{{ $_hugo_config := `{ "version": 1 }` }}

<hugo-encrypt>
	{{ if .Get "pass" }}
		{{- $passphrase := $.Scratch.Set "passphrase" (.Get "pass") -}}
	{{ else if .Site.Params.HugoEncrypt.Password }}
		{{- $passphrase := $.Scratch.Set "passphrase" .Site.Params.HugoEncrypt.Password -}}
	{{ else }}
		{{- $passphrase -}}
	{{ end }}
	{{ if .Get "placeholder" }}
		{{- $placeholder := $.Scratch.Set "placeholder" (.Get "placeholder") -}}
	{{ else }}
		{{- $placeholder := $.Scratch.Set "placeholder" "Enter the password" -}}
	{{ end }}
	<div id="hugo-encrypt-encryption-notice" style="display:flex;justify-content:center;">
		<noscript><span id="hugo-encrypt-enable-js">Javascript needs to be enabled to decrypt content</span></noscript>

		<div class='hugo-encrypt-form col-8' style="display:flex;justify-content:center;">
			<input
				class="hugo-encrypt-input form-control rounded"
				id="hugo-encrypt-password"
				placeholder='{{ $.Scratch.Get "placeholder" }}'
			/>
			<input
				class="hugo-encrypt-button btn btn-primary rounded"
				type="button"
				value='Validate'
				id="button" onclick="hugoDecrypt(document.getElementById('hugo-encrypt-password').value,'input')"
			/>
			<div id="hugo-encrypt-input-response"></div>
		</div>
	</div>
	<cipher-text data-password='{{ $.Scratch.Get "passphrase" }}' style="display:none;">
		{{ .Inner }}
	</cipher-text>
	{{ if $.Page.Scratch.Get "decryptScript" }}
	{{ else }}
		{{- $decryptScript := $.Page.Scratch.Set "decryptScript" 1 -}}
	<style type="text/css">div#hugo-encrypt-sha1sum {display: none;}</style>
	<script>
		const storageKey = location.pathname + "password";
		const userStorage = {{ if .Site.Params.HugoEncrypt.Storage }} window['{{.Site.Params.HugoEncrypt.Storage}}Storage'] {{ else }} localStorage {{ end }};
		/**
		 * Encodes a utf8 string as a byte array.
		 * @param {String} str
		 * @returns {Uint8Array}
		 */
		function str2buf(str) {
			return new TextEncoder("utf-8").encode(str);
		}
		/**
		 * Decodes a byte array as a utf8 string.
		 * @param {Uint8Array} buffer
		 * @returns {String}
		 */
		function buf2str(buffer) {
			return new TextDecoder("utf-8").decode(buffer);
		}
		/**
		 * Decodes a string of hex to a byte array.
		 * @param {String} hexStr
		 * @returns {Uint8Array}
		 */
		function hex2buf(hexStr) {
			return new Uint8Array(hexStr.match(/.{2}/g).map(h => parseInt(h, 16)));
		}
		/**
		 * Given a passphrase, this generates a crypto key
		 * using `PBKDF2` with SHA256 and 1000 iterations.
		 * If no salt is given, a new one is generated.
		 * The return value is an array of `[key, salt]`.
		 * @param {String} passphrase
		 * @param {UInt8Array} salt [salt=random bytes]
		 * @returns {Promise<[CryptoKey,UInt8Array]>}
		 */
		function deriveKey(passphrase, salt) {
			salt = salt || crypto.getRandomValues(new Uint8Array(8));
			return crypto.subtle
				.importKey("raw", str2buf(passphrase), "PBKDF2", false, ["deriveKey"])
				.then(key =>
					crypto.subtle.deriveKey(
						{ name: "PBKDF2", salt, iterations: 1000, hash: "SHA-256" },
						key,
						{ name: "AES-GCM", length: 256 },
						false,
						["encrypt", "decrypt"],
					),
				)
				.then(key => [key, salt]);
		}
		/**
		 * Given a key and ciphertext (in the form of a string) as given by `encrypt`,
		 * this decrypts the ciphertext and returns the original plaintext
		 * @param {String} passphrase
		 * @param {String} saltIvCipherHex
		 * @returns {Promise<String>}
		 */
		function decrypt(passphrase, saltIvCipherHex) {
			const [salt, iv, data] = saltIvCipherHex.split("-").map(hex2buf);
			return deriveKey(passphrase, salt)
				.then(([key]) => crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, data))
				.then(v => buf2str(new Uint8Array(v)));
		}
		/**
		 * @name: digestMessage
		 * @description: hashing string
		 * @param {String} message
		 * @returns {Promise<String>}
		 */
		async function digestMessage(message) {
			const msgUint8 = new TextEncoder().encode(message);
			const hashBuffer = await crypto.subtle.digest('SHA-1', msgUint8);
			const hashArray = Array.from(new Uint8Array(hashBuffer));
			const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
			return hashHex;
		}
		/**
		 * @name: hugoDecrypt
		 * @description: judge the password ,and decrypt post
		 * @param {String} password
		 * @param {String} type
		 */
		const hugoDecrypt = function(password, type) {
			for (const cipher of ciphers) {
				decrypt(password, cipher.innerText).then(function(decrypted_text) {
					/**
					* calculate sha1 of decrypted text and check if it
					* matches the sha1 at the bottom of the decrypted text
					* to get the same hash that was added during encryption we
					* need to remove the last line
					*/
					digestMessage(decrypted_text.replace(/\r?\n?[^\r\n]*$/, "")).then(function(sha1_sum) {
						if ( decrypted_text.includes(sha1_sum) ) {
							document.getElementById("hugo-encrypt-encryption-notice").remove();
							cipher.outerHTML = decrypted_text;
							userStorage.setItem(storageKey, password);
							document.getElementById("hugo-encrypt-sha1sum").innerHTML = "Success: " + sha1_sum;
							console.log("Decryption successful. Storing password in {{.Site.Params.HugoEncrypt.Storage}}Storage.");
						}
					});
				}).catch(function(error) {
					if (type === "input") {
						document.getElementById("hugo-encrypt-input-response").innerHTML = "Wrong password";
					} else if (type === "storage") {
						userStorage.removeItem(location.pathname + "password");
						console.log("Password changed. Clearing userStorage.", error);
					}
				});
			}
		};
	</script>
	<script>
		window.onload = () => {
			ciphers = Array.from(document.querySelectorAll("cipher-text"));
			if (userStorage.getItem(storageKey)) {
				console.log("Found storageKey in userStorage. Attemtping decryption");
				hugoDecrypt(userStorage.getItem(storageKey), "storage");
			}
		};
	</script>
	{{ end }}
</hugo-encrypt>