package main

import (
	"bufio"
	"context"
	"errors"
	"fmt"
	"io"
	"os"
	"path/filepath"
	"strings"
	"syscall"

	tea "github.com/charmbracelet/bubbletea"

	"proxyctl/internal/app"
	"proxyctl/internal/apt"
	"proxyctl/internal/dockerclient"
	"proxyctl/internal/dockerdaemon"
	"proxyctl/internal/gnome"
	"proxyctl/internal/operationlock"
	"proxyctl/internal/oplog"
	"proxyctl/internal/profile"
	"proxyctl/internal/shell"
	"proxyctl/internal/target"
	"proxyctl/internal/tui"
)

// version is overridden for releases with -ldflags "-X main.version=<version>".
var version = "dev"

func main() {
	if err := run(os.Args[1:], os.Stdin, os.Stdout); err != nil {
		fmt.Fprintln(os.Stderr, "proxyctl:", err)
		os.Exit(1)
	}
}

func run(args []string, input io.Reader, output io.Writer) error {
	return runWithSystemTargets(args, input, output, nil)
}

// runWithSystemTargets keeps process smoke tests hermetic. A nil slice selects
// production system Targets; a non-nil slice supplies fakes (or no Targets).
func runWithSystemTargets(args []string, input io.Reader, output io.Writer, systemTargets []target.Target) error {
	executable, err := os.Executable()
	if err != nil {
		return fmt.Errorf("locate proxyctl executable: %w", err)
	}
	return runWithEnvironmentAndTargets(args, input, output, processEnvironment{}, nil, executable, systemTargets)
}

type processEnvironment struct{}

var (
	processCurrentUser       = profile.SystemCurrentUser
	processLookupUser        = profile.SystemLookupUser
	processProductionTargets = productionTargets
)

func (processEnvironment) CurrentUser() (profile.UserIdentity, error) {
	return processCurrentUser()
}
func (processEnvironment) LookupUser(name string) (profile.UserIdentity, error) {
	return processLookupUser(name)
}
func (processEnvironment) LookupEnv(name string) (string, bool) { return os.LookupEnv(name) }

func runWithEnvironment(args []string, input io.Reader, output io.Writer, environment profile.IdentityEnvironment, files shell.FileSystem, executable string) error {
	return runWithEnvironmentAndTargets(args, input, output, environment, files, executable, nil)
}

func runWithEnvironmentAndTargets(args []string, input io.Reader, output io.Writer, environment profile.IdentityEnvironment, files shell.FileSystem, executable string, systemTargets []target.Target) error {
	if len(args) == 1 && args[0] == "version" {
		fmt.Fprintf(output, "proxyctl version %s\n", version)
		return nil
	}
	if len(args) == 2 && args[0] == "version" && args[1] == "--short" {
		fmt.Fprintln(output, version)
		return nil
	}

	profileConfiguration, err := profile.ResolveConfiguration(environment)
	if err != nil {
		if len(args) == 1 && args[0] == "doctor" {
			fmt.Fprintf(output, "[FAIL] identity resolution — %s\n", profile.RedactText(err.Error()))
		}
		return err
	}
	shellConfiguration, err := shell.ResolveConfiguration(environment)
	if err != nil {
		if len(args) == 1 && args[0] == "doctor" {
			fmt.Fprintf(output, "[FAIL] Shell Target configuration — %s\n", profile.RedactText(err.Error()))
		}
		return err
	}
	shellTarget := shell.New(shellConfiguration, files, environment)
	if systemTargets == nil {
		systemTargets, err = processProductionTargets(environment)
		if err != nil {
			return err
		}
	}
	targets := append([]target.Target{shellTarget}, systemTargets...)
	stateDirectory := filepath.Dir(shellConfiguration.RecoveryFile)
	userMutationLock := operationlock.NewOwned(filepath.Join(stateDirectory, "operation.lock"), profileConfiguration.Owner.UID, profileConfiguration.Owner.GID)
	var mutationLock app.MutationLock = userMutationLock
	if os.Geteuid() == 0 {
		// Every elevated process also takes a root-owned lock that the invoking
		// user cannot replace while a system Target mutation is in flight.
		mutationLock = operationlock.NewGroup(
			operationlock.New("/run/lock/proxyctl/operation.lock"),
			userMutationLock,
		)
	}
	logger := oplog.NewOwned(filepath.Join(stateDirectory, "operations.log"), 64*1024, 3, profileConfiguration.Owner.UID, profileConfiguration.Owner.GID)
	store := profile.NewOwnedFileStoreAt(profileConfiguration.Path, profileConfiguration.Owner, profileConfiguration.TrustedRoot)

	if len(args) != 0 {
		switch {
		case len(args) == 2 && args[0] == "shell" && (args[1] == "install" || args[1] == "uninstall"):
			availability := shellTarget.Availability(context.Background())
			if !availability.Available {
				return fmt.Errorf("Shell Target unavailable: %s", availability.Evidence)
			}
			unlock, err := mutationLock.Lock(context.Background())
			if err != nil {
				return fmt.Errorf("lock proxyctl mutation: %w", err)
			}
			defer unlock()
			operation := "shell-" + args[1]
			var operationErr error
			if args[1] == "install" {
				operationErr = shellTarget.Install(context.Background(), executable)
			} else {
				operationErr = shellTarget.Uninstall(context.Background())
			}
			result, detail := "success", "Shell integration changed"
			if operationErr != nil {
				result, detail = "failure", operationErr.Error()
			}
			logErr := logger.Write(app.LogEntry{Operation: operation, Target: shellTarget.ID(), Result: result, Detail: detail})
			if operationErr != nil {
				return errors.Join(operationErr, logErr)
			}
			if logErr != nil {
				return fmt.Errorf("Shell integration changed but the operation log could not be written: %w", logErr)
			}
			if args[1] == "install" {
				fmt.Fprintln(output, "Shell integration installed; restart or source your Shell startup file once.")
			} else {
				fmt.Fprintln(output, "Shell integration uninstalled.")
			}
			return nil
		case len(args) == 1 && args[0] == "doctor":
			checks := diagnosticChecks(profileConfiguration)
			return runMaintenanceCommand(args, input, output, store, targets, mutationLock, logger, checks)
		case len(args) == 1 && args[0] == "reset":
			return runMaintenanceCommand(args, input, output, store, targets, mutationLock, logger, nil)
		default:
			return fmt.Errorf("usage: proxyctl [version [--short]|doctor|reset|shell install|shell uninstall]")
		}
	}

	application, err := app.NewWithTargetsAndRuntime(store, targets, mutationLock, logger)
	if err != nil {
		return err
	}
	program := tea.NewProgram(tui.NewModel(application, tui.WithOutput(output)), tea.WithInput(input), tea.WithOutput(output), tea.WithAltScreen())
	_, err = program.Run()
	return err
}

func productionTargets(environment profile.IdentityEnvironment) ([]target.Target, error) {
	dockerClientConfiguration, err := dockerclient.ResolveConfiguration(environment)
	if err != nil {
		return nil, fmt.Errorf("resolve Docker containers/builds Target configuration: %w", err)
	}
	gnomeConfiguration, err := gnome.ResolveConfiguration(environment)
	if err != nil {
		return nil, fmt.Errorf("resolve GNOME Target configuration: %w", err)
	}
	return []target.Target{
		apt.New(apt.DefaultConfiguration(), nil, nil),
		dockerclient.New(dockerClientConfiguration, nil),
		gnome.New(gnomeConfiguration, nil, nil),
		dockerdaemon.New(dockerdaemon.DefaultConfiguration(), nil, nil),
	}, nil
}

func runMaintenanceCommand(args []string, input io.Reader, output io.Writer, store *profile.FileStore, targets []target.Target, mutationLock app.MutationLock, logger app.OperationLogger, checks []target.Check) error {
	if len(args) != 1 {
		return errors.New("invalid maintenance command")
	}
	if args[0] == "doctor" {
		state, err := store.ReadOnlyLoad()
		profileCheck := target.Check{Name: "Profile validity", OK: err == nil, Evidence: "Profile configuration is valid"}
		if err != nil {
			profileCheck.Evidence = err.Error()
		}
		checks = append([]target.Check{profileCheck}, checks...)
		report := app.NewMaintenance(state, targets, nil, nil).Doctor(context.Background(), checks)
		fmt.Fprint(output, report.String())
		if !report.Healthy() {
			return errors.New("doctor found configuration problems")
		}
		return nil
	}
	if args[0] != "reset" {
		return errors.New("invalid maintenance command")
	}
	readOnlyState, readOnlyErr := store.ReadOnlyLoad()
	if readOnlyErr != nil {
		return fmt.Errorf("inspect Profile state before reset confirmation: %w", readOnlyErr)
	}
	warning := app.NewMaintenance(readOnlyState, targets, nil, nil).ResetConfirmation(context.Background())
	fmt.Fprintln(output, "Reset every managed Target and restore recorded original state?")
	if warning != "" {
		fmt.Fprintln(output, warning)
	}
	fmt.Fprint(output, "Continue? [y/N] ")
	answer, _ := bufio.NewReader(input).ReadString('\n')
	answer = strings.ToLower(strings.TrimSpace(answer))
	if answer != "y" && answer != "yes" {
		fmt.Fprintln(output, "Reset cancelled; no Targets changed.")
		return nil
	}
	if mutationLock == nil {
		return errors.New("mutation lock is not configured")
	}
	unlock, err := mutationLock.Lock(context.Background())
	if err != nil {
		return fmt.Errorf("lock proxyctl mutation: %w", err)
	}
	defer unlock()
	state, err := store.Load()
	if err != nil {
		return err
	}
	result := app.NewMaintenance(state, targets, heldMutationLock{}, logger).Reset(context.Background(), true)
	for _, item := range result.Targets {
		if item.Skipped {
			fmt.Fprintf(output, "%s: skipped (%s) — %s\n", item.TargetID, item.Inspection.State, profile.RedactText(item.Inspection.Evidence))
			continue
		}
		if item.OperationErr != nil {
			fmt.Fprintf(output, "%s: failed (%s) — %s; fresh inspection: %s\n", item.TargetID, item.Inspection.State, profile.RedactText(item.OperationErr.Error()), profile.RedactText(item.Inspection.Evidence))
			if item.LogErr != nil {
				fmt.Fprintf(output, "%s: operation logging also failed — %s\n", item.TargetID, profile.RedactText(item.LogErr.Error()))
			}
			continue
		}
		if item.LogErr != nil {
			fmt.Fprintf(output, "%s: reset (%s) — %s; operation logging failed — %s\n", item.TargetID, item.Inspection.State, profile.RedactText(item.Inspection.Evidence), profile.RedactText(item.LogErr.Error()))
			continue
		}
		fmt.Fprintf(output, "%s: reset (%s) — %s\n", item.TargetID, item.Inspection.State, profile.RedactText(item.Inspection.Evidence))
	}
	return result.Err
}

type heldMutationLock struct{}

func (heldMutationLock) Lock(context.Context) (func(), error) { return func() {}, nil }

func diagnosticChecks(configuration profile.Configuration) []target.Check {
	identity := target.Check{Name: "identity resolution", OK: true, Evidence: fmt.Sprintf("configuration owner %s (uid %d, gid %d)", configuration.Owner.Username, configuration.Owner.UID, configuration.Owner.GID)}
	ok, evidence := storagePermissions(configuration)
	storage := target.Check{Name: "storage permissions", OK: ok, Evidence: evidence}
	return []target.Check{identity, storage}
}

func storagePermissions(configuration profile.Configuration) (bool, string) {
	authority := target.ReadOnlyWriteAuthority(configuration.Path)
	if !authority.OK {
		return false, authority.Evidence
	}
	info, err := os.Lstat(configuration.Path)
	if os.IsNotExist(err) {
		return true, authority.Evidence + "; Profile configuration does not exist yet"
	}
	if err != nil {
		return false, authority.Evidence + "; Profile configuration cannot be inspected: " + err.Error()
	}
	if info.Mode().Perm() != 0o600 {
		return false, fmt.Sprintf("%s; Profile configuration mode is %o, want 600", authority.Evidence, info.Mode().Perm())
	}
	if stat, present := info.Sys().(*syscall.Stat_t); present && int(stat.Uid) != configuration.Owner.UID {
		return false, fmt.Sprintf("%s; Profile configuration owner uid is %d, want %d", authority.Evidence, stat.Uid, configuration.Owner.UID)
	}
	return true, authority.Evidence + "; Profile configuration is owner-only"
}