using Fleet.Core;
using Fleet.Identity;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Routing;
using MoShiro.Backend.Application;
using MoShiro.Protocol;

namespace MoShiro.Backend.Api;

/// <summary>Agent 管理：列表、修改、审批、启停、接管、删除；加入令牌；Probe 身份。</summary>
public static class AgentEndpoints
{
    private const string AgentsTag = "admin-agents";
    private const string TokensTag = "admin-join-tokens";
    private const string ProbeTag = "admin-probe";

    public static void Map(RouteGroupBuilder group)
    {
        group.MapGet("/agents", ListAsync)
            .Api("agents_list", "All agents including pending and disabled ones", AgentsTag).Returns<PageDto<AgentDto>>().ProducesProblems(401, 403)
            .Requires(Capability.FleetRead);
        group.MapGet("/agents/{id}", GetAsync)
            .Api("agents_get", "One agent", AgentsTag).Returns<AgentDto>().ProducesProblems(401, 403, 404)
            .Requires(Capability.FleetRead);
        group.MapPatch("/agents/{id}", PatchAsync)
            .Accepts<AgentPatchRequest>("application/merge-patch+json", "application/json")
            .Api("agents_update", "Update name, labels, public host or visibility (merge-patch, If-Match supported)", AgentsTag)
            .Returns<AgentDto>().ProducesProblems(400, 401, 403, 404, 409, 412)
            .Requires(Capability.FleetWrite);
        group.MapPost("/agents/{id}/approve", (HttpContext http, AgentService agents, string id) => TransitionAsync(http, id, (nodeId, ct) => agents.ApproveAsync(nodeId, ct)))
            .Api("agents_approve", "Approve a pending agent", AgentsTag).Returns<AgentDto>().ProducesProblems(401, 403, 404, 409)
            .Requires(Capability.FleetEnroll);
        group.MapPost("/agents/{id}/disable", (HttpContext http, AgentService agents, string id) => TransitionAsync(http, id, (nodeId, ct) => agents.DisableAsync(nodeId, ct)))
            .Api("agents_disable", "Disable an agent and drop its connection", AgentsTag).Returns<AgentDto>().ProducesProblems(401, 403, 404, 409)
            .Requires(Capability.FleetWrite);
        group.MapPost("/agents/{id}/enable", (HttpContext http, AgentService agents, string id) => TransitionAsync(http, id, (nodeId, ct) => agents.EnableAsync(nodeId, ct)))
            .Api("agents_enable", "Enable a disabled agent", AgentsTag).Returns<AgentDto>().ProducesProblems(401, 403, 404, 409)
            .Requires(Capability.FleetWrite);
        group.MapPost("/agents/{id}/takeover", (HttpContext http, AgentService agents, string id) => TransitionAsync(http, id, (nodeId, ct) => agents.TakeoverAsync(nodeId, ct)))
            .Api("agents_takeover", "Replace the existing node of the same name with this pending one, keeping history", AgentsTag)
            .Returns<AgentDto>().ProducesProblems(401, 403, 404)
            .Requires(Capability.FleetEnroll);
        group.MapDelete("/agents/{id}", DeleteAsync)
            .Api("agents_delete", "Delete an agent; history expires with the retention policy", AgentsTag)
            .Returns<object>(StatusCodes.Status204NoContent).ProducesProblems(401, 403)
            .Requires(Capability.FleetRevoke);

        group.MapGet("/join-tokens", ListTokensAsync)
            .Api("join_tokens_list", "Join tokens", TokensTag).Returns<PageDto<JoinTokenDto>>().ProducesProblems(401, 403)
            .Requires(Capability.FleetRead);
        group.MapPost("/join-tokens", CreateTokenAsync)
            .Api("join_tokens_create", "Create a join token for an agent or a probe (role); the plaintext is returned only once", TokensTag)
            .Returns<CreatedJoinTokenDto>(StatusCodes.Status201Created).ProducesProblems(400, 401, 403)
            .Requires(Capability.FleetEnroll);
        group.MapDelete("/join-tokens/{id}", RevokeTokenAsync)
            .Api("join_tokens_revoke", "Revoke a join token; with purge=true delete the record for good", TokensTag)
            .Returns<object>(StatusCodes.Status204NoContent).ProducesProblems(401, 403)
            .Requires(Capability.FleetEnroll);

        group.MapGet("/probes", ListProbesAsync)
            .Api("probes_list", "All probes, with the agents each one is connected to", ProbeTag).Returns<PageDto<ProbeDto>>().ProducesProblems(401, 403)
            .Requires(Capability.FleetRead);
        group.MapGet("/probes/{id}", GetProbeAsync)
            .Api("probes_get", "One probe", ProbeTag).Returns<ProbeDto>().ProducesProblems(401, 403, 404)
            .Requires(Capability.FleetRead);
        group.MapPatch("/probes/{id}", PatchProbeAsync)
            .Api("probes_update", "Rename a probe", ProbeTag).Returns<ProbeDto>().ProducesProblems(400, 401, 403, 404, 409)
            .Requires(Capability.FleetWrite);
        group.MapPost("/probes/{id}/revoke", RevokeProbeAsync)
            .Api("probes_revoke", "Revoke a probe: every agent drops its session and refuses it; history stays until it expires", ProbeTag)
            .Returns<ProbeDto>().ProducesProblems(401, 403, 404)
            .Requires(Capability.FleetRevoke);
        group.MapDelete("/probes/{id}", DeleteProbeAsync)
            .Api("probes_delete", "Delete a probe and its lines; stored data expires with the retention policy", ProbeTag)
            .Returns<object>(StatusCodes.Status204NoContent).ProducesProblems(401, 403)
            .Requires(Capability.FleetRevoke);
        group.MapPost("/agents/{id}/probes/{probe_id}/disconnect", DisconnectProbeAsync)
            .Api("agents_probe_disconnect", "Make an agent drop one probe's session (the probe reconnects unless it is revoked)", AgentsTag)
            .Returns<object>(StatusCodes.Status204NoContent).ProducesProblems(401, 403, 404, 409)
            .Requires(Capability.FleetWrite);
    }

    private static async Task<IResult> ListAsync(AgentService agents, CancellationToken ct) =>
        TypedResults.Json(new PageDto<AgentDto>([.. (await agents.ListAsync(ct)).Select(Mappers.ToDto)], null), ApiJsonContext.Default.PageDtoAgentDto);

    private static async Task<IResult> GetAsync(HttpContext http, AgentService agents, string id, CancellationToken ct)
    {
        AgentView? view = await agents.GetAsync(new NodeId(id), ct);
        if (view is null)
        {
            return Problems.Create(http, MoShiroErrors.AgentNotFound, "agent not found");
        }

        Concurrency.SetETag(http, view.Agent.RowVersion);
        return TypedResults.Json(Mappers.ToDto(view), ApiJsonContext.Default.AgentDto);
    }

    private static async Task<IResult> PatchAsync(HttpContext http, AgentService agents, AgentPatchRequest request, string id, CancellationToken ct)
    {
        Result<AgentView> result = await agents.PatchAsync(
            new NodeId(id), new AgentPatch { Name = request.Name, Labels = request.Labels, PublicHost = request.PublicHost, Ipv6Host = request.Ipv6Host, PublicHostAuto = request.PublicHostAuto, Ipv6HostAuto = request.Ipv6HostAuto, PublicVisible = request.PublicVisible }, Concurrency.ExpectedRowVersion(http), ct);
        if (!result.TryGet(out AgentView? view, out FleetError? error))
        {
            return Problems.From(http, error);
        }

        Concurrency.SetETag(http, view.Agent.RowVersion);
        return TypedResults.Json(Mappers.ToDto(view), ApiJsonContext.Default.AgentDto);
    }

    private static async Task<IResult> TransitionAsync(HttpContext http, string id, Func<NodeId, CancellationToken, ValueTask<Result<AgentView>>> action)
    {
        Result<AgentView> result = await action(new NodeId(id), http.RequestAborted);
        if (!result.TryGet(out AgentView? view, out FleetError? error))
        {
            return Problems.From(http, error);
        }

        Concurrency.SetETag(http, view.Agent.RowVersion);
        return TypedResults.Json(Mappers.ToDto(view), ApiJsonContext.Default.AgentDto);
    }

    private static async Task<IResult> DeleteAsync(AgentService agents, string id, CancellationToken ct)
    {
        await agents.DeleteAsync(new NodeId(id), ct);
        return TypedResults.NoContent();
    }

    private static async Task<IResult> ListTokensAsync(JoinTokenService tokens, CancellationToken ct) =>
        TypedResults.Json(new PageDto<JoinTokenDto>([.. (await tokens.ListAsync(ct)).Select(Mappers.ToDto)], null), ApiJsonContext.Default.PageDtoJoinTokenDto);

    private static async Task<IResult> CreateTokenAsync(HttpContext http, JoinTokenService tokens, TrustService trust, CreateJoinTokenRequest request, BackendOptions options)
    {
        string baseUrl = options.PublicUrl ?? $"{http.Request.Scheme}://{http.Request.Host}";

        // 信任根建立之后，命令里带上创世指纹和属主；属主默认是操作员集合里的全部 passkey，也可以只选其中几把
        OperatorSet? set = await trust.CurrentAsync(http.RequestAborted);
        string? genesis = set is null ? null : (await trust.StateAsync(AuthEndpoints.PasskeyContextOf(http, options), http.RequestAborted)).Genesis;
        Result<string[]> owner = OwnerPolicy.Resolve(options.RequireOwner, set, request.Controllers);
        if (!owner.TryGet(out string[]? controllers, out FleetError? ownerError))
        {
            return Problems.From(http, ownerError);
        }

        var plan = new InstallPlan(genesis, controllers, InstallScripts.Sha256(InstallScripts.Sh), InstallScripts.Sha256(InstallScripts.Ps1));
        http.SetDetail($"{request.Role ?? JoinTokenService.AgentRole}: {request.Note}");
        Result<CreatedJoinToken> result = await tokens.CreateAsync(
            new Application.CreateJoinTokenRequest(request.Note, request.Labels, request.AutoApprove ?? true, request.MaxUses ?? 1, request.ExpiresInHours ?? 24, request.Role ?? JoinTokenService.AgentRole, http.GetPrincipal().Label), baseUrl, plan, http.RequestAborted);
        if (!result.TryGet(out CreatedJoinToken? created, out FleetError? error))
        {
            return Problems.From(http, error);
        }

        http.Response.Headers.CacheControl = "no-store";
        http.Response.Headers.Location = "/api/admin/join-tokens";
        return TypedResults.Json(new CreatedJoinTokenDto(Mappers.ToDto(created.Info), created.Plaintext, new InstallCommandsDto(created.InstallCommands.Linux, created.InstallCommands.Macos, created.InstallCommands.Windows)), ApiJsonContext.Default.CreatedJoinTokenDto, statusCode: StatusCodes.Status201Created);
    }

    private static async Task<IResult> RevokeTokenAsync(JoinTokenService tokens, string id, bool? purge, CancellationToken ct)
    {
        if (purge == true)
        {
            await tokens.DeleteAsync(id, ct);
        }
        else
        {
            await tokens.RevokeAsync(id, ct);
        }

        return TypedResults.NoContent();
    }

    private static async Task<IResult> ListProbesAsync(ProbeService probes, CancellationToken ct) =>
        TypedResults.Json(new PageDto<ProbeDto>([.. (await probes.ListAsync(ct)).Select(Mappers.ToDto)], null), ApiJsonContext.Default.PageDtoProbeDto);

    private static async Task<IResult> GetProbeAsync(HttpContext http, ProbeService probes, string id, CancellationToken ct) =>
        await probes.GetAsync(id, ct) is { } view
            ? TypedResults.Json(Mappers.ToDto(view), ApiJsonContext.Default.ProbeDto)
            : Problems.Create(http, MoShiroErrors.ProbeNotFound, "probe not found");

    private static async Task<IResult> PatchProbeAsync(HttpContext http, ProbeService probes, PatchProbeRequest request, string id, CancellationToken ct)
    {
        if (request.Name is null)
        {
            return Problems.From(http, ValidationError.Single("name", "is required"));
        }

        Result<ProbeView> result = await probes.RenameAsync(id, request.Name, ct);
        return result.TryGet(out ProbeView? view, out FleetError? error) ? TypedResults.Json(Mappers.ToDto(view), ApiJsonContext.Default.ProbeDto) : Problems.From(http, error);
    }

    private static async Task<IResult> RevokeProbeAsync(HttpContext http, ProbeService probes, string id, CancellationToken ct)
    {
        Result<ProbeView> result = await probes.RevokeAsync(id, ct);
        return result.TryGet(out ProbeView? view, out FleetError? error) ? TypedResults.Json(Mappers.ToDto(view), ApiJsonContext.Default.ProbeDto) : Problems.From(http, error);
    }

    private static async Task<IResult> DeleteProbeAsync(ProbeService probes, string id, CancellationToken ct)
    {
        await probes.DeleteAsync(id, ct);
        return TypedResults.NoContent();
    }

    private static async Task<IResult> DisconnectProbeAsync(HttpContext http, ProbeService probes, string id, string probe_id, CancellationToken ct)
    {
        Result<bool> result = await probes.DisconnectAsync(probe_id, new NodeId(id), ct);
        if (!result.TryGet(out bool dropped, out FleetError? error))
        {
            return Problems.From(http, error);
        }

        return dropped ? TypedResults.NoContent() : Problems.Create(http, MoShiroErrors.ProbeOffline, "this probe has no session with this agent");
    }
}