/**
 * 为 OSS Bucket 配置浏览器直传所需的 CORS 规则。
 * 使用 server/dukang-api/.env 中的 OSS 凭证。
 *
 * 用法：pnpm oss:cors
 * 可选环境变量 OSS_CORS_ORIGINS（逗号分隔），默认包含本地 H5 / admin 端口。
 */
import { readFileSync, existsSync } from 'node:fs';
import { resolve, dirname } from 'node:path';
import { fileURLToPath } from 'node:url';
import { createRequire } from 'node:module';

const __dirname = dirname(fileURLToPath(import.meta.url));
const apiRoot = resolve(__dirname, '../server/dukang-api');
const require = createRequire(resolve(apiRoot, 'package.json'));
const OSS = require('ali-oss');
const envPath = resolve(apiRoot, '.env');

function loadEnvFile(path: string) {
  if (!existsSync(path)) return;
  for (const line of readFileSync(path, 'utf8').split(/\r?\n/)) {
    const trimmed = line.trim();
    if (!trimmed || trimmed.startsWith('#')) continue;
    const eq = trimmed.indexOf('=');
    if (eq <= 0) continue;
    const key = trimmed.slice(0, eq).trim();
    let value = trimmed.slice(eq + 1).trim();
    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
      value = value.slice(1, -1);
    }
    if (process.env[key] === undefined) process.env[key] = value;
  }
}

loadEnvFile(envPath);

const {
  OSS_ACCESS_KEY_ID: accessKeyId,
  OSS_ACCESS_KEY_SECRET: accessKeySecret,
  OSS_BUCKET: bucket,
  OSS_REGION: region = 'oss-cn-hangzhou',
  OSS_CORS_ORIGINS,
} = process.env;

if (!accessKeyId || !accessKeySecret || !bucket) {
  console.error('请在 server/dukang-api/.env 配置 OSS_ACCESS_KEY_ID、OSS_ACCESS_KEY_SECRET、OSS_BUCKET');
  process.exit(1);
}

const defaultOrigins = [
  'http://localhost:5173',
  'http://localhost:5174',
  'http://localhost:5175',
  'http://127.0.0.1:5173',
  'http://127.0.0.1:5174',
  'http://127.0.0.1:5175',
  'http://localhost:5173/user',
  'http://localhost:5174/shop',
  'http://localhost:5175/partner',
  'https://user.runxian.top',
];

const allowedOrigin = (OSS_CORS_ORIGINS ?? defaultOrigins.join(','))
  .split(',')
  .map((s) => s.trim())
  .filter(Boolean);

const client = new OSS({
  region,
  accessKeyId,
  accessKeySecret,
  bucket,
});

const rules = [
  {
    allowedOrigin,
    allowedMethod: ['GET', 'POST', 'PUT', 'HEAD'],
    allowedHeader: ['*'],
    exposeHeader: ['ETag', 'x-oss-request-id'],
    maxAgeSeconds: 600,
  },
];

console.log(`配置 Bucket「${bucket}」CORS，允许来源：`);
for (const origin of allowedOrigin) console.log(`  - ${origin}`);

await client.putBucketCORS(bucket, rules);
console.log('CORS 规则已写入。若 H5 端仍直传 OSS，请确认来源域名已包含在列表中。');