import Foundation

struct AppConfig {
    // MARK: - PicoShare Configuration (Synology Setup)
    static let picoshareBaseURL = "ps.plet.i234.me"  // Je Synology domein
    static let useHTTPS = true
    
    // MARK: - PicoShare URL (Direct Access - nginx protected)
    static var modelDownloadURL: String {
        // Environment variable voor development/testing
        if let envURL = ProcessInfo.processInfo.environment["SHOTSCREEN_MODEL_URL"] {
            return envURL
        }
        
        // Direct URL (nginx User-Agent filtering provides security)
        return "https://\(picoshareBaseURL)/-2xXXWuMFfW"
    }
    
    private static func generatePicoShareURL() -> String {
        // Tijd-component (verandert elk uur voor security)
        let hourComponent = Int(Date().timeIntervalSince1970) / 3600
        
        // Base64 encoded delen - ✅ CONFIGURED VOOR JOUW PICOSHARE
        let serverPart = "aHR0cHM6Ly9wcy5wbGV0LmkyMzQubWUv"  // https://ps.plet.i234.me/
        let filePart = "LTJ4WFhXdU1GZlc="  // -2xXXWuMFfW (jouw PicoShare ID)
        
        guard let serverData = Data(base64Encoded: serverPart),
              let fileData = Data(base64Encoded: filePart),
              let serverURL = String(data: serverData, encoding: .utf8),
              let fileName = String(data: fileData, encoding: .utf8) else {
            // Fallback naar directe URL als obfuscation faalt
            return "https://\(picoshareBaseURL)/-2xXXWuMFfW"
        }
        
        // XOR obfuscation met tijd-component (verandert elk uur)
        let timeKey = UInt8(hourComponent % 256)
        let xorKey: UInt8 = 0x5A ^ timeKey  // Combineer met tijd
        
        let obfuscatedFileName = fileName.map { char in
            let ascii = char.asciiValue ?? 0
            let xored = ascii ^ xorKey
            // Zorg dat het een geldig karakter blijft
            if let validChar = UnicodeScalar(Int(xored)), validChar.isASCII {
                return String(Character(validChar))
            } else {
                return String(char)  // Behoud origineel als XOR ongeldig
            }
        }.joined()
        
        print("🔐 Generated time-based URL for hour: \(hourComponent)")
        return serverURL + obfuscatedFileName
    }
    
    // MARK: - Enhanced Security Headers for PicoShare
    static var secureHeaders: [String: String] {
        let timestamp = String(Int(Date().timeIntervalSince1970))
        let requestId = UUID().uuidString.prefix(12)
        let version = Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "1.0"
        let build = Bundle.main.infoDictionary?["CFBundleVersion"] as? String ?? "1"
        
        return [
            "User-Agent": "ShotScreen/\(version) (Build \(build); macOS; Synology)",
            "X-App-Version": version,
            "X-Request-ID": String(requestId),
            "X-Timestamp": timestamp,
            "X-Client-Type": "ShotScreen-Official",
            "X-Device-Type": "macOS",
            "Accept": "application/octet-stream",
            "Cache-Control": "no-cache"
        ]
    }
    
    // MARK: - Network Security
    static var userAgent: String {
        let version = Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "1.0"
        let build = Bundle.main.infoDictionary?["CFBundleVersion"] as? String ?? "1"
        return "ShotScreen/\(version) (Build \(build); macOS; Synology)"
    }
    
    static var maxDownloadSize: Int64 {
        return 200 * 1024 * 1024 // 200MB max
    }
    
    // MARK: - PicoShare URL Helper (voor handmatige setup)
    static func generateDirectPicoShareURL(fileID: String) -> String {
        return "https://\(picoshareBaseURL)/\(fileID)"
    }
}