const crypto = require('crypto');
const fs = require('fs');

class DataDecryptor {
  constructor(privateKeyPath) {
    this.privateKey = fs.readFileSync(privateKeyPath, 'utf8');
  }

  decryptUpload(encryptedPayload, encryptionMetadata) {
    try {
      // Parse the hybrid encrypted data
      // Format: base64(rsa_encrypted_aes_key)|base64(aes_encrypted_data)
      const [encryptedAESKeyB64, encryptedDataB64] = encryptedPayload.split('|');
      
      if (!encryptedAESKeyB64 || !encryptedDataB64) {
        throw new Error('Invalid encrypted payload format');
      }

      // Step 1: Decrypt AES key with RSA private key
      const encryptedAESKey = Buffer.from(encryptedAESKeyB64, 'base64');
      const aesKey = crypto.privateDecrypt(
        {
          key: this.privateKey,
          padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
          oaepHash: 'sha256'
        },
        encryptedAESKey
      );

      // Step 2: Decrypt data with AES-256-GCM
      const iv = Buffer.from(encryptionMetadata.iv, 'base64');
      const encryptedData = Buffer.from(encryptedDataB64, 'base64');
      
      // Split encrypted data and auth tag (last 16 bytes)
      const authTag = encryptedData.slice(-16);
      const ciphertext = encryptedData.slice(0, -16);
      
      const decipher = crypto.createDecipherGCM('aes-256-gcm', aesKey);
      decipher.setIV(iv);
      decipher.setAuthTag(authTag);
      
      let decrypted = decipher.update(ciphertext, null, 'utf8');
      decrypted += decipher.final('utf8');
      
      return JSON.parse(decrypted);
      
    } catch (error) {
      throw new Error(`Decryption failed: ${error.message}`);
    }
  }
}

// Usage example
const barcelonaDecryptor = new DataDecryptor('/etc/wellbeing-research/keys/barcelona_private_key.pem');
const gautengDecryptor = new DataDecryptor('/etc/wellbeing-research/keys/gauteng_private_key.pem');

// In your upload handler
app.post('/api/v1/participant-data', async (req, res) => {
  const { researchSite, encryptedData, encryptionMetadata } = req.body;
  
  try {
    const decryptor = researchSite === 'barcelona' ? barcelonaDecryptor : gautengDecryptor;
    const decryptedData = decryptor.decryptUpload(encryptedData, encryptionMetadata);
    
    // Process decrypted data
    await processParticipantData(decryptedData, req.body);
    
    res.json({ success: true, message: 'Data processed successfully' });
  } catch (error) {
    console.error('Decryption error:', error);
    res.status(400).json({ success: false, error: 'Decryption failed' });
  }
});

// test-encryption.js
const crypto = require('crypto');
const fs = require('fs');

// Test data
const testData = {
  participantUuid: '123e4567-e89b-12d3-a456-426614174000',
  researchSite: 'barcelona',
  uploadTimestamp: new Date().toISOString(),
  surveys: [{
    type: 'initial',
    submittedAt: new Date().toISOString(),
    responses: { wellbeingScore: 7, stressLevel: 3 }
  }],
  locationTracks: [{
    timestamp: new Date().toISOString(),
    latitude: 41.3851,
    longitude: 2.1734,
    accuracy: 15.0
  }]
};

function testEncryptionDecryption(publicKeyPath, privateKeyPath) {
  try {
    // Step 1: Generate AES key
    const aesKey = crypto.randomBytes(32); // 256-bit key
    const iv = crypto.randomBytes(12); // 96-bit IV for GCM
    
    // Step 2: Encrypt data with AES-256-GCM
    const cipher = crypto.createCipherGCM('aes-256-gcm', aesKey);
    cipher.setIV(iv);
    
    const jsonData = JSON.stringify(testData);
    let encrypted = cipher.update(jsonData, 'utf8');
    encrypted = Buffer.concat([encrypted, cipher.final()]);
    
    const authTag = cipher.getAuthTag();
    const encryptedDataWithTag = Buffer.concat([encrypted, authTag]);
    
    // Step 3: Encrypt AES key with RSA public key
    const publicKey = fs.readFileSync(publicKeyPath, 'utf8');
    const encryptedAESKey = crypto.publicEncrypt(
      {
        key: publicKey,
        padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
        oaepHash: 'sha256'
      },
      aesKey
    );
    
    // Step 4: Create final payload
    const finalPayload = encryptedAESKey.toString('base64') + '|' + encryptedDataWithTag.toString('base64');
    
    console.log('✅ Encryption successful');
    console.log('Payload size:', finalPayload.length, 'bytes');
    
    // Step 5: Test decryption
    const privateKey = fs.readFileSync(privateKeyPath, 'utf8');
    const [encryptedAESKeyB64, encryptedDataB64] = finalPayload.split('|');
    
    // Decrypt AES key
    const decryptedAESKey = crypto.privateDecrypt(
      {
        key: privateKey,
        padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
        oaepHash: 'sha256'
      },
      Buffer.from(encryptedAESKeyB64, 'base64')
    );
    
    // Decrypt data
    const encryptedDataBuffer = Buffer.from(encryptedDataB64, 'base64');
    const authTagFromData = encryptedDataBuffer.slice(-16);
    const ciphertext = encryptedDataBuffer.slice(0, -16);
    
    const decipher = crypto.createDecipherGCM('aes-256-gcm', decryptedAESKey);
    decipher.setIV(iv);
    decipher.setAuthTag(authTagFromData);
    
    let decrypted = decipher.update(ciphertext, null, 'utf8');
    decrypted += decipher.final('utf8');
    
    const decryptedData = JSON.parse(decrypted);
    
    console.log('✅ Decryption successful');
    console.log('Original data matches:', JSON.stringify(testData) === JSON.stringify(decryptedData));
    
    return true;
    
  } catch (error) {
    console.error('❌ Test failed:', error.message);
    return false;
  }
}

// Run tests
console.log('Testing Barcelona encryption...');
testEncryptionDecryption(
  '/secure/keys/barcelona/barcelona_public_key.pem',
  '/secure/keys/barcelona/barcelona_private_key.pem'
);

console.log('\nTesting Gauteng encryption...');
testEncryptionDecryption(
  '/secure/keys/gauteng/gauteng_public_key.pem',
  '/secure/keys/gauteng/gauteng_private_key.pem'
);