package services

import (
	"context"
	"fmt"

	ldaplib "github.com/go-ldap/ldap/v3"
	"github.com/shadow1ng/fscan/common"
)

type LDAPPlugin struct {
	name  string
	ports []int
}

func NewLDAPPlugin() *LDAPPlugin {
	return &LDAPPlugin{
		name:  "ldap",
		ports: []int{389, 636, 3268, 3269},
	}
}

func (p *LDAPPlugin) Name() string {
	return p.name
}

func (p *LDAPPlugin) GetPorts() []int {
	return p.ports
}

func (p *LDAPPlugin) Scan(ctx context.Context, info *common.HostInfo) *ScanResult {
	target := fmt.Sprintf("%s:%s", info.Host, info.Ports)

	if common.DisableBrute {
		return p.identifyService(ctx, info)
	}

	credentials := GenerateCredentials("ldap")
	if len(credentials) == 0 {
		return &ScanResult{
			Success: false,
			Service: "ldap",
			Error:   fmt.Errorf("没有可用的测试凭据"),
		}
	}

	for _, cred := range credentials {
		if p.testCredential(ctx, info, cred) {
			common.LogSuccess(fmt.Sprintf("LDAP %s %s:%s", target, cred.Username, cred.Password))
			return &ScanResult{
				Success:  true,
				Service:  "ldap",
				Username: cred.Username,
				Password: cred.Password,
			}
		}
	}

	return &ScanResult{
		Success: false,
		Service: "ldap",
		Error:   fmt.Errorf("未发现弱密码"),
	}
}


func (p *LDAPPlugin) testCredential(ctx context.Context, info *common.HostInfo, cred Credential) bool {
	conn, err := p.connectLDAP(ctx, info, cred)
	if err != nil {
		return false
	}
	defer conn.Close()

	// 简单的绑定测试
	if err := conn.Bind(cred.Username, cred.Password); err == nil {
		return true
	}
	return false
}

func (p *LDAPPlugin) connectLDAP(ctx context.Context, info *common.HostInfo, creds Credential) (*ldaplib.Conn, error) {
	target := fmt.Sprintf("%s:%s", info.Host, info.Ports)
	
	if info.Ports == "636" {
		return ldaplib.DialTLS("tcp", target, nil)
	}
	return ldaplib.Dial("tcp", target)
}






func (p *LDAPPlugin) identifyService(ctx context.Context, info *common.HostInfo) *ScanResult {
	target := fmt.Sprintf("%s:%s", info.Host, info.Ports)

	conn, err := p.connectLDAP(ctx, info, Credential{})
	if err != nil {
		return &ScanResult{
			Success: false,
			Service: "ldap",
			Error:   err,
		}
	}
	defer conn.Close()

	banner := "LDAP"
	common.LogSuccess(fmt.Sprintf("LDAP %s %s", target, banner))
	return &ScanResult{
		Success: true,
		Service: "ldap",
		Banner:  banner,
	}
}

func init() {
	// 使用高效注册方式：直接传递端口信息，避免实例创建
	RegisterPluginWithPorts("ldap", func() Plugin {
		return NewLDAPPlugin()
	}, []int{389, 636, 3268, 3269})
}