using System.Reflection;
using System.Security.Cryptography;
using System.Text.RegularExpressions;
using AlibabaCloud.OSS.V2.Credentials;
using AlibabaCloud.OSS.V2.Models;
using Microsoft.Extensions.Options;
using Minio;
using Minio.DataModel.Args;
using Minio.Exceptions;
using Tiku.Application.Storage;
using Oss = AlibabaCloud.OSS.V2;

namespace Tiku.Infrastructure.Storage;

public sealed partial class AliyunOssObjectStorageService(
    IOptions<ObjectStorageOptions> storageOptions,
    IOptions<AliyunOssOptions> aliyunOptions,
    IOptions<S3CompatibleOptions> s3Options)
    : IObjectStorageService, IDisposable
{
    private static readonly HashSet<string> SupportedProviders =
    [
        ObjectStorageProviders.ExternalUrl,
        ObjectStorageProviders.AliyunOss,
        ObjectStorageProviders.TencentCos,
        ObjectStorageProviders.QiniuKodo,
        ObjectStorageProviders.LocalDev
    ];

    private static readonly HashSet<string> UploadableProviders =
    [
        ObjectStorageProviders.LocalDev,
        ObjectStorageProviders.AliyunOss
    ];

    private readonly object clientLock = new();
    private Oss.Client? client;
    private IMinioClient? s3Client;
    private bool disposed;

    public void Dispose()
    {
        if (disposed) return;

        lock (clientLock)
        {
            client?.Dispose();
            client = null;
            s3Client?.Dispose();
            s3Client = null;
            disposed = true;
        }
    }

    public string ConfiguredDefaultProvider()
    {
        return NormalizeProvider(storageOptions.Value.DefaultProvider, ObjectStorageProviders.LocalDev);
    }

    public string ConfiguredDefaultBucket()
    {
        return string.IsNullOrWhiteSpace(storageOptions.Value.DefaultBucket)
            ? "tenant-assets"
            : storageOptions.Value.DefaultBucket.Trim();
    }

    public string NormalizeProvider(string? value, string? fallback = null)
    {
        var provider = (string.IsNullOrWhiteSpace(value) ? fallback : value)?.Trim() ?? ConfiguredDefaultProvider();
        if (!SupportedProviders.Contains(provider))
            throw new ObjectStorageException($"Unsupported storage provider: {provider}",
                "UNSUPPORTED_STORAGE_PROVIDER");

        return provider;
    }

    public string ValidateObjectKey(Guid tenantId, string objectKey)
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(objectKey);

        var clean = CanonicalObjectKey(objectKey);
        if (string.IsNullOrWhiteSpace(clean) ||
            clean.Contains("..", StringComparison.Ordinal) ||
            clean.Contains('\\', StringComparison.Ordinal) ||
            clean.Contains("%2f", StringComparison.OrdinalIgnoreCase) ||
            !SafeObjectKeyRegex().IsMatch(clean))
            throw new ObjectStorageException("Invalid objectKey.", "INVALID_OBJECT_KEY");

        if (storageOptions.Value.RequireTenantPrefix && !clean.StartsWith($"{tenantId:N}/", StringComparison.Ordinal))
            throw new ObjectStorageException(
                "objectKey must be scoped by tenantId prefix.",
                "OBJECT_KEY_TENANT_PREFIX_REQUIRED");

        return clean;
    }

    public string ValidateMimeType(string mimeType)
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(mimeType);

        var normalized = mimeType.Trim().ToLowerInvariant();
        if (normalized.Length > 160 ||
            normalized.Contains('\r', StringComparison.Ordinal) ||
            normalized.Contains('\n', StringComparison.Ordinal))
            throw new ObjectStorageException("Invalid mimeType.", "INVALID_MIME_TYPE");

        var exact = storageOptions.Value.AllowedMimeTypes
            .Select(item => item.Trim().ToLowerInvariant())
            .Where(item => item.Length > 0)
            .ToHashSet(StringComparer.Ordinal);
        var prefixes = storageOptions.Value.AllowedMimePrefixes
            .Select(item => item.Trim().ToLowerInvariant())
            .Where(item => item.Length > 0)
            .ToArray();

        if (!exact.Contains(normalized) &&
            !prefixes.Any(prefix => normalized.StartsWith(prefix, StringComparison.Ordinal)))
            throw new ObjectStorageException($"mimeType is not allowed: {normalized}", "MIME_TYPE_NOT_ALLOWED");

        return normalized;
    }

    public long? ValidateFileSize(long? fileSizeBytes)
    {
        if (fileSizeBytes is null) return null;

        if (fileSizeBytes < 0)
            throw new ObjectStorageException("fileSizeBytes must be non-negative.", "INVALID_FILE_SIZE");

        if (fileSizeBytes > storageOptions.Value.MaxUploadBytes)
            throw new ObjectStorageException("file exceeds configured storage max upload bytes.", "FILE_TOO_LARGE");

        return fileSizeBytes;
    }

    public void AssertUploadProvider(string provider)
    {
        var normalized = NormalizeProvider(provider);
        if (!UploadableProviders.Contains(normalized))
            throw new ObjectStorageException(
                $"{normalized} does not support managed upload signing.",
                "UPLOAD_PROVIDER_NOT_SUPPORTED");
    }

    public void AssertWritableLocation(StorageAssetLocation location)
    {
        var provider = NormalizeProvider(location.Provider);
        if (provider is ObjectStorageProviders.AliyunOss or ObjectStorageProviders.LocalDev &&
            (string.IsNullOrWhiteSpace(location.Bucket) || string.IsNullOrWhiteSpace(location.ObjectKey)))
            throw new ObjectStorageException(
                $"{provider} asset requires bucket and objectKey.",
                "ASSET_OBJECT_LOCATION_REQUIRED");
    }

    public async Task<ObjectStorageSignedUrl> SignUploadAsync(
        ObjectStorageUploadSignRequest request,
        CancellationToken cancellationToken = default)
    {
        cancellationToken.ThrowIfCancellationRequested();
        var provider = NormalizeProvider(request.Provider);
        AssertUploadProvider(provider);
        var objectKey = ValidateObjectKey(request.TenantId, request.ObjectKey);
        var mimeType = ValidateMimeType(request.MimeType);
        ValidateFileSize(request.FileSizeBytes);

        if (provider == ObjectStorageProviders.LocalDev)
        {
            await EnsureS3BucketAsync(request.Bucket, cancellationToken);
            var url = await GetS3Client().PresignedPutObjectAsync(new PresignedPutObjectArgs()
                .WithBucket(request.Bucket)
                .WithObject(objectKey)
                .WithExpiry(ExpirySeconds(request.ExpiresIn)));
            return new ObjectStorageSignedUrl(
                provider,
                request.Bucket,
                objectKey,
                "PUT",
                new Uri(url, UriKind.Absolute),
                new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
                {
                    ["content-type"] = mimeType
                },
                DateTimeOffset.UtcNow.Add(request.ExpiresIn),
                request.ExpiresIn,
                "s3-compatible-presigned-put");
        }

        return SignAliyunOss(
                request.Bucket,
                objectKey,
                "PUT",
                request.ExpiresIn,
                mimeType,
                null,
                null);
    }

    public async Task<ObjectStorageSignedUrl> SignDownloadAsync(
        ObjectStorageDownloadSignRequest request,
        CancellationToken cancellationToken = default)
    {
        cancellationToken.ThrowIfCancellationRequested();
        var provider = NormalizeProvider(request.Provider);

        if (!string.IsNullOrWhiteSpace(request.CdnUrl))
            return new ObjectStorageSignedUrl(
                provider,
                request.Bucket,
                request.ObjectKey,
                "GET",
                new Uri(request.CdnUrl, UriKind.Absolute),
                new Dictionary<string, string>(),
                DateTimeOffset.UtcNow.Add(request.ExpiresIn),
                request.ExpiresIn,
                "public-or-provider-managed");

        if (string.IsNullOrWhiteSpace(request.ObjectKey))
            throw new ObjectStorageException("Asset requires objectKey or cdnUrl.", "ASSET_LOCATION_REQUIRED");

        var objectKey = ValidateObjectKey(request.TenantId, request.ObjectKey);
        if (provider == ObjectStorageProviders.LocalDev)
        {
            if (string.IsNullOrWhiteSpace(request.Bucket))
                throw new ObjectStorageException("S3-compatible asset requires bucket.",
                    "ASSET_OBJECT_LOCATION_REQUIRED");
            var url = await GetS3Client().PresignedGetObjectAsync(new PresignedGetObjectArgs()
                .WithBucket(request.Bucket)
                .WithObject(objectKey)
                .WithExpiry(ExpirySeconds(request.ExpiresIn)));
            return new ObjectStorageSignedUrl(
                provider,
                request.Bucket,
                objectKey,
                "GET",
                new Uri(url, UriKind.Absolute),
                new Dictionary<string, string>(),
                DateTimeOffset.UtcNow.Add(request.ExpiresIn),
                request.ExpiresIn,
                "s3-compatible-presigned-get");
        }

        if (provider == ObjectStorageProviders.QiniuKodo)
            return LocalSignedUrl(provider, request.Bucket, objectKey, "GET", request.ExpiresIn,
                request.Disposition);

        if (provider != ObjectStorageProviders.AliyunOss)
            throw new ObjectStorageException($"{provider} asset requires cdnUrl.", "ASSET_LOCATION_REQUIRED");

        if (string.IsNullOrWhiteSpace(request.Bucket))
            throw new ObjectStorageException("Aliyun OSS asset requires bucket.", "ASSET_OBJECT_LOCATION_REQUIRED");

        return SignAliyunOss(
            request.Bucket,
            objectKey,
            "GET",
            request.ExpiresIn,
            null,
            request.FileName,
            request.Disposition);
    }

    public async Task<ObjectStorageMetadata> HeadObjectAsync(
        ObjectStorageHeadRequest request,
        CancellationToken cancellationToken = default)
    {
        cancellationToken.ThrowIfCancellationRequested();
        var provider = NormalizeProvider(request.Provider);
        if (string.IsNullOrWhiteSpace(request.ObjectKey))
            throw new ObjectStorageException("Asset requires objectKey.", "ASSET_LOCATION_REQUIRED");

        var objectKey = ValidateObjectKey(request.TenantId, request.ObjectKey);
        var fileSizeBytes = ValidateFileSize(request.DeclaredFileSizeBytes);
        var mimeType = request.DeclaredMimeType is null ? null : ValidateMimeType(request.DeclaredMimeType);
        var checksumSha256 = request.DeclaredChecksumSha256?.Trim().ToLowerInvariant();

        if (provider == ObjectStorageProviders.LocalDev)
        {
            if (string.IsNullOrWhiteSpace(request.Bucket))
                throw new ObjectStorageException("S3-compatible asset requires bucket.",
                    "ASSET_OBJECT_LOCATION_REQUIRED");
            try
            {
                var result = await GetS3Client().StatObjectAsync(new StatObjectArgs()
                    .WithBucket(request.Bucket)
                    .WithObject(objectKey), cancellationToken);
                return new ObjectStorageMetadata(
                    provider,
                    request.Bucket,
                    objectKey,
                    true,
                    result.Size,
                    result.ContentType,
                    checksumSha256,
                    result.ETag,
                    result.LastModified.ToString("O"),
                    new Dictionary<string, string>(),
                    "s3-compatible-stat-object");
            }
            catch (ObjectNotFoundException)
            {
                throw new ObjectStorageException("Uploaded object was not found in S3-compatible storage.",
                    "STORAGE_OBJECT_NOT_FOUND");
            }
        }

        if (provider != ObjectStorageProviders.AliyunOss)
            throw new ObjectStorageException(
                $"{provider} does not support upload confirmation.",
                "UPLOAD_CONFIRM_PROVIDER_NOT_SUPPORTED");

        if (string.IsNullOrWhiteSpace(request.Bucket))
            throw new ObjectStorageException("Aliyun OSS asset requires bucket and objectKey.",
                "ASSET_OBJECT_LOCATION_REQUIRED");

        try
        {
            var result = await GetClient().HeadObjectAsync(new HeadObjectRequest
            {
                Bucket = request.Bucket,
                Key = objectKey
            }, cancellationToken: cancellationToken);

            return MetadataFromHeadResult(request.Bucket, objectKey, result);
        }
        catch (Exception exception) when (TryGetStatusCode(exception) == 404)
        {
            throw new ObjectStorageException(
                "Uploaded object was not found in Aliyun OSS.",
                "STORAGE_OBJECT_NOT_FOUND");
        }
    }

    public async Task<ObjectStorageWriteResult> WriteObjectAsync(
        ObjectStorageWriteRequest request,
        CancellationToken cancellationToken = default)
    {
        cancellationToken.ThrowIfCancellationRequested();
        var provider = NormalizeProvider(request.Provider);
        AssertUploadProvider(provider);
        var objectKey = ValidateObjectKey(request.TenantId, request.ObjectKey);
        var mimeType = ValidateMimeType(request.MimeType);
        var fileSizeBytes = ValidateFileSize(request.FileSizeBytes);
        var checksumSha256 = NormalizeChecksum(request.ChecksumSha256);
        if (request.Content.CanSeek) request.Content.Position = 0;

        if (string.IsNullOrWhiteSpace(request.Bucket))
            throw new ObjectStorageException("Writable asset requires bucket.", "ASSET_OBJECT_LOCATION_REQUIRED");

        if (provider == ObjectStorageProviders.LocalDev)
        {
            await EnsureS3BucketAsync(request.Bucket, cancellationToken);
            MemoryStream? bufferedContent = null;
            var uploadContent = request.Content;
            if (checksumSha256 is null && !request.Content.CanSeek)
            {
                bufferedContent = new MemoryStream();
                await request.Content.CopyToAsync(bufferedContent, cancellationToken);
                bufferedContent.Position = 0;
                uploadContent = bufferedContent;
            }

            var resolvedChecksum = checksumSha256 ?? await ComputeSha256Async(uploadContent, cancellationToken);
            var objectSize = fileSizeBytes ?? (uploadContent.CanSeek
                ? uploadContent.Length - uploadContent.Position
                : -1);
            try
            {
                await GetS3Client().PutObjectAsync(new PutObjectArgs()
                    .WithBucket(request.Bucket)
                    .WithObject(objectKey)
                    .WithStreamData(uploadContent)
                    .WithObjectSize(objectSize)
                    .WithContentType(mimeType), cancellationToken);
                return new ObjectStorageWriteResult(
                    provider,
                    request.Bucket,
                    objectKey,
                    BuildPublicUrl(request.Bucket, objectKey),
                    fileSizeBytes ?? objectSize,
                    mimeType,
                    resolvedChecksum,
                    null,
                    new Dictionary<string, string>(),
                    "s3-compatible-put-object");
            }
            finally
            {
                if (bufferedContent is not null) await bufferedContent.DisposeAsync();
            }
        }

        if (provider != ObjectStorageProviders.AliyunOss)
            throw new ObjectStorageException(
                $"{provider} does not support managed server-side writes.",
                "WRITE_PROVIDER_NOT_SUPPORTED");

        var metadata = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
        if (request.Metadata is not null)
            foreach (var (key, value) in request.Metadata)
                if (!string.IsNullOrWhiteSpace(key) && value is not null)
                    metadata[key.Trim()] = value;

        if (!string.IsNullOrWhiteSpace(checksumSha256)) metadata["sha256"] = checksumSha256;

        var result = await GetClient().PutObjectAsync(new PutObjectRequest
        {
            Bucket = request.Bucket,
            Key = objectKey,
            Body = request.Content,
            ContentType = mimeType,
            ContentLength = fileSizeBytes,
            Metadata = metadata.Count == 0 ? null : metadata,
            ForbidOverwrite = !request.Upsert
        }, cancellationToken: cancellationToken);

        return new ObjectStorageWriteResult(
            provider,
            request.Bucket,
            objectKey,
            BuildPublicUrl(request.Bucket, objectKey),
            fileSizeBytes,
            mimeType,
            checksumSha256,
            CleanEtag(result.ETag),
            NormalizeHeaders(result.Headers),
            "aliyun-oss-put-object");
    }

    public async Task<Stream> OpenReadAsync(
        ObjectStorageReadRequest request,
        CancellationToken cancellationToken = default)
    {
        var provider = NormalizeProvider(request.Provider);
        var objectKey = ValidateObjectKey(request.TenantId, request.ObjectKey);
        if (provider == ObjectStorageProviders.LocalDev)
        {
            if (string.IsNullOrWhiteSpace(request.Bucket))
                throw new ObjectStorageException("S3-compatible asset requires bucket.",
                    "ASSET_OBJECT_LOCATION_REQUIRED");
            var content = new MemoryStream();
            try
            {
                await GetS3Client().GetObjectAsync(new GetObjectArgs()
                    .WithBucket(request.Bucket)
                    .WithObject(objectKey)
                    .WithCallbackStream(async (stream, token) =>
                        await stream.CopyToAsync(content, token)), cancellationToken);
                content.Position = 0;
                return content;
            }
            catch (ObjectNotFoundException)
            {
                await content.DisposeAsync();
                throw new ObjectStorageException("Object was not found in S3-compatible storage.",
                    "STORAGE_OBJECT_NOT_FOUND");
            }
        }

        if (provider != ObjectStorageProviders.AliyunOss)
            throw new ObjectStorageException(
                $"{provider} does not support managed server-side reads.",
                "READ_PROVIDER_NOT_SUPPORTED");
        if (string.IsNullOrWhiteSpace(request.Bucket))
            throw new ObjectStorageException("Aliyun OSS asset requires bucket.", "ASSET_OBJECT_LOCATION_REQUIRED");

        var result = await GetClient().GetObjectAsync(
            new GetObjectRequest { Bucket = request.Bucket, Key = objectKey },
            HttpCompletionOption.ResponseHeadersRead,
            null,
            cancellationToken);
        return result.Body ?? throw new ObjectStorageException(
            "Object storage returned an empty response stream.",
            "STORAGE_OBJECT_EMPTY_RESPONSE");
    }

    private ObjectStorageSignedUrl SignAliyunOss(
        string bucket,
        string objectKey,
        string method,
        TimeSpan expiresIn,
        string? mimeType,
        string? fileName,
        string? disposition)
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(bucket);
        var expiresAt = ResolveExpiration(expiresIn);

        PresignResult result;
        if (method == "PUT")
            result = GetClient().Presign(new PutObjectRequest
            {
                Bucket = bucket,
                Key = objectKey,
                ContentType = mimeType
            }, expiresAt.UtcDateTime);
        else
            result = GetClient().Presign(new GetObjectRequest
            {
                Bucket = bucket,
                Key = objectKey,
                ResponseContentDisposition = BuildContentDisposition(fileName, disposition)
            }, expiresAt.UtcDateTime);

        return ToSignedUrl(result, ObjectStorageProviders.AliyunOss, bucket, objectKey, method, expiresIn,
            "aliyun-oss-signature-url-v4");
    }

    private ObjectStorageSignedUrl LocalSignedUrl(
        string provider,
        string? bucket,
        string? objectKey,
        string method,
        TimeSpan expiresIn,
        string? disposition,
        IReadOnlyDictionary<string, string>? headers = null)
    {
        var expiresAt = ResolveExpiration(expiresIn);
        var baseUrl = storageOptions.Value.PublicBaseUrl?.Trim().TrimEnd('/');
        var path = $"{Uri.EscapeDataString(bucket ?? "default")}/{Uri.EscapeDataString(objectKey ?? "missing")}";
        var url = string.IsNullOrWhiteSpace(baseUrl)
            ? $"https://local-storage.invalid/{provider}/{path}?expiresAt={Uri.EscapeDataString(expiresAt.ToString("O"))}&disposition={disposition ?? "attachment"}"
            : $"{baseUrl}/{path}?expiresAt={Uri.EscapeDataString(expiresAt.ToString("O"))}&disposition={disposition ?? "attachment"}";

        return new ObjectStorageSignedUrl(
            provider,
            bucket,
            objectKey,
            method,
            new Uri(url),
            headers ?? new Dictionary<string, string>(),
            expiresAt,
            expiresIn,
            "local-placeholder");
    }

    private Uri? BuildPublicUrl(string bucket, string objectKey)
    {
        var baseUrl = storageOptions.Value.PublicBaseUrl?.Trim().TrimEnd('/');
        if (string.IsNullOrWhiteSpace(baseUrl)) return null;

        var path = string.Join(
            '/',
            bucket.Trim('/'),
            objectKey
                .Split('/', StringSplitOptions.RemoveEmptyEntries)
                .Select(Uri.EscapeDataString));
        return new Uri($"{baseUrl}/{path}", UriKind.Absolute);
    }

    private Oss.Client GetClient()
    {
        ObjectDisposedException.ThrowIf(disposed, this);

        if (client is not null) return client;

        lock (clientLock)
        {
            client ??= CreateClient(aliyunOptions.Value);
            return client;
        }
    }

    private IMinioClient GetS3Client()
    {
        ObjectDisposedException.ThrowIf(disposed, this);
        if (s3Client is not null) return s3Client;

        lock (clientLock)
        {
            if (s3Client is not null) return s3Client;
            var options = s3Options.Value;
            if (!options.IsConfigured)
                throw new ObjectStorageNotConfiguredException(
                    "S3-compatible storage is not configured: S3_ENDPOINT, S3_ACCESS_KEY and S3_SECRET_KEY are required.");

            var builder = new MinioClient()
                .WithEndpoint(options.Endpoint!.Trim())
                .WithCredentials(options.AccessKey!.Trim(), options.SecretKey!.Trim())
                .WithSSL(options.Secure);
            if (!string.IsNullOrWhiteSpace(options.Region)) builder = builder.WithRegion(options.Region.Trim());
            s3Client = builder.Build();
            return s3Client;
        }
    }

    private async Task EnsureS3BucketAsync(string bucket, CancellationToken cancellationToken)
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(bucket);
        var client = GetS3Client();
        var exists = await client.BucketExistsAsync(new BucketExistsArgs().WithBucket(bucket), cancellationToken);
        if (!exists)
            await client.MakeBucketAsync(new MakeBucketArgs().WithBucket(bucket), cancellationToken);
    }

    private static int ExpirySeconds(TimeSpan expiresIn)
    {
        return Math.Clamp((int)Math.Ceiling(expiresIn.TotalSeconds), 1, 7 * 24 * 60 * 60);
    }

    private static Oss.Client CreateClient(AliyunOssOptions currentOptions)
    {
        if (!currentOptions.IsConfigured)
            throw new ObjectStorageNotConfiguredException(
                "aliyun_oss is not configured: ALIYUN_OSS_ACCESS_KEY_ID, ALIYUN_OSS_ACCESS_KEY_SECRET and ALIYUN_OSS_REGION or ALIYUN_OSS_ENDPOINT are required.");

        var configuration = Oss.Configuration.LoadDefault();
        configuration.Region = currentOptions.Region?.Trim();
        configuration.Endpoint = NullIfWhiteSpace(currentOptions.Endpoint);
        configuration.UseInternalEndpoint = currentOptions.UseInternalEndpoint;
        configuration.UsePathStyle = currentOptions.UsePathStyle;
        configuration.UseCName = currentOptions.UseCName;
        configuration.DisableSsl = false;
        configuration.CredentialsProvider = string.IsNullOrWhiteSpace(currentOptions.SecurityToken)
            ? new StaticCredentialsProvider(
                currentOptions.AccessKeyId!.Trim(),
                currentOptions.AccessKeySecret!.Trim())
            : new StaticCredentialsProvider(
                currentOptions.AccessKeyId!.Trim(),
                currentOptions.AccessKeySecret!.Trim(),
                currentOptions.SecurityToken!.Trim());

        return new Oss.Client(configuration);
    }

    private static ObjectStorageSignedUrl ToSignedUrl(
        PresignResult result,
        string provider,
        string bucket,
        string objectKey,
        string method,
        TimeSpan expiresIn,
        string signatureMode)
    {
        if (!Uri.TryCreate(result.Url, UriKind.Absolute, out var url))
            throw new InvalidOperationException("Aliyun OSS SDK returned an invalid presigned URL.");

        return new ObjectStorageSignedUrl(
            provider,
            bucket,
            objectKey,
            string.IsNullOrWhiteSpace(result.Method) ? method : result.Method,
            url,
            result.SignedHeaders is null
                ? new Dictionary<string, string>()
                : new Dictionary<string, string>(result.SignedHeaders, StringComparer.OrdinalIgnoreCase),
            result.Expiration.HasValue
                ? new DateTimeOffset(DateTime.SpecifyKind(result.Expiration.Value, DateTimeKind.Utc))
                : DateTimeOffset.UtcNow.Add(expiresIn),
            expiresIn,
            signatureMode);
    }

    private static ObjectStorageMetadata MetadataFromHeadResult(
        string bucket,
        string objectKey,
        HeadObjectResult result)
    {
        var headers = NormalizeHeaders(result.Headers);
        foreach (var metadata in result.Metadata ?? new Dictionary<string, string>())
            headers[$"x-oss-meta-{metadata.Key}".ToLowerInvariant()] = metadata.Value;

        return new ObjectStorageMetadata(
            ObjectStorageProviders.AliyunOss,
            bucket,
            objectKey,
            true,
            result.ContentLength,
            NullIfWhiteSpace(result.ContentType),
            FirstHeader(headers, "x-oss-meta-sha256", "x-oss-meta-checksum-sha256")?.Trim().ToLowerInvariant(),
            CleanEtag(result.ETag ?? FirstHeader(headers, "etag")),
            NullIfWhiteSpace(result.LastModified) ?? FirstHeader(headers, "last-modified"),
            headers,
            "aliyun-oss-head-object");
    }

    private static Dictionary<string, string> NormalizeHeaders(IDictionary<string, string>? headers)
    {
        var normalized = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
        if (headers is null) return normalized;

        foreach (var (key, value) in headers)
            if (!string.IsNullOrWhiteSpace(key) && value is not null)
                normalized[key.ToLowerInvariant()] = value;

        return normalized;
    }

    private static int? TryGetStatusCode(Exception exception)
    {
        var type = exception.GetType();
        var property = type.GetProperty("StatusCode", BindingFlags.Public | BindingFlags.Instance) ??
                       type.GetProperty("Status", BindingFlags.Public | BindingFlags.Instance);
        return property?.GetValue(exception) switch
        {
            int statusCode => statusCode,
            long statusCode => checked((int)statusCode),
            string value when int.TryParse(value, out var statusCode) => statusCode,
            _ => null
        };
    }

    private static DateTimeOffset ResolveExpiration(TimeSpan expiresIn)
    {
        if (expiresIn <= TimeSpan.Zero)
            throw new ArgumentOutOfRangeException(nameof(expiresIn), expiresIn,
                "Signed URL expiration must be positive.");

        return DateTimeOffset.UtcNow.Add(expiresIn);
    }

    private static string CanonicalObjectKey(string objectKey)
    {
        return ConsecutiveSlashRegex().Replace(objectKey.Trim().TrimStart('/'), "/");
    }

    private static string? BuildContentDisposition(string? fileName, string? disposition)
    {
        if (string.IsNullOrWhiteSpace(fileName)) return null;

        var normalizedDisposition = string.Equals(disposition, "inline", StringComparison.OrdinalIgnoreCase)
            ? "inline"
            : "attachment";
        return $"{normalizedDisposition}; filename=\"{Uri.EscapeDataString(fileName.Trim())}\"";
    }

    private static string? FirstHeader(IReadOnlyDictionary<string, string> headers, params string[] keys)
    {
        foreach (var key in keys)
            if (headers.TryGetValue(key, out var value) && !string.IsNullOrWhiteSpace(value))
                return value;

        return null;
    }

    private static string? CleanEtag(string? value)
    {
        return string.IsNullOrWhiteSpace(value) ? null : value.Trim().Trim('"');
    }

    private static string? NullIfWhiteSpace(string? value)
    {
        return string.IsNullOrWhiteSpace(value) ? null : value.Trim();
    }

    private static string? NormalizeChecksum(string? value)
    {
        if (string.IsNullOrWhiteSpace(value)) return null;

        var normalized = value.Trim().ToLowerInvariant();
        return normalized.Length == 64 ? normalized : null;
    }

    private static async Task<string> ComputeSha256Async(Stream stream, CancellationToken cancellationToken)
    {
        if (stream.CanSeek) stream.Position = 0;

        var hash = await SHA256.HashDataAsync(stream, cancellationToken);
        if (stream.CanSeek) stream.Position = 0;

        return Convert.ToHexString(hash).ToLowerInvariant();
    }

    [GeneratedRegex("""^[A-Za-z0-9][A-Za-z0-9._~!$&'()+,;=@/-]{0,1023}$""")]
    private static partial Regex SafeObjectKeyRegex();

    [GeneratedRegex("/{2,}")]
    private static partial Regex ConsecutiveSlashRegex();
}