#!/usr/bin/env python3
"""自动创建 VLESS-Reality 入站并输出 vless:// 链接
用法: sudo python3 add-vless-reality.py [--port 35215] [--email user-01]
凭证: 环境变量 XUI_USER/XUI_PASS 或 /etc/x-ui/install-result.env
"""
import http.cookiejar, json, secrets, subprocess, socket, sys
import urllib.request, urllib.parse, argparse, os

XRAY = "/usr/local/x-ui/bin/xray-linux-amd64"
DB, INSTALL_ENV, TIMEOUT = "/etc/x-ui/x-ui.db", "/etc/x-ui/install-result.env", 15

def db(sql):
    p = subprocess.Popen(["sqlite3", DB, sql], stdout=subprocess.PIPE)
    return p.communicate()[0].decode().strip()

def load_creds():
    if os.environ.get("XUI_USER") and os.environ.get("XUI_PASS"):
        return os.environ["XUI_USER"], os.environ["XUI_PASS"]
    env = {}
    for line in open(INSTALL_ENV):
        if "=" in line:
            k, v = line.split("=", 1); env[k.strip()] = v.strip()
    return env.get("XUI_USERNAME"), env.get("XUI_PASSWORD")

def run(c):  # py3.6 兼容的 subprocess.run
    p = subprocess.Popen(c, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    o, _ = p.communicate(timeout=20); return o.decode()

port_ = db("SELECT value FROM settings WHERE key='webPort'")
path_ = db("SELECT value FROM settings WHERE key='webBasePath'")

ap = argparse.ArgumentParser()
ap.add_argument("--remark", default="Auto-VLESS")
ap.add_argument("--port", type=int, default=35215)
ap.add_argument("--email", default="user-01")
ap.add_argument("--dest", default="www.microsoft.com:443")
args = ap.parse_args()

# 密钥材料
uuid = run(["cat", "/proc/sys/kernel/random/uuid"]).strip()
kp = dict(l.split(":", 1) for l in run([XRAY, "x25519"]).splitlines() if ":" in l)
priv = kp["PrivateKey"].strip(); pub = kp["Password (PublicKey)"].strip()
sid = secrets.token_hex(8)

# API 会话（新版必须先拿 CSRF token）
base = f"http://127.0.0.1:{port_}/{path_.strip('/')}/"
jar = http.cookiejar.CookieJar()
opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(jar))
opener.open(base, timeout=TIMEOUT).read()
req = urllib.request.Request(base + "csrf-token",
        headers={"X-Requested-With": "XMLHttpRequest"})
csrf = json.loads(opener.open(req, timeout=TIMEOUT).read())["obj"]
user, pw = load_creds()
opener.open(urllib.request.Request(base + "login",
    data=json.dumps({"username": user, "password": pw}).encode(),
    headers={"Content-Type": "application/json",
             "X-CSRF-Token": csrf,
             "X-Requested-With": "XMLHttpRequest"}), timeout=TIMEOUT).read()

def api(path, payload):
    req = urllib.request.Request(base + path, data=json.dumps(payload).encode(),
        headers={"Content-Type": "application/json",
                 "X-CSRF-Token": csrf,
                 "X-Requested-With": "XMLHttpRequest"})
    return json.loads(opener.open(req, timeout=TIMEOUT).read())

# 1) 建入站
stream = {
    "network": "tcp", "security": "reality",
    "tcpSettings": {"acceptProxyProtocol": False, "header": {"type": "none"}},
    "realitySettings": {
        "show": False, "xver": 0, "target": args.dest,
        "serverNames": [args.dest.split(":")[0]], "privateKey": priv,
        "shortIds": [sid],
        "settings": {"publicKey": pub, "fingerprint": "chrome"},
    },
}
r = api("panel/api/inbounds/add", {
    "remark": args.remark, "enable": True, "listen": "", "port": args.port,
    "protocol": "vless",
    "settings": json.dumps({"clients": [], "decryption": "none"}),
    "streamSettings": json.dumps(stream),
    "sniffing": json.dumps({"enabled": True, "destOverride": ["http", "tls"]}),
})
ib_id = r["obj"]["id"]

# 2) 挂客户端（分叉版格式；官方版换成扁平 payload）
api("panel/api/clients/add", {
    "client": {"email": args.email, "uuid": uuid,
               "flow": "xtls-rprx-vision", "enable": True},
    "inboundIds": [ib_id],
})

# 3) 分叉版可能需要重启才写入运行配置
subprocess.call(["systemctl", "restart", "x-ui"])

# 4) 从数据库读回真实 uuid（面板可能重新生成）
row = db(f"SELECT c.uuid FROM clients c JOIN client_inbounds ci "
         f"ON c.id=ci.client_id WHERE ci.inbound_id={ib_id} AND c.email='{args.email}'")
uuid = row.strip()

ip = db("SELECT value FROM settings WHERE key='externalProxy'") or "YOUR_SERVER_IP"
link = (f"vless://{uuid}@{ip}:{args.port}?"
        + urllib.parse.urlencode({
            "type": "tcp", "security": "reality", "encryption": "none",
            "sni": args.dest.split(":")[0], "fp": "chrome",
            "pbk": pub, "sid": sid, "flow": "xtls-rprx-vision"})
        + f"#{args.email}")
print(link)