/**
 * SMTP Command Handler
 * Responsible for parsing and handling SMTP commands
 */

import * as plugins from '../../../plugins.js';
import { SmtpState } from './interfaces.js';
import type { ISmtpSession, IEnvelopeRecipient } from './interfaces.js';
import type { ICommandHandler, ISessionManager, IDataHandler, ITlsHandler, ISecurityHandler } from './interfaces.js';
import { SmtpCommand, SmtpResponseCode, SMTP_DEFAULTS, SMTP_EXTENSIONS } from './constants.js';
import { SmtpLogger } from './utils/logging.js';
import { extractCommandName, extractCommandArgs, formatMultilineResponse } from './utils/helpers.js';
import { validateEhlo, validateMailFrom, validateRcptTo, isValidCommandSequence } from './utils/validation.js';

/**
 * Handles SMTP commands and responses
 */
export class CommandHandler implements ICommandHandler {
  /**
   * Session manager instance
   */
  private sessionManager: ISessionManager;
  
  /**
   * Data handler instance (optional, injected when processing DATA command)
   */
  private dataHandler?: IDataHandler;
  
  /**
   * TLS handler instance (optional, injected when processing STARTTLS command)
   */
  private tlsHandler?: ITlsHandler;
  
  /**
   * Security handler instance (optional, used for IP reputation and authentication)
   */
  private securityHandler?: ISecurityHandler;
  
  /**
   * SMTP server options
   */
  private options: {
    hostname: string;
    size?: number;
    maxRecipients: number;
    auth?: {
      required: boolean;
      methods: ('PLAIN' | 'LOGIN' | 'OAUTH2')[];
    };
  };
  
  /**
   * Creates a new command handler
   * @param sessionManager - Session manager instance
   * @param options - Command handler options
   * @param dataHandler - Optional data handler instance
   * @param tlsHandler - Optional TLS handler instance
   * @param securityHandler - Optional security handler instance
   */
  constructor(
    sessionManager: ISessionManager,
    options: {
      hostname?: string;
      size?: number;
      maxRecipients?: number;
      auth?: {
        required: boolean;
        methods: ('PLAIN' | 'LOGIN' | 'OAUTH2')[];
      };
    } = {},
    dataHandler?: IDataHandler,
    tlsHandler?: ITlsHandler,
    securityHandler?: ISecurityHandler
  ) {
    this.sessionManager = sessionManager;
    this.dataHandler = dataHandler;
    this.tlsHandler = tlsHandler;
    this.securityHandler = securityHandler;
    
    this.options = {
      hostname: options.hostname || SMTP_DEFAULTS.HOSTNAME,
      size: options.size || SMTP_DEFAULTS.MAX_MESSAGE_SIZE,
      maxRecipients: options.maxRecipients || SMTP_DEFAULTS.MAX_RECIPIENTS,
      auth: options.auth
    };
  }
  
  /**
   * Process a command from the client
   * @param socket - Client socket
   * @param commandLine - Command line from client
   */
  public processCommand(socket: plugins.net.Socket | plugins.tls.TLSSocket, commandLine: string): void {
    // Get the session for this socket
    const session = this.sessionManager.getSession(socket);
    if (!session) {
      SmtpLogger.warn(`No session found for socket from ${socket.remoteAddress}`);
      this.sendResponse(socket, `${SmtpResponseCode.LOCAL_ERROR} Internal server error - session not found`);
      socket.end();
      return;
    }
    
    // Handle data state differently - pass to data handler
    if (session.state === SmtpState.DATA_RECEIVING) {
      if (this.dataHandler) {
        // Let the data handler process the line
        this.dataHandler.processEmailData(socket, commandLine)
          .catch(error => {
            SmtpLogger.error(`Error processing email data: ${error.message}`, { 
              sessionId: session.id,
              error
            });
            
            this.sendResponse(socket, `${SmtpResponseCode.LOCAL_ERROR} Error processing email data: ${error.message}`);
            this.resetSession(session);
          });
      } else {
        // No data handler available
        SmtpLogger.error('Data handler not available', { sessionId: session.id });
        this.sendResponse(socket, `${SmtpResponseCode.LOCAL_ERROR} Internal server error - data handler not available`);
        this.resetSession(session);
      }
      return;
    }
    
    // Handle command pipelining (RFC 2920)
    // Multiple commands can be sent in a single TCP packet
    if (commandLine.includes('\r\n') || commandLine.includes('\n')) {
      // Split the commandLine into individual commands by newline
      const commands = commandLine.split(/\r\n|\n/).filter(line => line.trim().length > 0);
      
      if (commands.length > 1) {
        SmtpLogger.debug(`Command pipelining detected: ${commands.length} commands`, {
          sessionId: session.id,
          commandCount: commands.length
        });
        
        // Process each command separately (recursively call processCommand)
        for (const cmd of commands) {
          this.processCommand(socket, cmd);
        }
        return;
      }
    }
    
    // Log received command (single command case)
    SmtpLogger.logCommand(commandLine, socket, session);
    
    // Extract command and arguments
    const command = extractCommandName(commandLine);
    const args = extractCommandArgs(commandLine);
    
    // Validate command sequence
    if (!this.validateCommandSequence(command, session)) {
      this.sendResponse(socket, `${SmtpResponseCode.BAD_SEQUENCE} Bad sequence of commands`);
      return;
    }
    
    // Process the command
    switch (command) {
      case SmtpCommand.EHLO:
      case SmtpCommand.HELO:
        this.handleEhlo(socket, args);
        break;
        
      case SmtpCommand.MAIL_FROM:
        this.handleMailFrom(socket, args);
        break;
        
      case SmtpCommand.RCPT_TO:
        this.handleRcptTo(socket, args);
        break;
        
      case SmtpCommand.DATA:
        this.handleData(socket);
        break;
        
      case SmtpCommand.RSET:
        this.handleRset(socket);
        break;
        
      case SmtpCommand.NOOP:
        this.handleNoop(socket);
        break;
        
      case SmtpCommand.QUIT:
        this.handleQuit(socket);
        break;
        
      case SmtpCommand.STARTTLS:
        if (this.tlsHandler && this.tlsHandler.isTlsEnabled()) {
          this.tlsHandler.handleStartTls(socket);
        } else {
          SmtpLogger.warn('STARTTLS requested but TLS is not enabled', {
            remoteAddress: socket.remoteAddress,
            remotePort: socket.remotePort
          });
          this.sendResponse(socket, `${SmtpResponseCode.TLS_UNAVAILABLE_TEMP} STARTTLS not available at this time`);
        }
        break;
        
      case SmtpCommand.AUTH:
        this.handleAuth(socket, args);
        break;
        
      case SmtpCommand.HELP:
        this.handleHelp(socket, args);
        break;
        
      case SmtpCommand.VRFY:
        this.handleVrfy(socket, args);
        break;
        
      case SmtpCommand.EXPN:
        this.handleExpn(socket, args);
        break;
        
      default:
        this.sendResponse(socket, `${SmtpResponseCode.COMMAND_NOT_IMPLEMENTED} Command not implemented`);
        break;
    }
  }
  
  /**
   * Send a response to the client
   * @param socket - Client socket
   * @param response - Response to send
   */
  public sendResponse(socket: plugins.net.Socket | plugins.tls.TLSSocket, response: string): void {
    try {
      socket.write(`${response}${SMTP_DEFAULTS.CRLF}`);
      SmtpLogger.logResponse(response, socket);
    } catch (error) {
      // Attempt to recover from known transient errors
      if (this.isRecoverableSocketError(error)) {
        this.handleSocketError(socket, error, response);
      } else {
        // Log error and destroy socket for non-recoverable errors
        SmtpLogger.error(`Error sending response: ${error instanceof Error ? error.message : String(error)}`, {
          response,
          remoteAddress: socket.remoteAddress,
          remotePort: socket.remotePort,
          error: error instanceof Error ? error : new Error(String(error))
        });
        
        socket.destroy();
      }
    }
  }
  
  /**
   * Check if a socket error is potentially recoverable
   * @param error - The error that occurred
   * @returns Whether the error is potentially recoverable
   */
  private isRecoverableSocketError(error: unknown): boolean {
    const recoverableErrorCodes = [
      'EPIPE',       // Broken pipe
      'ECONNRESET',  // Connection reset by peer
      'ETIMEDOUT',   // Connection timed out
      'ECONNABORTED' // Connection aborted
    ];
    
    return (
      error instanceof Error && 
      'code' in error && 
      typeof (error as any).code === 'string' && 
      recoverableErrorCodes.includes((error as any).code)
    );
  }
  
  /**
   * Handle recoverable socket errors with retry logic
   * @param socket - Client socket
   * @param error - The error that occurred
   * @param response - The response that failed to send
   */
  private handleSocketError(socket: plugins.net.Socket | plugins.tls.TLSSocket, error: unknown, response: string): void {
    // Get the session for this socket
    const session = this.sessionManager.getSession(socket);
    if (!session) {
      SmtpLogger.error(`Session not found when handling socket error`);
      socket.destroy();
      return;
    }
    
    // Get error details for logging
    const errorMessage = error instanceof Error ? error.message : String(error);
    const errorCode = error instanceof Error && 'code' in error ? (error as any).code : 'UNKNOWN';
    
    SmtpLogger.warn(`Recoverable socket error (${errorCode}): ${errorMessage}`, {
      sessionId: session.id,
      remoteAddress: session.remoteAddress,
      error: error instanceof Error ? error : new Error(String(error))
    });
    
    // Check if socket is already destroyed
    if (socket.destroyed) {
      SmtpLogger.info(`Socket already destroyed, cannot retry operation`);
      return;
    }
    
    // Check if socket is writeable
    if (!socket.writable) {
      SmtpLogger.info(`Socket no longer writable, aborting recovery attempt`);
      socket.destroy();
      return;
    }
    
    // Attempt to retry the write operation after a short delay
    setTimeout(() => {
      try {
        if (!socket.destroyed && socket.writable) {
          socket.write(`${response}${SMTP_DEFAULTS.CRLF}`);
          SmtpLogger.info(`Successfully retried send operation after error`);
        } else {
          SmtpLogger.warn(`Socket no longer available for retry`);
          if (!socket.destroyed) {
            socket.destroy();
          }
        }
      } catch (retryError) {
        SmtpLogger.error(`Retry attempt failed: ${retryError instanceof Error ? retryError.message : String(retryError)}`);
        if (!socket.destroyed) {
          socket.destroy();
        }
      }
    }, 100); // Short delay before retry
  }
  
  /**
   * Handle EHLO command
   * @param socket - Client socket
   * @param clientHostname - Client hostname from EHLO command
   */
  public handleEhlo(socket: plugins.net.Socket | plugins.tls.TLSSocket, clientHostname: string): void {
    // Get the session for this socket
    const session = this.sessionManager.getSession(socket);
    if (!session) {
      this.sendResponse(socket, `${SmtpResponseCode.LOCAL_ERROR} Internal server error - session not found`);
      return;
    }
    
    // Extract command and arguments from clientHostname
    // EHLO/HELO might come with the command itself in the arguments string
    let hostname = clientHostname;
    if (hostname.toUpperCase().startsWith('EHLO ') || hostname.toUpperCase().startsWith('HELO ')) {
      hostname = hostname.substring(5).trim();
    }
    
    // Check for empty hostname
    if (!hostname) {
      this.sendResponse(socket, `${SmtpResponseCode.SYNTAX_ERROR_PARAMETERS} Missing domain name`);
      return;
    }
    
    // Validate EHLO hostname
    const validation = validateEhlo(hostname);
    
    if (!validation.isValid) {
      this.sendResponse(socket, `${SmtpResponseCode.SYNTAX_ERROR_PARAMETERS} ${validation.errorMessage}`);
      return;
    }
    
    // Update session state and client hostname
    session.clientHostname = validation.hostname || hostname;
    this.sessionManager.updateSessionState(session, SmtpState.AFTER_EHLO);
    
    // Set up EHLO response lines
    const responseLines = [
      `${this.options.hostname} greets ${session.clientHostname}`,
      SMTP_EXTENSIONS.PIPELINING,
      SMTP_EXTENSIONS.formatExtension(SMTP_EXTENSIONS.SIZE, this.options.size),
      SMTP_EXTENSIONS.EIGHTBITMIME,
      SMTP_EXTENSIONS.ENHANCEDSTATUSCODES
    ];
    
    // Add TLS extension if available and not already using TLS
    if (this.tlsHandler && this.tlsHandler.isTlsEnabled() && !session.useTLS) {
      responseLines.push(SMTP_EXTENSIONS.STARTTLS);
    }
    
    // Add AUTH extension if configured
    if (this.options.auth && this.options.auth.methods && this.options.auth.methods.length > 0) {
      responseLines.push(`${SMTP_EXTENSIONS.AUTH} ${this.options.auth.methods.join(' ')}`);
    }
    
    // Send multiline response
    this.sendResponse(socket, formatMultilineResponse(SmtpResponseCode.OK, responseLines));
  }
  
  /**
   * Handle MAIL FROM command
   * @param socket - Client socket
   * @param args - Command arguments
   */
  public handleMailFrom(socket: plugins.net.Socket | plugins.tls.TLSSocket, args: string): void {
    // Get the session for this socket
    const session = this.sessionManager.getSession(socket);
    if (!session) {
      this.sendResponse(socket, `${SmtpResponseCode.LOCAL_ERROR} Internal server error - session not found`);
      return;
    }
    
    // Check if the client has sent EHLO/HELO first
    if (session.state === SmtpState.GREETING) {
      this.sendResponse(socket, `${SmtpResponseCode.BAD_SEQUENCE} Bad sequence of commands`);
      return;
    }
    
    // Check if authentication is required but not provided
    if (this.options.auth && this.options.auth.required && !session.authenticated) {
      this.sendResponse(socket, `${SmtpResponseCode.AUTH_REQUIRED} Authentication required`);
      return;
    }
    
    // Special handling for commands that include "MAIL FROM:" in the args
    let processedArgs = args;
    if (args.toUpperCase().startsWith('FROM')) {
      processedArgs = args;
    } else if (args.toUpperCase().includes('MAIL FROM')) {
      // The command was already prepended to the args
      const colonIndex = args.indexOf(':');
      if (colonIndex !== -1) {
        processedArgs = args.substring(colonIndex + 1).trim();
      }
    }
    
    // Validate MAIL FROM syntax
    const validation = validateMailFrom(processedArgs);
    
    if (!validation.isValid) {
      this.sendResponse(socket, `${SmtpResponseCode.SYNTAX_ERROR_PARAMETERS} ${validation.errorMessage}`);
      return;
    }
    
    // Enhanced SIZE parameter handling
    if (validation.params && validation.params.SIZE) {
      const size = parseInt(validation.params.SIZE, 10);
      
      // Check for valid numeric format
      if (isNaN(size)) {
        this.sendResponse(socket, `${SmtpResponseCode.SYNTAX_ERROR_PARAMETERS} Invalid SIZE parameter: not a number`);
        return;
      }
      
      // Check for negative values
      if (size < 0) {
        this.sendResponse(socket, `${SmtpResponseCode.SYNTAX_ERROR_PARAMETERS} Invalid SIZE parameter: cannot be negative`);
        return;
      }
      
      // Ensure reasonable minimum size (at least 100 bytes for headers)
      if (size < 100) {
        this.sendResponse(socket, `${SmtpResponseCode.SYNTAX_ERROR_PARAMETERS} Invalid SIZE parameter: too small (minimum 100 bytes)`);
        return;
      }
      
      // Check against server maximum
      if (size > this.options.size!) {
        // Generate informative error with the server's limit
        this.sendResponse(socket, `${SmtpResponseCode.EXCEEDED_STORAGE} Message size exceeds limit of ${Math.floor(this.options.size! / 1024)} KB`);
        return;
      }
      
      // Log large messages for monitoring
      if (size > this.options.size! * 0.8) {
        SmtpLogger.info(`Large message detected (${Math.floor(size / 1024)} KB)`, {
          sessionId: session.id,
          remoteAddress: session.remoteAddress,
          sizeBytes: size,
          percentOfMax: Math.floor((size / this.options.size!) * 100)
        });
      }
    }
    
    // Reset email data and recipients for new transaction
    session.mailFrom = validation.address || '';
    session.rcptTo = [];
    session.emailData = '';
    session.emailDataChunks = [];
    
    // Update envelope information
    session.envelope = {
      mailFrom: {
        address: validation.address || '',
        args: validation.params || {}
      },
      rcptTo: []
    };
    
    // Update session state
    this.sessionManager.updateSessionState(session, SmtpState.MAIL_FROM);
    
    // Send success response
    this.sendResponse(socket, `${SmtpResponseCode.OK} OK`);
  }
  
  /**
   * Handle RCPT TO command
   * @param socket - Client socket
   * @param args - Command arguments
   */
  public handleRcptTo(socket: plugins.net.Socket | plugins.tls.TLSSocket, args: string): void {
    // Get the session for this socket
    const session = this.sessionManager.getSession(socket);
    if (!session) {
      this.sendResponse(socket, `${SmtpResponseCode.LOCAL_ERROR} Internal server error - session not found`);
      return;
    }
    
    // Check if MAIL FROM was provided first
    if (session.state !== SmtpState.MAIL_FROM && session.state !== SmtpState.RCPT_TO) {
      this.sendResponse(socket, `${SmtpResponseCode.BAD_SEQUENCE} Bad sequence of commands`);
      return;
    }
    
    // Special handling for commands that include "RCPT TO:" in the args
    let processedArgs = args;
    if (args.toUpperCase().startsWith('TO:')) {
      processedArgs = args;
    } else if (args.toUpperCase().includes('RCPT TO')) {
      // The command was already prepended to the args
      const colonIndex = args.indexOf(':');
      if (colonIndex !== -1) {
        processedArgs = args.substring(colonIndex + 1).trim();
      }
    }
    
    // Validate RCPT TO syntax
    const validation = validateRcptTo(processedArgs);
    
    if (!validation.isValid) {
      this.sendResponse(socket, `${SmtpResponseCode.SYNTAX_ERROR_PARAMETERS} ${validation.errorMessage}`);
      return;
    }
    
    // Check if we've reached maximum recipients
    if (session.rcptTo.length >= this.options.maxRecipients) {
      this.sendResponse(socket, `${SmtpResponseCode.TRANSACTION_FAILED} Too many recipients`);
      return;
    }
    
    // Create recipient object
    const recipient: IEnvelopeRecipient = {
      address: validation.address || '',
      args: validation.params || {}
    };
    
    // Add to session data
    session.rcptTo.push(validation.address || '');
    session.envelope.rcptTo.push(recipient);
    
    // Update session state
    this.sessionManager.updateSessionState(session, SmtpState.RCPT_TO);
    
    // Send success response
    this.sendResponse(socket, `${SmtpResponseCode.OK} Recipient ok`);
  }
  
  /**
   * Handle DATA command
   * @param socket - Client socket
   */
  public handleData(socket: plugins.net.Socket | plugins.tls.TLSSocket): void {
    // Get the session for this socket
    const session = this.sessionManager.getSession(socket);
    if (!session) {
      this.sendResponse(socket, `${SmtpResponseCode.LOCAL_ERROR} Internal server error - session not found`);
      return;
    }
    
    // Check command sequence - DATA must follow RCPT TO
    if (session.state !== SmtpState.RCPT_TO) {
      this.sendResponse(socket, `${SmtpResponseCode.BAD_SEQUENCE} Bad sequence of commands`);
      return;
    }
    
    // Check if we have recipients
    if (!session.rcptTo.length) {
      this.sendResponse(socket, `${SmtpResponseCode.BAD_SEQUENCE} No recipients specified`);
      return;
    }
    
    // Update session state
    this.sessionManager.updateSessionState(session, SmtpState.DATA_RECEIVING);
    
    // Reset email data storage
    session.emailData = '';
    session.emailDataChunks = [];
    
    // Set up timeout for DATA command
    const dataTimeout = SMTP_DEFAULTS.DATA_TIMEOUT;
    if (session.dataTimeoutId) {
      clearTimeout(session.dataTimeoutId);
    }
    
    session.dataTimeoutId = setTimeout(() => {
      if (session.state === SmtpState.DATA_RECEIVING) {
        SmtpLogger.warn(`DATA command timeout for session ${session.id}`, { 
          sessionId: session.id,
          timeout: dataTimeout
        });
        
        this.sendResponse(socket, `${SmtpResponseCode.LOCAL_ERROR} Data timeout`);
        this.resetSession(session);
      }
    }, dataTimeout);
    
    // Send intermediate response to signal start of data
    this.sendResponse(socket, `${SmtpResponseCode.START_MAIL_INPUT} Start mail input; end with <CRLF>.<CRLF>`);
  }
  
  /**
   * Handle RSET command
   * @param socket - Client socket
   */
  public handleRset(socket: plugins.net.Socket | plugins.tls.TLSSocket): void {
    // Get the session for this socket
    const session = this.sessionManager.getSession(socket);
    if (!session) {
      this.sendResponse(socket, `${SmtpResponseCode.LOCAL_ERROR} Internal server error - session not found`);
      return;
    }
    
    // Reset the transaction state
    this.resetSession(session);
    
    // Send success response
    this.sendResponse(socket, `${SmtpResponseCode.OK} OK`);
  }
  
  /**
   * Handle NOOP command
   * @param socket - Client socket
   */
  public handleNoop(socket: plugins.net.Socket | plugins.tls.TLSSocket): void {
    // Get the session for this socket
    const session = this.sessionManager.getSession(socket);
    if (!session) {
      this.sendResponse(socket, `${SmtpResponseCode.LOCAL_ERROR} Internal server error - session not found`);
      return;
    }
    
    // Update session activity timestamp
    this.sessionManager.updateSessionActivity(session);
    
    // Send success response
    this.sendResponse(socket, `${SmtpResponseCode.OK} OK`);
  }
  
  /**
   * Handle QUIT command
   * @param socket - Client socket
   */
  public handleQuit(socket: plugins.net.Socket | plugins.tls.TLSSocket): void {
    // Get the session for this socket
    const session = this.sessionManager.getSession(socket);
    
    // Send goodbye message
    this.sendResponse(socket, `${SmtpResponseCode.SERVICE_CLOSING} ${this.options.hostname} Service closing transmission channel`);
    
    // End the connection
    socket.end();
    
    // Clean up session if we have one
    if (session) {
      this.sessionManager.removeSession(socket);
    }
  }
  
  /**
   * Handle AUTH command
   * @param socket - Client socket
   * @param args - Command arguments
   */
  private handleAuth(socket: plugins.net.Socket | plugins.tls.TLSSocket, args: string): void {
    // Get the session for this socket
    const session = this.sessionManager.getSession(socket);
    if (!session) {
      this.sendResponse(socket, `${SmtpResponseCode.LOCAL_ERROR} Internal server error - session not found`);
      return;
    }
    
    // Check if we have auth config
    if (!this.options.auth || !this.options.auth.methods || !this.options.auth.methods.length) {
      this.sendResponse(socket, `${SmtpResponseCode.COMMAND_NOT_IMPLEMENTED} Authentication not supported`);
      return;
    }
    
    // Check if TLS is required for authentication
    if (!session.useTLS) {
      this.sendResponse(socket, `${SmtpResponseCode.AUTH_FAILED} Authentication requires TLS`);
      return;
    }
    
    // Simple response for now - authentication would be implemented in the security handler
    this.sendResponse(socket, `${SmtpResponseCode.AUTH_FAILED} Authentication not implemented yet`);
  }
  
  /**
   * Handle HELP command
   * @param socket - Client socket
   * @param args - Command arguments
   */
  private handleHelp(socket: plugins.net.Socket | plugins.tls.TLSSocket, args: string): void {
    // Get the session for this socket
    const session = this.sessionManager.getSession(socket);
    if (!session) {
      this.sendResponse(socket, `${SmtpResponseCode.LOCAL_ERROR} Internal server error - session not found`);
      return;
    }
    
    // Update session activity timestamp
    this.sessionManager.updateSessionActivity(session);
    
    // Provide help information based on arguments
    const helpCommand = args.trim().toUpperCase();
    
    if (!helpCommand) {
      // General help
      const helpLines = [
        'Supported commands:',
        'EHLO/HELO domain - Identify yourself to the server',
        'MAIL FROM:<address> - Start a new mail transaction',
        'RCPT TO:<address> - Specify recipients for the message',
        'DATA - Start message data input',
        'RSET - Reset the transaction',
        'NOOP - No operation',
        'QUIT - Close the connection',
        'HELP [command] - Show help'
      ];
      
      // Add conditional commands
      if (this.tlsHandler && this.tlsHandler.isTlsEnabled()) {
        helpLines.push('STARTTLS - Start TLS negotiation');
      }
      
      if (this.options.auth && this.options.auth.methods.length) {
        helpLines.push('AUTH mechanism - Authenticate with the server');
      }
      
      this.sendResponse(socket, formatMultilineResponse(SmtpResponseCode.HELP_MESSAGE, helpLines));
      return;
    }
    
    // Command-specific help
    let helpText: string;
    
    switch (helpCommand) {
      case 'EHLO':
      case 'HELO':
        helpText = 'EHLO/HELO domain - Identify yourself to the server';
        break;
        
      case 'MAIL':
        helpText = 'MAIL FROM:<address> [SIZE=size] - Start a new mail transaction';
        break;
        
      case 'RCPT':
        helpText = 'RCPT TO:<address> - Specify a recipient for the message';
        break;
        
      case 'DATA':
        helpText = 'DATA - Start message data input, end with <CRLF>.<CRLF>';
        break;
        
      case 'RSET':
        helpText = 'RSET - Reset the transaction';
        break;
        
      case 'NOOP':
        helpText = 'NOOP - No operation';
        break;
        
      case 'QUIT':
        helpText = 'QUIT - Close the connection';
        break;
        
      case 'STARTTLS':
        helpText = 'STARTTLS - Start TLS negotiation';
        break;
        
      case 'AUTH':
        helpText = `AUTH mechanism - Authenticate with the server. Supported methods: ${this.options.auth?.methods.join(', ')}`;
        break;
        
      default:
        helpText = `Unknown command: ${helpCommand}`;
        break;
    }
    
    this.sendResponse(socket, `${SmtpResponseCode.HELP_MESSAGE} ${helpText}`);
  }
  
  /**
   * Handle VRFY command (Verify user/mailbox)
   * RFC 5321 Section 3.5.1: Server MAY respond with 252 to avoid disclosing sensitive information
   * @param socket - Client socket
   * @param args - Command arguments (username to verify)
   */
  private handleVrfy(socket: plugins.net.Socket | plugins.tls.TLSSocket, args: string): void {
    // Get the session for this socket
    const session = this.sessionManager.getSession(socket);
    if (!session) {
      this.sendResponse(socket, `${SmtpResponseCode.LOCAL_ERROR} Internal server error - session not found`);
      return;
    }
    
    // Update session activity timestamp
    this.sessionManager.updateSessionActivity(session);
    
    const username = args.trim();
    
    // Security best practice: Do not confirm or deny user existence
    // Instead, respond with 252 "Cannot verify, but will attempt delivery"
    // This prevents VRFY from being used for user enumeration attacks
    if (!username) {
      this.sendResponse(socket, `${SmtpResponseCode.SYNTAX_ERROR_PARAMETERS} User name required`);
    } else {
      // Log the VRFY attempt
      SmtpLogger.info(`VRFY command received for user: ${username}`, {
        sessionId: session.id,
        remoteAddress: session.remoteAddress,
        useTLS: session.useTLS
      });
      
      // Respond with ambiguous response for security
      this.sendResponse(socket, `${SmtpResponseCode.CANNOT_VRFY} Cannot VRFY user, but will accept message and attempt delivery`);
    }
  }
  
  /**
   * Handle EXPN command (Expand mailing list)
   * RFC 5321 Section 3.5.2: Server MAY disable this for security
   * @param socket - Client socket
   * @param args - Command arguments (mailing list to expand)
   */
  private handleExpn(socket: plugins.net.Socket | plugins.tls.TLSSocket, args: string): void {
    // Get the session for this socket
    const session = this.sessionManager.getSession(socket);
    if (!session) {
      this.sendResponse(socket, `${SmtpResponseCode.LOCAL_ERROR} Internal server error - session not found`);
      return;
    }
    
    // Update session activity timestamp
    this.sessionManager.updateSessionActivity(session);
    
    const listname = args.trim();
    
    // Log the EXPN attempt
    SmtpLogger.info(`EXPN command received for list: ${listname}`, {
      sessionId: session.id,
      remoteAddress: session.remoteAddress,
      useTLS: session.useTLS
    });
    
    // Disable EXPN for security (best practice - RFC 5321 Section 3.5.2)
    // EXPN allows enumeration of list members, which is a privacy concern
    this.sendResponse(socket, `${SmtpResponseCode.COMMAND_NOT_IMPLEMENTED} EXPN command is disabled for security reasons`);
  }
  
  /**
   * Reset session to after-EHLO state
   * @param session - SMTP session to reset
   */
  private resetSession(session: ISmtpSession): void {
    // Clear any data timeout
    if (session.dataTimeoutId) {
      clearTimeout(session.dataTimeoutId);
      session.dataTimeoutId = undefined;
    }
    
    // Reset data fields but keep authentication state
    session.mailFrom = '';
    session.rcptTo = [];
    session.emailData = '';
    session.emailDataChunks = [];
    session.envelope = {
      mailFrom: { address: '', args: {} },
      rcptTo: []
    };
    
    // Reset state to after EHLO
    this.sessionManager.updateSessionState(session, SmtpState.AFTER_EHLO);
  }
  
  /**
   * Validate command sequence based on current state
   * @param command - Command to validate
   * @param session - Current session
   * @returns Whether the command is valid in the current state
   */
  private validateCommandSequence(command: string, session: ISmtpSession): boolean {
    return isValidCommandSequence(command, session.state);
  }
}