import { logger } from '../../../core/utils/logger.js';
import type { IRouteConfig } from '../models/route-types.js';

/**
 * Validates route configurations for correctness and safety
 */
export class RouteValidator {
  private static readonly VALID_TLS_MODES = ['terminate', 'passthrough', 'terminate-and-reencrypt'];
  private static readonly VALID_ACTION_TYPES = ['forward', 'socket-handler'];
  private static readonly VALID_PROTOCOLS = ['tcp', 'http', 'https', 'ws', 'wss'];
  private static readonly MAX_PORTS = 100;
  private static readonly MAX_DOMAINS = 1000;
  private static readonly MAX_HEADER_SIZE = 8192;

  /**
   * Validate a single route configuration
   */
  public static validateRoute(route: IRouteConfig): { valid: boolean; errors: string[] } {
    const errors: string[] = [];

    // Validate route has a name
    if (!route.name || typeof route.name !== 'string') {
      errors.push('Route must have a valid name');
    }

    // Validate match criteria
    if (!route.match) {
      errors.push('Route must have match criteria');
    } else {
      // Validate ports
      if (route.match.ports) {
        const ports = Array.isArray(route.match.ports) ? route.match.ports : [route.match.ports];
        
        if (ports.length > this.MAX_PORTS) {
          errors.push(`Too many ports specified (max ${this.MAX_PORTS})`);
        }
        
        for (const port of ports) {
          if (typeof port === 'number') {
            if (!this.isValidPort(port)) {
              errors.push(`Invalid port: ${port}. Must be between 1 and 65535`);
            }
          } else if (typeof port === 'object' && 'from' in port && 'to' in port) {
            if (!this.isValidPort(port.from)) {
              errors.push(`Invalid port range start: ${port.from}. Must be between 1 and 65535`);
            }
            if (!this.isValidPort(port.to)) {
              errors.push(`Invalid port range end: ${port.to}. Must be between 1 and 65535`);
            }
            if (port.from > port.to) {
              errors.push(`Invalid port range: ${port.from}-${port.to} (start > end)`);
            }
          } else {
            errors.push(`Invalid port configuration: ${JSON.stringify(port)}`);
          }
        }
      }

      // Validate domains
      if (route.match.domains) {
        const domains = Array.isArray(route.match.domains) ? route.match.domains : [route.match.domains];
        
        if (domains.length > this.MAX_DOMAINS) {
          errors.push(`Too many domains specified (max ${this.MAX_DOMAINS})`);
        }
        
        for (const domain of domains) {
          if (!this.isValidDomain(domain)) {
            errors.push(`Invalid domain pattern: ${domain}`);
          }
        }
      }

      // Validate paths
      if (route.match.path) {
        const paths = Array.isArray(route.match.path) ? route.match.path : [route.match.path];
        
        for (const path of paths) {
          if (!this.isValidPath(path)) {
            errors.push(`Invalid path pattern: ${path}`);
          }
        }
      }

      // Validate client IPs
      if (route.match.clientIp) {
        const ips = Array.isArray(route.match.clientIp) ? route.match.clientIp : [route.match.clientIp];
        
        for (const ip of ips) {
          if (!this.isValidIPPattern(ip)) {
            errors.push(`Invalid IP pattern: ${ip}`);
          }
        }
      }

      // Validate headers
      if (route.match.headers) {
        for (const [key, value] of Object.entries(route.match.headers)) {
          if (key.length > 256) {
            errors.push(`Header name too long: ${key}`);
          }
          
          const headerValue = String(value);
          if (headerValue.length > this.MAX_HEADER_SIZE) {
            errors.push(`Header value too long for ${key} (max ${this.MAX_HEADER_SIZE} bytes)`);
          }
          
          if (!/^[\x20-\x7E]+$/.test(key)) {
            errors.push(`Invalid header name: ${key} (must be printable ASCII)`);
          }
        }
      }

      // Protocol validation removed - not part of IRouteMatch interface
    }

    // Validate action
    if (!route.action) {
      errors.push('Route must have an action');
    } else {
      // Validate action type
      if (!route.action.type || !this.VALID_ACTION_TYPES.includes(route.action.type)) {
        errors.push(`Invalid action type: ${route.action.type}. Must be one of: ${this.VALID_ACTION_TYPES.join(', ')}`);
      }

      // Validate socket-handler
      if (route.action.type === 'socket-handler') {
        if (typeof route.action.socketHandler !== 'function') {
          errors.push('socket-handler action requires a socketHandler function');
        }
      }

      // Validate forward target
      if (route.action.type === 'forward') {
        if (!route.action.targets || route.action.targets.length === 0) {
          errors.push('Forward action must have at least one target');
        } else {
          for (const target of route.action.targets) {
            if (!target.host) {
              errors.push('Target must have a host');
            } else if (typeof target.host !== 'string' && !Array.isArray(target.host) && typeof target.host !== 'function') {
              errors.push('Target host must be a string, array of strings, or function');
            }
            
            if (target.port) {
              if (typeof target.port === 'number' && !this.isValidPort(target.port)) {
                errors.push(`Invalid target port: ${target.port}`);
              } else if (target.port !== 'preserve' && typeof target.port !== 'function' && typeof target.port !== 'number') {
                errors.push(`Invalid target port configuration: ${target.port}`);
              }
            }
          }
        }
      }

      // Validate TLS settings
      if (route.action.tls) {
        if (route.action.tls.mode && !this.VALID_TLS_MODES.includes(route.action.tls.mode)) {
          errors.push(`Invalid TLS mode: ${route.action.tls.mode}. Must be one of: ${this.VALID_TLS_MODES.join(', ')}`);
        }

        if (route.action.tls.certificate) {
          if (route.action.tls.certificate !== 'auto' && typeof route.action.tls.certificate !== 'object') {
            errors.push('TLS certificate must be "auto" or a certificate configuration object');
          }
        }

        if (route.action.tls.versions) {
          for (const version of route.action.tls.versions) {
            if (!['TLSv1', 'TLSv1.1', 'TLSv1.2', 'TLSv1.3'].includes(version)) {
              errors.push(`Invalid TLS version: ${version}`);
            }
          }
        }
      }
    }

    // Validate security settings
    if (route.security) {
      // Validate IP allow/block lists
      if (route.security.ipAllowList) {
        const allowList = Array.isArray(route.security.ipAllowList) ? route.security.ipAllowList : [route.security.ipAllowList];
        
        for (const ip of allowList) {
          if (!this.isValidIPPattern(ip)) {
            errors.push(`Invalid IP pattern in allow list: ${ip}`);
          }
        }
      }

      if (route.security.ipBlockList) {
        const blockList = Array.isArray(route.security.ipBlockList) ? route.security.ipBlockList : [route.security.ipBlockList];
        
        for (const ip of blockList) {
          if (!this.isValidIPPattern(ip)) {
            errors.push(`Invalid IP pattern in block list: ${ip}`);
          }
        }
      }

      // Validate rate limits
      if (route.security.rateLimit) {
        if (route.security.rateLimit.maxRequests && route.security.rateLimit.maxRequests < 0) {
          errors.push('Rate limit maxRequests must be positive');
        }
        
        if (route.security.rateLimit.window && route.security.rateLimit.window < 0) {
          errors.push('Rate limit window must be positive');
        }
      }

      // Validate connection limits
      if (route.security.maxConnections && route.security.maxConnections < 0) {
        errors.push('Max connections must be positive');
      }
    }

    // Validate priority
    if (route.priority !== undefined && (route.priority < 0 || route.priority > 10000)) {
      errors.push('Priority must be between 0 and 10000');
    }

    return {
      valid: errors.length === 0,
      errors
    };
  }

  /**
   * Validate multiple route configurations
   */
  public static validateRoutes(routes: IRouteConfig[]): { valid: boolean; errors: Map<string, string[]> } {
    const errorMap = new Map<string, string[]>();
    let valid = true;

    // Check for duplicate route names
    const routeNames = new Set<string>();
    for (const route of routes) {
      if (route.name && routeNames.has(route.name)) {
        const existingErrors = errorMap.get(route.name) || [];
        existingErrors.push('Duplicate route name');
        errorMap.set(route.name, existingErrors);
        valid = false;
      }
      routeNames.add(route.name);
    }

    // Validate each route
    for (const route of routes) {
      const result = this.validateRoute(route);
      if (!result.valid) {
        errorMap.set(route.name || 'unnamed', result.errors);
        valid = false;
      }
    }

    // Check for conflicting routes
    const conflicts = this.findRouteConflicts(routes);
    if (conflicts.length > 0) {
      for (const conflict of conflicts) {
        const existingErrors = errorMap.get(conflict.route) || [];
        existingErrors.push(conflict.message);
        errorMap.set(conflict.route, existingErrors);
      }
      valid = false;
    }

    return { valid, errors: errorMap };
  }

  /**
   * Find potential conflicts between routes
   */
  private static findRouteConflicts(routes: IRouteConfig[]): Array<{ route: string; message: string }> {
    const conflicts: Array<{ route: string; message: string }> = [];
    
    // Group routes by port
    const portMap = new Map<number, IRouteConfig[]>();
    
    for (const route of routes) {
      if (route.match?.ports) {
        const ports = Array.isArray(route.match.ports) ? route.match.ports : [route.match.ports];
        
        // Expand port ranges to individual ports
        const expandedPorts: number[] = [];
        for (const port of ports) {
          if (typeof port === 'number') {
            expandedPorts.push(port);
          } else if (typeof port === 'object' && 'from' in port && 'to' in port) {
            for (let p = port.from; p <= port.to; p++) {
              expandedPorts.push(p);
            }
          }
        }
        
        for (const port of expandedPorts) {
          const routesOnPort = portMap.get(port) || [];
          routesOnPort.push(route);
          portMap.set(port, routesOnPort);
        }
      }
    }

    // Check for conflicting catch-all routes on the same port
    for (const [port, routesOnPort] of portMap) {
      const catchAllRoutes = routesOnPort.filter(r => 
        !r.match.domains || 
        (Array.isArray(r.match.domains) && r.match.domains.includes('*')) ||
        r.match.domains === '*'
      );
      
      if (catchAllRoutes.length > 1) {
        for (const route of catchAllRoutes) {
          conflicts.push({
            route: route.name,
            message: `Multiple catch-all routes on port ${port}`
          });
        }
      }
    }

    return conflicts;
  }

  /**
   * Validate port number
   */
  private static isValidPort(port: number): boolean {
    return Number.isInteger(port) && port >= 1 && port <= 65535;
  }

  /**
   * Validate domain pattern
   */
  private static isValidDomain(domain: string): boolean {
    if (!domain || typeof domain !== 'string') return false;
    if (domain === '*') return true;
    
    // Basic domain pattern validation
    const domainPattern = /^(\*\.)?([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)*[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$/;
    return domainPattern.test(domain) || domain === 'localhost';
  }

  /**
   * Validate path pattern
   */
  private static isValidPath(path: string): boolean {
    if (!path || typeof path !== 'string') return false;
    if (!path.startsWith('/')) return false;
    
    // Check for invalid characters
    if (!/^[a-zA-Z0-9/_*:{}.-]+$/.test(path)) return false;
    
    // Validate parameter syntax
    const paramPattern = /\{[a-zA-Z_][a-zA-Z0-9_]*\}/g;
    const params = path.match(paramPattern) || [];
    
    for (const param of params) {
      if (param.length > 32) return false;
    }
    
    return true;
  }

  /**
   * Validate IP pattern
   */
  private static isValidIPPattern(ip: string): boolean {
    if (!ip || typeof ip !== 'string') return false;
    if (ip === '*') return true;
    
    // Check for CIDR notation
    if (ip.includes('/')) {
      const [addr, prefix] = ip.split('/');
      const prefixNum = parseInt(prefix, 10);
      
      if (addr.includes(':')) {
        // IPv6 CIDR
        return this.isValidIPv6(addr) && prefixNum >= 0 && prefixNum <= 128;
      } else {
        // IPv4 CIDR
        return this.isValidIPv4(addr) && prefixNum >= 0 && prefixNum <= 32;
      }
    }
    
    // Check for range
    if (ip.includes('-')) {
      const [start, end] = ip.split('-');
      return (this.isValidIPv4(start) && this.isValidIPv4(end)) ||
             (this.isValidIPv6(start) && this.isValidIPv6(end));
    }
    
    // Check for wildcards in IPv4
    if (ip.includes('*') && !ip.includes(':')) {
      const parts = ip.split('.');
      if (parts.length !== 4) return false;
      
      for (const part of parts) {
        if (part !== '*' && !/^\d{1,3}$/.test(part)) return false;
        if (part !== '*' && parseInt(part, 10) > 255) return false;
      }
      
      return true;
    }
    
    // Regular IP address
    return this.isValidIPv4(ip) || this.isValidIPv6(ip);
  }

  /**
   * Validate IPv4 address
   */
  private static isValidIPv4(ip: string): boolean {
    const parts = ip.split('.');
    if (parts.length !== 4) return false;
    
    for (const part of parts) {
      const num = parseInt(part, 10);
      if (isNaN(num) || num < 0 || num > 255) return false;
    }
    
    return true;
  }

  /**
   * Validate IPv6 address
   */
  private static isValidIPv6(ip: string): boolean {
    // Simple IPv6 validation
    const ipv6Pattern = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|::[0-9a-fA-F]{0,4}(:[0-9a-fA-F]{1,4}){0,6}|::1|::)$/;
    return ipv6Pattern.test(ip);
  }

  /**
   * Log validation errors
   */
  public static logValidationErrors(errors: Map<string, string[]>): void {
    for (const [routeName, routeErrors] of errors) {
      logger.log('error', `Route validation failed for ${routeName}:`, {
        route: routeName,
        errors: routeErrors,
        component: 'route-validator'
      });
      
      for (const error of routeErrors) {
        logger.log('error', `  - ${error}`, {
          route: routeName,
          component: 'route-validator'
        });
      }
    }
  }
}