// Crypto.kt — Optional encryption for sensitive data
object Crypto {
    private const val ALGORITHM = "AES/GCM/NoPadding"
    private const val KEYSTORE_PROVIDER = "AndroidKeyStore"
    
    fun encrypt(plaintext: ByteArray): ByteArray {
        val keyStore = KeyStore.getInstance(KEYSTORE_PROVIDER)
        keyStore.load(null)
        
        // Generate key in Android Keystore
        val keyGenerator = KeyGenerator.getInstance(
            KeyProperties.KEY_ALGORITHM_AES, KEYSTORE_PROVIDER
        )
        keyGenerator.init(KeyGenParameterSpec.Builder(
            "akashboard_key",
            KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
        )
        .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
        .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
        .build())
        
        val secretKey = keyGenerator.generateKey()
        
        val cipher = Cipher.getInstance(ALGORITHM)
        cipher.init(Cipher.ENCRYPT_MODE, secretKey)
        
        val iv = cipher.iv
        val ciphertext = cipher.doFinal(plaintext)
        
        // Prepend IV to ciphertext
        return iv + ciphertext
    }
    
    fun decrypt(ciphertext: ByteArray): ByteArray {
        val keyStore = KeyStore.getInstance(KEYSTORE_PROVIDER)
        keyStore.load(null)
        
        val key = keyStore.getKey("akashboard_key", null) as SecretKey
        
        val iv = ciphertext.sliceArray(0..11)  // GCM IV is 12 bytes
        val data = ciphertext.sliceArray(12 until ciphertext.size)
        
        val cipher = Cipher.getInstance(ALGORITHM)
        cipher.init(Cipher.DECRYPT_MODE, key, GCMParameterSpec(128, iv))
        
        return cipher.doFinal(data)
    }
}

// All JNI inputs are validated
class PredictorBridge {
    companion object {
        init { System.loadLibrary("predictor") }
        
        external fun nativePredict(context: String, topK: Int): Array<String>
    }
    
    fun predict(context: String, topK: Int = 3): List<String> {
        // Validate inputs
        require(topK in 1..5) { "topK must be between 1 and 5" }
        require(context.length <= 500) { "Context too long" }
        
        // Sanitize
        val sanitizedContext = context.take(500)
        
        return try {
            nativePredict(sanitizedContext, topK).toList()
        } catch (e: Exception) {
            emptyList()  // Never crash on prediction errors
        }
    }
}

// ClipboardManager — Security measures
class ClipboardManager(private val context: Context) {
    
    // Auto-clear clipboard after timeout
    private val clipboardTimeout = 5 * 60 * 1000L  // 5 minutes
    
    private val clipboardClearRunnable = Runnable {
        clearSystemClipboard()
    }
    
    fun addItem(text: String, sourceApp: String?) {
        // Don't copy passwords
        if (isPasswordField(sourceApp)) {
            return
        }
        
        // Don't copy very long text (potential data exfil)
        if (text.length > 10000) {
            return
        }
        
        // Schedule clipboard clear
        handler.postDelayed(clipboardClearRunnable, clipboardTimeout)
    }
    
    private fun isPasswordField(packageName: String?): Boolean {
        // Check if current field is a password field
        // This is determined by EditorInfo.inputType
        return packageName?.contains("password") == true
    }
    
    private fun clearSystemClipboard() {
        val clipboard = context.getSystemService(Context.CLIPBOARD_SERVICE) as ClipboardManager
        clipboard.setPrimaryClip(ClipData.newPlainText("", ""))
    }
}

// ThemeParser — Validate theme JSON before applying
class ThemeParser {
    
    fun parse(json: String): Result<ThemeConfig> {
        return try {
            val config = Json.decodeFromString<ThemeConfig>(json)
            
            // Validate name
            require(config.name.isNotBlank() && config.name.length <= 50) {
                "Invalid theme name"
            }
            
            // Validate colors are valid hex/rgba
            validateColor(config.colors.background, "background")
            validateColor(config.colors.keyBackground, "keyBackground")
            // ... validate all colors
            
            // Validate dimensions
            require(config.dimensions.cornerRadius in 0f..24f) {
                "Invalid corner radius"
            }
            
            Result.success(config)
        } catch (e: Exception) {
            Result.failure(e)
        }
    }
    
    private fun validateColor(color: Long, fieldName: String) {
        // Color should be a valid ARGB value
        require(color != 0L) { "Invalid color for $fieldName" }
    }
}

// StorageBudget — Prevent storage overflow
class StorageBudget(private val context: Context) {
    
    companion object {
        const val MAX_TOTAL_BYTES = 2 * 1024 * 1024L  // 2MB
        const val WARNING_THRESHOLD = 1.5 * 1024 * 1024L  // 1.5MB
    }
    
    suspend fun checkBudget(): BudgetStatus {
        val totalSize = calculateTotalSize()
        
        return when {
            totalSize > MAX_TOTAL_BYTES -> BudgetStatus.OVER
            totalSize > WARNING_THRESHOLD -> BudgetStatus.WARNING
            else -> BudgetStatus.OK
        }
    }
    
    suspend fun enforceBudget() {
        when (checkBudget()) {
            BudgetStatus.OVER -> {
                // Aggressively prune oldest data
                prunePredictionModel(maxEntries = 5000)
                pruneClipboardHistory(maxItems = 20)
            }
            BudgetStatus.WARNING -> {
                // Gently prune
                prunePredictionModel(maxEntries = 8000)
            }
            BudgetStatus.OK -> { /* No action needed */ }
        }
    }
}

enum class BudgetStatus { OK, WARNING, OVER }