/**
 * Caddy Manager for Onebox
 *
 * Manages Caddy binary download, process lifecycle, and Admin API configuration.
 * Caddy is used as the reverse proxy with native SNI support.
 */

import { logger } from '../logging.ts';
import { getErrorMessage } from '../utils/error.ts';

const CADDY_VERSION = '2.10.2';
const CADDY_DOWNLOAD_URL = `https://github.com/caddyserver/caddy/releases/download/v${CADDY_VERSION}/caddy_${CADDY_VERSION}_linux_amd64.tar.gz`;

export interface ICaddyRoute {
  domain: string;
  upstream: string; // e.g., "10.0.1.40:80"
}

export interface ICaddyCertificate {
  domain: string;
  certPath: string;
  keyPath: string;
}

interface ICaddyLoggingConfig {
  logs: {
    [name: string]: {
      writer: {
        output: string;
        address?: string;
        dial_timeout?: string;
        soft_start?: boolean;
      };
      encoder?: { format: string };
      level?: string;
      include?: string[];
    };
  };
}

interface ICaddyConfig {
  admin: {
    listen: string;
  };
  logging?: ICaddyLoggingConfig;
  apps: {
    http: {
      servers: {
        [key: string]: {
          listen: string[];
          routes: ICaddyRouteConfig[];
          automatic_https?: {
            disable?: boolean;
            disable_redirects?: boolean;
          };
          logs?: {
            default_logger_name: string;
          };
        };
      };
    };
    tls?: {
      automation?: {
        policies: Array<{ issuers: never[] }>;
      };
      certificates?: {
        load_files?: Array<{
          certificate: string;
          key: string;
          tags?: string[];
        }>;
      };
    };
  };
}

interface ICaddyRouteConfig {
  match: Array<{ host: string[] }>;
  handle: Array<{
    handler: string;
    upstreams?: Array<{ dial: string }>;
    routes?: ICaddyRouteConfig[];
  }>;
  terminal?: boolean;
}

export class CaddyManager {
  private process: Deno.ChildProcess | null = null;
  private binaryPath: string;
  private certsDir: string;
  private adminUrl: string;
  private httpPort: number;
  private httpsPort: number;
  private logReceiverPort: number;
  private loggingEnabled: boolean;
  private routes: Map<string, ICaddyRoute> = new Map();
  private certificates: Map<string, ICaddyCertificate> = new Map();

  constructor(options?: {
    binaryPath?: string;
    certsDir?: string;
    adminPort?: number;
    httpPort?: number;
    httpsPort?: number;
    logReceiverPort?: number;
    loggingEnabled?: boolean;
  }) {
    this.binaryPath = options?.binaryPath || './.nogit/caddy';
    this.certsDir = options?.certsDir || './.nogit/certs';
    this.adminUrl = `http://localhost:${options?.adminPort || 2019}`;
    this.httpPort = options?.httpPort || 8080;
    this.httpsPort = options?.httpsPort || 8443;
    this.logReceiverPort = options?.logReceiverPort || 9999;
    this.loggingEnabled = options?.loggingEnabled ?? true;
  }

  /**
   * Update listening ports (must call reloadConfig after if running)
   */
  setPorts(httpPort: number, httpsPort: number): void {
    this.httpPort = httpPort;
    this.httpsPort = httpsPort;
  }

  /**
   * Ensure Caddy binary is downloaded and executable
   */
  async ensureBinary(): Promise<void> {
    try {
      // Check if binary exists
      try {
        const stat = await Deno.stat(this.binaryPath);
        if (stat.isFile) {
          // Verify it's executable by checking version
          const cmd = new Deno.Command(this.binaryPath, {
            args: ['version'],
            stdout: 'piped',
            stderr: 'piped',
          });
          const result = await cmd.output();
          if (result.success) {
            const version = new TextDecoder().decode(result.stdout).trim();
            logger.info(`Caddy binary found: ${version}`);
            return;
          }
        }
      } catch {
        // Binary doesn't exist, need to download
      }

      logger.info(`Downloading Caddy v${CADDY_VERSION}...`);

      // Create directory if needed
      const dir = this.binaryPath.substring(0, this.binaryPath.lastIndexOf('/'));
      await Deno.mkdir(dir, { recursive: true });

      // Download tar.gz
      const response = await fetch(CADDY_DOWNLOAD_URL);
      if (!response.ok) {
        throw new Error(`Failed to download Caddy: ${response.status} ${response.statusText}`);
      }

      const tarGzPath = `${this.binaryPath}.tar.gz`;
      const data = new Uint8Array(await response.arrayBuffer());
      await Deno.writeFile(tarGzPath, data);

      // Extract using tar command
      const extractCmd = new Deno.Command('tar', {
        args: ['-xzf', tarGzPath, '-C', dir, 'caddy'],
        stdout: 'piped',
        stderr: 'piped',
      });
      const extractResult = await extractCmd.output();
      if (!extractResult.success) {
        throw new Error(`Failed to extract Caddy: ${new TextDecoder().decode(extractResult.stderr)}`);
      }

      // Clean up tar.gz
      await Deno.remove(tarGzPath);

      // Make executable
      await Deno.chmod(this.binaryPath, 0o755);

      logger.success(`Caddy v${CADDY_VERSION} downloaded to ${this.binaryPath}`);
    } catch (error) {
      logger.error(`Failed to ensure Caddy binary: ${getErrorMessage(error)}`);
      throw error;
    }
  }

  /**
   * Start Caddy process with minimal config, then configure via Admin API
   */
  async start(): Promise<void> {
    if (this.process) {
      logger.warn('Caddy is already running');
      return;
    }

    try {
      // Create certs directory
      await Deno.mkdir(this.certsDir, { recursive: true });

      logger.info('Starting Caddy server...');

      // Start Caddy with blank config - Admin API is available immediately
      // We'll push the full configuration via Admin API after it's ready
      const cmd = new Deno.Command(this.binaryPath, {
        args: ['run'],
        stdin: 'null',
        stdout: 'piped',
        stderr: 'piped',
      });

      this.process = cmd.spawn();

      // Start log readers (non-blocking)
      this.readProcessOutput();

      // Wait for Admin API to be ready
      await this.waitForReady();

      // Now configure via Admin API with current routes and certificates
      await this.reloadConfig();

      logger.success(`Caddy started (HTTP: ${this.httpPort}, HTTPS: ${this.httpsPort}, Admin: ${this.adminUrl})`);
    } catch (error) {
      logger.error(`Failed to start Caddy: ${getErrorMessage(error)}`);
      throw error;
    }
  }

  /**
   * Read process stdout/stderr and log
   */
  private async readProcessOutput(): Promise<void> {
    if (!this.process) return;

    // Read stderr (Caddy logs to stderr by default)
    const stderrReader = this.process.stderr.getReader();
    (async () => {
      try {
        while (true) {
          const { done, value } = await stderrReader.read();
          if (done) break;
          const text = new TextDecoder().decode(value).trim();
          if (text) {
            // Parse Caddy's JSON log format or just log as-is
            for (const line of text.split('\n')) {
              if (line.includes('"level":"error"')) {
                logger.error(`[Caddy] ${line}`);
              } else if (line.includes('"level":"warn"')) {
                logger.warn(`[Caddy] ${line}`);
              } else {
                logger.debug(`[Caddy] ${line}`);
              }
            }
          }
        }
      } catch {
        // Process ended
      }
    })();
  }

  /**
   * Wait for Caddy to be ready by polling admin API
   */
  private async waitForReady(maxAttempts = 50, intervalMs = 100): Promise<void> {
    for (let i = 0; i < maxAttempts; i++) {
      try {
        const response = await fetch(`${this.adminUrl}/config/`);
        if (response.ok) {
          return;
        }
      } catch {
        // Not ready yet
      }
      await new Promise((resolve) => setTimeout(resolve, intervalMs));
    }
    throw new Error('Caddy failed to start within timeout');
  }

  /**
   * Stop Caddy process
   */
  async stop(): Promise<void> {
    if (!this.process) {
      return;
    }

    try {
      logger.info('Stopping Caddy...');

      // Try graceful shutdown via API first
      try {
        await fetch(`${this.adminUrl}/stop`, { method: 'POST' });
        // Wait for process to exit
        await Promise.race([
          this.process.status,
          new Promise((resolve) => setTimeout(resolve, 5000)),
        ]);
      } catch {
        // API not available, kill directly
      }

      // Force kill if still running
      try {
        this.process.kill('SIGTERM');
      } catch {
        // Already dead
      }

      this.process = null;
      logger.info('Caddy stopped');
    } catch (error) {
      logger.error(`Failed to stop Caddy: ${getErrorMessage(error)}`);
    }
  }

  /**
   * Check if Caddy is healthy
   */
  async isHealthy(): Promise<boolean> {
    try {
      const response = await fetch(`${this.adminUrl}/config/`);
      return response.ok;
    } catch {
      return false;
    }
  }

  /**
   * Build Caddy JSON configuration from current routes and certificates
   */
  private buildConfig(): ICaddyConfig {
    const routes: ICaddyRouteConfig[] = [];

    // Add routes
    for (const [domain, route] of this.routes) {
      routes.push({
        match: [{ host: [domain] }],
        handle: [
          {
            handler: 'reverse_proxy',
            upstreams: [{ dial: route.upstream }],
          },
        ],
        terminal: true,
      });
    }

    // Build certificate load_files
    const loadFiles: Array<{ certificate: string; key: string; tags?: string[] }> = [];
    for (const [domain, cert] of this.certificates) {
      loadFiles.push({
        certificate: cert.certPath,
        key: cert.keyPath,
        tags: [domain],
      });
    }

    const config: ICaddyConfig = {
      admin: {
        listen: this.adminUrl.replace('http://', ''),
      },
      apps: {
        http: {
          servers: {
            main: {
              listen: [`:${this.httpPort}`, `:${this.httpsPort}`],
              routes,
              // Disable automatic HTTPS to prevent Caddy from trying to bind to port 80/443
              automatic_https: {
                disable: true,
              },
            },
          },
        },
      },
    };

    // Add access logging configuration if enabled
    if (this.loggingEnabled) {
      config.logging = {
        logs: {
          access: {
            writer: {
              output: 'net',
              address: `tcp/localhost:${this.logReceiverPort}`,
              dial_timeout: '5s',
              soft_start: true, // Continue even if log receiver is down
            },
            encoder: { format: 'json' },
            level: 'INFO',
            include: ['http.log.access'],
          },
        },
      };

      // Associate server with access logger
      config.apps.http.servers.main.logs = {
        default_logger_name: 'access',
      };
    }

    // Add TLS config if we have certificates
    if (loadFiles.length > 0) {
      config.apps.tls = {
        automation: {
          // Disable automatic HTTPS - we manage certs ourselves
          policies: [{ issuers: [] }],
        },
        certificates: {
          load_files: loadFiles,
        },
      };
    }

    return config;
  }

  /**
   * Reload Caddy configuration via Admin API
   */
  async reloadConfig(): Promise<void> {
    if (!this.process) {
      logger.warn('Caddy not running, cannot reload config');
      return;
    }

    const config = this.buildConfig();

    try {
      const response = await fetch(`${this.adminUrl}/load`, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify(config),
      });

      if (!response.ok) {
        const text = await response.text();
        throw new Error(`Failed to reload Caddy config: ${response.status} ${text}`);
      }

      logger.debug('Caddy configuration reloaded');
    } catch (error) {
      logger.error(`Failed to reload Caddy config: ${getErrorMessage(error)}`);
      throw error;
    }
  }

  /**
   * Add or update a route
   */
  async addRoute(domain: string, upstream: string): Promise<void> {
    this.routes.set(domain, { domain, upstream });

    if (this.process) {
      await this.reloadConfig();
    }

    logger.success(`Added Caddy route: ${domain} -> ${upstream}`);
  }

  /**
   * Remove a route
   */
  async removeRoute(domain: string): Promise<void> {
    if (this.routes.delete(domain)) {
      if (this.process) {
        await this.reloadConfig();
      }
      logger.success(`Removed Caddy route: ${domain}`);
    }
  }

  /**
   * Add or update a TLS certificate
   * Writes PEM files to disk and updates config
   */
  async addCertificate(domain: string, certPem: string, keyPem: string): Promise<void> {
    // Write PEM files
    const certPath = `${this.certsDir}/${domain}.crt`;
    const keyPath = `${this.certsDir}/${domain}.key`;

    await Deno.mkdir(this.certsDir, { recursive: true });
    await Deno.writeTextFile(certPath, certPem);
    await Deno.writeTextFile(keyPath, keyPem);

    // Use absolute paths for Caddy
    const absoluteCertPath = await Deno.realPath(certPath);
    const absoluteKeyPath = await Deno.realPath(keyPath);

    this.certificates.set(domain, {
      domain,
      certPath: absoluteCertPath,
      keyPath: absoluteKeyPath,
    });

    if (this.process) {
      await this.reloadConfig();
    }

    logger.success(`Added TLS certificate for ${domain}`);
  }

  /**
   * Remove a TLS certificate
   */
  async removeCertificate(domain: string): Promise<void> {
    const cert = this.certificates.get(domain);
    if (cert) {
      this.certificates.delete(domain);

      // Remove files
      try {
        await Deno.remove(cert.certPath);
        await Deno.remove(cert.keyPath);
      } catch {
        // Files may not exist
      }

      if (this.process) {
        await this.reloadConfig();
      }

      logger.success(`Removed TLS certificate for ${domain}`);
    }
  }

  /**
   * Get all current routes
   */
  getRoutes(): ICaddyRoute[] {
    return Array.from(this.routes.values());
  }

  /**
   * Get all current certificates
   */
  getCertificates(): ICaddyCertificate[] {
    return Array.from(this.certificates.values());
  }

  /**
   * Clear all routes and certificates (useful for reload from database)
   */
  clear(): void {
    this.routes.clear();
    this.certificates.clear();
  }

  /**
   * Get status
   */
  getStatus(): {
    running: boolean;
    httpPort: number;
    httpsPort: number;
    routes: number;
    certificates: number;
  } {
    return {
      running: this.process !== null,
      httpPort: this.httpPort,
      httpsPort: this.httpsPort,
      routes: this.routes.size,
      certificates: this.certificates.size,
    };
  }
}