls };
}

// ─────────────────── core: answer.wrapper.handler.ts ───────────────────

/** L226-232 resolvePlaceHolder */
function resolvePlaceHolder(data, env, options) {
  if (typeof data === 'string') {
    const matches = data.match(/\${(.*?)}/g) || [];
    matches.forEach((placeHolder) => {
      const value = env[placeHolder.replace(/\${(.*)}/, '$1')];
      data = data.replace(placeHolder, options?.encodeURI ? encodeURIComponent(value) : value);
    });
  } else if (typeof data === 'object') {
    const keys = Object.keys(data);
    for (const key of keys) {
      data[key] = resolvePlaceHolder(data[key], env, options);
    }
  }
  return data;
}

/** L43-234 POST 分支移植：返回每个 wrapper 实际会发出的 JSON body（连同 env 默认值） */
function defaultAnswerWrapperHandler(wrappers, env) {
  const temp = JSON.parse(JSON.stringify(wrappers));
  if (temp.length === 0) throw new Error('题库配置不能为空，请配置后重新开始自动答题。');

  // L74-82 env 默认值：避免占位符被替换成 'undefined' 字面量
  if (env.title === undefined) env.title = '';
  if (env.options === undefined) env.options = '';
  if (env.type === undefined) env.type = 'unknown';
  if (env.images === undefined) env.images = [];
  if (env.suggestion_title === undefined) env.suggestion_title = '';
  if (env.suggestion_options === undefined) env.suggestion_options = '';

  const requests = [];
  for (const wrapper of temp) {
    const {
      name = '未知题库',
      homepage = '#',
      method = 'get',
      type = 'fetch',
      contentType = 'json',
      responseType = 'json',
      headers = {},
      data: wrapperData = {},
      handler = 'return (res)=> [JSON.stringify(res), undefined]'
    } = wrapper;

    if (method.toLocaleLowerCase() === 'post') {
      if (!Object.keys(headers).some((k) => k.toLowerCase() === 'content-type')) {
        headers['Content-Type'] = 'application/json';
      }
    }

    let requestData;
    if (method.toLocaleLowerCase() === 'post') {
      const data = Object.create({});
      Object.keys(wrapperData).forEach((key) => {
        if (typeof wrapperData[key] === 'object' && Reflect.has(wrapperData[key], 'handler')) {
          const h = Function(Reflect.get(wrapperData[key], 'handler'))();
          if (typeof h !== 'function') throw new Error('data 字段解析器必须返回一个函数');
          Reflect.set(data, key, h(env));
        } else {
          Reflect.set(data, key, resolvePlaceHolder(wrapperData[key], env));
        }
      });
      requestData = data;
    } else {
      // GET：data 会被拼到 query（本配置为 POST，仅作对照）
      requestData = {};
    }

    // 响应 handler 也执行一次，确保 DSL 本身可被 Function 构造（不校验响应逻辑）
    const responseHandler = Function(handler)();
    if (typeof responseHandler !== 'function') {
      throw new Error('handler 响应处理器必须返回一个函数');
    }

    const body = JSON.parse(JSON.stringify(requestData));
    requests.push({
      name,
      url: wrapper.url,
      method,
      contentType,
      requestType: type,
      headers,
      body,
      bodySize: JSON.stringify(body).length
    });
  }
  return { envAfterDefaults: env, requests };
}

// ────────────── core: answer.wrapper.parser.ts ──────────────

function parseFromObject(json) {
  const aw = json;
  const errors = [];
  if (!aw || !Array.isArray(aw)) return { ok: false, errors: ['题库配置格式错误！'] };
  if (!aw.length) return { ok: false, errors: ['题库为空！'] };
  for (let i = 0; i < aw.length; i++) {
    const item = aw[i] || {};
    if (typeof item.name !== 'string') errors.push(`第 ${i + 1} 个题库的 名字(name) 为空`);
    if (typeof item.url !== 'string') errors.push(`第 ${i + 1} 个题库的 接口地址(url) 为空`);
    if (typeof item.handler !== 'string') errors.push(`第 ${i + 1} 个题库的 解析器(handler) 为空`);
    if (item.headers && typeof item.headers !== 'object') errors.push(`第 ${i + 1} 个题库的 头部信息(header) 应为 对象 格式`);
    if (item.data && typeof item.data !== 'object') errors.push(`第 ${i + 1} 个题库的 提交数据(data) 应为 对象 格式`);
    if (['json', 'text'].every((x) => x !== item.contentType) && item.contentType) {
      errors.push(`第 ${i + 1} 个题库的 contentType 非法`);
    }
    if (['post', 'get'].every((x) => x !== item.method) && item.method) {
      errors.push(`第 ${i + 1} 个题库的 method 非法`);
    }
    if (['fetch', 'GM_xmlhttpRequest'].every((x) => x !== item.type) && item.type) {
      errors.push(`第 ${i + 1} 个题库的 type 非法`);
    }
  }
  return { ok: errors.length === 0, errors };
}

// ────────────── scripts: answer-wrapper-security.ts ──────────────

const DANGEROUS_PATTERNS = [
  { pattern: /\beval\b/, feature: 'eval' },
  { pattern: /\bFunction\s*\(/, feature: 'Function()' },
  { pattern: /\bfetch\s*\(/, feature: 'fetch' },
  { pattern: /\bXMLHttpRequest\b/, feature: 'XMLHttpRequest' },
  { pattern: /\bGM_xmlhttpRequest\b|\bGM\s*\.\s*xmlHttpRequest\b/, feature: 'GM_xmlhttpRequest' },
  { pattern: /\bGM_\w+|\bGM\s*\.\s*\w+/, feature: 'GM API' },
  { pattern: /\blocalStorage\b|\bsessionStorage\b|\bindexedDB\b/, feature: '本地存储' },
  { pattern: /\bcookie\b/i, feature: 'cookie' },
  { pattern: /\bsendBeacon\b/, feature: 'sendBeacon' },
  { pattern: /\bWebSocket\b|\bEventSource\b/, feature: 'WebSocket/EventSource' },
  { pattern: /\blocation\b/, feature: 'location' },
  { pattern: /\bwindow\b|\bglobalThis\b|\bunsafeWindow\b|\btop\b|\bparent\b|\bopener\b/, feature: '全局对象' },
  { pattern: /\bdocument\b/, feature: 'document' },
  { pattern: /\bpostMessage\b/, feature: 'postMessage' },
  { pattern: /\bimport\s*\(/, feature: 'import()' },
  { pattern: /\brequire\s*\(/, feature: 'require()' },
  { pattern: /\.constructor\b|\b__proto__\b/, feature: '原型链访问' },
  { pattern: /\bfromCharCode\b|\batob\b|\bunescape\b/, feature: '解码函数' },
  { pattern: /\bWorker\b/, feature: 'Worker' },
  {
    pattern: /\[\s*['"`][^\]'"]*['"`]\s*\+|\+\s*['"`][^\]'"]*['"`]\s*\]/,
    feature: '拼接属性访问'
  }
];

/** L77-138 移植：去掉注释与字符串字面量（避免字符串内关键词误报） */
function stripCommentsAndStrings(code) {
  const findings = [];
  let stripped = '';
  let i = 0;
  while (i < code.length) {
    const ch = code[i];
    const next = code[i + 1];
    if (ch === '/' && next === '/') {
      while (i < code.length && code[i] !== '\n') i++;
      continue;
    }
    if (ch === '/' && next === '*') {
      i += 2;
      while (i < code.length && !(code[i] === '*' && code[i + 1] === '/')) i++;
      i += 2;
      continue;
    }
    if (ch === "'" || ch === '"' || ch === '`') {
      const quote = ch;
      let str = '';
      i++;
      while (i < code.length && code[i] !== quote) {
        if (code[i] === '\\') {
          str += code[i] + (code[i + 1] || '');
          i += 2;
          continue;
        }
        if (quote !== '`' && code[i] === '\n') break;
        str += code[i];
        i++;
      }
      i++;
      if (/\\x[0-9a-fA-F]{2}|\\u[0-9a-fA-F]{4}|\\u\{[0-9a-fA-F]+\}/.test(str)) {
        findings.push({ where: '', feature: '转义字符' });
      }
      if (str.length > 100 && /^[A-Za-z0-9+/=\s]+$/.test(str)) {
        findings.push({ where: '', feature: '超长编码串' });
      }
      if (quote === '`') {
        for (const match of str.matchAll(/\$\{([^{}]*)\}/g)) {
          stripped += ' ' + match[1] + ' ';
        }
      }
      stripped += '""';
      continue;
    }
    stripped += ch;
    i++;
  }
  return { stripped, findings };
}

function detectHandlerRisks(code, where = '') {
  const { stripped, findings } = stripCommentsAndStrings(code);
  for (const { pattern, feature } of DANGEROUS_PATTERNS) {
    if (pattern.test(stripped)) findings.push({ where, feature });
  }
  const seen = new Set();
  return findings
    .map((f) => ({ ...f, where }))
    .filter((f) => {
      const key = f.where + '|' + f.feature;
      if (seen.has(key)) return false;
      seen.add(key);
      return true;
    });
}

function scanAnswerWrapperRisks(aw) {
  const findings = [];
  if (typeof aw.handler === 'string') findings.push(...detectHandlerRisks(aw.handler, 'handler 解析器'));
  if (aw.data && typeof aw.data === 'object') {
    for (const key of Object.keys(aw.data)) {
      const field = aw.data[key];
      if (field && typeof field === 'object' && typeof field.handler === 'string') {
        findings.push(...detectHandlerRisks(field.handler, `data.${key} 字段解析器`));
      }
    }
  }
  return findings;
}

// ────────────────────────────── ops ──────────────────────────────

async function opDetect(req) {
  const wrappers = req.wrappers || [];
  const perWrapper = wrappers.map((w, i) => ({
    index: i,
    name: w && w.name,
    method: w && w.method,
    supportsImageOptimize: isAnswererWrapperSupportImageOptimize(w),
    risks: scanAnswerWrapperRisks(w || {}),
    parser: parseFromObject([w])
  }));
  return {
    supportsImageOptimize: isAnswererWrappersSupportImageOptimize(wrappers),
    perWrapper,
    directCases: (req.cases || []).map((c) => ({
      name: c.name,
      result: isAnswererWrapperSupportImageOptimize(c.wrapper),
      // 单个对象越界字段不影响判断，此处同时输出 Object.values 数量自检
      dataValueCount: Object.values((c.wrapper && c.wrapper.data) || {}).length
    }))
  };
}

async function opBuild(req) {
  const wrappers = req.wrappers || [];
  const scenarios = req.scenarios || [];
  const out = [];
  for (const scenario of scenarios) {
    const imagePayloads = scenario.imagePayloads || {};
    const { env, imageUrls } = await buildAnswererEnv(
      {
        type: scenario.type,
        title: scenario.title,
        options: scenario.options,
        titleImages: scenario.titleImages,
        optionsImages: scenario.optionsImages,
        enableImageOptimize: scenario.enableImageOptimize !== false
      },
      imagePayloads
    );
    const { envAfterDefaults, requests } = defaultAnswerWrapperHandler(wrappers, env);
    out.push({
      name: scenario.name,
      imageUrls,
      envAfterDefaults,
      requests
    });
  }
  return { scenarios: out };
}

function opParse(req) {
  const fromObject = parseFromObject(req.wrappers || []);
  // from(string) 只做 JSON.parse，不校验字段（parser.ts L69-79）
  let stringParseOk = true;
  let stringParseError = null;
  try {
    JSON.parse(req.rawString || '');
  } catch (e) {
    stringParseOk = false;
    stringParseError = String(e && e.message);
  }
  return { fromObject, stringParseOk, stringParseError };
}

async function main() {
  let raw = '';
  for await (const chunk of process.stdin) raw += chunk;
  const req = JSON.parse(raw || '{}');
  let result;
  switch (req.op) {
    case 'detect':
      result = await opDetect(req);
      break;
    case 'build':
      result = await opBuild(req);
      break;
    case 'parse':
      result = opParse(req);
      break;
    default:
      throw new Error(`unknown op: ${req.op}`);
  }
  process.stdout.write(JSON.stringify(result));
}

main().catch((e) => {
  process.stderr.write(String((e && e.stack) || e) + '\n');
  process.exit(1);
});