graph LR
    A[本地摄像头/麦克风] --> B[MediaStreamTrack]
    B --> C[RTCRtpSender / 编码器]
    C --> D[Insertable Stream: 加密 Transform]
    D --> E[网络传输 SRTP 密文]
    E --> F[Insertable Stream: 解密 Transform]
    F --> G[RTCRtpReceiver / 解码器]
    G --> H[远端渲染 video/audio 标签]

// peerConnection 已建立并完成协商
const sender = peerConnection.getSenders().find(s => s.track.kind === 'video');

// 1. 获取可插入流
const { readable, writable } = sender.createEncodedStreams();

// 2. 构建加密 Transform
const encryptTransform = new TransformStream({
  async transform(encodedFrame, controller) {
    // 仅处理视频关键帧与关键帧，或根据业务策略决定是否加密音频
    if (encodedFrame.type === 'key') {
      // 关键帧通常较大，建议异步处理避免阻塞
      await encryptFrame(encodedFrame, controller);
    } else {
      // 非关键帧可同步或批量处理
      encryptFrame(encodedFrame, controller);
    }
  }
});

// 3. 连接管道：readable -> encryptTransform -> writable
readable.pipeThrough(encryptTransform).pipeTo(writable);

const KEY_ID_LENGTH = 4; // 字节
const IV_LENGTH = 12;    // AES-GCM 建议 12 字节 IV
const AUTH_TAG_LENGTH = 16;

async function encryptFrame(frame, controller) {
  try {
    // 1. 准备明文数据
    const payload = new Uint8Array(frame.data);
    const keyId = getCurrentKeyId(); // 当前有效密钥索引
    const cryptoKey = getCryptoKey(keyId);

    // 2. 构造 IV：KeyID (4B) + Frame Counter (8B) 或随机数
    const iv = new Uint8Array(IV_LENGTH);
    new DataView(iv.buffer).setUint32(0, keyId, false); // 大端序
    // 后 8 字节使用帧计数器或随机值，确保同一密钥下 IV 不重复
    crypto.getRandomValues(iv.subarray(KEY_ID_LENGTH));

    // 3. 附加数据 (AAD)：保护 Header Extensions 等元数据不被篡改
    // 注意：部分 Header Extension (如 MID, RID) 需保留明文供 SFU 路由
    const aad = buildAAD(frame);

    // 4. 执行加密
    const encryptedData = await crypto.subtle.encrypt(
      { name: 'AES-GCM', iv, additionalData: aad },
      cryptoKey,
      payload
    );

    // 5. 组装新帧：[KeyID(4B) | IV(8B) | Ciphertext | AuthTag(16B)]
    // 规范建议将开销封装在 Frame Metadata 或自定义 Header Extension 中
    // 此处演示直接拼接至 data 前端（需接收端协同解析）
    const newData = new Uint8Array(KEY_ID_LENGTH + IV_LENGTH + encryptedData.byteLength);
    newData.set(new Uint32Array([keyId]).buffer, 0); // KeyID
    newData.set(iv.subarray(KEY_ID_LENGTH), KEY_ID_LENGTH); // IV 后 8 字节
    newData.set(new Uint8Array(encryptedData), KEY_ID_LENGTH + IV_LENGTH);

    // 6. 创建新帧对象（保留原始时间戳、帧类型等元数据）
    const newFrame = new RTCEncodedVideoFrame({
      type: frame.type,
      timestamp: frame.timestamp,
      data: newData.buffer,
      // 关键：若加密导致无法解析原始 Header Extension，需手动携带必要字段
      // 例如：newFrame.getMetadata().width = frame.getMetadata().width;
    });

    controller.enqueue(newFrame);
  } catch (e) {
    console.error('加密失败，丢弃帧:', e);
    // 可选：发送 PLI 请求关键帧重传
  }
}

const receiver = peerConnection.getReceivers().find(r => r.track.kind === 'video');
const { readable, writable } = receiver.createEncodedStreams();

const decryptTransform = new TransformStream({
  async transform(encodedFrame, controller) {
    try {
      const decryptedFrame = await decryptFrame(encodedFrame);
      controller.enqueue(decryptedFrame);
    } catch (e) {
      console.warn('解密失败，丢弃帧:', e);
      // 触发 NACK 或 PLI 请求重传
      requestKeyFrame();
    }
  }
});

readable.pipeThrough(decryptTransform).pipeTo(writable);

async function decryptFrame(frame) {
  const data = new Uint8Array(frame.data);
  const minLength = KEY_ID_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH;
  if (data.length < minLength) throw new Error('数据包长度不足');

  // 1. 解析 KeyID 与 IV
  const keyId = new DataView(data.buffer, 0, KEY_ID_LENGTH).getUint32(0, false);
  const iv = new Uint8Array(IV_LENGTH);
  iv.set(data.subarray(0, KEY_ID_LENGTH), 0); // 前 4 字节 KeyID
  iv.set(data.subarray(KEY_ID_LENGTH, KEY_ID_LENGTH + IV_LENGTH - KEY_ID_LENGTH), KEY_ID_LENGTH); // 后 8 字节

  // 2. 获取密钥
  const cryptoKey = getCryptoKey(keyId);
  if (!cryptoKey) throw new Error(`未找到密钥索引: ${keyId}`);

  // 3. 提取密文与 AAD
  const ciphertext = data.subarray(KEY_ID_LENGTH + IV_LENGTH);
  const aad = buildAAD(frame); // 必须与发送端完全一致

  // 4. 解密验证
  const decryptedPayload = await crypto.subtle.decrypt(
    { name: 'AES-GCM', iv, additionalData: aad },
    cryptoKey,
    ciphertext
  );

  // 5. 还原原始帧结构
  return new RTCEncodedVideoFrame({
    type: frame.type,
    timestamp: frame.timestamp,
    data: decryptedPayload
  });
}

graph TB
    Main[主线程<br/>UI/信令/PC管理] -->|1. createEncodedStreams| Sender[RTCRtpSender]
    Sender -->|2. ReadableStream| Worker[加密 Worker]
    Worker -->|3. TransformStream| Sender
    Receiver[RTCRtpReceiver] -->|4. ReadableStream| DecWorker[解密 Worker]
    DecWorker -->|5. TransformStream| Receiver
    Worker <--->|MessageChannel: 密钥更新/控制指令| Main
    DecWorker <--->|MessageChannel: 密钥更新/错误上报| Main

// main.js - 发送端初始化
const sender = pc.getSenders()[0];
const { readable, writable } = sender.createEncodedStreams();

// 1. 创建 Worker
const encryptWorker = new Worker('encrypt-worker.js', { type: 'module' });

// 2. 将 ReadableStream 传给 Worker (Transferable)
encryptWorker.postMessage({ type: 'INIT_ENCRYPT', readable }, [readable]);

// 3. Worker 返回一个可写的 WritableStream (代理流)
const { readable: proxyReadable, writable: proxyWritable } = new TransformStream();
encryptWorker.postMessage({ type: 'SET_WRITABLE', writable: proxyWritable }, [proxyWritable]);

// 4. 主线程只需管道连接：原始可读 -> Worker处理 -> 代理可写 -> 原始可写
// 注意：此处需借助 IdentityTransformStream 桥接
readable.pipeTo(proxyWritable).catch(console.error); // 主线程仅做管道连接，不处理数据
proxyReadable.pipeTo(writable).catch(console.error);

// encrypt-worker.js
let writeController, cryptoKey, keyIdCounter = 0;

self.onmessage = async (e) => {
  if (e.data.type === 'INIT_ENCRYPT') {
    const readable = e.data.readable;
    // 在 Worker 内部构建完整 Transform 链路
    const transform = new TransformStream({
      async transform(frame, controller) { /* 加密逻辑 */ },
      flush() { /* 清理 */ }
    });
    // 将处理后的流通过 MessageChannel 传回主线程的代理流
    // 此处简化：实际需配合 ReadableStreamDefaultController 操作
    readable.pipeThrough(transform).pipeTo(writeController); 
  } else if (e.data.type === 'SET_WRITABLE') {
    writeController = e.data.writable.getWriter();
  } else if (e.data.type === 'KEY_UPDATE') {
    await rotateKey(e.data.keyMaterial);
  }
};

// lib.rs
use wasm_bindgen::prelude::*;
use aes_gcm::{Aes256Gcm, Key, Nonce, KeyInit};
use aes_gcm::aead::{Aead, Payload};

#[wasm_bindgen]
pub struct EncryptContext {
    cipher: Aes256Gcm,
    key_id: u32,
    counter: u64,
}

#[wasm_bindgen]
impl EncryptContext {
    #[wasm_bindgen(constructor)]
    pub fn new(key_ptr: *const u8, key_len: usize, key_id: u32) -> Result<EncryptContext, JsValue> {
        // 安全：从线性内存读取密钥材料
        let key_slice = unsafe { std::slice::from_raw_parts(key_ptr, key_len) };
        let key = Key::<Aes256Gcm>::from_slice(key_slice);
        Ok(Self { cipher: Aes256Gcm::new(key), key_id, counter: 0 })
    }

    /// 加密单帧：输入输出均为线性内存指针，避免 JS<->WASM 拷贝
    /// 返回值：加密后总长度 (u32)，错误码写入最后 4 字节
    #[wasm_bindgen]
    pub fn encrypt_frame(
        &mut self,
        in_ptr: *const u8, in_len: usize,
        out_ptr: *mut u8, out_cap: usize,
        aad_ptr: *const u8, aad_len: usize
    ) -> u32 {
        // 1. 构造 Nonce: KeyID(4B) + Counter(8B) -> 12B
        let mut nonce_bytes = [0u8; 12];
        nonce_bytes[0..4].copy_from_slice(&self.key_id.to_be_bytes());
        nonce_bytes[4..12].copy_from_slice(&self.counter.to_be_bytes());
        self.counter = self.counter.wrapping_add(1);
        let nonce = Nonce::from_slice(&nonce_bytes);

        // 2. 读取明文
        let plaintext = unsafe { std::slice::from_raw_parts(in_ptr, in_len) };
        let aad = unsafe { std::slice::from_raw_parts(aad_ptr, aad_len) };

        // 3. 加密 (原地或输出缓冲区)
        // 输出格式: [KeyID(4B) | Nonce_Suffix(8B) | Ciphertext | Tag(16B)]
        let payload = Payload { msg: plaintext, aad };
        let ciphertext = match self.cipher.encrypt_in_place_detached(nonce, aad, plaintext) {
            Ok(tag) => tag,
            Err(_) => return u32::MAX, // 错误码
        };

        // 4. 写入输出缓冲区 (需调用方保证 out_cap >= 4+8+in_len+16)
        let out_slice = unsafe { std::slice::from_raw_parts_mut(out_ptr, out_cap) };
        out_slice[0..4].copy_from_slice(&self.key_id.to_be_bytes());
        out_slice[4..12].copy_from_slice(&nonce_bytes[4..]);
        // ciphertext 已在 plaintext 缓冲区原地修改 (encrypt_in_place)
        // 此处需根据实际内存布局决定是否需拷贝，建议输入输出共用大缓冲区池
        // 简化演示：假设输入输出同缓冲区
        let tag_start = 12 + in_len;
        out_slice[tag_start..tag_start+16].copy_from_slice(&ciphertext);

        (12 + in_len + 16) as u32 // 返回实际长度
    }
}

// 加密 Transform 中
const spatialId = frame.getMetadata().spatialIndex ?? 0; // 0=BL, 1=EL1...
const temporalId = frame.getMetadata().temporalIndex ?? 0;

// AAD 中显式绑定层信息，防止层替换攻击
const aad = buildAAD({
  ssrc: frame.getMetadata().ssrc,
  rid: frame.getMetadata().rid,
  spatialId,
  temporalId,
  frameId: frame.getMetadata().frameId
});

// 关键：所有层使用同一 CryptoKey，但 Nonce 包含 spatialId/temporalId
// Nonce = KeyID(4B) | SpatialID(1B) | TemporalID(1B) | FrameCounter(6B)

SFrame Header: [KeyID (varint) | Counter (varint) | CipherSuite (1B, 可选)]
Encrypted Payload: AES-GCM / ChaCha20-Poly1305 (Payload + Auth Tag)

// encrypt.transform.test.ts (Vitest/Jest)
import { EncryptTransform } from './encrypt-transform';
import { MockReadableStream, MockWritableStream } from './stream-mocks';

describe('EncryptTransform', () => {
  it('should encrypt key frame and preserve metadata', async () => {
    const keyMaterial = crypto.getRandomValues(new Uint8Array(32));
    const transform = new EncryptTransform(keyMaterial);
    
    const inputFrame = createMockVideoFrame({ type: 'key', timestamp: 90000 });
    const readable = new MockReadableStream([inputFrame]);
    const writable = new MockWritableStream();
    
    await readable.pipeThrough(transform).pipeTo(writable);
    
    const outputFrame = writable.chunks[0];
    expect(outputFrame.type).toBe('key');
    expect(outputFrame.timestamp).toBe(90000);
    expect(outputFrame.data.byteLength).toBeGreaterThan(inputFrame.data.byteLength + 28); // Overhead check
    
    // 解密回环验证
    const decryptTransform = new DecryptTransform(keyMaterial);
    const decrypted = await new MockReadableStream([outputFrame])
      .pipeThrough(decryptTransform)
      .pipeTo(new MockWritableStream());
    expect(new Uint8Array(decrypted.chunks[0].data)).toEqual(new Uint8Array(inputFrame.data));
  });

  it('should handle out-of-order frames with sliding window replay protection', async () => {
    // ... 模拟乱序帧，验证滑动窗口拒绝重放包
  });
});

# 加密/解密端到端延迟 (ms)
histogram_quantile(0.99, rate(e2ee_encrypt_duration_ms_bucket[5m]))
histogram_quantile(0.99, rate(e2ee_decrypt_duration_ms_bucket[5m]))

# 解密失败率 (按错误码分类)
sum(rate(e2ee_decrypt_fail_total{code="AUTH_TAG_MISMATCH"}[5m])) 
  / sum(rate(e2ee_decrypt_total[5m]))

# 密钥轮换成功率 & 耗时
rate(e2ee_key_rotation_success_total[5m])
histogram_quantile(0.95, rate(e2ee_key_rotation_duration_ms_bucket[5m]))

# Worker 健康度
process_resident_memory_bytes{job="e2ee-worker"}
worker_restart_total

graph LR
    Cam[摄像头] --> VC[VideoEncoder<br/>WebCodecs + 硬编]
    VC -->|EncodedVideoChunk| E2EE[E2EE Transform<br/>WASM/SFrame]
    E2EE -->|RTCEncodedVideoFrame| Net[RTCRtpSender<br/>WebRTC NV]
    Net --> NetWire[网络]
    NetWire --> NetRecv[RTCRtpReceiver]
    NetRecv -->|RTCEncodedVideoFrame| E2EED[E2EE Transform]
    E2EED -->|EncodedVideoChunk| VD[VideoDecoder<br/>WebCodecs + 硬解]
    VD --> Render[VideoFrame -> Canvas/WebGL]