mnemo_cards/mnemo_cards_backend/lib/user/telegram.dart

import 'dart:convert';
import 'dart:developer';
import 'package:crypto/crypto.dart' as crypto;
import 'package:http/http.dart' as http;

class TelegramUtils {
  static const _botToken = '7057032753:AAFP-BCpdry-YuBUOqx1W8dGxiFQdSOJlpI';

  /// Validates the data received from the Telegram web app
  /// Following the Python implementation exactly
  /// 
  /// [initData] should be URL-encoded (as received from Telegram Web App)
  /// [isAlreadyDecoded] if true, treats initData as already decoded
  bool checkValidateInitData(String hashStr, String initData, String token,
      {String cStr = "WebAppData", bool isAlreadyDecoded = false}) {
    try {
      // Decode URL-encoded string if needed
      final decodedData = isAlreadyDecoded ? initData : Uri.decodeComponent(initData);

      // Split into chunks and filter out hash parameter
      final chunks = decodedData
          .split('&')
          .where((chunk) => !chunk.startsWith('hash='))
          .map((chunk) => chunk.split('='))
          .toList();

      // Sort by first element (key)
      chunks.sort((a, b) => a[0].compareTo(b[0]));

      // Create data string with newline separator
      final dataString = chunks.map((rec) => '${rec[0]}=${rec[1]}').join('\n');

      // Create secret key: HMAC_SHA256(cStr, token)
      final secretKey = crypto.Hmac(crypto.sha256, utf8.encode(cStr))
          .convert(utf8.encode(token));

      // Create data check hash: HMAC_SHA256(secretKey, dataString)
      final dataCheck = crypto.Hmac(crypto.sha256, secretKey.bytes)
          .convert(utf8.encode(dataString));

      final calculatedHash = dataCheck.toString();
      final isValid = calculatedHash == hashStr;
      
      if (!isValid) {
        log('checkValidateInitData: hash mismatch. Expected: ${hashStr.substring(0, hashStr.length > 20 ? 20 : hashStr.length)}..., Got: ${calculatedHash.substring(0, calculatedHash.length > 20 ? 20 : calculatedHash.length)}...');
      }
      
      // Compare hex digests
      return isValid;
    } catch (e, s) {
      log('checkValidateInitData error: $e', error: e, stackTrace: s);
      return false;
    }
  }

  Future<({String id, String? username})?> getUserId(String initialData) async {
    try {
      log('getUserId: initialData length: ${initialData.length}');
      log('getUserId: initialData preview: ${initialData.length > 150 ? initialData.substring(0, 150) : initialData}');
      
      // Check if data is a toString() representation of TelegramInitData object
      // If it contains "raw: " pattern, extract the raw value
      // Pattern: raw: user=...&hash=...} (may have closing brace at the end)
      String? rawData;
      final rawMatch = RegExp(r'raw:\s*(.+)').firstMatch(initialData);
      if (rawMatch != null) {
        rawData = rawMatch.group(1)?.trim();
        // Remove trailing } if present (from the closing brace of the object)
        if (rawData != null && rawData.endsWith('}')) {
          rawData = rawData.substring(0, rawData.length - 1);
        }
        log('getUserId: extracted raw data from TelegramInitData toString(), length: ${rawData?.length ?? 0}');
      }
      
      // Use raw data if extracted, otherwise use initialData as-is
      final dataToProcess = rawData ?? initialData;
      
      // Try to determine if data is URL-encoded or already decoded
      // If it contains % characters, it's likely URL-encoded
      final isUrlEncoded = dataToProcess.contains('%');
      log('getUserId: data appears to be ${isUrlEncoded ? "URL-encoded" : "decoded"}');
      
      String dataToValidate;
      String hash;
      String decodedData;
      
      if (isUrlEncoded) {
        // Data is URL-encoded, extract hash from encoded string
        final hashMatchEncoded = RegExp(r'hash=([^&]+)').firstMatch(dataToProcess);
        if (hashMatchEncoded == null) {
          log('getUserId: hash not found in URL-encoded data');
          return null;
        }
        final hashEncoded = hashMatchEncoded.group(1)!;
        hash = Uri.decodeComponent(hashEncoded);
        dataToValidate = dataToProcess;
        decodedData = Uri.decodeComponent(dataToProcess);
        // Validate with URL-encoded data (default behavior)
        if (!checkValidateInitData(hash, dataToValidate, _botToken)) {
          log('getUserId: validation failed with URL-encoded data');
          return null;
        }
      } else {
        // Data appears to be already decoded, extract hash directly
        final hashMatch = RegExp(r'hash=([^&]+)').firstMatch(dataToProcess);
        if (hashMatch == null) {
          log('getUserId: hash not found in decoded data');
          return null;
        }
        hash = hashMatch.group(1)!;
        dataToValidate = dataToProcess;
        decodedData = dataToProcess;
        // Validate with already decoded data
        if (!checkValidateInitData(hash, dataToValidate, _botToken, isAlreadyDecoded: true)) {
          log('getUserId: validation failed with decoded data');
          return null;
        }
      }
      
      log('getUserId: hash extracted: ${hash.substring(0, hash.length > 20 ? 20 : hash.length)}...');
      log('getUserId: validation passed');

      // Extract user ID from user parameter (use decoded data)
      final userMatch = RegExp(r'user=([^&]+)').firstMatch(decodedData);
      if (userMatch == null) {
        log('getUserId: user parameter not found');
        return null;
      }

      // If data was already decoded, user value is also already decoded
      final userValue = userMatch.group(1)!;
      final userJson = isUrlEncoded ? Uri.decodeComponent(userValue) : userValue;
      final userData = jsonDecode(userJson) as Map<String, dynamic>;
      final userId = userData['id']?.toString();
      final username = userData['username']?.toString();
      if (userId == null) {
        log('getUserId: user ID is null in user data');
        return null;
      }
      log('getUserId: successfully extracted userId: $userId');
      return (id: userId, username: username);
    } catch (e, s) {
      log('getUserId error: $e', error: e, stackTrace: s);
      return null;
    }
  }

  /// Send message to admin via Telegram Bot API
  static Future<bool> sendMessageToAdmin(
      String telegramUserId, String message) async {
    try {
      final url =
          Uri.parse('https://api.telegram.org/bot$_botToken/sendMessage');

      final response = await http.post(
        url,
        headers: {'Content-Type': 'application/json'},
        body: jsonEncode({
          'chat_id': telegramUserId,
          'text': message,
          'parse_mode': 'HTML',
        }),
      );

      if (response.statusCode == 200) {
        final data = jsonDecode(response.body);
        return data['ok'] == true;
      }

      log('Failed to send Telegram message: ${response.statusCode} ${response.body}');
      return false;
    } catch (e) {
      log('Error sending Telegram message: $e');
      return false;
    }
  }
}