package xrpc

import (
	"context"
	"errors"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"strings"

	"github.com/bluesky-social/indigo/api/atproto"
	"github.com/bluesky-social/indigo/atproto/syntax"
	indigoxrpc "github.com/bluesky-social/indigo/xrpc"
	"tangled.org/core/api/tangled"
	"tangled.org/core/knotmirror/db"
	"tangled.org/core/knotmirror/models"
)

var mirrorToKnotNSID = map[string]string{
	tangled.GitTempListBranchesNSID:  tangled.RepoBranchesNSID,
	tangled.GitTempListTagsNSID:      tangled.RepoTagsNSID,
	tangled.GitTempListCommitsNSID:   tangled.RepoLogNSID,
	tangled.GitTempGetTreeNSID:       tangled.RepoTreeNSID,
	tangled.GitTempGetBranchNSID:     tangled.RepoBranchNSID,
	tangled.GitTempGetBlobNSID:       tangled.RepoBlobNSID,
	tangled.GitTempGetTagNSID:        tangled.RepoTagNSID,
	tangled.GitTempGetArchiveNSID:    tangled.RepoArchiveNSID,
	tangled.RepoBlobNSID:             tangled.RepoBlobNSID,
	tangled.GitTempListLanguagesNSID: tangled.RepoLanguagesNSID,
}

var hopByHopHeaders = map[string]bool{
	"Connection":          true,
	"Keep-Alive":          true,
	"Transfer-Encoding":   true,
	"Te":                  true,
	"Trailer":             true,
	"Upgrade":             true,
	"Proxy-Authorization": true,
	"Proxy-Authenticate":  true,
}

type knotInfo struct {
	baseURL        string
	repoIdentifier string
}

// validateKnotURL ensures a knot base URL is safe to proxy to.
// It rejects URLs with path components, query strings, or fragments
// that could be used for path injection.
func validateKnotURL(raw string) (string, error) {
	u, err := url.Parse(raw)
	if err != nil {
		return "", fmt.Errorf("invalid knot URL: %w", err)
	}
	if u.Scheme != "http" && u.Scheme != "https" {
		return "", errors.New("knot URL must use http or https scheme")
	}
	if u.Path != "" && u.Path != "/" {
		return "", fmt.Errorf("knot URL must not contain a path: %q", raw)
	}
	if u.RawQuery != "" || u.Fragment != "" {
		return "", fmt.Errorf("knot URL must not contain query or fragment: %q", raw)
	}
	if u.User != nil {
		return "", fmt.Errorf("knot URL must not contain userinfo: %q", raw)
	}
	// Strip trailing slash for consistent formatting
	return strings.TrimRight(u.String(), "/"), nil
}

func (x *Xrpc) resolveKnot(ctx context.Context, repoAt syntax.ATURI) (*knotInfo, error) {
	repo, err := db.GetRepoByAtUri(ctx, x.db, repoAt)
	if err == nil && repo != nil {
		knotURL := repo.KnotDomain
		if !strings.Contains(repo.KnotDomain, "://") {
			if host, _ := db.GetHost(ctx, x.db, repo.KnotDomain); host != nil {
				knotURL = host.URL()
			} else {
				x.logger.Warn("repo is from unknown knot")
				if x.cfg.KnotUseSSL {
					knotURL = "https://" + knotURL
				} else {
					knotURL = "http://" + knotURL
				}
			}
		}
		knotURL, err = validateKnotURL(knotURL)
		if err != nil {
			return nil, err
		}
		return &knotInfo{baseURL: knotURL, repoIdentifier: repo.RepoIdentifier()}, nil
	}

	owner, err := x.resolver.ResolveIdent(ctx, repoAt.Authority().String())
	if err != nil {
		return nil, fmt.Errorf("resolving repo owner: %w", err)
	}

	xrpcc := indigoxrpc.Client{Host: owner.PDSEndpoint()}
	out, err := atproto.RepoGetRecord(ctx, &xrpcc, "", tangled.RepoNSID, repoAt.Authority().String(), repoAt.RecordKey().String())
	if err != nil {
		return nil, fmt.Errorf("fetching repo record from PDS: %w", err)
	}

	record := out.Value.Val.(*tangled.Repo)
	if record.RepoDid == nil || *record.RepoDid == "" {
		return nil, fmt.Errorf("repo record has no repo_did")
	}
	knotURL := record.Knot
	if !strings.Contains(record.Knot, "://") {
		if host, _ := db.GetHost(ctx, x.db, record.Knot); host != nil {
			knotURL = host.URL()
		} else {
			x.logger.Warn("repo is from unknown knot")
			if x.cfg.KnotUseSSL {
				knotURL = "https://" + knotURL
			} else {
				knotURL = "http://" + knotURL
			}
		}
	}

	rkey := repoAt.RecordKey().String()
	repoDid := syntax.DID(*record.RepoDid)
	go func() {
		bgCtx := context.Background()
		pending := &models.Repo{
			Did:        owner.DID,
			Rkey:       repoAt.RecordKey(),
			Cid:        (*syntax.CID)(out.Cid),
			Name:       rkey,
			KnotDomain: knotURL,
			RepoDid:    repoDid,
			State:      models.RepoStatePending,
		}
		if upsertErr := db.UpsertRepo(bgCtx, x.db, pending); upsertErr != nil {
			x.logger.Error("failed to upsert repo after proxy resolution", "err", upsertErr)
		}
	}()

	knotURL, err = validateKnotURL(knotURL)
	if err != nil {
		return nil, err
	}
	return &knotInfo{
		baseURL:        knotURL,
		repoIdentifier: repoDid.String(),
	}, nil
}

func (x *Xrpc) proxyToKnot(w http.ResponseWriter, r *http.Request, repoAt syntax.ATURI) bool {
	mirrorNSID := strings.TrimPrefix(r.URL.Path, "/xrpc/")
	knotNSID, ok := mirrorToKnotNSID[mirrorNSID]
	if !ok {
		return false
	}

	knot, err := x.resolveKnot(r.Context(), repoAt)
	if err != nil {
		x.logger.Warn("proxy: failed to resolve knot", "repo", repoAt, "err", err)
		return false
	}

	params := make(url.Values)
	for k, v := range r.URL.Query() {
		params[k] = v
	}
	params.Set("repo", knot.repoIdentifier)

	target := fmt.Sprintf("%s/xrpc/%s?%s", knot.baseURL, knotNSID, params.Encode())

	req, err := http.NewRequestWithContext(r.Context(), http.MethodGet, target, nil)
	if err != nil {
		x.logger.Warn("proxy: failed to build request", "target", target, "err", err)
		return false
	}

	resp, err := x.httpClient.Do(req)
	if err != nil {
		x.logger.Warn("proxy: knot request failed", "target", target, "err", err)
		return false
	}
	defer resp.Body.Close()

	for k, vv := range resp.Header {
		if hopByHopHeaders[k] {
			continue
		}
		for _, v := range vv {
			w.Header().Add(k, v)
		}
	}
	w.WriteHeader(resp.StatusCode)
	if _, err := io.Copy(w, resp.Body); err != nil {
		x.logger.Warn("proxy: response copy interrupted", "target", target, "err", err)
	}

	x.logger.Info("proxy: served from knot", "repo", repoAt, "knot", knot.baseURL, "status", resp.StatusCode)
	return true
}
