use crate::EcdsaCipher;

use ed25519_dalek::{Signer, SigningKey};

use lyquor_primitives::alloy_primitives::{self, U256, uint};

// The prime modulus: 2^255 - 19 ("p_0" in ed25519.sol)

pub const P: U256 = uint!(0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed_U256);

// Edwards 'd' coefficient: -121665 * inv(121666) mod P ("d_0" in ed25519.sol)

pub const D_0: U256 = uint!(0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3_U256);

// SCL Mapping Constant 'delta' = A_mont / 3 ("delta" in ed25519.sol)

pub const DELTA: U256 = uint!(0x2aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaad2451_U256);

// SCL Mapping Constant 'c' ("c" in ed25519.sol)

pub const C_VAL: U256 = uint!(0x70d9120b9f5ff9442d84f723fc03b0813a5e2c2eb482e57d3391fb5500ba81e7_U256);

// Target Curve Coefficient 'a' = 1 - A^2/3 ("a_0" in ed25519.sol)

pub const WEI_A: U256 = uint!(19298681539552699237261830834781317975544997444273427339909597334573241639236_U256);

// Target Curve Coefficient 'b' = (2A^3 - 9A)/27 ("b_0" in ed25519.sol)

pub const WEI_B: U256 = uint!(55751746669818908907645289078257140818241103727901012315294400837956729358436_U256);

pub const SET_ED25519_SECP256K1_BINDING_PREFIX: &[u8] = b"lyquor_set_ed25519_secp256k1_binding\0";

/// Convert from an ed25519 public key from the Rust library to SCL's format (see

/// src/eth/lib/ed25519.sol of lyquor-seq crate).

#[derive(Debug, Clone)]

pub struct SCLPubkey {

    pub qx: U256,

    pub qy: U256,

    pub compressed: U256,

}

impl SCLPubkey {

    /// Converts Ed25519 bytes -> SCL Weierstrass Inputs

    pub fn new(key: [u8; 32]) -> SCLPubkey {

        let (ed_x, ed_y) = recover_edwards_x(key);

        let (qx, qy) = map_to_weierstrass(ed_x, ed_y);

        let compressed = U256::from_be_bytes(key);

        SCLPubkey { qx, qy, compressed }

    }

    pub fn to_ed25519(&self) -> [U256; 5] {

        [

            self.qx,         // Index 0: Mapped Weirstrass X

            self.qy,         // Index 1: Mapped Weirstrass Y

            U256::ZERO,      // Index 2: Unused/Padding

            U256::ZERO,      // Index 3: Unused/Padding

            self.compressed, // Index 4: Original Ed25519 Compressed Y (for hash validation)

        ]

    }

}

/// Decompresses an Ed25519 public key (recovers `x` from `y`).

fn recover_edwards_x(mut y_bytes: [u8; 32]) -> (U256, U256) {

    let p = P;

    // Parse Y and Sign Bit (Little Endian)

    let sign_bit = (y_bytes[31] & 0x80) >> 7;

    y_bytes[31] &= 0x7F;

    let y = U256::from_le_bytes(y_bytes);

    // u = y^2 - 1

    let y_sq = y.mul_mod(y, p);

    let one = U256::from(1);

    let u = if y_sq >= one { y_sq - one } else { 
p + y_sq - one0
 };

    // v = d*y^2 + 1

    let d_times_y_sq = D_0.mul_mod(y_sq, p);

    let v = d_times_y_sq.add_mod(one, p);

    // x^2 = u * v^-1

    let v_inv = v.inv_mod(p).expect("Invalid Key: v is zero");

    let x_sq = u.mul_mod(v_inv, p);

    // sqrt(x^2) using p = 5 mod 8

    let three = U256::from(3);

    let eight = U256::from(8);

    let exp = p.wrapping_add(three).checked_div(eight).unwrap();

    let mut x = x_sq.pow_mod(exp, p);

    // Check root, multiply by sqrt(-1) if needed

    if x.mul_mod(x, p) != x_sq {

        let four = U256::from(4);

        let exp_i = p.wrapping_sub(one).checked_div(four).unwrap();

        let i = U256::from(2).pow_mod(exp_i, p);

        x = x.mul_mod(i, p);

    
}0

    // Adjust sign

    let is_odd = x.bit(0);

    let sign_is_set = sign_bit == 1;

    if is_odd != sign_is_set {

        x = p.wrapping_sub(x);

    
}0

    (x, y)

}

/// Maps an Ed25519 point $(x_{ed}, y_{ed})$ to a Short Weierstrass point $(X_w, Y_w)$.

fn map_to_weierstrass(ed_x: U256, ed_y: U256) -> (U256, U256) {

    let p = P;

    let one = U256::from(1);

    // (1 + y)

    let one_plus_y = one.add_mod(ed_y, p);

    // (1 - y)^-1

    let one_minus_y = if one >= ed_y {

        one - ed_y

    } else {

        p.wrapping_add(one).wrapping_sub(ed_y)

    };

    let one_minus_y_inv = one_minus_y.inv_mod(p).expect("Point at infinity?");

    // X_w = delta + (1 + y)/(1 - y)

    let term_x = one_plus_y.mul_mod(one_minus_y_inv, p);

    let x_w = DELTA.add_mod(term_x, p);

    // Y_w = C * (1 + y) / ((1 - y) * x)

    let num_y = C_VAL.mul_mod(one_plus_y, p);

    let den_base = one_minus_y.mul_mod(ed_x, p);

    let den_y = den_base.inv_mod(p).expect("Divide by zero in map");

    let y_w = num_y.mul_mod(den_y, p);

    (x_w, y_w)

}

pub fn set_ed25519_secp256k1_binding_message(

    addr: alloy_primitives::Address, pubkey: alloy_primitives::B256,

) -> Vec<u8> {

    let mut msg = Vec::new();

    msg.extend_from_slice(SET_ED25519_SECP256K1_BINDING_PREFIX);

    msg.extend_from_slice(addr.as_slice());

    msg.extend_from_slice(pubkey.as_ref());

    msg

}

pub fn set_ed25519_address_args(kp: &SigningKey) -> Vec<String> {

    let scl_pub = SCLPubkey::new(kp.verifying_key().to_bytes());

    let ecdsa_cipher = EcdsaCipher::new(kp);

    let addr = ecdsa_cipher.address();

    let pubkey_bytes = alloy_primitives::B256::from(scl_pub.compressed.to_be_bytes::<32>());

    let msg = set_ed25519_secp256k1_binding_message(addr, pubkey_bytes);

    let sig = kp.sign(&msg);

    let sig_bytes = sig.to_bytes();

    let ec_sig = crate::SignatureCipher::sign(&ecdsa_cipher, &msg).expect("ecdsa signature");

    let r = alloy_primitives::U256::from_be_bytes::<32>(sig_bytes[0..32].try_into().unwrap());

    let s = alloy_primitives::U256::from_be_bytes::<32>(sig_bytes[32..64].try_into().unwrap());

    let pubkey = alloy_primitives::B256::from(scl_pub.compressed.to_be_bytes::<32>());

    vec![

        addr.to_string(),

        format!("0x{:x}", pubkey),

        format!("0x{:x}", scl_pub.qx),

        format!("0x{:x}", scl_pub.qy),

        format!("0x{:x}", r),

        format!("0x{:x}", s),

        format!("0x{}", lyquor_primitives::hex::encode(ec_sig)),

    ]

}

#[cfg(test)]

mod tests {

    use super::*;

    use core::str::FromStr;

    use ed25519_dalek::Signature;

    use lyquor_primitives::alloy_primitives::hex;

    use lyquor_test::test;

    #[test]

    fn test_rfc8032_example() {

        // RFC 8032 Test 1: https://datatracker.ietf.org/doc/html/rfc8032#section-7.1

        let pubkey_hex = hex::decode("0xd75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a").unwrap();

        let mut bytes = [0u8; 32];

        bytes.copy_from_slice(&pubkey_hex);

        let result = SCLPubkey::new(bytes);

        // GOLDEN VALUES (tested in sequencer/src/eth/ed25519_test.sol)

        let qx = uint!(0x5961a13b250782afee75256fdba2e6bec4d810f89f6ce1c033585acd96b48329_U256);

        let qy = uint!(0x53373f33d468fee07fb2e53496849c8e52b3db37af7729999b2c3d372aca8de5_U256);

        assert_eq!(result.qx, qx, "X-coordinate mismatch");

        assert_eq!(result.qy, qy, "Y-coordinate mismatch");

    }

    #[test]

    fn test_set_ed25519_address_args() {

        let kp = SigningKey::from_bytes(&[7u8; 32]);

        let args = set_ed25519_address_args(&kp);

        let addr: alloy_primitives::Address = args[0].parse().unwrap();

        let pubkey_bytes = alloy_primitives::B256::from_str(&args[1]).unwrap();

        let r = alloy_primitives::U256::from_str(&args[4]).unwrap();

        let s = alloy_primitives::U256::from_str(&args[5]).unwrap();

        let ec_sig = hex::decode(args[6].trim_start_matches("0x")).unwrap();

        let msg = set_ed25519_secp256k1_binding_message(addr, pubkey_bytes);

        let mut sig_bytes = [0u8; 64];

        sig_bytes[..32].copy_from_slice(&r.to_be_bytes::<32>());

        sig_bytes[32..].copy_from_slice(&s.to_be_bytes::<32>());

        let ed_sig = Signature::from_slice(&sig_bytes).unwrap();

        kp.verifying_key().verify_strict(&msg, &ed_sig).unwrap();

        assert!(crate::SignatureCipher::verify(

            &EcdsaCipher::new(&kp),

            &msg,

            &ec_sig,

            addr.as_slice()

        ));

    }

}