secrets/crates/secrets-mcp/src/web.rs

use askama::Template;
use chrono::SecondsFormat;
use std::net::{IpAddr, SocketAddr};

use axum::{
    Json, Router,
    body::Body,
    extract::{ConnectInfo, Path, Query, State},
    http::{HeaderMap, StatusCode, header},
    response::{Html, IntoResponse, Redirect, Response},
    routing::{get, patch, post},
};
use serde::{Deserialize, Serialize};
use serde_json::json;
use tower_sessions::Session;
use uuid::Uuid;

use secrets_core::audit::log_login;
use secrets_core::crypto::hex;
use secrets_core::error::AppError;
use secrets_core::service::{
    api_key::{ensure_api_key, regenerate_api_key},
    audit_log::{count_for_user, list_for_user},
    delete::delete_by_id,
    search::{SearchParams, count_entries, fetch_secret_schemas, ilike_pattern, list_entries},
    update::{UpdateEntryFieldsByIdParams, update_fields_by_id},
    user::{
        OAuthProfile, bind_oauth_account, find_or_create_user, get_user_by_id,
        unbind_oauth_account, update_user_key_setup,
    },
};

use crate::AppState;
use crate::oauth::{OAuthConfig, OAuthUserInfo, google_auth_url, random_state};

const SESSION_USER_ID: &str = "user_id";
const SESSION_OAUTH_STATE: &str = "oauth_state";
const SESSION_OAUTH_BIND_MODE: &str = "oauth_bind_mode";
const SESSION_LOGIN_PROVIDER: &str = "login_provider";

// ── Template types ────────────────────────────────────────────────────────────

#[derive(Template)]
#[template(path = "login.html")]
struct LoginTemplate {
    has_google: bool,
    base_url: String,
    version: &'static str,
}

#[derive(Template)]
#[template(path = "home.html")]
struct HomeTemplate {
    is_logged_in: bool,
    base_url: String,
    version: &'static str,
}

#[derive(Template)]
#[template(path = "dashboard.html")]
struct DashboardTemplate {
    user_name: String,
    user_email: String,
    has_passphrase: bool,
    base_url: String,
    version: &'static str,
}

#[derive(Template)]
#[template(path = "audit.html")]
struct AuditPageTemplate {
    user_name: String,
    user_email: String,
    entries: Vec<AuditEntryView>,
    current_page: u32,
    total_pages: u32,
    total_count: i64,
    version: &'static str,
}

struct AuditEntryView {
    /// RFC3339 UTC for `<time datetime>`; rendered as browser-local in audit.html.
    created_at_iso: String,
    action: String,
    target: String,
    detail: String,
}

#[derive(Template)]
#[template(path = "entries.html")]
struct EntriesPageTemplate {
    user_name: String,
    user_email: String,
    entries: Vec<EntryListItemView>,
    folder_tabs: Vec<FolderTabView>,
    type_options: Vec<String>,
    secret_type_options_json: String,
    filter_folder: String,
    filter_name: String,
    filter_type: String,
    current_page: u32,
    total_pages: u32,
    total_count: i64,
    version: &'static str,
}

/// Non-sensitive entry fields; `secrets` lists field names/types only (no ciphertext).
struct EntryListItemView {
    id: String,
    folder: String,
    entry_type: String,
    name: String,
    notes: String,
    tags: String,
    /// Compact JSON for `data-entry-metadata` (dialog editor).
    metadata_json: String,
    /// Secret field summaries for table + dialog chips.
    secrets: Vec<SecretSummaryView>,
    /// JSON array of `{ id, name, secret_type }` for dialog secret chips.
    secrets_json: String,
    /// RFC3339 UTC; shown in edit dialog.
    updated_at_iso: String,
}

#[derive(Serialize)]
struct SecretSummaryView {
    id: String,
    name: String,
    secret_type: String,
}

struct FolderTabView {
    name: String,
    count: i64,
    href: String,
    active: bool,
}

/// Cap for HTML list (avoids loading unbounded rows into memory).
const ENTRIES_PAGE_LIMIT: u32 = 50;
const AUDIT_PAGE_LIMIT: i64 = 10;

#[derive(Deserialize)]
struct EntriesQuery {
    folder: Option<String>,
    name: Option<String>,
    /// URL query key is `type` (maps to DB column `entries.type`).
    #[serde(rename = "type")]
    entry_type: Option<String>,
    page: Option<u32>,
}

// ── App state helpers ─────────────────────────────────────────────────────────

fn google_cfg(state: &AppState) -> Option<&OAuthConfig> {
    state.google_config.as_ref()
}

async fn current_user_id(session: &Session) -> Option<Uuid> {
    match session.get::<String>(SESSION_USER_ID).await {
        Ok(opt) => match opt {
            Some(s) => match Uuid::parse_str(&s) {
                Ok(id) => Some(id),
                Err(e) => {
                    tracing::warn!(error = %e, user_id_str = %s, "invalid user_id UUID in session");
                    None
                }
            },
            None => None,
        },
        Err(e) => {
            tracing::warn!(error = %e, "failed to read user_id from session");
            None
        }
    }
}

fn request_client_ip(headers: &HeaderMap, connect_info: ConnectInfo<SocketAddr>) -> Option<String> {
    let trust_proxy = std::env::var("TRUST_PROXY")
        .as_deref()
        .is_ok_and(|v| matches!(v, "1" | "true" | "yes"));
    request_client_ip_with_trust_proxy(headers, connect_info, trust_proxy)
}

fn request_client_ip_with_trust_proxy(
    headers: &HeaderMap,
    connect_info: ConnectInfo<SocketAddr>,
    trust_proxy: bool,
) -> Option<String> {
    if trust_proxy {
        if let Some(first) = headers
            .get("x-forwarded-for")
            .and_then(|v| v.to_str().ok())
            .and_then(|s| s.split(',').next())
        {
            let value = first.trim();
            if let Ok(ip) = value.parse::<IpAddr>() {
                return Some(ip.to_string());
            }
        }
        if let Some(value) = headers.get("x-real-ip").and_then(|v| v.to_str().ok()) {
            let value = value.trim();
            if let Ok(ip) = value.parse::<IpAddr>() {
                return Some(ip.to_string());
            }
        }
    }

    Some(connect_info.ip().to_string())
}

fn request_user_agent(headers: &HeaderMap) -> Option<String> {
    headers
        .get(header::USER_AGENT)
        .and_then(|value| value.to_str().ok())
        .map(str::trim)
        .filter(|value| !value.is_empty())
        .map(ToOwned::to_owned)
}

fn paginate(page: u32, total_count: i64, page_size: u32) -> (u32, u32, u32) {
    let page_size = page_size.max(1);
    let safe_total_count = u32::try_from(total_count.max(0)).unwrap_or(u32::MAX);
    let total_pages = safe_total_count.div_ceil(page_size).max(1);
    let current_page = page.max(1).min(total_pages);
    let offset = (current_page - 1).saturating_mul(page_size);
    (current_page, total_pages, offset)
}

// ── Routes ────────────────────────────────────────────────────────────────────

pub fn web_router() -> Router<AppState> {
    Router::new()
        .route("/robots.txt", get(robots_txt))
        .route("/llms.txt", get(llms_txt))
        .route("/ai.txt", get(ai_txt))
        .route("/static/i18n.js", get(i18n_js))
        .route("/favicon.svg", get(favicon_svg))
        .route(
            "/favicon.ico",
            get(|| async { Redirect::permanent("/favicon.svg") }),
        )
        .route(
            "/.well-known/oauth-protected-resource",
            get(oauth_protected_resource_metadata),
        )
        .route("/", get(home_page))
        .route("/login", get(login_page))
        .route("/auth/google", get(auth_google))
        .route("/auth/google/callback", get(auth_google_callback))
        .route("/auth/logout", post(auth_logout))
        .route("/dashboard", get(dashboard))
        .route("/entries", get(entries_page))
        .route("/audit", get(audit_page))
        .route("/account/bind/google", get(account_bind_google))
        .route("/account/unbind/{provider}", post(account_unbind))
        .route("/api/key-salt", get(api_key_salt))
        .route("/api/key-setup", post(api_key_setup))
        .route("/api/apikey", get(api_apikey_get))
        .route("/api/apikey/regenerate", post(api_apikey_regenerate))
        .route(
            "/api/entries/{id}",
            patch(api_entry_patch).delete(api_entry_delete),
        )
        .route(
            "/api/entries/{entry_id}/secrets/{secret_id}",
            axum::routing::delete(api_entry_secret_unlink),
        )
        .route("/api/secrets/{secret_id}", patch(api_secret_patch))
        .route("/api/secrets/check-name", get(api_secret_check_name))
}

fn text_asset_response(content: &'static str, content_type: &'static str) -> Response {
    Response::builder()
        .status(StatusCode::OK)
        .header(header::CONTENT_TYPE, content_type)
        .header(header::CACHE_CONTROL, "public, max-age=86400")
        .body(Body::from(content))
        .expect("text asset response")
}

async fn robots_txt() -> Response {
    text_asset_response(
        include_str!("../static/robots.txt"),
        "text/plain; charset=utf-8",
    )
}

async fn llms_txt() -> Response {
    text_asset_response(
        include_str!("../static/llms.txt"),
        "text/markdown; charset=utf-8",
    )
}

async fn ai_txt() -> Response {
    llms_txt().await
}

async fn i18n_js() -> Response {
    text_asset_response(
        include_str!("../templates/i18n.js"),
        "application/javascript; charset=utf-8",
    )
}

async fn favicon_svg() -> Response {
    Response::builder()
        .status(StatusCode::OK)
        .header(header::CONTENT_TYPE, "image/svg+xml")
        .header(header::CACHE_CONTROL, "public, max-age=86400")
        .body(Body::from(include_str!("../static/favicon.svg")))
        .expect("favicon response")
}

// ── Home page (public) ───────────────────────────────────────────────────────

async fn home_page(
    State(state): State<AppState>,
    session: Session,
) -> Result<Response, StatusCode> {
    let is_logged_in = current_user_id(&session).await.is_some();
    let tmpl = HomeTemplate {
        is_logged_in,
        base_url: state.base_url.clone(),
        version: env!("CARGO_PKG_VERSION"),
    };
    render_template(tmpl)
}

// ── Login page ────────────────────────────────────────────────────────────────

async fn login_page(
    State(state): State<AppState>,
    session: Session,
) -> Result<Response, StatusCode> {
    if let Some(_uid) = current_user_id(&session).await {
        return Ok(Redirect::to("/dashboard").into_response());
    }

    let tmpl = LoginTemplate {
        has_google: state.google_config.is_some(),
        base_url: state.base_url.clone(),
        version: env!("CARGO_PKG_VERSION"),
    };
    render_template(tmpl)
}

// ── Google OAuth ──────────────────────────────────────────────────────────────

async fn auth_google(
    State(state): State<AppState>,
    session: Session,
) -> Result<Response, StatusCode> {
    let config = google_cfg(&state).ok_or(StatusCode::SERVICE_UNAVAILABLE)?;

    let oauth_state = random_state();
    session
        .insert(SESSION_OAUTH_STATE, &oauth_state)
        .await
        .map_err(|e| {
            tracing::error!(error = %e, "failed to insert oauth_state into session");
            StatusCode::INTERNAL_SERVER_ERROR
        })?;

    let url = google_auth_url(config, &oauth_state);
    Ok(Redirect::to(&url).into_response())
}

#[derive(Deserialize)]
struct OAuthCallbackQuery {
    code: Option<String>,
    state: Option<String>,
    error: Option<String>,
}

async fn auth_google_callback(
    State(state): State<AppState>,
    connect_info: ConnectInfo<SocketAddr>,
    headers: HeaderMap,
    session: Session,
    Query(params): Query<OAuthCallbackQuery>,
) -> Result<Response, StatusCode> {
    let client_ip = request_client_ip(&headers, connect_info);
    let user_agent = request_user_agent(&headers);
    handle_oauth_callback(
        &state,
        &session,
        params,
        "google",
        client_ip.as_deref(),
        user_agent.as_deref(),
        |s, cfg, code| {
            Box::pin(crate::oauth::google::exchange_code(
                &s.http_client,
                cfg,
                code,
            ))
        },
    )
    .await
}

// ── Shared OAuth callback handler ─────────────────────────────────────────────

async fn handle_oauth_callback<F>(
    state: &AppState,
    session: &Session,
    params: OAuthCallbackQuery,
    provider: &str,
    client_ip: Option<&str>,
    user_agent: Option<&str>,
    exchange_fn: F,
) -> Result<Response, StatusCode>
where
    F: for<'a> Fn(
        &'a AppState,
        &'a OAuthConfig,
        &'a str,
    ) -> std::pin::Pin<
        Box<dyn std::future::Future<Output = anyhow::Result<OAuthUserInfo>> + Send + 'a>,
    >,
{
    if let Some(err) = params.error {
        tracing::warn!(provider, error = %err, "OAuth error");
        return Ok(Redirect::to("/login?error=oauth_error").into_response());
    }

    let Some(code) = params.code else {
        tracing::warn!(provider, "OAuth callback missing code");
        return Ok(Redirect::to("/login?error=oauth_missing_code").into_response());
    };
    let Some(returned_state) = params.state.as_deref() else {
        tracing::warn!(provider, "OAuth callback missing state");
        return Ok(Redirect::to("/login?error=oauth_missing_state").into_response());
    };

    let expected_state: Option<String> = session.get(SESSION_OAUTH_STATE).await.map_err(|e| {
        tracing::error!(provider, error = %e, "failed to read oauth_state from session");
        StatusCode::INTERNAL_SERVER_ERROR
    })?;
    if expected_state.as_deref() != Some(returned_state) {
        tracing::warn!(
            provider,
            expected_present = expected_state.is_some(),
            "OAuth state mismatch (empty session often means SameSite=Strict or server restart)"
        );
        return Ok(Redirect::to("/login?error=oauth_state").into_response());
    }
    if let Err(e) = session.remove::<String>(SESSION_OAUTH_STATE).await {
        tracing::warn!(provider, error = %e, "failed to remove oauth_state from session");
    }

    let config = match provider {
        "google" => state
            .google_config
            .as_ref()
            .ok_or(StatusCode::SERVICE_UNAVAILABLE)?,
        _ => return Err(StatusCode::BAD_REQUEST),
    };

    let user_info = exchange_fn(state, config, code.as_str())
        .await
        .map_err(|e| {
            tracing::error!(provider, error = %e, "failed to exchange OAuth code");
            StatusCode::INTERNAL_SERVER_ERROR
        })?;

    let bind_mode: bool = match session.get::<bool>(SESSION_OAUTH_BIND_MODE).await {
        Ok(v) => v.unwrap_or(false),
        Err(e) => {
            tracing::error!(
                provider,
                error = %e,
                "failed to read oauth_bind_mode from session"
            );
            return Err(StatusCode::INTERNAL_SERVER_ERROR);
        }
    };

    if bind_mode {
        let user_id = current_user_id(session)
            .await
            .ok_or(StatusCode::UNAUTHORIZED)?;
        if let Err(e) = session.remove::<bool>(SESSION_OAUTH_BIND_MODE).await {
            tracing::warn!(provider, error = %e, "failed to remove oauth_bind_mode from session after bind");
        }

        let profile = OAuthProfile {
            provider: user_info.provider,
            provider_id: user_info.provider_id,
            email: user_info.email,
            name: user_info.name,
            avatar_url: user_info.avatar_url,
        };

        bind_oauth_account(&state.pool, user_id, profile)
            .await
            .map_err(|e| {
                tracing::error!(error = %e, "failed to bind OAuth account");
                StatusCode::INTERNAL_SERVER_ERROR
            })?;

        return Ok(Redirect::to("/dashboard?bound=1").into_response());
    }

    let profile = OAuthProfile {
        provider: user_info.provider,
        provider_id: user_info.provider_id,
        email: user_info.email,
        name: user_info.name,
        avatar_url: user_info.avatar_url,
    };

    let (user, _is_new) = find_or_create_user(&state.pool, profile)
        .await
        .map_err(|e| {
            tracing::error!(error = %e, "failed to find or create user");
            StatusCode::INTERNAL_SERVER_ERROR
        })?;

    session
        .insert(SESSION_USER_ID, user.id.to_string())
        .await
        .map_err(|e| {
            tracing::error!(
                error = %e,
                user_id = %user.id,
                "failed to insert user_id into session after OAuth"
            );
            StatusCode::INTERNAL_SERVER_ERROR
        })?;
    session
        .insert(SESSION_LOGIN_PROVIDER, &provider)
        .await
        .map_err(|e| {
            tracing::error!(
                provider,
                error = %e,
                "failed to insert login_provider into session after OAuth"
            );
            StatusCode::INTERNAL_SERVER_ERROR
        })?;

    log_login(
        &state.pool,
        "oauth",
        provider,
        user.id,
        client_ip,
        user_agent,
    )
    .await;

    Ok(Redirect::to("/dashboard").into_response())
}

// ── Logout ────────────────────────────────────────────────────────────────────

async fn auth_logout(session: Session) -> impl IntoResponse {
    if let Err(e) = session.flush().await {
        tracing::warn!(error = %e, "failed to flush session on logout");
    }
    Redirect::to("/")
}

// ── Dashboard ─────────────────────────────────────────────────────────────────

async fn dashboard(
    State(state): State<AppState>,
    session: Session,
) -> Result<Response, StatusCode> {
    let Some(user_id) = current_user_id(&session).await else {
        return Ok(Redirect::to("/login").into_response());
    };

    let user = match get_user_by_id(&state.pool, user_id).await.map_err(|e| {
        tracing::error!(error = %e, %user_id, "failed to load user for dashboard");
        StatusCode::INTERNAL_SERVER_ERROR
    })? {
        Some(u) => u,
        None => return Ok(Redirect::to("/login").into_response()),
    };

    let tmpl = DashboardTemplate {
        user_name: user.name.clone(),
        user_email: user.email.clone().unwrap_or_default(),
        has_passphrase: user.key_salt.is_some(),
        base_url: state.base_url.clone(),
        version: env!("CARGO_PKG_VERSION"),
    };

    render_template(tmpl)
}

async fn entries_page(
    State(state): State<AppState>,
    session: Session,
    Query(q): Query<EntriesQuery>,
) -> Result<Response, StatusCode> {
    let Some(user_id) = current_user_id(&session).await else {
        return Ok(Redirect::to("/login").into_response());
    };

    let user = match get_user_by_id(&state.pool, user_id).await.map_err(|e| {
        tracing::error!(error = %e, %user_id, "failed to load user for entries page");
        StatusCode::INTERNAL_SERVER_ERROR
    })? {
        Some(u) => u,
        None => return Ok(Redirect::to("/login").into_response()),
    };

    let folder_filter = q
        .folder
        .as_ref()
        .map(|s| s.trim())
        .filter(|s| !s.is_empty())
        .map(|s| s.to_string());
    let type_filter = q
        .entry_type
        .as_ref()
        .map(|s| s.trim())
        .filter(|s| !s.is_empty())
        .map(|s| s.to_string());
    let name_filter = q
        .name
        .as_ref()
        .map(|s| s.trim())
        .filter(|s| !s.is_empty())
        .map(|s| s.to_string());
    let page = q.page.unwrap_or(1).max(1);
    let count_params = SearchParams {
        folder: folder_filter.as_deref(),
        entry_type: type_filter.as_deref(),
        name: None,
        name_query: name_filter.as_deref(),
        tags: &[],
        query: None,
        sort: "updated",
        limit: ENTRIES_PAGE_LIMIT,
        offset: 0,
        user_id: Some(user_id),
    };

    let total_count = count_entries(&state.pool, &count_params)
        .await
        .inspect_err(|e| tracing::warn!(error = %e, "count_entries failed for web entries page"))
        .unwrap_or(0);
    let (current_page, total_pages, offset) = paginate(page, total_count, ENTRIES_PAGE_LIMIT);

    let list_params = SearchParams {
        offset,
        ..count_params
    };

    let rows = list_entries(&state.pool, list_params).await.map_err(|e| {
        tracing::error!(error = %e, "failed to load entries list for web");
        StatusCode::INTERNAL_SERVER_ERROR
    })?;
    let entry_ids: Vec<Uuid> = rows.iter().map(|e| e.id).collect();
    let secret_schemas = fetch_secret_schemas(&state.pool, &entry_ids)
        .await
        .map_err(|e| {
            tracing::error!(error = %e, "failed to load secret schema list for web");
            StatusCode::INTERNAL_SERVER_ERROR
        })?;

    #[derive(sqlx::FromRow)]
    struct FolderCountRow {
        folder: String,
        count: i64,
    }

    let mut folder_sql =
        "SELECT folder, COUNT(*)::bigint AS count FROM entries WHERE user_id = $1".to_string();
    let mut bind_idx = 2;
    if type_filter.is_some() {
        folder_sql.push_str(&format!(" AND type = ${bind_idx}"));
        bind_idx += 1;
    }
    if name_filter.is_some() {
        folder_sql.push_str(&format!(" AND name ILIKE ${bind_idx} ESCAPE '\\'"));
        bind_idx += 1;
    }
    let _ = bind_idx;
    folder_sql.push_str(" GROUP BY folder ORDER BY folder");

    let mut folder_query = sqlx::query_as::<_, FolderCountRow>(&folder_sql).bind(user_id);
    if let Some(t) = type_filter.as_deref() {
        folder_query = folder_query.bind(t);
    }
    if let Some(n) = name_filter.as_deref() {
        folder_query = folder_query.bind(ilike_pattern(n));
    }
    let folder_rows: Vec<FolderCountRow> =
        folder_query.fetch_all(&state.pool).await.map_err(|e| {
            tracing::error!(error = %e, "failed to load folder tabs for web");
            StatusCode::INTERNAL_SERVER_ERROR
        })?;

    #[derive(sqlx::FromRow)]
    struct TypeOptionRow {
        #[sqlx(rename = "type")]
        entry_type: String,
    }
    let mut type_options: Vec<String> = sqlx::query_as::<_, TypeOptionRow>(
        "SELECT DISTINCT type FROM entries WHERE user_id = $1 ORDER BY type",
    )
    .bind(user_id)
    .fetch_all(&state.pool)
    .await
    .map_err(|e| {
        tracing::error!(error = %e, "failed to load type options for web");
        StatusCode::INTERNAL_SERVER_ERROR
    })?
    .into_iter()
    .map(|r| r.entry_type)
    .filter(|t| !t.is_empty())
    .collect();
    if let Some(current) = type_filter.as_ref()
        && !current.is_empty()
        && !type_options.iter().any(|t| t == current)
    {
        type_options.push(current.clone());
        type_options.sort_unstable();
    }

    fn entries_href(
        folder: Option<&str>,
        entry_type: Option<&str>,
        name: Option<&str>,
        page: Option<u32>,
    ) -> String {
        let mut pairs: Vec<String> = Vec::new();
        if let Some(f) = folder
            && !f.is_empty()
        {
            pairs.push(format!("folder={}", urlencoding::encode(f)));
        }
        if let Some(t) = entry_type
            && !t.is_empty()
        {
            pairs.push(format!("type={}", urlencoding::encode(t)));
        }
        if let Some(n) = name
            && !n.is_empty()
        {
            pairs.push(format!("name={}", urlencoding::encode(n)));
        }
        if let Some(p) = page {
            pairs.push(format!("page={}", p));
        }
        if pairs.is_empty() {
            "/entries".to_string()
        } else {
            format!("/entries?{}", pairs.join("&"))
        }
    }

    let all_count: i64 = folder_rows.iter().map(|r| r.count).sum();
    let mut folder_tabs: Vec<FolderTabView> = Vec::with_capacity(folder_rows.len() + 1);
    folder_tabs.push(FolderTabView {
        name: "全部".to_string(),
        count: all_count,
        href: entries_href(
            None,
            type_filter.as_deref(),
            name_filter.as_deref(),
            Some(1),
        ),
        active: folder_filter.is_none(),
    });
    for r in folder_rows {
        let name = r.folder;
        folder_tabs.push(FolderTabView {
            href: entries_href(
                Some(&name),
                type_filter.as_deref(),
                name_filter.as_deref(),
                Some(1),
            ),
            active: folder_filter.as_deref() == Some(name.as_str()),
            name,
            count: r.count,
        });
    }

    let entries = rows
        .into_iter()
        .map(|e| {
            let secrets: Vec<SecretSummaryView> = secret_schemas
                .get(&e.id)
                .map(|fields| {
                    fields
                        .iter()
                        .map(|f| SecretSummaryView {
                            id: f.id.to_string(),
                            name: f.name.clone(),
                            secret_type: f.secret_type.clone(),
                        })
                        .collect()
                })
                .unwrap_or_default();
            let secrets_json = serde_json::to_string(&secrets).unwrap_or_else(|_| "[]".to_string());
            let metadata_json =
                serde_json::to_string(&e.metadata).unwrap_or_else(|_| "{}".to_string());
            EntryListItemView {
                id: e.id.to_string(),
                folder: e.folder,
                entry_type: e.entry_type,
                name: e.name,
                notes: e.notes,
                tags: e.tags.join(", "),
                metadata_json,
                secrets,
                secrets_json,
                updated_at_iso: e.updated_at.to_rfc3339_opts(SecondsFormat::Secs, true),
            }
        })
        .collect();

    let tmpl = EntriesPageTemplate {
        user_name: user.name.clone(),
        user_email: user.email.clone().unwrap_or_default(),
        entries,
        folder_tabs,
        type_options,
        secret_type_options_json: serde_json::to_string(
            &secrets_core::taxonomy::SECRET_TYPE_OPTIONS
                .iter()
                .map(|s| s.to_string())
                .collect::<Vec<_>>(),
        )
        .unwrap_or_default(),
        filter_folder: folder_filter.unwrap_or_default(),
        filter_name: name_filter.unwrap_or_default(),
        filter_type: type_filter.unwrap_or_default(),
        current_page,
        total_pages,
        total_count,
        version: env!("CARGO_PKG_VERSION"),
    };

    render_template(tmpl)
}

#[derive(Deserialize)]
struct AuditQuery {
    page: Option<u32>,
}

async fn audit_page(
    State(state): State<AppState>,
    session: Session,
    Query(aq): Query<AuditQuery>,
) -> Result<Response, StatusCode> {
    let Some(user_id) = current_user_id(&session).await else {
        return Ok(Redirect::to("/login").into_response());
    };

    let user = match get_user_by_id(&state.pool, user_id).await.map_err(|e| {
        tracing::error!(error = %e, %user_id, "failed to load user for audit page");
        StatusCode::INTERNAL_SERVER_ERROR
    })? {
        Some(u) => u,
        None => return Ok(Redirect::to("/login").into_response()),
    };

    let page = aq.page.unwrap_or(1).max(1);

    let total_count = count_for_user(&state.pool, user_id).await.map_err(|e| {
        tracing::error!(error = %e, "failed to count audit log for user");
        StatusCode::INTERNAL_SERVER_ERROR
    })?;

    let (current_page, total_pages, offset) = paginate(page, total_count, AUDIT_PAGE_LIMIT as u32);
    let actual_offset = i64::from(offset);

    let rows = list_for_user(&state.pool, user_id, AUDIT_PAGE_LIMIT, actual_offset)
        .await
        .map_err(|e| {
            tracing::error!(error = %e, "failed to load audit log for user");
            StatusCode::INTERNAL_SERVER_ERROR
        })?;

    let entries = rows
        .into_iter()
        .map(|row| AuditEntryView {
            created_at_iso: row.created_at.to_rfc3339_opts(SecondsFormat::Secs, true),
            action: row.action,
            target: format_audit_target(&row.folder, &row.entry_type, &row.name),
            detail: serde_json::to_string_pretty(&row.detail).unwrap_or_else(|_| "{}".to_string()),
        })
        .collect();

    let tmpl = AuditPageTemplate {
        user_name: user.name.clone(),
        user_email: user.email.clone().unwrap_or_default(),
        entries,
        current_page,
        total_pages,
        total_count,
        version: env!("CARGO_PKG_VERSION"),
    };

    render_template(tmpl)
}

// ── Account bind/unbind ───────────────────────────────────────────────────────

async fn account_bind_google(
    State(state): State<AppState>,
    session: Session,
) -> Result<Response, StatusCode> {
    let _ = current_user_id(&session)
        .await
        .ok_or(StatusCode::UNAUTHORIZED)?;

    session
        .insert(SESSION_OAUTH_BIND_MODE, true)
        .await
        .map_err(|e| {
            tracing::error!(error = %e, "failed to insert oauth_bind_mode into session");
            StatusCode::INTERNAL_SERVER_ERROR
        })?;

    let config = google_cfg(&state).ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
    let oauth_state = random_state();
    if let Err(e) = session.insert(SESSION_OAUTH_STATE, &oauth_state).await {
        tracing::error!(error = %e, "failed to insert oauth_state for account bind flow");
        if let Err(rm) = session.remove::<bool>(SESSION_OAUTH_BIND_MODE).await {
            tracing::warn!(error = %rm, "failed to roll back oauth_bind_mode after oauth_state insert failure");
        }
        return Err(StatusCode::INTERNAL_SERVER_ERROR);
    }

    let url = google_auth_url(config, &oauth_state);
    Ok(Redirect::to(&url).into_response())
}

async fn account_unbind(
    State(state): State<AppState>,
    Path(provider): Path<String>,
    session: Session,
) -> Result<Response, StatusCode> {
    let user_id = current_user_id(&session)
        .await
        .ok_or(StatusCode::UNAUTHORIZED)?;

    let current_login_provider = session
        .get::<String>(SESSION_LOGIN_PROVIDER)
        .await
        .map_err(|e| {
            tracing::error!(error = %e, "failed to read login_provider from session");
            StatusCode::INTERNAL_SERVER_ERROR
        })?;

    unbind_oauth_account(
        &state.pool,
        user_id,
        &provider,
        current_login_provider.as_deref(),
    )
    .await
    .map_err(|e| {
        tracing::warn!(error = %e, "failed to unbind oauth account");
        StatusCode::BAD_REQUEST
    })?;

    Ok(Redirect::to("/dashboard?unbound=1").into_response())
}

// ── Passphrase / Key setup API ────────────────────────────────────────────────

#[derive(Serialize)]
struct KeySaltResponse {
    has_passphrase: bool,
    #[serde(skip_serializing_if = "Option::is_none")]
    salt: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    key_check: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    params: Option<serde_json::Value>,
}

async fn api_key_salt(
    State(state): State<AppState>,
    session: Session,
) -> Result<Json<KeySaltResponse>, StatusCode> {
    let user_id = current_user_id(&session)
        .await
        .ok_or(StatusCode::UNAUTHORIZED)?;

    let user = get_user_by_id(&state.pool, user_id)
        .await
        .map_err(|e| {
            tracing::error!(error = %e, %user_id, "failed to load user for key-salt API");
            StatusCode::INTERNAL_SERVER_ERROR
        })?
        .ok_or(StatusCode::UNAUTHORIZED)?;

    if user.key_salt.is_none() {
        return Ok(Json(KeySaltResponse {
            has_passphrase: false,
            salt: None,
            key_check: None,
            params: None,
        }));
    }

    Ok(Json(KeySaltResponse {
        has_passphrase: true,
        salt: user.key_salt.as_deref().map(hex::encode_hex),
        key_check: user.key_check.as_deref().map(hex::encode_hex),
        params: user.key_params,
    }))
}

#[derive(Deserialize)]
struct KeySetupRequest {
    /// Hex-encoded 32-byte random salt
    salt: String,
    /// Hex-encoded AES-256-GCM encryption of "secrets-mcp-key-check" with the derived key
    key_check: String,
    /// Key derivation parameters, e.g. {"alg":"pbkdf2-sha256","iterations":600000}
    params: serde_json::Value,
}

#[derive(Serialize)]
struct KeySetupResponse {
    ok: bool,
}

async fn api_key_setup(
    State(state): State<AppState>,
    session: Session,
    Json(body): Json<KeySetupRequest>,
) -> Result<Json<KeySetupResponse>, StatusCode> {
    let user_id = current_user_id(&session)
        .await
        .ok_or(StatusCode::UNAUTHORIZED)?;

    let salt = hex::decode_hex(&body.salt).map_err(|e| {
        tracing::warn!(error = %e, "invalid hex in key-setup salt");
        StatusCode::BAD_REQUEST
    })?;
    let key_check = hex::decode_hex(&body.key_check).map_err(|e| {
        tracing::warn!(error = %e, "invalid hex in key-setup key_check");
        StatusCode::BAD_REQUEST
    })?;

    if salt.len() != 32 {
        tracing::warn!(salt_len = salt.len(), "key-setup salt must be 32 bytes");
        return Err(StatusCode::BAD_REQUEST);
    }

    update_user_key_setup(&state.pool, user_id, &salt, &key_check, &body.params)
        .await
        .map_err(|e| {
            tracing::error!(error = %e, "failed to update key setup");
            StatusCode::INTERNAL_SERVER_ERROR
        })?;

    Ok(Json(KeySetupResponse { ok: true }))
}

// ── API Key management ────────────────────────────────────────────────────────

#[derive(Serialize)]
struct ApiKeyResponse {
    api_key: String,
}

async fn api_apikey_get(
    State(state): State<AppState>,
    session: Session,
) -> Result<Json<ApiKeyResponse>, StatusCode> {
    let user_id = current_user_id(&session)
        .await
        .ok_or(StatusCode::UNAUTHORIZED)?;

    let api_key = ensure_api_key(&state.pool, user_id).await.map_err(|e| {
        tracing::error!(error = %e, %user_id, "ensure_api_key failed");
        StatusCode::INTERNAL_SERVER_ERROR
    })?;

    Ok(Json(ApiKeyResponse { api_key }))
}

async fn api_apikey_regenerate(
    State(state): State<AppState>,
    session: Session,
) -> Result<Json<ApiKeyResponse>, StatusCode> {
    let user_id = current_user_id(&session)
        .await
        .ok_or(StatusCode::UNAUTHORIZED)?;

    let api_key = regenerate_api_key(&state.pool, user_id)
        .await
        .map_err(|e| {
            tracing::error!(error = %e, %user_id, "regenerate_api_key failed");
            StatusCode::INTERNAL_SERVER_ERROR
        })?;

    Ok(Json(ApiKeyResponse { api_key }))
}

// ── Entry management (Web UI, non-sensitive fields only) ───────────────────────

#[derive(Deserialize)]
struct EntryPatchBody {
    folder: String,
    #[serde(rename = "type")]
    entry_type: String,
    name: String,
    notes: String,
    tags: Vec<String>,
    metadata: serde_json::Value,
}

type EntryApiError = (StatusCode, Json<serde_json::Value>);

#[derive(Clone, Copy)]
enum UiLang {
    ZhCn,
    ZhTw,
    En,
}

fn request_ui_lang(headers: &HeaderMap) -> UiLang {
    let Some(raw) = headers
        .get(header::ACCEPT_LANGUAGE)
        .and_then(|v| v.to_str().ok())
    else {
        return UiLang::ZhCn;
    };
    let lower = raw.to_ascii_lowercase();
    if lower.contains("zh-tw") || lower.contains("zh-hk") || lower.contains("zh-hant") {
        UiLang::ZhTw
    } else if lower.contains("zh") {
        UiLang::ZhCn
    } else if lower.contains("en") {
        UiLang::En
    } else {
        UiLang::ZhCn
    }
}

fn tr(lang: UiLang, zh_cn: &'static str, zh_tw: &'static str, en: &'static str) -> &'static str {
    match lang {
        UiLang::ZhCn => zh_cn,
        UiLang::ZhTw => zh_tw,
        UiLang::En => en,
    }
}

fn map_entry_mutation_err(e: anyhow::Error, lang: UiLang) -> EntryApiError {
    if let Some(app_err) = e.downcast_ref::<AppError>() {
        return map_app_error(app_err, lang);
    }

    // Fallback for legacy string-based errors and raw sqlx errors
    let msg = e.to_string();
    if msg.contains("already exists") {
        return (
            StatusCode::CONFLICT,
            Json(
                json!({ "error": tr(lang, "该账号下已存在相同 folder + name 的条目", "此帳號下已存在相同 folder + name 的條目", "An entry with the same folder + name already exists for this account") }),
            ),
        );
    }
    if msg.contains("must be at most") {
        return (StatusCode::BAD_REQUEST, Json(json!({ "error": msg })));
    }
    tracing::error!(error = %e, "entry mutation failed");
    (
        StatusCode::INTERNAL_SERVER_ERROR,
        Json(
            json!({ "error": tr(lang, "操作失败，请稍后重试", "操作失敗，請稍後重試", "Operation failed, please try again later") }),
        ),
    )
}

fn map_app_error(err: &AppError, lang: UiLang) -> EntryApiError {
    match err {
        AppError::ConflictEntryName { .. } | AppError::ConflictSecretName { .. } => (
            StatusCode::CONFLICT,
            Json(json!({ "error": err.to_string() })),
        ),
        AppError::NotFoundEntry | AppError::NotFoundUser | AppError::NotFoundSecret => (
            StatusCode::NOT_FOUND,
            Json(
                json!({ "error": tr(lang, "资源不存在或无权访问", "資源不存在或無權存取", "Resource not found or no access") }),
            ),
        ),
        AppError::AuthenticationFailed | AppError::Unauthorized => (
            StatusCode::UNAUTHORIZED,
            Json(
                json!({ "error": tr(lang, "认证失败或无权访问", "認證失敗或無權存取", "Authentication failed or unauthorized") }),
            ),
        ),
        AppError::Validation { message } => {
            (StatusCode::BAD_REQUEST, Json(json!({ "error": message })))
        }
        AppError::ConcurrentModification => (
            StatusCode::CONFLICT,
            Json(
                json!({ "error": tr(lang, "条目已被修改，请刷新后重试", "條目已被修改，請重新整理後重試", "Entry was modified, please refresh and try again") }),
            ),
        ),
        AppError::DecryptionFailed => (
            StatusCode::BAD_REQUEST,
            Json(
                json!({ "error": tr(lang, "解密失败，请检查密码短语", "解密失敗，請檢查密碼短語", "Decryption failed — please check your passphrase") }),
            ),
        ),
        AppError::EncryptionKeyNotSet => (
            StatusCode::BAD_REQUEST,
            Json(
                json!({ "error": tr(lang, "请先设置密码短语后再使用此功能", "請先設定密碼短語再使用此功能", "Please set a passphrase before using this feature") }),
            ),
        ),
        AppError::Internal(_) => {
            tracing::error!(error = %err, "internal error in entry mutation");
            (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(
                    json!({ "error": tr(lang, "操作失败，请稍后重试", "操作失敗，請稍後重試", "Operation failed, please try again later") }),
                ),
            )
        }
    }
}

async fn api_entry_patch(
    State(state): State<AppState>,
    session: Session,
    headers: HeaderMap,
    Path(entry_id): Path<Uuid>,
    Json(body): Json<EntryPatchBody>,
) -> Result<Json<serde_json::Value>, EntryApiError> {
    let lang = request_ui_lang(&headers);
    let user_id = current_user_id(&session).await.ok_or((
        StatusCode::UNAUTHORIZED,
        Json(json!({ "error": tr(lang, "未登录", "尚未登入", "Not logged in") })),
    ))?;

    let folder = body.folder.trim();
    let entry_type = body.entry_type.trim();
    let name = body.name.trim();
    let notes = body.notes.trim();

    if name.is_empty() {
        return Err((
            StatusCode::BAD_REQUEST,
            Json(
                json!({ "error": tr(lang, "name 不能为空", "name 不能為空", "name cannot be empty") }),
            ),
        ));
    }

    let tags: Vec<String> = body
        .tags
        .into_iter()
        .map(|t| t.trim().to_string())
        .filter(|t| !t.is_empty())
        .collect();

    if !body.metadata.is_object() {
        return Err((
            StatusCode::BAD_REQUEST,
            Json(
                json!({ "error": tr(lang, "metadata 必须是 JSON 对象", "metadata 必須是 JSON 物件", "metadata must be a JSON object") }),
            ),
        ));
    }

    update_fields_by_id(
        &state.pool,
        entry_id,
        user_id,
        UpdateEntryFieldsByIdParams {
            folder,
            entry_type,
            name,
            notes,
            tags: &tags,
            metadata: &body.metadata,
        },
    )
    .await
    .map_err(|e| map_entry_mutation_err(e, lang))?;

    Ok(Json(json!({ "ok": true })))
}

async fn api_entry_delete(
    State(state): State<AppState>,
    session: Session,
    headers: HeaderMap,
    Path(entry_id): Path<Uuid>,
) -> Result<Json<serde_json::Value>, EntryApiError> {
    let lang = request_ui_lang(&headers);
    let user_id = current_user_id(&session).await.ok_or((
        StatusCode::UNAUTHORIZED,
        Json(json!({ "error": tr(lang, "未登录", "尚未登入", "Not logged in") })),
    ))?;

    delete_by_id(&state.pool, entry_id, user_id)
        .await
        .map_err(|e| map_entry_mutation_err(e, lang))?;

    Ok(Json(json!({
        "ok": true,
    })))
}

#[derive(Deserialize)]
struct SecretCheckNameQuery {
    name: String,
    exclude_secret_id: Option<Uuid>,
}

#[derive(Serialize)]
struct SecretCheckNameResponse {
    ok: bool,
    available: bool,
    #[serde(skip_serializing_if = "Option::is_none")]
    error: Option<String>,
}

async fn api_secret_check_name(
    State(state): State<AppState>,
    session: Session,
    headers: HeaderMap,
    Query(params): Query<SecretCheckNameQuery>,
) -> Result<Json<SecretCheckNameResponse>, EntryApiError> {
    let lang = request_ui_lang(&headers);
    let user_id = current_user_id(&session).await.ok_or((
        StatusCode::UNAUTHORIZED,
        Json(json!({ "error": tr(lang, "未登录", "尚未登入", "Not logged in") })),
    ))?;

    let name = params.name.trim();
    if name.is_empty() {
        return Err((
            StatusCode::BAD_REQUEST,
            Json(
                json!({ "error": tr(lang, "secret name 不能为空", "secret name 不能為空", "secret name cannot be empty") }),
            ),
        ));
    }
    if name.chars().count() > 256 {
        return Err((
            StatusCode::BAD_REQUEST,
            Json(
                json!({ "error": tr(lang, "secret name 长度不能超过 256 个字符", "secret name 長度不能超過 256 個字元", "secret name must be at most 256 characters") }),
            ),
        ));
    }

    let count: i64 = if let Some(exclude_id) = params.exclude_secret_id {
        sqlx::query_scalar::<_, i64>(
            "SELECT COUNT(*) FROM secrets WHERE user_id = $1 AND name = $2 AND id != $3",
        )
        .bind(user_id)
        .bind(name)
        .bind(exclude_id)
        .fetch_one(&state.pool)
        .await
    } else {
        sqlx::query_scalar::<_, i64>(
            "SELECT COUNT(*) FROM secrets WHERE user_id = $1 AND name = $2",
        )
        .bind(user_id)
        .bind(name)
        .fetch_one(&state.pool)
        .await
    }.map_err(|e| {
        tracing::error!(error = %e, "failed to check secret name availability");
        (
            StatusCode::INTERNAL_SERVER_ERROR,
            Json(
                json!({ "error": tr(lang, "操作失败，请稍后重试", "操作失敗，請稍後重試", "Operation failed, please try again later") }),
            ),
        )
    })?;

    let available = count == 0;
    let error = if available {
        None
    } else {
        Some(
            tr(
                lang,
                "该用户下已存在相同 name 的密文",
                "該用戶下已存在相同 name 的密文",
                "A secret with the same name already exists for this user",
            )
            .to_string(),
        )
    };

    Ok(Json(SecretCheckNameResponse {
        ok: true,
        available,
        error,
    }))
}

#[derive(Deserialize)]
struct SecretPatchBody {
    name: Option<String>,
    #[serde(rename = "type")]
    secret_type: Option<String>,
}

async fn api_secret_patch(
    State(state): State<AppState>,
    session: Session,
    headers: HeaderMap,
    Path(secret_id): Path<Uuid>,
    Json(body): Json<SecretPatchBody>,
) -> Result<Json<serde_json::Value>, EntryApiError> {
    #[derive(Serialize, sqlx::FromRow)]
    struct LinkedEntryAuditRow {
        folder: String,
        #[sqlx(rename = "type")]
        entry_type: String,
        name: String,
    }

    let lang = request_ui_lang(&headers);
    let user_id = current_user_id(&session).await.ok_or((
        StatusCode::UNAUTHORIZED,
        Json(json!({ "error": tr(lang, "未登录", "尚未登入", "Not logged in") })),
    ))?;

    let name = body.name.as_ref().map(|s| s.trim());
    let secret_type = body.secret_type.as_ref().map(|s| s.trim());

    if let Some(n) = name {
        if n.is_empty() {
            return Err((
                StatusCode::BAD_REQUEST,
                Json(
                    json!({ "error": tr(lang, "secret name 不能为空", "secret name 不能為空", "secret name cannot be empty") }),
                ),
            ));
        }
        if n.chars().count() > 256 {
            return Err((
                StatusCode::BAD_REQUEST,
                Json(
                    json!({ "error": tr(lang, "secret name 长度不能超过 256 个字符", "secret name 長度不能超過 256 個字元", "secret name must be at most 256 characters") }),
                ),
            ));
        }
    }

    if let Some(t) = secret_type {
        if t.is_empty() {
            return Err((
                StatusCode::BAD_REQUEST,
                Json(
                    json!({ "error": tr(lang, "secret type 不能为空", "secret type 不能為空", "secret type cannot be empty") }),
                ),
            ));
        }
        if t.chars().count() > 64 {
            return Err((
                StatusCode::BAD_REQUEST,
                Json(
                    json!({ "error": tr(lang, "secret type 长度不能超过 64 个字符", "secret type 長度不能超過 64 個字元", "secret type must be at most 64 characters") }),
                ),
            ));
        }
    }

    if name.is_none() && secret_type.is_none() {
        return Err((
            StatusCode::BAD_REQUEST,
            Json(
                json!({ "error": tr(lang, "至少需要提供 name 或 type 之一", "至少需要提供 name 或 type 之一", "At least one of name or type is required") }),
            ),
        ));
    }

    let mut tx = state
        .pool
        .begin()
        .await
        .map_err(|e| map_entry_mutation_err(e.into(), lang))?;

    let secret_row: Option<(String, String)> =
        sqlx::query_as("SELECT name, type FROM secrets WHERE id = $1 AND user_id = $2 FOR UPDATE")
            .bind(secret_id)
            .bind(user_id)
            .fetch_optional(&mut *tx)
            .await
            .map_err(|e| map_entry_mutation_err(e.into(), lang))?;

    let Some((old_name, old_type)) = secret_row else {
        let _ = tx.rollback().await;
        return Err((
            StatusCode::NOT_FOUND,
            Json(
                json!({ "error": tr(lang, "密文不存在或无权访问", "密文不存在或無權存取", "Secret not found or no access") }),
            ),
        ));
    };

    let linked_entries: Vec<LinkedEntryAuditRow> = sqlx::query_as(
        "SELECT e.folder, e.type, e.name \
         FROM entry_secrets es \
         JOIN entries e ON e.id = es.entry_id \
         WHERE es.secret_id = $1 AND e.user_id = $2 \
         ORDER BY e.folder, e.type, e.name",
    )
    .bind(secret_id)
    .bind(user_id)
    .fetch_all(&mut *tx)
    .await
    .map_err(|e| map_entry_mutation_err(e.into(), lang))?;

    let new_name = name.unwrap_or(&old_name).to_string();
    let new_type = secret_type.unwrap_or(&old_type).to_string();

    let result = sqlx::query(
        "UPDATE secrets SET name = $1, type = $2, version = version + 1, updated_at = NOW() \
         WHERE id = $3",
    )
    .bind(&new_name)
    .bind(&new_type)
    .bind(secret_id)
    .execute(&mut *tx)
    .await;

    if let Err(e) = result {
        if let Some(db_err) = e.as_database_error()
            && db_err.code() == Some("23505".into())
        {
            let _ = tx.rollback().await;
            return Err(map_app_error(
                &AppError::ConflictSecretName {
                    secret_name: new_name.clone(),
                },
                lang,
            ));
        }
        let _ = tx.rollback().await;
        return Err(map_entry_mutation_err(e.into(), lang));
    }

    secrets_core::audit::log_tx(
        &mut tx,
        Some(user_id),
        "rename_secret",
        "",
        "",
        &old_name,
        json!({
            "source": "web",
            "secret_id": secret_id,
            "old_name": old_name,
            "new_name": new_name,
            "old_type": old_type,
            "new_type": new_type,
            "linked_entries": linked_entries,
        }),
    )
    .await;

    tx.commit()
        .await
        .map_err(|e| map_entry_mutation_err(e.into(), lang))?;

    Ok(Json(json!({ "ok": true })))
}

async fn api_entry_secret_unlink(
    State(state): State<AppState>,
    session: Session,
    headers: HeaderMap,
    Path((entry_id, secret_id)): Path<(Uuid, Uuid)>,
) -> Result<Json<serde_json::Value>, EntryApiError> {
    #[derive(sqlx::FromRow)]
    struct EntryAuditRow {
        folder: String,
        #[sqlx(rename = "type")]
        entry_type: String,
        name: String,
    }

    let lang = request_ui_lang(&headers);
    let user_id = current_user_id(&session).await.ok_or((
        StatusCode::UNAUTHORIZED,
        Json(json!({ "error": tr(lang, "未登录", "尚未登入", "Not logged in") })),
    ))?;

    let mut tx = state
        .pool
        .begin()
        .await
        .map_err(|e| map_entry_mutation_err(e.into(), lang))?;

    let entry_row: Option<EntryAuditRow> =
        sqlx::query_as("SELECT folder, type, name FROM entries WHERE id = $1 AND user_id = $2")
            .bind(entry_id)
            .bind(user_id)
            .fetch_optional(&mut *tx)
            .await
            .map_err(|e| map_entry_mutation_err(e.into(), lang))?;

    let Some(entry_row) = entry_row else {
        let _ = tx.rollback().await;
        return Err((
            StatusCode::NOT_FOUND,
            Json(
                json!({ "error": tr(lang, "条目不存在或无权访问", "條目不存在或無權存取", "Entry not found or no access") }),
            ),
        ));
    };

    let deleted = sqlx::query("DELETE FROM entry_secrets WHERE entry_id = $1 AND secret_id = $2")
        .bind(entry_id)
        .bind(secret_id)
        .execute(&mut *tx)
        .await
        .map_err(|e| map_entry_mutation_err(e.into(), lang))?
        .rows_affected();

    if deleted == 0 {
        let _ = tx.rollback().await;
        return Err((
            StatusCode::NOT_FOUND,
            Json(json!({ "error": tr(lang, "关联不存在", "關聯不存在", "Relation not found") })),
        ));
    }

    let secret_deleted = sqlx::query(
        "DELETE FROM secrets s \
         WHERE s.id = $1 \
           AND NOT EXISTS (SELECT 1 FROM entry_secrets es WHERE es.secret_id = s.id)",
    )
    .bind(secret_id)
    .execute(&mut *tx)
    .await
    .map_err(|e| map_entry_mutation_err(e.into(), lang))?
    .rows_affected()
        > 0;

    secrets_core::audit::log_tx(
        &mut tx,
        Some(user_id),
        "unlink_secret",
        &entry_row.folder,
        &entry_row.entry_type,
        &entry_row.name,
        json!({
            "source": "web",
            "entry_id": entry_id,
            "secret_id": secret_id,
            "deleted_secret": secret_deleted,
        }),
    )
    .await;

    tx.commit()
        .await
        .map_err(|e| map_entry_mutation_err(e.into(), lang))?;

    Ok(Json(json!({
        "ok": true,
        "deleted_relation": true,
        "deleted_secret": secret_deleted,
    })))
}

// ── OAuth / Well-known ────────────────────────────────────────────────────────

/// RFC 9728 — OAuth 2.0 Protected Resource Metadata.
///
/// Advertises that this server accepts Bearer tokens in the `Authorization`
/// header.  We deliberately omit `authorization_servers` because this service
/// issues its own API keys (no external OAuth AS is involved).  MCP clients
/// that probe this endpoint will see the resource identifier and stop looking
/// for a delegated OAuth flow.
async fn oauth_protected_resource_metadata(State(state): State<AppState>) -> impl IntoResponse {
    let body = serde_json::json!({
        "resource": state.base_url,
        "bearer_methods_supported": ["header"],
        "resource_documentation": format!("{}/dashboard", state.base_url),
    });
    (
        StatusCode::OK,
        [(header::CONTENT_TYPE, "application/json")],
        axum::Json(body),
    )
}

// ── Helper ────────────────────────────────────────────────────────────────────

fn render_template<T: Template>(tmpl: T) -> Result<Response, StatusCode> {
    let html = tmpl.render().map_err(|e| {
        tracing::error!(error = %e, "template render error");
        StatusCode::INTERNAL_SERVER_ERROR
    })?;
    Ok(Html(html).into_response())
}

fn format_audit_target(folder: &str, entry_type: &str, name: &str) -> String {
    // Auth events (folder="auth") use entry_type/name as provider-scoped target.
    if folder == "auth" {
        format!("{}/{}", entry_type, name)
    } else if !folder.is_empty() && !entry_type.is_empty() {
        format!("[{}/{}] {}", folder, entry_type, name)
    } else if !folder.is_empty() {
        format!("[{}] {}", folder, name)
    } else {
        name.to_string()
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn request_client_ip_ignores_forwarded_headers_without_trusted_proxy() {
        let mut headers = HeaderMap::new();
        headers.insert("x-forwarded-for", "203.0.113.10".parse().unwrap());

        let ip = request_client_ip_with_trust_proxy(
            &headers,
            ConnectInfo(SocketAddr::from(([127, 0, 0, 1], 9315))),
            false,
        );

        assert_eq!(ip.as_deref(), Some("127.0.0.1"));
    }

    #[test]
    fn request_client_ip_uses_valid_forwarded_header_with_trusted_proxy() {
        let mut headers = HeaderMap::new();
        headers.insert("x-forwarded-for", "203.0.113.10, 10.0.0.1".parse().unwrap());

        let ip = request_client_ip_with_trust_proxy(
            &headers,
            ConnectInfo(SocketAddr::from(([127, 0, 0, 1], 9315))),
            true,
        );

        assert_eq!(ip.as_deref(), Some("203.0.113.10"));
    }

    #[test]
    fn request_ui_lang_prefers_zh_cn_over_en_fallback() {
        let mut headers = HeaderMap::new();
        headers.insert(header::ACCEPT_LANGUAGE, "zh-CN, en;q=0.5".parse().unwrap());

        assert!(matches!(request_ui_lang(&headers), UiLang::ZhCn));
    }

    #[test]
    fn request_ui_lang_detects_traditional_chinese_variants() {
        let mut headers = HeaderMap::new();
        headers.insert(
            header::ACCEPT_LANGUAGE,
            "zh-Hant, en;q=0.5".parse().unwrap(),
        );

        assert!(matches!(request_ui_lang(&headers), UiLang::ZhTw));
    }

    #[test]
    fn paginate_clamps_page_before_computing_offset() {
        let (current_page, total_pages, offset) = paginate(100, 12, 10);

        assert_eq!(current_page, 2);
        assert_eq!(total_pages, 2);
        assert_eq!(offset, 10);
    }

    #[test]
    fn paginate_handles_large_page_without_overflow() {
        let (current_page, total_pages, offset) = paginate(u32::MAX, 1, ENTRIES_PAGE_LIMIT);

        assert_eq!(current_page, 1);
        assert_eq!(total_pages, 1);
        assert_eq!(offset, 0);
    }

    #[test]
    fn paginate_saturates_large_total_count() {
        let (_, total_pages, _) = paginate(1, i64::MAX, ENTRIES_PAGE_LIMIT);

        assert_eq!(total_pages, u32::MAX.div_ceil(ENTRIES_PAGE_LIMIT));
    }
}