using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Text.Json.Nodes;
using Fleet.Core;
using Fleet.Hosting;
using Fleet.Identity;

namespace Fleet.Enrollment.Client;

public sealed record EnrollmentResult(string NodeId, string Status, string IdentityDirectory);

/// <summary>
/// 用加入令牌注册（供 <c>fleet-enroll</c> 使用，也可以嵌入产品自己的安装工具）：
/// 生成身份密钥和 TLS 证书 → 用身份私钥签名持有证明 → 调用注册端点 → 写入身份目录。
/// 注册逻辑只存在于这里，常驻的业务进程不包含注册代码，也不使用 HttpClient。
/// </summary>
public static class EnrollmentClient
{
    public static async Task<Result<EnrollmentResult>> EnrollAsync(
        HttpClient http, Uri server, string joinToken, string name, string identityDirectory, string nodeVersion, JsonNode? productMeta, TimeProvider time, CancellationToken ct)
    {
        string nodeFile = Path.Combine(identityDirectory, LoadedNodeIdentity.NodeFileName);
        if (File.Exists(nodeFile))
        {
            return Result<EnrollmentResult>.Fail(FleetErrors.NameConflict, $"{nodeFile} already exists: this node is already enrolled (remove the directory to enroll again)");
        }

        using NodeIdentity identity = NodeIdentity.Generate();
        byte[] pfx = NodeCertificate.CreateSelfSignedPfx(name, TimeSpan.FromDays(3650), time);
        byte[] spki;
        using (var certificate = NodeCertificate.LoadPfx(pfx))
        {
            spki = NodeCertificate.SpkiFingerprint(certificate);
        }

        string pubkey = Convert.ToBase64String(identity.PublicKeySpki);
        string tokenHash = Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes(joinToken)));
        var body = new JsonObject
        {
            ["join_token"] = joinToken,
            ["name"] = name,
            ["pubkey"] = pubkey,
            ["tls_spki"] = Convert.ToBase64String(spki),
            ["proof"] = Convert.ToBase64String(identity.Sign(SignaturePurpose.Enroll, tokenHash, pubkey)),
            ["node_version"] = nodeVersion,
            ["meta"] = productMeta,
        };

        using var content = new StringContent(body.ToJsonString(), Encoding.UTF8, "application/json");
        using HttpResponseMessage response = await http.PostAsync(new Uri(server, "/api/agent/v1/enroll"), content, ct);
        string text = await response.Content.ReadAsStringAsync(ct);
        if (!response.IsSuccessStatusCode)
        {
            string code = "fleet_internal";
            string detail = text;
            try
            {
                JsonNode? problem = JsonNode.Parse(text);
                code = problem?["code"]?.GetValue<string>() ?? code;
                detail = problem?["detail"]?.GetValue<string>() ?? detail;
            }
            catch (JsonException)
            {
                // 不是 problem+json：原样返回
            }

            return Result<EnrollmentResult>.Fail(new ErrorCode(code), $"{(int)response.StatusCode}: {detail}");
        }

        JsonNode result = JsonNode.Parse(text)!;
        string nodeId = result["node_id"]!.GetValue<string>();
        var store = new ConfigStore(identityDirectory);
        store.Write(LoadedNodeIdentity.KeyFileName, identity.ExportPkcs8());
        store.Write(LoadedNodeIdentity.TlsFileName, pfx);
        // node.json 最后写：它存在就表示注册完整完成
        store.Write(
            LoadedNodeIdentity.NodeFileName,
            JsonSerializer.SerializeToUtf8Bytes(new NodeFile { NodeId = nodeId, Server = server.ToString().TrimEnd('/'), TlsSpki = Convert.ToBase64String(spki) }, NodeFileContext.Default.NodeFile));
        return Result<EnrollmentResult>.Ok(new EnrollmentResult(nodeId, result["status"]!.GetValue<string>(), identityDirectory));
    }
}