//go:build linux

// Package command implements the deliberately small dwh-auth operator CLI.
// It is intentionally independent of flag.CommandLine: command-line values
// are never included in diagnostics, and the grammar is closed by default.
package command

import (
	"context"
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"os"
	"path/filepath"
	"strings"
	"time"
	"unicode"
	"unicode/utf8"

	"github.com/aritmolab/thothii/tools/dwh-auth/internal/credential"
	"github.com/aritmolab/thothii/tools/dwh-auth/internal/record"
	"github.com/aritmolab/thothii/tools/dwh-auth/internal/registry"
	"github.com/aritmolab/thothii/tools/dwh-auth/internal/securefile"
)

const (
	exitOK          = 0
	exitUsage       = 2
	exitNotFound    = 3
	exitIntegrity   = 4
	maxReasonBytes  = 160
	commandServeMsg = "serve is not available in this release"
)

var (
	nowUTC             = func() time.Time { return time.Now().UTC() }
	generateCredential = func() (credential.Material, error) { return credential.Generate(rand.Reader) }
	addRecord          = func(store *registry.Store, value record.Record) error { return store.Add(value) }
	closeStore         = func(store *registry.Store) error { return store.Close() }
)

// Run executes one dwh-auth invocation and returns its stable process exit
// status. It writes only redacted, deterministic diagnostics to stderr.
func Run(ctx context.Context, args []string, _ io.Reader, stdout, stderr io.Writer) int {
	if ctx == nil {
		ctx = context.Background()
	}
	if stdout == nil || stderr == nil {
		return exitIntegrity
	}
	if len(args) > 0 && args[0] == "serve" {
		return runServe(args[1:], stderr)
	}
	root, rest, err := parseRoot(args)
	if err != nil {
		writeLine(stderr, "unsafe invocation")
		return exitUsage
	}
	if len(rest) == 0 {
		writeLine(stderr, "unsafe invocation")
		return exitUsage
	}

	switch rest[0] {
	case "key":
		return runKey(ctx, root, rest[1:], stdout, stderr)
	case "check":
		return runCheck(ctx, root, rest[1:], stdout, stderr)
	default:
		writeLine(stderr, "unsafe invocation")
		return exitUsage
	}
}

func parseRoot(args []string) (string, []string, error) {
	if len(args) < 2 || args[0] != "--registry-root" || args[1] == "" || !filepath.IsAbs(args[1]) {
		return "", nil, errors.New("invalid registry root")
	}
	return filepath.Clean(args[1]), args[2:], nil
}

func runKey(ctx context.Context, root string, args []string, stdout, stderr io.Writer) int {
	if len(args) == 0 {
		writeLine(stderr, "unsafe invocation")
		return exitUsage
	}
	switch args[0] {
	case "create":
		return runCreate(ctx, root, args[1:], stdout, stderr)
	case "import":
		return runImport(ctx, root, args[1:], stdout, stderr)
	case "list":
		return runList(ctx, root, args[1:], stdout, stderr)
	case "status":
		return runStatus(ctx, root, args[1:], stdout, stderr)
	case "revoke":
		return runRevoke(ctx, root, args[1:], stdout, stderr)
	default:
		writeLine(stderr, "unsafe invocation")
		return exitUsage
	}
}

type parsed struct {
	installationID string
	description    string
	expiresAt      string
	output         string
	fromFile       string
	keyID          string
	reason         string
	json           bool
	legacyRaw      bool
	socket         string
}

func parseFlags(args []string, allowed map[string]bool) (parsed, error) {
	var value parsed
	seen := make(map[string]bool)
	for i := 0; i < len(args); i++ {
		name := args[i]
		if !strings.HasPrefix(name, "--") || name == "--" || strings.Contains(name, "=") {
			return parsed{}, errors.New("invalid option")
		}
		if !allowed[name] || seen[name] {
			return parsed{}, errors.New("invalid option")
		}
		seen[name] = true
		if name == "--json" || name == "--legacy-raw" {
			switch name {
			case "--json":
				value.json = true
			case "--legacy-raw":
				value.legacyRaw = true
			}
			continue
		}
		if i+1 >= len(args) || strings.HasPrefix(args[i+1], "--") {
			return parsed{}, errors.New("missing option value")
		}
		i++
		switch name {
		case "--installation-id":
			value.installationID = args[i]
		case "--description":
			value.description = args[i]
		case "--expires-at":
			value.expiresAt = args[i]
		case "--output":
			value.output = args[i]
		case "--from-file":
			value.fromFile = args[i]
		case "--key-id":
			value.keyID = args[i]
		case "--reason":
			value.reason = args[i]
		case "--socket":
			value.socket = args[i]
		}
	}
	return value, nil
}

func runCreate(ctx context.Context, root string, args []string, stdout, stderr io.Writer) int {
	options, err := parseFlags(args, map[string]bool{
		"--installation-id": true,
		"--description":     true,
		"--expires-at":      true,
		"--output":          true,
	})
	if err != nil || options.installationID == "" || options.output == "" || !filepath.IsAbs(options.output) || !validInstallationID(options.installationID) || !validMetadata(options.description) || containsCanonicalCredential(options.description) {
		writeLine(stderr, "unsafe invocation")
		return exitUsage
	}
	createdAt := nowUTC()
	expiresAt, err := parseExpiry(options.expiresAt, createdAt)
	if err != nil {
		writeLine(stderr, "unsafe invocation")
		return exitUsage
	}
	if err := ctx.Err(); err != nil {
		writeLine(stderr, "operation cancelled")
		return exitIntegrity
	}

	material, err := generateCredential()
	if err != nil {
		writeLine(stderr, "integrity failure")
		return exitIntegrity
	}
	outputFile, err := securefile.CreateSecret(options.output)
	if err != nil {
		writeLine(stderr, "integrity failure")
		return exitIntegrity
	}
	if err := writeAndSync(outputFile, material.Value); err != nil {
		_ = outputFile.Close()
		if cleanupOutput(options.output) != nil {
			writeCleanupFailure(stderr, options.output)
			return exitIntegrity
		}
		writeLine(stderr, "integrity failure")
		return exitIntegrity
	}
	if err := outputFile.Close(); err != nil {
		if cleanupOutput(options.output) != nil {
			writeCleanupFailure(stderr, options.output)
			return exitIntegrity
		}
		writeLine(stderr, "integrity failure")
		return exitIntegrity
	}

	store, err := registry.Open(root)
	if err != nil {
		if cleanupOutput(options.output) != nil {
			writeCleanupFailure(stderr, options.output)
			return exitIntegrity
		}
		writeLine(stderr, "integrity failure")
		return exitIntegrity
	}
	value := record.Record{
		SchemaVersion:  record.SchemaVersion,
		Kind:           record.KindV1,
		KeyID:          material.KeyID,
		InstallationID: options.installationID,
		Description:    options.description,
		SecretSHA256:   base64.RawURLEncoding.EncodeToString(material.Digest[:]),
		CreatedAt:      createdAt,
		ExpiresAt:      expiresAt,
	}
	addErr := addRecord(store, value)
	if addErr != nil {
		present, snapshotErr := snapshotContainsKey(store, material.KeyID)
		closeErr := closeStore(store)
		if snapshotErr == nil && !present && closeErr == nil {
			if cleanupOutput(options.output) != nil {
				writeCleanupFailure(stderr, options.output)
				return exitIntegrity
			}
		} else {
			writeRecoveryFailure(stderr, options.output)
			return exitIntegrity
		}
		if errors.Is(addErr, registry.ErrConflict) || errors.Is(addErr, registry.ErrRevoked) {
			writeLine(stderr, "credential already exists")
			return exitIntegrity
		}
		writeLine(stderr, "integrity failure")
		return exitIntegrity
	}
	if err := closeStore(store); err != nil {
		writeRecoveryFailure(stderr, options.output)
		return exitIntegrity
	}
	_, _ = fmt.Fprintf(stdout, "created key_id=%s installation_id=%s output=%s\n", material.KeyID, options.installationID, filepath.Clean(options.output))
	return exitOK
}

func runImport(ctx context.Context, root string, args []string, stdout, stderr io.Writer) int {
	options, err := parseFlags(args, map[string]bool{
		"--legacy-raw":      true,
		"--installation-id": true,
		"--from-file":       true,
	})
	if err != nil || !options.legacyRaw || options.installationID != record.LegacyKeyID || options.fromFile == "" || !filepath.IsAbs(options.fromFile) {
		writeLine(stderr, "unsafe invocation")
		return exitUsage
	}
	if err := ctx.Err(); err != nil {
		writeLine(stderr, "operation cancelled")
		return exitIntegrity
	}
	value, err := securefile.ReadSecret(options.fromFile, credential.MaxHeaderBytes)
	if err != nil {
		writeLine(stderr, "integrity failure")
		return exitIntegrity
	}
	sum := sha256.Sum256(value)
	digest := record.Digest(sum)
	if !credential.VerifyLegacy(value, digest) {
		writeLine(stderr, "unsafe invocation")
		return exitUsage
	}
	store, err := registry.Open(root)
	if err != nil {
		writeLine(stderr, "integrity failure")
		return exitIntegrity
	}
	now := time.Now().UTC()
	addErr := store.Add(record.Record{
		SchemaVersion:  record.SchemaVersion,
		Kind:           record.KindLegacyRaw,
		KeyID:          record.LegacyKeyID,
		InstallationID: record.LegacyKeyID,
		SecretSHA256:   base64.RawURLEncoding.EncodeToString(digest[:]),
		CreatedAt:      now,
	})
	closeErr := store.Close()
	if closeErr != nil {
		writeLine(stderr, "integrity failure")
		return exitIntegrity
	}
	if addErr != nil {
		switch {
		case errors.Is(addErr, registry.ErrConflict), errors.Is(addErr, registry.ErrRevoked):
			writeLine(stderr, "credential already exists")
			return exitIntegrity
		default:
			writeLine(stderr, "integrity failure")
			return exitIntegrity
		}
	}
	_, _ = fmt.Fprintf(stdout, "imported key_id=%s installation_id=%s\n", record.LegacyKeyID, record.LegacyKeyID)
	return exitOK
}

func runList(ctx context.Context, root string, args []string, stdout, stderr io.Writer) int {
	options, err := parseFlags(args, map[string]bool{"--json": true})
	if err != nil {
		writeLine(stderr, "unsafe invocation")
		return exitUsage
	}
	store, err := openCheckedStore(ctx, root)
	if err != nil {
		writeStoreError(stderr, err)
		return storeExit(err)
	}
	values, listErr := store.List()
	closeErr := store.Close()
	if listErr != nil || closeErr != nil {
		writeLine(stderr, "integrity failure")
		return exitIntegrity
	}
	if options.json {
		writeJSON(stdout, values)
		return exitOK
	}
	for _, value := range values {
		_, _ = fmt.Fprintf(stdout, "key_id=%s installation_id=%s state=%s\n", value.KeyID, value.InstallationID, value.State)
	}
	return exitOK
}

func runStatus(ctx context.Context, root string, args []string, stdout, stderr io.Writer) int {
	options, err := parseFlags(args, map[string]bool{"--key-id": true, "--json": true})
	if err != nil || options.keyID == "" || !validKeyID(options.keyID) {
		writeLine(stderr, "unsafe invocation")
		return exitUsage
	}
	store, err := openCheckedStore(ctx, root)
	if err != nil {
		writeStoreError(stderr, err)
		return storeExit(err)
	}
	values, listErr := store.List()
	closeErr := store.Close()
	if listErr != nil || closeErr != nil {
		writeLine(stderr, "integrity failure")
		return exitIntegrity
	}
	for _, value := range values {
		if value.KeyID != options.keyID {
			continue
		}
		if options.json {
			writeJSON(stdout, value)
		} else {
			_, _ = fmt.Fprintf(stdout, "key_id=%s installation_id=%s state=%s\n", value.KeyID, value.InstallationID, value.State)
		}
		return exitOK
	}
	writeLine(stderr, "not found")
	return exitNotFound
}

func runRevoke(ctx context.Context, root string, args []string, stdout, stderr io.Writer) int {
	options, err := parseFlags(args, map[string]bool{"--key-id": true, "--reason": true})
	if err != nil || options.keyID == "" || !validKeyID(options.keyID) || options.reason == "" || !validMetadata(options.reason) || containsCanonicalCredential(options.reason) {
		writeLine(stderr, "unsafe invocation")
		return exitUsage
	}
	if err := ctx.Err(); err != nil {
		writeLine(stderr, "operation cancelled")
		return exitIntegrity
	}
	store, err := registry.Open(root)
	if err != nil {
		writeLine(stderr, "integrity failure")
		return exitIntegrity
	}
	err = store.Revoke(options.keyID, options.reason, nowUTC())
	closeErr := store.Close()
	if errors.Is(err, registry.ErrNotFound) {
		writeLine(stderr, "not found")
		return exitNotFound
	}
	if err != nil || closeErr != nil {
		writeLine(stderr, "integrity failure")
		return exitIntegrity
	}
	_, _ = fmt.Fprintf(stdout, "revoked key_id=%s\n", options.keyID)
	return exitOK
}

func runCheck(ctx context.Context, root string, args []string, stdout, stderr io.Writer) int {
	options, err := parseFlags(args, map[string]bool{"--json": true})
	if err != nil {
		writeLine(stderr, "unsafe invocation")
		return exitUsage
	}
	if err := ctx.Err(); err != nil {
		writeLine(stderr, "operation cancelled")
		return exitIntegrity
	}
	store, err := registry.Open(root)
	if err != nil {
		writeLine(stderr, "integrity failure")
		return exitIntegrity
	}
	checkErr := store.Check()
	closeErr := store.Close()
	if checkErr != nil || closeErr != nil {
		writeLine(stderr, "integrity failure")
		return exitIntegrity
	}
	if options.json {
		_, _ = io.WriteString(stdout, "{\"status\":\"ok\"}\n")
	} else {
		writeLine(stdout, "ok")
	}
	return exitOK
}

func runServe(args []string, stderr io.Writer) int {
	if len(args) != 4 || args[0] != "--registry-root" || args[2] != "--socket" || !filepath.IsAbs(args[1]) || !filepath.IsAbs(args[3]) {
		writeLine(stderr, "unsafe invocation")
		return exitUsage
	}
	// The Unix-socket service is intentionally introduced by Task 4. Keeping
	// this exact grammar reserved prevents accidental plaintext or network fallback.
	writeLine(stderr, commandServeMsg)
	return exitIntegrity
}

func snapshotContainsKey(store *registry.Store, keyID string) (bool, error) {
	values, err := store.List()
	if err != nil {
		return false, err
	}
	for _, value := range values {
		if value.KeyID == keyID {
			return true, nil
		}
	}
	return false, nil
}

func openCheckedStore(ctx context.Context, root string) (*registry.Store, error) {
	if err := ctx.Err(); err != nil {
		return nil, err
	}
	store, err := registry.Open(root)
	if err != nil {
		return nil, err
	}
	if err := store.Check(); err != nil {
		_ = store.Close()
		return nil, err
	}
	return store, nil
}

func writeStoreError(stderr io.Writer, err error) {
	if errors.Is(err, registry.ErrNotFound) {
		writeLine(stderr, "not found")
		return
	}
	writeLine(stderr, "integrity failure")
}

func storeExit(err error) int {
	if errors.Is(err, registry.ErrNotFound) {
		return exitNotFound
	}
	return exitIntegrity
}

func writeJSON(writer io.Writer, value any) {
	data, err := json.Marshal(value)
	if err != nil {
		return
	}
	_, _ = writer.Write(append(data, '\n'))
}

func writeLine(writer io.Writer, value string) {
	_, _ = io.WriteString(writer, value+"\n")
}

func writeAndSync(file *os.File, value []byte) error {
	for len(value) > 0 {
		n, err := file.Write(value)
		if err != nil {
			return err
		}
		if n == 0 {
			return io.ErrShortWrite
		}
		value = value[n:]
	}
	return file.Sync()
}

func cleanupOutput(path string) error {
	info, err := os.Lstat(path)
	if errors.Is(err, os.ErrNotExist) {
		return nil
	}
	if err != nil || !info.Mode().IsRegular() {
		return errors.New("cleanup target is not a regular file")
	}
	if err := os.Remove(path); err != nil && !errors.Is(err, os.ErrNotExist) {
		return err
	}
	return nil
}

func writeCleanupFailure(stderr io.Writer, path string) {
	_, _ = fmt.Fprintf(stderr, "cleanup failed path=%s\n", filepath.Clean(path))
}

func writeRecoveryFailure(stderr io.Writer, path string) {
	_, _ = fmt.Fprintf(stderr, "publication uncertain path=%s\n", filepath.Clean(path))
}

func parseExpiry(value string, createdAt time.Time) (*time.Time, error) {
	if value == "" {
		return nil, nil
	}
	parsed, err := time.Parse(time.RFC3339, value)
	if err != nil || parsed.Location() != time.UTC || !parsed.After(createdAt) {
		return nil, errors.New("expiry must be UTC RFC3339")
	}
	return &parsed, nil
}

func validInstallationID(value string) bool {
	if len(value) < 1 || len(value) > 63 {
		return false
	}
	for i := range value {
		c := value[i]
		if (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || (i > 0 && c == '-') {
			continue
		}
		return false
	}
	return true
}

func validMetadata(value string) bool {
	if !utf8.ValidString(value) || len([]rune(value)) > maxReasonBytes {
		return false
	}
	for _, r := range value {
		if unicode.IsControl(r) {
			return false
		}
	}
	return true
}

func containsCanonicalCredential(value string) bool {
	const credentialLength = len(credential.Prefix) + 1 + credential.KeyIDEncodedLength + 1 + credential.SecretEncodedLength
	needle := credential.Prefix + "."
	for offset := 0; offset < len(value); {
		index := strings.Index(value[offset:], needle)
		if index < 0 {
			return false
		}
		index += offset
		if index+credentialLength <= len(value) {
			candidate := []byte(value[index : index+credentialLength])
			sum := sha256.Sum256(candidate)
			if _, ok := credential.VerifyV1(candidate, record.Digest(sum)); ok {
				return true
			}
		}
		offset = index + len(needle)
	}
	return false
}

func validKeyID(value string) bool {
	if value == record.LegacyKeyID {
		return true
	}
	if len(value) != credential.KeyIDEncodedLength {
		return false
	}
	decoded, err := base64.RawURLEncoding.DecodeString(value)
	return err == nil && len(decoded) == 12 && base64.RawURLEncoding.EncodeToString(decoded) == value
}