/**
 * Cloudflare 账户 A 的 Worker：企业级全能视频安全网关
 * 包含：2小时长效发牌、防篡改哈希、R2读取拦截、动态M3U8重写、Cache API成本优化
 */

// 核心签名算法：生成不可逆的安全印记
async function generateSignature(folderPath, expires, secret) {
  const encoder = new TextEncoder();
  const data = encoder.encode(`${folderPath}:${expires}:${secret}`);
  const hashBuffer = await crypto.subtle.digest('SHA-256', data);
  const hashArray = Array.from(new Uint8Array(hashBuffer));
  return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
}

export default {
  // 注意：务必带有 ctx 参数以支持 Cache API 后台异步写入
  async fetch(request, env, ctx) {
    const url = new URL(request.url);
    
    // --- 1. CORS 多域名白名单校验 ---
    const origin = request.headers.get('Origin');
    const safeOrigin = origin ? origin.toLowerCase() : "";
    const ALLOWED_ORIGINS_STR = env.ALLOWED_ORIGINS || "https://www.example.com";
    const SECRET_KEY = env.SECRET_KEY || "YOUR_SUPER_SECRET_KEY";
    const allowedOriginsList = ALLOWED_ORIGINS_STR.split(',').map(domain => domain.trim().toLowerCase());
    const corsOrigin = allowedOriginsList.includes(safeOrigin) ? origin : "null";

    const corsHeaders = {
      'Access-Control-Allow-Origin': corsOrigin, 
      'Access-Control-Allow-Methods': 'GET, OPTIONS',
      'Access-Control-Allow-Headers': 'Content-Type',
    };

    // 放行浏览器 OPTIONS 跨域预检
    if (request.method === 'OPTIONS') {
      return new Response(null, { headers: corsHeaders });
    }

    // 非法域名强行阻断（非 .ts 文件直接拦截，防止白嫖 M3U8）
    if (corsOrigin === "null" && !url.pathname.endsWith('.ts')) {
       return new Response('CORS Blocked: 非法来源', { status: 403, headers: corsHeaders });
    }

    // --- 2. 路由 A：API 发牌器 ---
    if (url.pathname === '/api/get-token') {
      const rawPath = url.searchParams.get('path');
      if (!rawPath) return new Response('Missing path', { status: 400, headers: corsHeaders });

      // Token 寿命设定为 7200 秒 (2小时)，防止长视频看一半被踢
      const expires = Math.floor(Date.now() / 1000) + 7200; 
      
      // 智能提取干净路径，剔除可能的域名干扰
      let cleanPath = "";
      try {
        cleanPath = new URL(rawPath).pathname;
      } catch (e) {
        cleanPath = new URL(rawPath, 'http://dummy.com').pathname;
      }
      
      const folderPath = cleanPath.substring(0, cleanPath.lastIndexOf('/'));
      const token = await generateSignature(folderPath, expires, SECRET_KEY);

      const separator = rawPath.includes('?') ? '&' : '?';
      const secureUrl = `${rawPath}${separator}token=${token}&expires=${expires}`;
      
      return new Response(JSON.stringify({ secureUrl }), {
        headers: { 'Content-Type': 'application/json', ...corsHeaders }
      });
    }

    // --- 3. 路由 B：拦截与 Token 验真 ---
    const token = url.searchParams.get('token');
    const expires = url.searchParams.get('expires');
    const now = Math.floor(Date.now() / 1000);
    
    if (!token || !expires || parseInt(expires) < now) {
      return new Response('Token Expired: 票据失效', { status: 403, headers: corsHeaders });
    }

    // 重新计算哈希，比对访客带来的票据是否被篡改
    const pathForCheck = url.pathname.substring(0, url.pathname.lastIndexOf('/'));
    const expectedToken = await generateSignature(pathForCheck, expires, SECRET_KEY);
    
    if (token !== expectedToken) {
      return new Response('Invalid Signature: 签名错误', { status: 403, headers: corsHeaders });
    }

    // --- 4. 路由 C：引入 Cache API 防 R2 账单爆炸 ---
    const cache = caches.default;
    // 剔除 URL 中的临时 Token 参数，将纯净的路径作为全网唯一的缓存 Key
    const cacheKeyUrl = new URL(url.pathname, url.origin).toString();
    const cacheKey = new Request(cacheKeyUrl, request);
    
    let response = await cache.match(cacheKey);

    if (!response) {
      // 缓存没命中，去 R2 桶拿货
      const objectKey = decodeURIComponent(url.pathname.slice(1)); 
      const object = await env.BUCKET.get(objectKey);

      if (!object) {
        return new Response('File Not Found', { status: 404, headers: corsHeaders });
      }

      const headers = new Headers(corsHeaders);
      
      if (url.pathname.endsWith('.m3u8')) {
        // M3U8 动态重写逻辑 (绝不缓存)
        const text = await object.text();
        const rewrittenLines = text.split('\n').map(line => {
          const trimmed = line.trim();
          // 给物理密钥 (.key) 打上 Token
          if (trimmed.startsWith('#EXT-X-KEY')) {
            return trimmed.replace(/URI="([^"]+)"/, (match, uri) => {
                const sep = uri.includes('?') ? '&' : '?';
                return `URI="${uri}${sep}token=${token}&expires=${expires}"`;
            });
          }
          // 给所有的视频切片 (.ts) 打上 Token
          if (trimmed && !trimmed.startsWith('#')) {
            const sep = trimmed.includes('?') ? '&' : '?';
            return `${trimmed}${sep}token=${token}&expires=${expires}`;
          }
          return line;
        });

        headers.set('Content-Type', 'application/x-mpegURL');
        headers.set('Cache-Control', 'no-cache, no-store, must-revalidate');
        response = new Response(rewrittenLines.join('\n'), { headers });

      } else {
        // TS 切片与 KEY 二进制流逻辑 (边缘节点缓存1个月)
        if (url.pathname.endsWith('.key')) headers.set('Content-Type', 'application/octet-stream');
        if (url.pathname.endsWith('.ts')) headers.set('Content-Type', 'video/MP2T');
        
        headers.set('Cache-Control', 'public, max-age=2592000');
        response = new Response(object.body, { headers });
      }

      // 将合法的切片存入缓存，下次请求秒开，不扣 R2 读取次数
      if (response.status === 200 && !url.pathname.endsWith('.m3u8')) {
          ctx.waitUntil(cache.put(cacheKey, response.clone()));
      }
    } else {
      // 命中缓存时，需重新克隆 Response，补齐访客对应的 CORS 头
      response = new Response(response.body, response);
      response.headers.set('Access-Control-Allow-Origin', corsOrigin);
    }

    return response;
  }
}

document.addEventListener('DOMContentLoaded', async () => {
    // 1. 优先加载配置文件
    const workerDomain = await loadConfig();
    
    if (workerDomain) {
        // 2. 配置加载成功后，再启动播放器初始化
        initAllSecurePlayers(workerDomain);
    } else {
        console.error("无法启动播放器：配置文件加载失败。");
    }
});

/**
 * 从根目录读取 config.json
 */
async function loadConfig() {
    try {
        // 请求根目录下的 config.json
        const response = await fetch('/config.json');
        if (!response.ok) throw new Error('config.json 不存在');
        const config = await response.json();
        return config.workerDomain;
    } catch (error) {
        console.error("加载 config.json 出错:", error);
        return null;
    }
}

/**
 * 批量扫描并初始化播放器
 */
async function initAllSecurePlayers(workerDomain) {
    const playerContainers = document.querySelectorAll('.video-player');
    
    for (const container of playerContainers) {
        const rawVideoPath = container.getAttribute('data-path'); 
        if (!rawVideoPath) continue;

        try {
            // 使用配置中的域名发起请求
            const response = await fetch(`${workerDomain}/api/get-token?path=${encodeURIComponent(rawVideoPath)}`);
            
            if (!response.ok) throw new Error('Worker 鉴权拒绝');
            const data = await response.json();
            
            let finalUrl = data.secureUrl;
            
            // 拼接绝对地址
            if (finalUrl.startsWith('/')) {
                finalUrl = `${workerDomain}${finalUrl}`;
            }

            createSingleArtPlayer(container, finalUrl);

        } catch (error) {
            console.error(`视频 [${rawVideoPath}] 授权失败:`, error);
            container.innerHTML = `<div class="player-error">视频加载失败，请检查配置或网络</div>`;
        }
    }
}

/**
 * 实例化 Artplayer
 */
function createSingleArtPlayer(container, secureUrl) {
    const art = new Artplayer({
        container: container, 
        url: secureUrl,       
        type: 'm3u8',
        customType: {
            m3u8: function (video, url) {
                initHlsPlayerDirectly(video, url); 
            },
        },
        setting: true,
        playbackRate: true,
        fullscreen: true,
        pip: true,
        volume: 0.8
    });

    art.on('play', () => {
        Artplayer.instances.forEach((instance) => {
            if (instance !== art) instance.pause();
        });
    });
}

/**
 * HLS 内核加载
 */
function initHlsPlayerDirectly(videoElement, initialUrl) {
    if (Hls.isSupported()) {
        // 加入快速启动配置参数
        const hls = new Hls({
            // 限制播放器只下载当前所需清晰度的切片
            capLevelToPlayerSize: true, 
            // 降低初始缓冲要求，尽快吐出画面
            maxBufferLength: 10,
            maxMaxBufferLength: 30,
        });
        
        hls.loadSource(initialUrl);
        hls.attachMedia(videoElement);
        videoElement.addEventListener('destroy', () => hls.destroy());
    } else if (videoElement.canPlayType('application/vnd.apple.mpegurl')) {
        videoElement.src = initialUrl;
    }
}