package issues

import (
	"context"
	"database/sql"
	"errors"
	"fmt"
	"log/slog"
	"net/http"
	"strings"
	"time"

	comatproto "github.com/bluesky-social/indigo/api/atproto"
	"github.com/bluesky-social/indigo/atproto/atclient"
	"github.com/bluesky-social/indigo/atproto/syntax"
	lexutil "github.com/bluesky-social/indigo/lex/util"

	"tangled.org/core/api/tangled"
	"tangled.org/core/appview/config"
	"tangled.org/core/appview/db"
	issues_indexer "tangled.org/core/appview/indexer/issues"
	"tangled.org/core/appview/knotacl"
	"tangled.org/core/appview/mentions"
	"tangled.org/core/appview/models"
	"tangled.org/core/appview/notify"
	"tangled.org/core/appview/oauth"
	"tangled.org/core/appview/pages"
	"tangled.org/core/appview/pagination"
	"tangled.org/core/appview/reporesolver"
	"tangled.org/core/appview/searchquery"
	"tangled.org/core/idresolver"
	"tangled.org/core/ogre"
	"tangled.org/core/orm"
	"tangled.org/core/tid"
)

type Issues struct {
	oauth            *oauth.OAuth
	repoResolver     *reporesolver.RepoResolver
	acl              *knotacl.Service
	pages            *pages.Pages
	idResolver       *idresolver.Resolver
	mentionsResolver *mentions.Resolver
	db               *db.DB
	config           *config.Config
	notifier         notify.Notifier
	logger           *slog.Logger
	indexer          *issues_indexer.Indexer
	ogreClient       *ogre.Client
}

func New(
	oauth *oauth.OAuth,
	repoResolver *reporesolver.RepoResolver,
	acl *knotacl.Service,
	pages *pages.Pages,
	idResolver *idresolver.Resolver,
	mentionsResolver *mentions.Resolver,
	db *db.DB,
	config *config.Config,
	notifier notify.Notifier,
	indexer *issues_indexer.Indexer,
	logger *slog.Logger,
) *Issues {
	return &Issues{
		oauth:            oauth,
		repoResolver:     repoResolver,
		acl:              acl,
		pages:            pages,
		idResolver:       idResolver,
		mentionsResolver: mentionsResolver,
		db:               db,
		config:           config,
		notifier:         notifier,
		logger:           logger,
		indexer:          indexer,
		ogreClient:       ogre.NewClient(config.Ogre.Host),
	}
}

func (rp *Issues) RepoSingleIssue(w http.ResponseWriter, r *http.Request) {
	l := rp.logger.With("handler", "RepoSingleIssue")
	user := rp.oauth.GetMultiAccountUser(r)
	f, err := rp.repoResolver.Resolve(r)
	if err != nil {
		l.Error("failed to get repo and knot", "err", err)
		return
	}

	issue, ok := r.Context().Value("issue").(*models.Issue)
	if !ok {
		l.Error("failed to get issue")
		rp.pages.Error404(w)
		return
	}

	if user != nil {
		userDid := user.Did
		repoDid := f.RepoDid
		issueId := issue.IssueId
		atUri := issue.AtUri().String()
		focusing := pages.BaseParamsFromContext(r.Context()).FocusParams.Focusing
		go func() {
			if !focusing {
				if err := db.MarkNotificationsReadForIssue(rp.db, userDid, repoDid, issueId); err != nil {
					l.Error("failed to mark issue notifications as read", "err", err)
				}
			}
			if err := db.UpsertRecentLink(rp.db, userDid, models.RecentLinkTypeIssue, atUri); err != nil {
				l.Error("failed to upsert recent link", "err", err)
			}
		}()
	}

	entities := []syntax.ATURI{issue.AtUri()}
	for _, c := range issue.Comments {
		entities = append(entities, c.FeedCommentAtUri())
	}
	reactions, err := db.ListReactionDisplayDataMap(rp.db, entities, 20)
	if err != nil {
		l.Error("failed to get reactions", "err", err)
	}

	var userReactions map[syntax.ATURI]map[models.ReactionKind]bool
	if user != nil {
		userReactions, err = db.ListReactionStatusMap(rp.db, entities, syntax.DID(user.Did))
		if err != nil {
			l.Error("failed to get user reactions", "err", err)
		}
	}

	backlinks, err := db.GetBacklinks(rp.db, issue.AtUri())
	if err != nil {
		l.Error("failed to fetch backlinks", "err", err)
		rp.pages.Error503(w)
		return
	}

	labelDefs, err := db.GetLabelDefinitions(
		rp.db,
		orm.FilterIn("at_uri", f.Labels),
		orm.FilterContains("scope", tangled.RepoIssueNSID),
	)
	if err != nil {
		l.Error("failed to fetch labels", "err", err)
		rp.pages.Error503(w)
		return
	}

	vouchRelationships := make(map[syntax.DID]*models.VouchRelationship)
	if user != nil {
		participants := issue.Participants()
		vouchRelationships, err = db.GetVouchRelationshipsBatch(rp.db, syntax.DID(user.Did), participants)
		if err != nil {
			l.Error("failed to fetch vouch relationships", "err", err)
		}
	}

	defs := make(map[string]*models.LabelDefinition)
	for _, l := range labelDefs {
		defs[l.AtUri().String()] = &l
	}

	var isSubscribed *bool
	if user != nil {
		sub, found, err2 := db.GetIssueSubscription(rp.db, user.Did, issue.Id)
		if err2 == nil {
			if found {
				isSubscribed = &sub
			} else {
				// Implicitly subscribed when you're the author or a participant.
				isAuthorOrParticipant := issue.Did == user.Did
				if !isAuthorOrParticipant {
					for _, p := range issue.Participants() {
						if p.String() == user.Did {
							isAuthorOrParticipant = true
							break
						}
					}
				}
				if isAuthorOrParticipant {
					t := true
					isSubscribed = &t
				}
			}
		}
	}

	err = rp.pages.RepoSingleIssue(w, pages.RepoSingleIssueParams{
		BaseParams:         pages.BaseParamsFromContext(r.Context()),
		RepoInfo:           rp.repoResolver.GetRepoInfo(r, user),
		Issue:              issue,
		CommentList:        models.NewCommentList(issue.Comments),
		Backlinks:          backlinks,
		Reactions:          reactions,
		UserReacted:        userReactions,
		LabelDefs:          defs,
		VouchRelationships: vouchRelationships,
		IsSubscribed:       isSubscribed,
	})
	if err != nil {
		l.Error("failed to render issue", "err", err)
	}
}

// SubscribeIssue handles subscribe/unsubscribe for a specific issue.
func (rp *Issues) SubscribeIssue(w http.ResponseWriter, r *http.Request) {
	l := rp.logger.With("handler", "SubscribeIssue")
	user := rp.oauth.GetMultiAccountUser(r)
	if user == nil {
		w.WriteHeader(http.StatusUnauthorized)
		return
	}

	issue, ok := r.Context().Value("issue").(*models.Issue)
	if !ok {
		l.Error("failed to get issue from context")
		w.WriteHeader(http.StatusNotFound)
		return
	}

	subscribe := r.FormValue("subscribe") != "false"

	if err := db.UpsertIssueSubscription(rp.db, user.Did, issue.Id, subscribe); err != nil {
		l.Error("failed to update issue subscription", "err", err)
		w.WriteHeader(http.StatusInternalServerError)
		return
	}

	// Return the updated subscription button fragment.
	repoInfo := rp.repoResolver.GetRepoInfo(r, user)
	rp.pages.IssueSubscribeFragment(w, pages.IssueSubscribeParams{
		RepoInfo:     repoInfo,
		IssueId:      issue.IssueId,
		IsSubscribed: &subscribe,
	})
}

func (rp *Issues) EditIssue(w http.ResponseWriter, r *http.Request) {
	l := rp.logger.With("handler", "EditIssue")
	user := rp.oauth.GetMultiAccountUser(r)

	issue, ok := r.Context().Value("issue").(*models.Issue)
	if !ok {
		l.Error("failed to get issue")
		rp.pages.Error404(w)
		return
	}

	switch r.Method {
	case http.MethodGet:
		rp.pages.EditIssueFragment(w, pages.EditIssueParams{
			BaseParams: pages.BaseParamsFromContext(r.Context()),
			RepoInfo:   rp.repoResolver.GetRepoInfo(r, user),
			Issue:      issue,
		})
	case http.MethodPost:
		noticeId := "issues"
		newIssue := issue
		newIssue.Title = r.FormValue("title")
		newIssue.Body = r.FormValue("body")
		newIssue.Mentions, newIssue.References = rp.mentionsResolver.Resolve(r.Context(), newIssue.Body)

		if err := newIssue.Validate(); err != nil {
			l.Error("validation error", "err", err)
			rp.pages.Notice(w, noticeId, fmt.Sprintf("Failed to edit issue: %s", err))
			return
		}

		newRecord := newIssue.AsRecord()

		// edit an atproto record
		client, err := rp.oauth.AuthorizedClient(r)
		if err != nil {
			l.Error("failed to get authorized client", "err", err)
			rp.pages.Notice(w, noticeId, "Failed to edit issue.")
			return
		}

		ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.RepoIssueNSID, user.Did, newIssue.Rkey)
		if err != nil {
			l.Error("failed to get record", "err", err)
			rp.pages.Notice(w, noticeId, "Failed to edit issue, no record found on PDS.")
			return
		}

		_, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
			Collection: tangled.RepoIssueNSID,
			Repo:       user.Did,
			Rkey:       newIssue.Rkey,
			SwapRecord: ex.Cid,
			Record: &lexutil.LexiconTypeDecoder{
				Val: &newRecord,
			},
		})
		if err != nil {
			l.Error("failed to edit record on PDS", "err", err)
			rp.pages.Notice(w, noticeId, "Failed to edit issue on PDS.")
			return
		}

		// modify on DB -- TODO: transact this cleverly
		tx, err := rp.db.Begin()
		if err != nil {
			l.Error("failed to edit issue on DB", "err", err)
			rp.pages.Notice(w, noticeId, "Failed to edit issue.")
			return
		}
		defer tx.Rollback()

		err = db.PutIssue(tx, newIssue)
		if err != nil {
			l.Error("failed to edit issue", "err", err)
			rp.pages.Notice(w, "issues", "Failed to edit issue.")
			return
		}

		if err = tx.Commit(); err != nil {
			l.Error("failed to edit issue", "err", err)
			rp.pages.Notice(w, "issues", "Failed to cedit issue.")
			return
		}

		rp.pages.HxRefresh(w)
	}
}

func (rp *Issues) DeleteIssue(w http.ResponseWriter, r *http.Request) {
	l := rp.logger.With("handler", "DeleteIssue")
	noticeId := "issue-actions-error"

	f, err := rp.repoResolver.Resolve(r)
	if err != nil {
		l.Error("failed to get repo and knot", "err", err)
		return
	}

	issue, ok := r.Context().Value("issue").(*models.Issue)
	if !ok {
		l.Error("failed to get issue")
		rp.pages.Notice(w, noticeId, "Failed to delete issue.")
		return
	}
	l = l.With("did", issue.Did, "rkey", issue.Rkey)

	tx, err := rp.db.Begin()
	if err != nil {
		l.Error("failed to start transaction", "err", err)
		rp.pages.Notice(w, "issue-comment", "Failed to create comment, try again later.")
		return
	}
	defer tx.Rollback()

	// delete from PDS
	client, err := rp.oauth.AuthorizedClient(r)
	if err != nil {
		l.Error("failed to get authorized client", "err", err)
		rp.pages.Notice(w, "issue-comment", "Failed to delete comment.")
		return
	}
	_, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{
		Collection: tangled.RepoIssueNSID,
		Repo:       issue.Did,
		Rkey:       issue.Rkey,
	})
	if err != nil {
		// TODO: transact this better
		l.Error("failed to delete issue from PDS", "err", err)
		rp.pages.Notice(w, noticeId, "Failed to delete issue.")
		return
	}

	// delete from db
	if err := db.DeleteIssues(tx, issue.Did, issue.Rkey); err != nil {
		l.Error("failed to delete issue", "err", err)
		rp.pages.Notice(w, noticeId, "Failed to delete issue.")
		return
	}
	tx.Commit()

	rp.notifier.DeleteIssue(r.Context(), issue)

	// return to all issues page
	ownerSlashRepo := reporesolver.GetBaseRepoPath(r, f)
	rp.pages.HxRedirect(w, "/"+ownerSlashRepo+"/issues")
}

func (rp *Issues) CloseIssue(w http.ResponseWriter, r *http.Request) {
	l := rp.logger.With("handler", "CloseIssue")
	user := rp.oauth.GetMultiAccountUser(r)
	if user == nil {
		l.Error("nil user")
		rp.pages.Notice(w, "issue-action", "You must be logged in to close this issue.")
		return
	}
	f, err := rp.repoResolver.Resolve(r)
	if err != nil {
		l.Error("failed to get repo and knot", "err", err)
		return
	}

	issue, ok := r.Context().Value("issue").(*models.Issue)
	if !ok {
		l.Error("failed to get issue")
		rp.pages.Error404(w)
		return
	}

	roles := rp.acl.RolesInRepo(r.Context(), f, user.Did)
	isRepoOwner := roles.IsOwner()
	isCollaborator := roles.IsCollaborator()
	isIssueOwner := user.Did == issue.Did

	// TODO: make this more granular
	if isIssueOwner || isRepoOwner || isCollaborator {
		if err := rp.writeIssueStateRecord(r, user.Did, issue.AtUri(), models.StateClosed); err != nil {
			l.Error("failed to write issue state record", "err", err)
			rp.pages.Notice(w, "issue-action", "Failed to close issue. Try again later.")
			return
		}

		err = db.CloseIssues(
			rp.db,
			orm.FilterEq("id", issue.Id),
		)
		if err != nil {
			l.Error("failed to close issue", "err", err)
			rp.pages.Notice(w, "issue-action", "Failed to close issue. Try again later.")
			return
		}
		// change the issue state (this will pass down to the notifiers)
		issue.Open = false

		// notify about the issue closure
		rp.notifier.NewIssueState(r.Context(), syntax.DID(user.Did), issue)

		ownerSlashRepo := reporesolver.GetBaseRepoPath(r, f)
		rp.pages.HxLocation(w, fmt.Sprintf("/%s/issues/%d", ownerSlashRepo, issue.IssueId))
		return
	} else {
		l.Error("user is not permitted to close issue")
		http.Error(w, "for biden", http.StatusUnauthorized)
		return
	}
}

func (rp *Issues) ReopenIssue(w http.ResponseWriter, r *http.Request) {
	l := rp.logger.With("handler", "ReopenIssue")
	user := rp.oauth.GetMultiAccountUser(r)
	if user == nil {
		l.Error("nil user")
		rp.pages.Notice(w, "issue-action", "You must be logged in to reopen this issue.")
		return
	}
	f, err := rp.repoResolver.Resolve(r)
	if err != nil {
		l.Error("failed to get repo and knot", "err", err)
		return
	}

	issue, ok := r.Context().Value("issue").(*models.Issue)
	if !ok {
		l.Error("failed to get issue")
		rp.pages.Error404(w)
		return
	}

	roles := rp.acl.RolesInRepo(r.Context(), f, user.Did)
	isRepoOwner := roles.IsOwner()
	isCollaborator := roles.IsCollaborator()
	isIssueOwner := user.Did == issue.Did

	if isCollaborator || isRepoOwner || isIssueOwner {
		if err := rp.writeIssueStateRecord(r, user.Did, issue.AtUri(), models.StateOpen); err != nil {
			l.Error("failed to write issue state record", "err", err)
			rp.pages.Notice(w, "issue-action", "Failed to reopen issue. Try again later.")
			return
		}

		err := db.ReopenIssues(
			rp.db,
			orm.FilterEq("id", issue.Id),
		)
		if err != nil {
			l.Error("failed to reopen issue", "err", err)
			rp.pages.Notice(w, "issue-action", "Failed to reopen issue. Try again later.")
			return
		}
		// change the issue state (this will pass down to the notifiers)
		issue.Open = true

		// notify about the issue reopen
		rp.notifier.NewIssueState(r.Context(), syntax.DID(user.Did), issue)

		ownerSlashRepo := reporesolver.GetBaseRepoPath(r, f)
		rp.pages.HxLocation(w, fmt.Sprintf("/%s/issues/%d", ownerSlashRepo, issue.IssueId))
		return
	} else {
		l.Error("user is not the owner of the repo")
		http.Error(w, "forbidden", http.StatusUnauthorized)
		return
	}
}

func (rp *Issues) writeIssueStateRecord(r *http.Request, actorDid string, subject syntax.ATURI, value models.StateValue) error {
	client, err := rp.oauth.AuthorizedClient(r)
	if err != nil {
		return err
	}

	record, err := models.AsIssueStateRecord(subject, value, time.Now())
	if err != nil {
		return err
	}

	_, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
		Collection: tangled.RepoIssueStateNSID,
		Repo:       actorDid,
		Rkey:       tid.TID(),
		Record: &lexutil.LexiconTypeDecoder{
			Val: &record,
		},
	})
	return err
}

func (rp *Issues) RepoIssues(w http.ResponseWriter, r *http.Request) {
	l := rp.logger.With("handler", "RepoIssues")

	params := r.URL.Query()
	page := pagination.FromContext(r.Context())

	user := rp.oauth.GetMultiAccountUser(r)
	f, err := rp.repoResolver.Resolve(r)
	if err != nil {
		l.Error("failed to get repo and knot", "err", err)
		return
	}

	query := searchquery.Parse(params.Get("q"))

	var isOpen *bool
	if urlState := params.Get("state"); urlState != "" {
		switch urlState {
		case "open":
			isOpen = ptrBool(true)
		case "closed":
			isOpen = ptrBool(false)
		}
		query.Set("state", urlState)
	} else if queryState := query.Get("state"); queryState != nil {
		switch *queryState {
		case "open":
			isOpen = ptrBool(true)
		case "closed":
			isOpen = ptrBool(false)
		}
	} else if _, hasQ := params["q"]; !hasQ {
		// no q param at all -- default to open
		isOpen = ptrBool(true)
		query.Set("state", "open")
	}

	resolve := func(ctx context.Context, ident string) (string, error) {
		id, err := rp.idResolver.ResolveIdent(ctx, ident)
		if err != nil {
			return "", err
		}
		return id.DID.String(), nil
	}

	authorDid, negatedAuthorDids := searchquery.ResolveAuthor(r.Context(), query, resolve, l)

	labels := query.GetAll("label")
	negatedLabels := query.GetAllNegated("label")
	labelValues := query.GetDynamicTags()
	negatedLabelValues := query.GetNegatedDynamicTags()

	// resolve DID-format label values: if a dynamic tag's label
	// definition has format "did", resolve the handle to a DID
	if len(labelValues) > 0 || len(negatedLabelValues) > 0 {
		labelDefs, err := db.GetLabelDefinitions(
			rp.db,
			orm.FilterIn("at_uri", f.Labels),
			orm.FilterContains("scope", tangled.RepoIssueNSID),
		)
		if err == nil {
			didLabels := make(map[string]bool)
			for _, def := range labelDefs {
				if def.ValueType.Format == models.ValueTypeFormatDid {
					didLabels[def.Name] = true
				}
			}
			labelValues = searchquery.ResolveDIDLabelValues(r.Context(), labelValues, didLabels, resolve, l)
			negatedLabelValues = searchquery.ResolveDIDLabelValues(r.Context(), negatedLabelValues, didLabels, resolve, l)
		} else {
			l.Debug("failed to fetch label definitions for DID resolution", "err", err)
		}
	}

	tf := searchquery.ExtractTextFilters(query)

	searchOpts := models.IssueSearchOptions{
		Keywords:           tf.Keywords,
		Phrases:            tf.Phrases,
		RepoDid:            f.RepoDid,
		IsOpen:             isOpen,
		AuthorDid:          authorDid,
		Labels:             labels,
		LabelValues:        labelValues,
		NegatedKeywords:    tf.NegatedKeywords,
		NegatedPhrases:     tf.NegatedPhrases,
		NegatedLabels:      negatedLabels,
		NegatedLabelValues: negatedLabelValues,
		NegatedAuthorDids:  negatedAuthorDids,
		Page:               page,
	}

	totalIssues := 0
	if isOpen == nil {
		totalIssues = f.RepoStats.IssueCount.Open + f.RepoStats.IssueCount.Closed
	} else if *isOpen {
		totalIssues = f.RepoStats.IssueCount.Open
	} else {
		totalIssues = f.RepoStats.IssueCount.Closed
	}

	repoInfo := rp.repoResolver.GetRepoInfo(r, user)

	var issues []models.Issue

	if searchOpts.HasSearchFilters() {
		res, err := rp.indexer.Search(r.Context(), searchOpts)
		if err != nil {
			l.Error("failed to search for issues", "err", err)
			return
		}
		l.Debug("searched issues with indexer", "count", len(res.Hits))
		totalIssues = int(res.Total)

		// update tab counts to reflect filtered results
		countOpts := searchOpts
		countOpts.Page = pagination.Page{Limit: 1}
		countOpts.IsOpen = ptrBool(true)
		if openRes, err := rp.indexer.Search(r.Context(), countOpts); err == nil {
			repoInfo.Stats.IssueCount.Open = int(openRes.Total)
		}
		countOpts.IsOpen = ptrBool(false)
		if closedRes, err := rp.indexer.Search(r.Context(), countOpts); err == nil {
			repoInfo.Stats.IssueCount.Closed = int(closedRes.Total)
		}

		if len(res.Hits) > 0 {
			issues, err = db.GetIssues(
				rp.db,
				orm.FilterIn("id", res.Hits),
			)
			if err != nil {
				l.Error("failed to get issues", "err", err)
				rp.pages.Notice(w, "issues", "Failed to load issues. Try again later.")
				return
			}
		}
	} else {
		filters := []orm.Filter{
			orm.FilterEq("repo_did", f.RepoDid),
		}
		if isOpen != nil {
			openInt := 0
			if *isOpen {
				openInt = 1
			}
			filters = append(filters, orm.FilterEq("open", openInt))
		}
		issues, err = db.GetIssuesPaginated(
			rp.db,
			page,
			filters...,
		)
		if err != nil {
			l.Error("failed to get issues", "err", err)
			rp.pages.Notice(w, "issues", "Failed to load issues. Try again later.")
			return
		}
	}

	labelDefs, err := db.GetLabelDefinitions(
		rp.db,
		orm.FilterIn("at_uri", f.Labels),
		orm.FilterContains("scope", tangled.RepoIssueNSID),
	)
	if err != nil {
		l.Error("failed to fetch labels", "err", err)
		rp.pages.Error503(w)
		return
	}

	defs := make(map[string]*models.LabelDefinition)
	for _, l := range labelDefs {
		defs[l.AtUri().String()] = &l
	}

	filterState := ""
	if isOpen != nil {
		if *isOpen {
			filterState = "open"
		} else {
			filterState = "closed"
		}
	}

	vouchRelationships := make(map[syntax.DID]*models.VouchRelationship)
	if user != nil {
		dids := make([]syntax.DID, len(issues))
		for i, u := range issues {
			dids[i] = syntax.DID(u.Did)
		}
		vouchRelationships, err = db.GetVouchRelationshipsBatch(rp.db, syntax.DID(user.Did), dids)
		if err != nil {
			l.Error("failed to fetch vouch relationships", "err", err)
		}
	}
	baseFilterParts := make([]string, 0, len(query.Items()))
	for _, item := range query.Items() {
		if item.Kind == searchquery.KindTagValue {
			if item.Key == "label" || !searchquery.KnownTags[item.Key] {
				continue
			}
		}
		baseFilterParts = append(baseFilterParts, item.Raw)
	}
	baseFilterQuery := strings.Join(baseFilterParts, " ")
	rp.pages.RepoIssues(w, pages.RepoIssuesParams{
		BaseParams:         pages.BaseParamsFromContext(r.Context()),
		RepoInfo:           repoInfo,
		Issues:             issues,
		IssueCount:         totalIssues,
		LabelDefs:          defs,
		FilterState:        filterState,
		FilterQuery:        query.String(),
		BaseFilterQuery:    baseFilterQuery,
		Page:               page,
		VouchRelationships: vouchRelationships,
	})
}

func ptrBool(b bool) *bool { return &b }

func (rp *Issues) NewIssue(w http.ResponseWriter, r *http.Request) {
	l := rp.logger.With("handler", "NewIssue")
	user := rp.oauth.GetMultiAccountUser(r)

	f, err := rp.repoResolver.Resolve(r)
	if err != nil {
		l.Error("failed to get repo and knot", "err", err)
		return
	}

	switch r.Method {
	case http.MethodGet:
		rp.pages.RepoNewIssue(w, pages.RepoNewIssueParams{
			BaseParams: pages.BaseParamsFromContext(r.Context()),
			RepoInfo:   rp.repoResolver.GetRepoInfo(r, user),
		})
	case http.MethodPost:
		body := r.FormValue("body")
		mentions, references := rp.mentionsResolver.Resolve(r.Context(), body)

		issue := &models.Issue{
			RepoDid:    syntax.DID(f.RepoDid),
			Rkey:       tid.TID(),
			Title:      r.FormValue("title"),
			Body:       body,
			Open:       true,
			Did:        user.Did,
			Created:    time.Now(),
			Mentions:   mentions,
			References: references,
			Repo:       f,
		}

		if err := issue.Validate(); err != nil {
			l.Error("validation error", "err", err)
			rp.pages.Notice(w, "issues", fmt.Sprintf("Failed to create issue: %s", err))
			return
		}

		record := issue.AsRecord()

		// create an atproto record
		client, err := rp.oauth.AuthorizedClient(r)
		if err != nil {
			l.Error("failed to get authorized client", "err", err)
			rp.pages.Notice(w, "issues", "Failed to create issue.")
			return
		}
		resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
			Collection: tangled.RepoIssueNSID,
			Repo:       user.Did,
			Rkey:       issue.Rkey,
			Record: &lexutil.LexiconTypeDecoder{
				Val: &record,
			},
		})
		if err != nil {
			l.Error("failed to create issue", "err", err)
			rp.pages.Notice(w, "issues", "Failed to create issue.")
			return
		}
		atUri := resp.Uri

		tx, err := rp.db.BeginTx(r.Context(), nil)
		if err != nil {
			rp.pages.Notice(w, "issues", "Failed to create issue, try again later")
			return
		}
		rollback := func() {
			err1 := tx.Rollback()
			err2 := rollbackRecord(context.Background(), atUri, client)

			if errors.Is(err1, sql.ErrTxDone) {
				err1 = nil
			}

			if err := errors.Join(err1, err2); err != nil {
				l.Error("failed to rollback txn", "err", err)
			}
		}
		defer rollback()

		err = db.PutIssue(tx, issue)
		if err != nil {
			l.Error("failed to create issue", "err", err)
			rp.pages.Notice(w, "issues", "Failed to create issue.")
			return
		}

		if err = tx.Commit(); err != nil {
			l.Error("failed to create issue", "err", err)
			rp.pages.Notice(w, "issues", "Failed to create issue.")
			return
		}

		// everything is successful, do not rollback the atproto record
		atUri = ""

		rp.notifier.NewIssue(r.Context(), issue, mentions)

		ownerSlashRepo := reporesolver.GetBaseRepoPath(r, f)
		rp.pages.HxLocation(w, fmt.Sprintf("/%s/issues/%d", ownerSlashRepo, issue.IssueId))
		return
	}
}

// this is used to rollback changes made to the PDS
//
// it is a no-op if the provided ATURI is empty
func rollbackRecord(ctx context.Context, aturi string, client *atclient.APIClient) error {
	if aturi == "" {
		return nil
	}

	parsed := syntax.ATURI(aturi)

	collection := parsed.Collection().String()
	repo := parsed.Authority().String()
	rkey := parsed.RecordKey().String()

	_, err := comatproto.RepoDeleteRecord(ctx, client, &comatproto.RepoDeleteRecord_Input{
		Collection: collection,
		Repo:       repo,
		Rkey:       rkey,
	})
	return err
}
