import LocalAuthentication

let context = LAContext()
var error: NSError?

if context.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &error) {
    let reason = "로그인을 위해 생체 인증이 필요합니다"
    
    context.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, 
                          localizedReason: reason) { success, error in
        if success {
            // 인증 성공
            DispatchQueue.main.async {
                self.handleSuccessfulAuth()
            }
        } else {
            // 인증 실패
            print("인증 실패: \(error?.localizedDescription ?? "Unknown error")")
        }
    }
}

import androidx.biometric.BiometricPrompt
import androidx.core.content.ContextCompat

val executor = ContextCompat.getMainExecutor(this)
val biometricPrompt = BiometricPrompt(this, executor,
    object : BiometricPrompt.AuthenticationCallback() {
        override fun onAuthenticationSucceeded(
            result: BiometricPrompt.AuthenticationResult) {
            super.onAuthenticationSucceeded(result)
            // 인증 성공 처리
            handleSuccessfulAuth()
        }
        
        override fun onAuthenticationFailed() {
            super.onAuthenticationFailed()
            // 인증 실패 처리
        }
    })

val promptInfo = BiometricPrompt.PromptInfo.Builder()
    .setTitle("생체 인증")
    .setSubtitle("지문을 인식해주세요")
    .setNegativeButtonText("취소")
    .build()

biometricPrompt.authenticate(promptInfo)

val promptInfo = BiometricPrompt.PromptInfo.Builder()
    .setTitle("얼굴 인증")
    .setSubtitle("얼굴을 인식해주세요")
    .setAllowedAuthenticators(
        BiometricManager.Authenticators.BIOMETRIC_STRONG or
        BiometricManager.Authenticators.DEVICE_CREDENTIAL
    )
    .build()

// BIOMETRIC_STRONG: Class 3 생체 인식만 허용
// BIOMETRIC_WEAK: Class 2 이상 허용
// DEVICE_CREDENTIAL: PIN/패턴/비밀번호 허용

// ML Kit Face Detection 예시 (Android)
val options = FaceDetectorOptions.Builder()
    .setPerformanceMode(FaceDetectorOptions.PERFORMANCE_MODE_ACCURATE)
    .setLandmarkMode(FaceDetectorOptions.LANDMARK_MODE_ALL)
    .setClassificationMode(FaceDetectorOptions.CLASSIFICATION_MODE_ALL)
    .setMinFaceSize(0.15f)
    .enableTracking()
    .build()

val detector = FaceDetection.getClient(options)

detector.process(image)
    .addOnSuccessListener { faces ->
        for (face in faces) {
            val bounds = face.boundingBox
            val rotY = face.headEulerAngleY  // 좌우 회전
            val rotZ = face.headEulerAngleZ  // 기울기
            
            // 눈 깜빡임, 미소 확률 등도 감지 가능
            if (face.smilingProbability != null) {
                val smileProb = face.smilingProbability
            }
        }
    }

// 순차적 인증 예시
fun performSequentialAuth() {
    // 1단계: 지문 인증
    authenticateFingerprint { fingerprintSuccess ->
        if (fingerprintSuccess) {
            // 2단계: 얼굴 인증
            authenticateFace { faceSuccess ->
                if (faceSuccess) {
                    grantAccess()
                } else {
                    showError("얼굴 인증 실패")
                }
            }
        } else {
            showError("지문 인증 실패")
        }
    }
}

// ❌ 잘못된 예시
fun sendBiometricData(fingerprintData: ByteArray) {
    api.uploadFingerprint(fingerprintData) // 절대 금지!
}

// ✅ 올바른 예시
fun authenticateAndGetToken() {
    biometricPrompt.authenticate(promptInfo)
    // 인증 성공 시 로컬에서 토큰 생성
    val token = generateSecureToken()
    api.verifyToken(token) // 토큰만 서버로 전송
}

// 프로젝트 구조
app/
├── data/
│   ├── repository/
│   │   └── BiometricRepository.kt
│   └── local/
│       └── SecureStorage.kt
├── domain/
│   ├── usecase/
│   │   ├── AuthenticateUseCase.kt
│   │   └── CheckBiometricAvailabilityUseCase.kt
│   └── model/
│       └── AuthResult.kt
├── presentation/
│   ├── login/
│   │   ├── LoginViewModel.kt
│   │   └── LoginActivity.kt
│   └── transfer/
│       ├── TransferViewModel.kt
│       └── TransferActivity.kt
└── util/
    └── BiometricHelper.kt

class BiometricHelper(private val activity: FragmentActivity) {
    
    private val executor = ContextCompat.getMainExecutor(activity)
    
    enum class AuthStrength {
        WEAK,      // 간단한 로그인
        STRONG,    // 금융 거래
        CRITICAL   // 민감한 작업
    }
    
    fun authenticate(
        strength: AuthStrength,
        onSuccess: () -> Unit,
        onError: (String) -> Unit,
        onFailed: () -> Unit
    ) {
        // 생체 인증 가능 여부 확인
        val biometricManager = BiometricManager.from(activity)
        when (biometricManager.canAuthenticate(getAuthenticators(strength))) {
            BiometricManager.BIOMETRIC_SUCCESS -> {
                showBiometricPrompt(strength, onSuccess, onError, onFailed)
            }
            BiometricManager.BIOMETRIC_ERROR_NO_HARDWARE -> {
                onError("생체 인증 하드웨어가 없습니다")
            }
            BiometricManager.BIOMETRIC_ERROR_HW_UNAVAILABLE -> {
                onError("생체 인증을 사용할 수 없습니다")
            }
            BiometricManager.BIOMETRIC_ERROR_NONE_ENROLLED -> {
                onError("등록된 생체 정보가 없습니다")
            }
        }
    }
    
    private fun getAuthenticators(strength: AuthStrength): Int {
        return when (strength) {
            AuthStrength.WEAK -> 
                BiometricManager.Authenticators.BIOMETRIC_WEAK
            AuthStrength.STRONG -> 
                BiometricManager.Authenticators.BIOMETRIC_STRONG
            AuthStrength.CRITICAL -> 
                BiometricManager.Authenticators.BIOMETRIC_STRONG or
                BiometricManager.Authenticators.DEVICE_CREDENTIAL
        }
    }
    
    private fun showBiometricPrompt(
        strength: AuthStrength,
        onSuccess: () -> Unit,
        onError: (String) -> Unit,
        onFailed: () -> Unit
    ) {
        val promptInfo = BiometricPrompt.PromptInfo.Builder()
            .setTitle(getTitleForStrength(strength))
            .setSubtitle(getSubtitleForStrength(strength))
            .setAllowedAuthenticators(getAuthenticators(strength))
            .apply {
                if (strength != AuthStrength.CRITICAL) {
                    setNegativeButtonText("취소")
                }
            }
            .build()
        
        val biometricPrompt = BiometricPrompt(
            activity,
            executor,
            object : BiometricPrompt.AuthenticationCallback() {
                override fun onAuthenticationSucceeded(
                    result: BiometricPrompt.AuthenticationResult
                ) {
                    super.onAuthenticationSucceeded(result)
                    onSuccess()
                }
                
                override fun onAuthenticationError(
                    errorCode: Int,
                    errString: CharSequence
                ) {
                    super.onAuthenticationError(errorCode, errString)
                    onError(errString.toString())
                }
                
                override fun onAuthenticationFailed() {
                    super.onAuthenticationFailed()
                    onFailed()
                }
            }
        )
        
        biometricPrompt.authenticate(promptInfo)
    }
    
    private fun getTitleForStrength(strength: AuthStrength): String {
        return when (strength) {
            AuthStrength.WEAK -> "로그인"
            AuthStrength.STRONG -> "본인 인증"
            AuthStrength.CRITICAL -> "보안 인증"
        }
    }
    
    private fun getSubtitleForStrength(strength: AuthStrength): String {
        return when (strength) {
            AuthStrength.WEAK -> "생체 정보로 로그인하세요"
            AuthStrength.STRONG -> "거래를 진행하려면 인증이 필요합니다"
            AuthStrength.CRITICAL -> "민감한 작업을 위해 인증해주세요"
        }
    }
}

class TransferViewModel : ViewModel() {
    
    fun initiateTransfer(amount: Long, recipient: String) {
        val authStrength = determineAuthStrength(amount)
        
        biometricHelper.authenticate(
            strength = authStrength,
            onSuccess = {
                performTransfer(amount, recipient)
            },
            onError = { error ->
                _transferState.value = TransferState.Error(error)
            },
            onFailed = {
                _transferState.value = TransferState.AuthFailed
            }
        )
    }
    
    private fun determineAuthStrength(amount: Long): BiometricHelper.AuthStrength {
        return when {
            amount < 10_000 -> BiometricHelper.AuthStrength.WEAK
            amount < 100_000 -> BiometricHelper.AuthStrength.STRONG
            else -> BiometricHelper.AuthStrength.CRITICAL
        }
    }
    
    private fun performTransfer(amount: Long, recipient: String) {
        viewModelScope.launch {
            try {
                val result = transferRepository.transfer(amount, recipient)
                _transferState.value = TransferState.Success(result)
            } catch (e: Exception) {
                _transferState.value = TransferState.Error(e.message ?: "송금 실패")
            }
        }
    }
}

class SecureStorage(private val context: Context) {
    
    private val keyAlias = "BiometricAuthKey"
    private val sharedPrefs = context.getSharedPreferences(
        "secure_prefs",
        Context.MODE_PRIVATE
    )
    
    fun saveAuthToken(token: String) {
        val encryptedToken = encrypt(token)
        sharedPrefs.edit()
            .putString("auth_token", encryptedToken)
            .apply()
    }
    
    fun getAuthToken(): String? {
        val encryptedToken = sharedPrefs.getString("auth_token", null)
        return encryptedToken?.let { decrypt(it) }
    }
    
    private fun encrypt(data: String): String {
        val cipher = getCipher()
        cipher.init(Cipher.ENCRYPT_MODE, getSecretKey())
        
        val iv = cipher.iv
        val encrypted = cipher.doFinal(data.toByteArray())
        
        // IV와 암호화된 데이터를 함께 저장
        val combined = iv + encrypted
        return Base64.encodeToString(combined, Base64.DEFAULT)
    }
    
    private fun decrypt(encryptedData: String): String {
        val combined = Base64.decode(encryptedData, Base64.DEFAULT)
        
        // IV와 암호화된 데이터 분리
        val iv = combined.copyOfRange(0, 12)
        val encrypted = combined.copyOfRange(12, combined.size)
        
        val cipher = getCipher()
        val spec = GCMParameterSpec(128, iv)
        cipher.init(Cipher.DECRYPT_MODE, getSecretKey(), spec)
        
        val decrypted = cipher.doFinal(encrypted)
        return String(decrypted)
    }
    
    private fun getSecretKey(): SecretKey {
        val keyStore = KeyStore.getInstance("AndroidKeyStore")
        keyStore.load(null)
        
        if (!keyStore.containsAlias(keyAlias)) {
            val keyGenerator = KeyGenerator.getInstance(
                KeyProperties.KEY_ALGORITHM_AES,
                "AndroidKeyStore"
            )
            
            val keyGenParameterSpec = KeyGenParameterSpec.Builder(
                keyAlias,
                KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
            )
                .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
                .setUserAuthenticationRequired(true)
                .setUserAuthenticationValidityDurationSeconds(30)
                .build()
            
            keyGenerator.init(keyGenParameterSpec)
            keyGenerator.generateKey()
        }
        
        return keyStore.getKey(keyAlias, null) as SecretKey
    }
    
    private fun getCipher(): Cipher {
        return Cipher.getInstance(
            "${KeyProperties.KEY_ALGORITHM_AES}/" +
            "${KeyProperties.BLOCK_MODE_GCM}/" +
            "${KeyProperties.ENCRYPTION_PADDING_NONE}"
        )
    }
}