// 调试脚本：逐行审计 cloud ecs/vas 加密字段，区分"明文原本为空"与"解密失败"
// 用法：node dev_test_scripts/debug/debug_cloud_decrypt_audit.js
const crypto = require('crypto')
const fs = require('fs')
const path = require('path')
const os = require('os')

// 与 index.js 相同的凭据加载逻辑
const userProfile = process.env.USERPROFILE || process.env.HOME || os.homedir()
const credsPath = path.join(userProfile, 'Toolbox_local_creds.env.local')
if (fs.existsSync(credsPath)) {
  fs.readFileSync(credsPath, 'utf-8').split(/\r?\n/).forEach(line => {
    const t = line.trim()
    if (!t || t.startsWith('#')) return
    const i = t.indexOf('=')
    if (i <= 0) return
    const k = t.slice(0, i).trim()
    const v = t.slice(i + 1).trim()
    if (k && !Object.prototype.hasOwnProperty.call(process.env, k)) process.env[k] = v
  })
  console.log('creds loaded from', credsPath)
} else {
  console.log('WARN: creds file not found')
}

const { db } = require('../../src/server/db')
const cfg = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'config', 'cloud.json'), 'utf-8'))
const saltStr = String(cfg.machine_salt || '')
const passphrase = process.env.CLOUD_PASSPHRASE || process.env.SYSTEM_AUTH_PASS_93220 || ''
console.log('passphrase present:', !!passphrase)
const key = crypto.scryptSync(passphrase + saltStr, Buffer.from(saltStr || 'default', 'utf-8'), 32)

const audit = (table, ec, ivc, tagc) => {
  const rows = db.prepare(`SELECT id, ${ec}, ${ivc}, ${tagc} FROM ${table}`).all()
  let empty = 0
  let fail = 0
  let ok = 0
  for (const r of rows) {
    if (!r[ec] || !r[ivc] || !r[tagc]) continue
    try {
      const d = crypto.createDecipheriv('aes-256-gcm', key, r[ivc])
      d.setAuthTag(r[tagc])
      const pt = Buffer.concat([d.update(r[ec]), d.final()]).toString('utf-8')
      if (pt === '') { empty++; console.log(`${table} id=${r.id}: 解密成功但明文为空（原本就没填）`) } else ok++
    } catch (e) { fail++; console.log(`${table} id=${r.id}: 解密失败 ${String(e.message)}`) }
  }
  console.log(`${table}: ok_non_empty=${ok} empty_plaintext=${empty} auth_fail=${fail}`)
}

audit('cloud_operators', 'login_password_enc', 'login_password_iv', 'login_password_tag')
audit('cloud_ecs', 'rdp_password_enc', 'rdp_password_iv', 'rdp_password_tag')
audit('cloud_vas', 'access_text_enc', 'access_text_iv', 'access_text_tag')
console.log('audit done')