#安全架构

{
  "app": {
    "withGlobalTauri": false,
    "security": {
      "csp": "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'; connect-src 'self' ws://127.0.0.1:* http://127.0.0.1:* ipc://localhost http://ipc.localhost; frame-ancestors 'none'; form-action 'none'; base-uri 'self'"
    }
  }
}

{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "default",
  "windows": ["main"],
  "permissions": [
    "opener:default",
    "autostart:allow-enable",
    "autostart:allow-disable",
    "autostart:allow-is-enabled",
    "core:window:allow-close",
    "core:window:allow-start-dragging",
    "core:window:allow-minimize",
    "core:window:allow-maximize",
    "core:window:allow-hide",
    "core:window:allow-show",
    "core:window:allow-set-focus",
    "core:window:allow-is-visible",
    "core:window:allow-is-maximized",
    "core:window:allow-set-title",
    "core:event:allow-listen",
    "core:event:allow-unlisten",
    "core:image:default",
    "core:menu:default",
    "core:tray:default",
    "core:resources:default",
    "core:app:default",
    "dialog:allow-message",
    "notification:default",
    "window-state:default"
  ]
}

async function openUrl(url) {
  const trimmed = typeof url === 'string' ? url.trim() : '';
  if (!/^https?:\/\//i.test(trimmed)) {
    throw new ApiError('openUrl only supports http and https URLs');
  }
  return invoke('plugin:opener|open_url', { url: trimmed });
}

pub fn validate_subscription_url_basic(url: &str) -> Result<(String, u16, bool), String> {
    let trimmed = url.trim();
    // WHATWG 解析器会静默丢弃 tab/LF/CR：`http://\t/sub` 会被解析成 host `sub`。
    // 合法订阅链接不含控制字符，直接拒绝。
    if trimmed.chars().any(|c| c.is_ascii_control()) {
        return Err("Invalid URL: must not contain control characters".to_owned());
    }
    // 特殊 scheme 的解析会忽略多余/缺失的斜杠（`http:/sub`、`HTTP:///sub`），
    // 会把畸形 URL 变成"被授权的单标签内网主机"。要求恰好 `//` + authority。
    let lower = trimmed.to_ascii_lowercase();
    if let Some(rest) = lower.strip_prefix("http:").or_else(|| lower.strip_prefix("https:")) {
        let mut chars = rest.chars();
        let slashes_ok = matches!((chars.next(), chars.next()), (Some('/'), Some('/')));
        if !slashes_ok || matches!(chars.next(), None | Some('/' | '\\')) {
            return Err("URL must have a host".to_owned());
        }
    }

    let parsed_url = url::Url::parse(trimmed).map_err(|e| format!("Invalid URL: {e}"))?;
    let scheme = parsed_url.scheme();
    if scheme != "http" && scheme != "https" {
        return Err("Only HTTP and HTTPS URLs are allowed".to_owned());
    }
    let host = parsed_url.host_str().ok_or("URL must have a host")?;
    // ...
    // 显式输入的单标签名（`nas`、`router`）与私有后缀名同等对待：仅直连
    let user_entered_private = is_private_host(host) || is_single_label_host(host);
    let default_port = if scheme == "https" { 443 } else { 80 };
    let port = parsed_url.port().unwrap_or(default_port);
    Ok((host.to_owned(), port, user_entered_private))
}

fn is_unsafe_destination_v6(ipv6: std::net::Ipv6Addr) -> bool {
    let bits = u128::from(ipv6);
    // 先判定直接属性：`::/96` 前缀包含 `::` 与 `::1`，若按嵌入地址判断会被当成 0.0.0.0 / 0.0.0.1
    if ipv6.is_loopback()
        || ipv6.is_unspecified()
        || ipv6.is_multicast()
        || (ipv6.segments()[0] & 0xfe00) == 0xfc00   // ULA
        || (ipv6.segments()[0] & 0xff00) == 0xfe00   // Link-local
        || v6_in_cidr(bits, 0x2001_0db8_0000_0000_0000_0000_0000_0000, 32)
    {
        return true;
    }
    // `::ffff:169.254.169.254` 与 `64:ff9b::a9fe:a9fe` 和 IPv4 地址是同一个目的地
    embedded_ipv4(bits).into_iter().flatten().any(is_unsafe_destination_v4)
}

pub fn is_private_host(host: &str) -> bool {
    // 去掉首尾空白与结尾的 '.'，小写化
    // ...
    if host_lower == "localhost"
        || host_lower.ends_with(".localhost")
        || host_lower.ends_with(".local")
        || host_lower.ends_with(".internal")
        || host_lower.ends_with(".intranet")
        || host_lower.ends_with(".private")
        || host_lower.ends_with(".lan")
        || host_lower == "home.arpa"
        || host_lower.ends_with(".home.arpa")
        || host_lower.ends_with(".home")
        || host_lower.ends_with(".corp")
    {
        return true;
    }
    // IP 字面量（含 [IPv6]）委托给 is_private_ip
    // ...
}

pub fn contains(&self, ip: IpAddr) -> bool {
    match ip {
        IpAddr::V4(ipv4) => { /* 任一 v4 段命中 */ }
        IpAddr::V6(ipv6) => {
            // v6 段命中，或 ::ffff:a.b.c.d 映射的 IPv4 命中 v4 段
        }
    }
}

pub fn build_http_client(config: HttpClientConfig) -> Result<reqwest::Client, String> {
    // 默认 .no_proxy()，防止系统/环境代理泄漏（只有显式传入 proxy_url 才走代理）
    let mut client_builder = reqwest::Client::builder()
        .timeout(Duration::from_secs(config.timeout_secs))
        .connect_timeout(Duration::from_secs(config.connect_timeout_secs))
        .redirect(safe_redirect_policy(
            config.allowed_private_host.clone(),
            config.fake_ip_ranges.clone(),
        ))
        .no_proxy();

    if config.proxy_url.is_none() {
        // 直连：注册连接期安全解析器
        client_builder = client_builder.dns_resolver(std::sync::Arc::new(SafeDnsResolver {
            allowed_private_host: config.allowed_private_host.clone(),
            fake_ip_ranges: config.fake_ip_ranges.clone(),
        }));
    } else {
        // 代理：禁用自动重定向，改为逐跳手动校验
        client_builder = client_builder.redirect(reqwest::redirect::Policy::none());
    }
    // ... proxy、resolve_pin、User-Agent
}

pub fn check_redirect_target(
    url: &url::Url,
    allowed_private_host: Option<&str>,
    fake_ip_ranges: &FakeIpRanges,
) -> Result<(), String> {
    let scheme = url.scheme();
    if scheme != "http" && scheme != "https" {
        return Err(format!("{SSRF_BLOCK_MARKER} Invalid redirect scheme: {scheme}"));
    }
    let host = match url.host_str() {
        Some(h) => h,
        None => return Err(format!("{SSRF_BLOCK_MARKER} Redirect URL has no host")),
    };
    // 仅允许回到同一个被授权的私网主机（忽略大小写、结尾 '.'、IPv6 方括号）
    let same_allowed = allowed_private_host
        .is_some_and(|a| normalize_host(a).eq_ignore_ascii_case(normalize_host(host)));

    if !same_allowed && (is_private_host(host) || is_single_label_host(host)) {
        return Err(format!("{SSRF_BLOCK_MARKER} Redirect to private host blocked: {host}"));
    }
    let clean_host = host.trim_matches(['[', ']'].as_slice());
    if let Ok(ip) = clean_host.parse::<std::net::IpAddr>() {
        if fake_ip_ranges.contains(ip) {
            return Err(format!("{SSRF_BLOCK_MARKER} Redirect to fake IP blocked: {host}"));
        }
        if !same_allowed && is_private_ip(ip) {
            return Err(format!("{SSRF_BLOCK_MARKER} Redirect to private IP blocked: {host}"));
        }
    }
    Ok(())
}

const fn is_proxy_destination_public(
    mihomo: super::subscription::MihomoDnsVerdict,
    local_verified_public: bool,
) -> bool {
    match mihomo {
        MihomoDnsVerdict::Public => true,
        MihomoDnsVerdict::FakeIpOnly => local_verified_public,
        MihomoDnsVerdict::Private | MihomoDnsVerdict::UnavailableOrFailed => false,
    }
}

┌────────┬──────────────┬──────────────┬──────────────┐
│ "v2:"  │ Nonce (12B)  │  Ciphertext  │ AuthTag(16B) │
│ 3 字节 │   12 字节     │   N 字节     │   16 字节     │
└────────┴──────────────┴──────────────┴──────────────┘
│◄──────────── Base64 编码 ──────────────────────────►│

pub(super) fn obfuscate_string(s: &str) -> Result<String, String> {
    use aes_gcm::{aead::{Aead as _, KeyInit as _}, Aes256Gcm, Nonce};

    let key_bytes = get_machine_key();
    if key_bytes.len() != 32 {
        return Err(format!("Invalid key length {}, expected 32", key_bytes.len()));
    }
    let cipher = Aes256Gcm::new_from_slice(&key_bytes)
        .map_err(|e| format!("Failed to initialize AES cipher: {e}"))?;

    let nonce_bytes: [u8; 12] = rand::rng().random();
    let nonce: Nonce<_> = nonce_bytes.into();

    let ciphertext = cipher
        .encrypt(&nonce, s.as_bytes())
        .map_err(|e| format!("AES encryption failed: {e}"))?;

    let mut result = b"v2:".to_vec();
    result.extend(&nonce_bytes);
    result.extend(ciphertext);
    Ok(base64_standard.encode(&result))
}

pub(super) fn deobfuscate_string(s: &str) -> Result<String, String> {
    let decoded = base64_standard
        .decode(s)
        .map_err(|e| format!("Invalid base64 encoding: {e}"))?;

    if !decoded.starts_with(b"v2:") {
        return Err("Unknown or missing encryption version prefix".to_owned());
    }
    if decoded.len() < 31 {
        return Err("Invalid v2 ciphertext: too short".to_owned());
    }
    let nonce_bytes = decoded.get(3..15).ok_or("Invalid ciphertext: missing nonce")?;
    let ciphertext = decoded.get(15..).ok_or("Invalid ciphertext: missing data")?;

    let key_bytes = get_machine_key();
    if key_bytes.len() != 32 {
        return Err(format!("Invalid key length {}, expected 32", key_bytes.len()));
    }
    let cipher = Aes256Gcm::new_from_slice(&key_bytes)
        .map_err(|e| format!("Failed to initialize AES cipher: {e}"))?;
    let nonce: Nonce<_> = nonce_bytes
        .try_into()
        .map_err(|e| format!("Invalid nonce length: {e}"))?;

    // 解密同时校验认证标签
    let plaintext = cipher
        .decrypt(&nonce, ciphertext)
        .map_err(|e| format!("AES decryption failed - data may be tampered: {e}"))?;

    // 严格 UTF-8 校验
    String::from_utf8(plaintext).map_err(|e| format!("Decrypted data is not valid UTF-8: {e}"))
}

static DERIVED_KEY: OnceLock<Vec<u8>> = OnceLock::new();

pub(super) fn get_machine_key() -> Vec<u8> {
    DERIVED_KEY.get_or_init(compute_machine_key).clone()
}

pub(super) fn save_metadata(paths: &AppPaths, meta: &ProfilesMetadata) -> Result<(), String> {
    let mut obf_meta = ProfilesMetadata::default();
    for (k, v) in &meta.configs {
        obf_meta.configs.insert(k.clone(), ConfigMetadata {
            url: v.url.as_ref().and_then(|s| obfuscate_string(s).ok()),           // 订阅 URL 加密
            sub_info: v.sub_info.as_ref().and_then(|s| obfuscate_string(s).ok()), // 流量信息加密
            last_updated: v.last_updated,                 // 明文
            auto_update_interval: v.auto_update_interval, // 明文
            user_agent: v.user_agent.clone(),             // 非敏感，明文
        });
    }
    // 序列化后通过 write_file_secure_atomic 持久替换；
    // 原子 rename 失败时先备份为 metadata.json.bak 再直接写入，备份失败则拒绝破坏性写入
    // ...
}

pub fn sanitize_base_filename(raw: String) -> Result<String, crate::error::AppError> {
    // Step 1: 完整 URL 解码
    let decoded = url_decode_complete(&raw);
    // 去除结尾空格和点，防止 Windows 规范化绕过（如 ".. " 或 ".. ."）
    let trimmed = decoded.trim_end_matches([' ', '.']);

    // Step 1.5: 提取文件名之前先检查目录分隔符
    if trimmed.contains('/') || trimmed.contains('\\') {
        return Err(ConfigError("Path traversal detected: directory separators are not allowed"));
    }
    // 单独的 ".." 是真正的父目录引用
    if trimmed == ".." {
        return Err(ConfigError("Path traversal detected: '..' is not allowed"));
    }
    if trimmed == "." || trimmed.is_empty() {
        return Err(ConfigError("'.' is not a valid filename"));
    }

    // Step 2: 提取纯文件名
    let filename = Path::new(trimmed).file_name().and_then(|f| f.to_str()).unwrap_or(trimmed).to_owned();

    // Step 3/4: 空字节与控制字符
    if filename.contains('\0') { return Err(/* null byte detected */); }
    if filename.chars().any(char::is_control) { return Err(/* control characters not allowed */); }

    // Step 5: 长度限制
    if filename.len() > 255 { return Err(/* maximum 255 characters */); }
    Ok(filename)
}

pub fn sanitize_config_file_name(config_path: String) -> Result<String, crate::error::AppError> {
    let config_file_name = sanitize_base_filename(config_path)?;
    // 扩展名白名单 .yaml / .yml（大小写不敏感）
    // Windows 保留名检测（所有平台一致执行）
    // ...
}

pub fn url_decode_complete(input: &str) -> String {
    if !input.contains('%') {
        return input.to_owned();
    }
    let mut current = input.as_bytes().to_vec();
    let mut decoded = Vec::with_capacity(current.len());

    for _ in 0..5 {
        let mut changed = false;
        decoded.clear();
        let mut i = 0;
        while let Some(&byte) = current.get(i) {
            if byte == b'%' {
                if let (Some(hi), Some(lo)) = (
                    current.get(i + 1).and_then(|&b| decode_hex_digit(b)),
                    current.get(i + 2).and_then(|&b| decode_hex_digit(b)),
                ) {
                    decoded.push((hi << 4) | lo);
                    i += 3;
                    changed = true;
                    continue;
                }
            }
            decoded.push(byte);
            i += 1;
        }
        std::mem::swap(&mut current, &mut decoded);
        if !changed || !current.contains(&b'%') {
            break;
        }
    }
    String::from_utf8(current)
        .unwrap_or_else(|e| String::from_utf8_lossy(e.as_bytes()).into_owned())
}

pub fn validate_path_within_dir(resolved_path: &Path, base_dir: &Path) -> Result<(), AppError> {
    if resolved_path.exists() {
        // 文件已存在：canonicalize 解析符号链接后比较
        let canonical_resolved = resolved_path.canonicalize()?;
        let canonical_base = base_dir.canonicalize()?;
        if !canonical_resolved.starts_with(&canonical_base) {
            return Err(ConfigError("Path traversal detected: resolved path is outside allowed directory"));
        }
    } else {
        // 文件不存在：分隔符归一后做字符串前缀检查
        let resolved_normalized = resolved_path.to_string_lossy().replace('\\', "/");
        let base_normalized = base_dir.to_string_lossy().replace('\\', "/");
        if !resolved_normalized.starts_with(&*base_normalized) {
            return Err(ConfigError("Path traversal detected: resolved path is outside allowed directory"));
        }
    }
    Ok(())
}

// ZIP：符号链接直接报错（不是跳过）
if file.is_symlink() {
    return Err("Refusing to extract symlink from ZIP".to_owned());
}
let name = file.name().map_err(|e| format!("Invalid ZIP entry name: {e}"))?;
if name.contains("..") || name.starts_with('/') || name.starts_with('\\') {
    return Err(format!("Malicious ZIP path detected: {name}"));
}

// TAR：符号链接与硬链接直接报错
let entry_type = entry_inner.header().entry_type();
if entry_type.is_symlink() || entry_type.is_hard_link() {
    return Err("Refusing to extract linked TAR entry".to_owned());
}
if path_str.contains("..") || path_str.starts_with('/') {
    return Err(format!("Malicious TAR path detected: {path_str}"));
}

// .gz 解压循环中的检查
total_decompressed += n as u64;
if total_decompressed > 200 * 1024 * 1024 {
    return Err("Decompressed gz too large".to_owned());
}
if total_decompressed > 64 * 1024
    && compressed_size > 0
    && total_decompressed > compressed_size.saturating_mul(200)
{
    return Err("Suspicious compression ratio detected (possible zip bomb)".to_owned());
}

pub const CONTROL_PLANE_KEYS: &[&str] = &[
    "external-controller-unix", // Unix socket 上的 REST API，Mihomo 不校验 secret
    "external-controller-pipe", // Windows 命名管道上的 REST API，不校验 secret
    "external-controller-tls",  // 可绑定任意地址的第二个（TLS）API 监听
    "external-controller-cors", // 放宽 API 的浏览器同源检查
    "external-doh-server",      // 控制器上不校验 secret 的 DoH 端点
    "external-ui",              // 从控制器源提供（并下载）任意 Web UI
    "external-ui-url",
    "external-ui-name",
];

const MAX_YAML_DEPTH: usize = 100;

fn remove_dangerous_keys_internal(value: &mut serde_yaml::Value, in_provider_context: bool, depth: usize) {
    if depth > MAX_YAML_DEPTH {
        *value = serde_yaml::Value::Null;
        return;
    }
    match value {
        serde_yaml::Value::Mapping(map) => {
            // 全局移除：脚本相关
            remove_keys_resolved(map, &["script", "script-path"]);
            // 全局移除：Clash-for-Windows 遗留键
            remove_keys_resolved(map, &[
                "cfw-bypass", "cfw-bypass-domain", "cfw-profiles-path",
                "cfw-conn-break-strategy", "prepend-proxy-groups", "append-proxy-groups",
            ]);

            // Provider 判定：type + (url | path)，键可以带显式标签，也可以经 `<<` 合并键继承
            let has_key = |name: &str| merged_mapping_has_key(map, name, depth);
            let is_provider = has_key("type") && (has_key("url") || has_key("path"));
            if in_provider_context || is_provider {
                remove_keys_resolved(map, &["path"]);
            }

            for (k, v) in map.iter_mut() {
                // `<<` 合并源在 Mihomo 解析后属于同一个映射，继承外层的 Provider 上下文
                let is_merge_source = resolved_key_str(k) == Some(YAML_MERGE_KEY);
                let child_ctx = if is_merge_source { in_provider_context || is_provider } else { is_provider };
                remove_dangerous_keys_internal(v, child_ctx, depth + 1);
            }
        }
        serde_yaml::Value::Sequence(seq) => {
            for item in seq.iter_mut() {
                remove_dangerous_keys_internal(item, in_provider_context, depth + 1);
            }
        }
        serde_yaml::Value::Tagged(tagged) => {
            // Mihomo 的解码器会透过标签读取内部节点，因此带标签的映射必须同样清理
            remove_dangerous_keys_internal(&mut tagged.value, in_provider_context, depth + 1);
        }
        _ => {}
    }
}

pub fn remove_dangerous_keys_internal_pub(value: &mut serde_yaml::Value, in_provider_context: bool) {
    remove_dangerous_keys_internal(value, in_provider_context, 0);
    remove_control_plane_keys(value);   // 作为配置文档根，同时清除控制面键
}

pub fn quote_short_id_values(content: &str) -> String {
    // 正则：(?:^|\n)(\s*short-id:\s*)([^\s"'\n][^\s\n]*)
    // 例如 short-id: 34010e92 → short-id: "34010e92"
    // ...
}

pub fn prepare_runtime_config(
    content: &str,
    secret: &str,
    prefs: Option<&GlobalPreferences>,
) -> Option<(String, u16, Option<ProxyEndpoint>)> {
    let mut yaml_val = serde_yaml::from_str::<serde_yaml::Value>(content).ok()?;
    if !yaml_val.is_mapping() {
        return None;
    }
    let config_port = parse_external_controller_port(&yaml_val);
    if let Some(mapping) = yaml_val.as_mapping_mut() {
        // 强制绑定到 127.0.0.1（防止外部访问 API）
        insert_yaml(mapping, "external-controller",
            serde_yaml::Value::String(format!("127.0.0.1:{config_port}")));
        // 注入随机 secret（防止未授权 API 访问）
        insert_yaml(mapping, "secret", serde_yaml::Value::String(secret.to_owned()));
        // ... 性能默认值与全局偏好（mode 仅接受 rule/global/direct）
    }
    // ...
}

pub fn restore_security_settings(yaml: &mut YamlValue, settings: &SecuritySettings) {
    remove_control_plane_keys(yaml);
    let YamlValue::Mapping(ref mut map) = yaml else { return; };

    // 先删除所有解析后同名的条目（包括 `!!str secret` 这类带标签写法），避免出现两份冲突设置
    remove_keys_resolved(map, &["external-controller"]);
    if settings.secret.is_some() {
        remove_keys_resolved(map, &["secret"]);
    }
    // external-controller 始终恢复为 127.0.0.1:<port>（端口非法时用 9090）
    // secret 恢复为原值，不允许被补丁移除
    // TUN 原本关闭时强制 tun.enable = false（只能通过 UI 开关切换）
    // ...
}

fn validate_custom_args(custom_args: &[String]) -> Result<Vec<String>, String> {
    let blocked_args = [
        "-d", "--directory",                 // 工作目录（路径遍历）
        "-f", "--config",                    // 配置文件路径（绕过安全检查）
        "-ext-ctl", "--external-controller", // API 监听地址（绑定 0.0.0.0）
        "-secret", "--secret",               // API 认证密钥（绕过认证）
    ];
    // 命中则返回 "Argument '...' is not allowed for security reasons"
    // ...
}

const TRUSTED_HOSTS: [&str; 3] = [
    "github.com",
    "api.github.com",
    "objects.githubusercontent.com",
];

fn is_trusted_update_url(url: &str) -> bool {
    if let Ok(parsed) = reqwest::Url::parse(url) {
        if let Some(host) = parsed.host_str() {
            return TRUSTED_HOSTS
                .iter()
                .any(|&h| host == h || host.ends_with(&format!(".{h}")));
        }
    }
    false
}

fn validate_version_format(version: &str) -> bool {
    if !version.starts_with('v') { return false; }
    if version.len() < 3 || version.len() > 25 { return false; }

    // 拒绝路径遍历与 shell/HTML 特殊字符
    if version.contains("..") || version.contains('/') || version.contains('\\')
        || version.contains('\0') || version.contains('<') || version.contains('>')
        || version.contains('|') || version.contains('&') || version.contains(';')
        || version.contains('$') || version.contains('`') || version.contains('\n')
        || version.contains('\r')
    {
        return false;
    }

    // vX.Y.Z，允许 `-` 之后的预发布后缀
    let version_part = &version[1..];
    let (main_version, _pre_release) = match version_part.find('-') {
        Some(idx) => (&version_part[..idx], Some(&version_part[idx + 1..])),
        None => (version_part, None),
    };
    let parts: Vec<&str> = main_version.split('.').collect();
    if parts.len() != 3 { return false; }
    parts.iter().all(|p| !p.is_empty() && p.chars().all(|c| c.is_ascii_digit()))
}

fn parse_github_release_info(url: &str) -> Option<(String, String)> {
    if let Ok(parsed) = reqwest::Url::parse(url) {
        if parsed.host_str() != Some("github.com") {
            return None; // 仅允许 github.com
        }
        let segments: Vec<&str> = parsed.path_segments()?.collect();
        if segments.len() >= 5
            && segments.first().is_some_and(|s| *s == "MetaCubeX")
            && segments.get(1).is_some_and(|s| *s == "mihomo")
            && segments.get(2).is_some_and(|s| *s == "releases")
            && segments.get(3).is_some_and(|s| *s == "download")
        {
            let version = segments.get(4).map(|s| (*s).to_owned()).unwrap_or_default();
            let asset_name = segments.get(5).map(|s| (*s).to_owned()).unwrap_or_default();
            if !validate_version_format(&version) { return None; }
            let asset_lower = asset_name.to_lowercase();
            if !asset_lower.starts_with("mihomo-") { return None; }
            if !asset_lower.ends_with(".zip") && !asset_lower.ends_with(".gz") { return None; }
            if asset_name.contains("..") || asset_name.contains('/') || asset_name.contains('\\')
                || asset_name.contains('\0') || asset_name.contains('<') || asset_name.contains('>')
            {
                return None;
            }
            return Some((version, asset_name));
        }
    }
    None
}

fn parse_digest(digest: &str) -> Option<String> {
    let hash = digest.strip_prefix("sha256:")?;
    (hash.len() == 64 && hash.chars().all(|c| c.is_ascii_hexdigit())).then(|| hash.to_lowercase())
}

async fn get_expected_sha256(app: Option<&tauri::AppHandle>, version: &str, asset_name: &str)
    -> Result<String, String>
{
    // 1. 缓存命中（同一版本、同一资产名）
    // 2. 否则查询 https://api.github.com/repos/MetaCubeX/mihomo/releases/tags/{version}
    //    取对应资产的 digest 字段
    // ...
    Err(format!(
        "Could not find SHA256 hash for {asset_name}. Verification is required for security."
    ))
}

fn verify_sha256(file_path: &std::path::Path, expected_hash: &str) -> Result<(), String> {
    let mut file = std::fs::File::open(file_path).map_err(|e| e.to_string())?;
    let mut hasher = Sha256::new();
    let mut buffer = [0u8; 8192];
    loop {   // 流式计算，支持大文件
        let n = file.read(&mut buffer).map_err(|e| e.to_string())?;
        if n == 0 { break; }
        hasher.update(buffer.get(..n).unwrap_or(&[]));
    }
    let hex_result = hex::encode(hasher.finalize());
    if hex_result.to_lowercase() == expected_hash.to_lowercase() {
        Ok(())
    } else {
        Err(format!("SHA256 mismatch: expected {expected_hash}, got {hex_result}"))
    }
}

// 1. Release 必须携带格式正确的 SHA256 digest，否则删除安装包并拒绝
let Some(hash) = info.download_digest.as_deref().and_then(|digest| {
    digest
        .strip_prefix("sha256:")
        .filter(|h| h.len() == 64 && h.chars().all(|c| c.is_ascii_hexdigit()))
}) else {
    let _ = std::fs::remove_file(&dest_path);
    return Err("No valid integrity digest available for this release. Installer was deleted for security.".to_owned());
};
verify_sha256(&dest_path, hash)?;

// 2. Minisign Ed25519 签名：下载 {download_url}.minisig（读取时即限制 4 KB）
const MAX_SIG_SIZE: usize = 4096;
let signature_content = sig_client.get_text_capped(&minisig_url, MAX_SIG_SIZE).await?;
crate::minisign_verify::verify_minisign_signature(&dest_path, &signature_content)?;

// 3. 全部通过后才用系统默认程序打开安装包
tauri_plugin_opener::open_path(&dest_path, None::<&str>)?;

// minisign_verify.rs
const ZEPHYR_PUBLIC_KEY: &str = "RWRkVQqGWolsGBbhZRpFQ3sPG/i4A2dGlf2E0NXJvZAviVd/I+sUzw1Z";

pub fn verify_minisign_signature(file_path: &Path, signature_content: &str) -> Result<(), String> {
    let public_key = minisign::PublicKey::from_base64(ZEPHYR_PUBLIC_KEY)?;
    let signature_box = minisign::SignatureBox::from_string(signature_content)?;
    let mut file = std::fs::File::open(file_path)?;
    minisign::verify(&public_key, &signature_box, &mut file, true, false, false)?;
    Ok(())
}

// 不可预测的临时文件名
let temp_suffix = uuid::Uuid::new_v4();
let archive_path = paths.core_dir.join(format!("core_update_{temp_suffix}.tmp"));
let temp_exe_path = paths.core_dir.join(format!("{}_{}.tmp", core_manager::core_binary_name(), temp_suffix));

pub struct RateLimiter {
    calls: Mutex<HashMap<String, Instant>>,
}

impl RateLimiter {
    pub fn check_rate_limit(&self, command: &str, min_interval_ms: u64) -> bool {
        let mut calls = self.calls.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
        let now = Instant::now();
        // 清理 60 秒前的过期条目，防止内存无限增长
        calls.retain(|_, last_call| now.duration_since(*last_call) < Duration::from_secs(60));
        if let Some(last_call) = calls.get(command) {
            if now.duration_since(*last_call) < Duration::from_millis(min_interval_ms) {
                return false; // 被限流
            }
        }
        calls.insert(command.to_owned(), now);
        true
    }
}

macro_rules! rate_limit {
    ($limiter:expr, $cmd:expr, $ms:expr) => {
        if !$limiter.check_rate_limit($cmd, $ms) {
            let msg = format!("{} rate limited (min {}ms interval), please wait", $cmd, $ms);
            emit_warn!(Core, CORE_START_FAILED, "RateLimit: {msg}");
            return Err(msg);
        }
    };
}

#[cfg(unix)]
{
    use std::os::unix::fs::PermissionsExt as _;
    fs::set_permissions(path, fs::Permissions::from_mode(0o600))
        .map_err(|e| format!("Failed to set permissions on {path:?}: {e}"))?;
}

#[cfg(target_os = "windows")]
{
    // 构建两条 ACL 规则
    let mut ea: [EXPLICIT_ACCESS_W; 2] = [std::mem::zeroed(), std::mem::zeroed()];

    // 规则 1：当前用户 → 完全访问 (GENERIC_ALL)
    ea[0].grfAccessPermissions = GENERIC_ALL;
    ea[0].grfAccessMode = GRANT_ACCESS;
    ea[0].grfInheritance = NO_INHERITANCE;
    ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
    ea[0].Trustee.TrusteeType = TRUSTEE_IS_USER;
    ea[0].Trustee.ptstrName = token_user.User.Sid as *mut _;

    // 规则 2：SYSTEM 账户 → 完全访问（CreateWellKnownSid(WinLocalSystemSid)）
    ea[1].grfAccessPermissions = GENERIC_ALL;
    ea[1].grfAccessMode = GRANT_ACCESS;
    ea[1].grfInheritance = NO_INHERITANCE;
    ea[1].Trustee.TrusteeForm = TRUSTEE_IS_SID;
    ea[1].Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
    ea[1].Trustee.ptstrName = system_sid as *mut _;

    // SetEntriesInAclW 生成新 ACL，SetSecurityInfo 应用；
    // PROTECTED_DACL_SECURITY_INFORMATION 阻止继承父目录的 ACE
    SetSecurityInfo(
        handle,
        SE_FILE_OBJECT,
        DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION,
        ptr::null_mut(), ptr::null_mut(),
        new_acl,
        ptr::null_mut(),
    );
}

// profiles 目录 — 0o700（core_process.rs）
#[cfg(unix)]
{
    use std::os::unix::fs::PermissionsExt as _;
    let _ = fs::set_permissions(&paths.profiles_dir, fs::Permissions::from_mode(0o700));
}

// api.js — Tauri IPC 桥接层
const _t = typeof window !== 'undefined' ? window.__TAURI_INTERNALS__ : undefined;

function invoke(cmd, args) {
  if (!_t?.invoke) throw new Error('[API] Tauri IPC not available');
  return _t.invoke(cmd, args);
}

async function listen(event, handler) {
  if (!_t?.transformCallback) throw new Error('[API] Tauri IPC not available');
  const callbackId = _t.transformCallback(handler);
  const eventId = await invoke('plugin:event|listen', {
    event,
    target: { kind: 'Window', label: 'main' },
    handler: callbackId,
  });
  // ... 返回 unlisten 清理函数
}

pub(super) fn generate_secret() -> String {
    rand::rng()
        .sample_iter(rand::distr::Alphanumeric)
        .take(32)
        .map(char::from)
        .collect()
}

pub fn strip_secret_from_yaml(yaml: &mut YamlValue) {
    if let YamlValue::Mapping(ref mut map) = yaml {
        map.remove(YamlValue::String("secret".to_owned()));
    }
}

const HTML_ESCAPE_TEST_RE = /[&<>"']/;
const HTML_ESCAPE_RE = /[&<>"']/g;
const HTML_ESCAPE_MAP = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' };

export function escapeHtml(str) {
    if (typeof str !== 'string') return '';
    if (!HTML_ESCAPE_TEST_RE.test(str)) return str;   // 快速路径：无特殊字符直接返回
    return str.replace(HTML_ESCAPE_RE, (ch) => HTML_ESCAPE_MAP[ch]);
}

export function escapeAttr(str) {
    return escapeHtml(str);   // 别名：escapeHtml 已转义引号
}