package api

import (
	"bytes"
	"crypto/rand"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"errors"
	"io"
	"math"
	"net/http"
	"slices"
	"strings"
	"time"

	"git.golem15.com/golem15/summercms/modules/lagoon"
	"git.golem15.com/golem15/summercms/modules/wire"
	"git.golem15.com/jakub/sm-bm-plugin/classes"
	"git.golem15.com/jakub/sm-bm-plugin/models"
	"gorm.io/gorm"
)

// CalendarPath is the path prefix of the public ICS feed; the feed of a
// token is at CalendarPath/<token>.ics.
const CalendarPath = "/_bm/calendar"

// calendarCacheControl lets a calendar client reuse a fetch for 15 minutes.
const calendarCacheControl = "private, max-age=900"

// fetchStampEvery limits the last_fetched_at writes of a feed.
const fetchStampEvery = time.Minute

// tokenBytes is the size of a feed token before hex encoding.
const tokenBytes = 32

var calendarFeedRules = []lagoon.RequestRule{
	{Field: "excluded_course_ids", Rules: lagoon.ParseRules("sometimes|array|max:500")},
	{Field: "excluded_course_ids.*", Rules: lagoon.ParseRules("integer|min:1|exists:jz_bm_courses,id")},
	{Field: "include_meetings", Rules: lagoon.ParseRules("sometimes|boolean")},
	{Field: "include_deadlines", Rules: lagoon.ParseRules("sometimes|boolean")},
}

// calendarFeedJSON is the caller's feed as the API shows it.
type calendarFeedJSON struct {
	URL               string  `json:"url"`
	ExcludedCourseIDs []uint  `json:"excluded_course_ids"`
	IncludeMeetings   bool    `json:"include_meetings"`
	IncludeDeadlines  bool    `json:"include_deadlines"`
	LastFetchedAt     *string `json:"last_fetched_at"`
}

// publicBase is the absolute base URL of the application: jz.bm.public_url
// when set, otherwise the scheme and Host of the request.
func (h *Handlers) publicBase(r *http.Request) string {
	if base := strings.TrimRight(strings.TrimSpace(h.PublicURL), "/"); base != "" {
		return base
	}
	scheme := "http"
	if r.TLS != nil {
		scheme = "https"
	}
	return scheme + "://" + r.Host
}

func (h *Handlers) newFeedJSON(r *http.Request, f *models.CalendarFeed) calendarFeedJSON {
	ids := []uint(f.ExcludedCourseIDs)
	if ids == nil {
		ids = []uint{}
	}
	out := calendarFeedJSON{
		URL:               h.publicBase(r) + CalendarPath + "/" + f.Token + ".ics",
		ExcludedCourseIDs: ids,
		IncludeMeetings:   f.IncludeMeetings,
		IncludeDeadlines:  f.IncludeDeadlines,
	}
	if f.LastFetchedAt != nil {
		s := models.FormatDateTime(*f.LastFetchedAt)
		out.LastFetchedAt = &s
	}
	return out
}

// newToken returns 32 random bytes in hex.
func newToken() (string, error) {
	b := make([]byte, tokenBytes)
	if _, err := rand.Read(b); err != nil {
		return "", err
	}
	return hex.EncodeToString(b), nil
}

// findFeed loads the caller's feed; nil when there is none.
func findFeed(db *gorm.DB, userID uint) (*models.CalendarFeed, error) {
	var feed models.CalendarFeed
	res := db.Where("user_id = ?", userID).Limit(1).Find(&feed)
	if res.Error != nil {
		return nil, res.Error
	}
	if res.RowsAffected == 0 {
		return nil, nil
	}
	return &feed, nil
}

// CalendarFeed answers GET /calendar-feed: the caller's feed, or null.
func (h *Handlers) CalendarFeed(w http.ResponseWriter, r *http.Request) {
	userID, ok := h.caller(w, r)
	if !ok {
		return
	}
	db, ok := h.db(w, r)
	if !ok {
		return
	}
	feed, err := findFeed(db, userID)
	if err != nil {
		writeOpaque500(w)
		return
	}
	if feed == nil {
		writeData(w, nil)
		return
	}
	writeData(w, h.newFeedJSON(r, feed))
}

// readJSONObject decodes a JSON object body; an empty body is an empty
// object.
func readJSONObject(r *http.Request) (map[string]any, error) {
	var in map[string]any
	if err := json.NewDecoder(r.Body).Decode(&in); err != nil && !errors.Is(err, io.EOF) {
		return nil, err
	}
	if in == nil {
		in = map[string]any{}
	}
	// JSON numbers decode as float64; whole ones become int64, so the
	// exists rule queries with an integer.
	if raw, ok := in["excluded_course_ids"].([]any); ok {
		for i, v := range raw {
			if f, ok := v.(float64); ok && f == math.Trunc(f) && math.Abs(f) < 1<<53 {
				raw[i] = int64(f)
			}
		}
	}
	return in, nil
}

// excludedIDs returns the validated excluded_course_ids, sorted and without
// duplicates.
func excludedIDs(v any) models.IDList {
	raw, _ := v.([]any)
	out := models.IDList{}
	for _, item := range raw {
		if n, ok := item.(int64); ok && n > 0 {
			out = append(out, uint(n))
		}
	}
	slices.Sort(out)
	return slices.Compact(out)
}

// UpdateCalendarFeed answers PUT /calendar-feed: it creates the caller's
// feed with a new token when there is none, and applies the settings the
// body gives.
func (h *Handlers) UpdateCalendarFeed(w http.ResponseWriter, r *http.Request) {
	userID, ok := h.caller(w, r)
	if !ok {
		return
	}
	in, err := readJSONObject(r)
	if err != nil {
		wire.WriteJSON(w, http.StatusBadRequest, map[string]any{"error": true, "message": "The request body is not a JSON object."})
		return
	}
	db, ok := h.db(w, r)
	if !ok {
		return
	}
	errs, err := lagoon.ValidateRequest(r.Context(), db, in, calendarFeedRules, h.translator())
	if err != nil {
		writeOpaque500(w)
		return
	}
	if len(errs) > 0 {
		writeValidation(w, errs)
		return
	}
	token, err := newToken()
	if err != nil {
		writeOpaque500(w)
		return
	}
	now := h.now().UTC()
	var feed *models.CalendarFeed
	err = db.Transaction(func(tx *gorm.DB) error {
		if err := tx.Exec(`INSERT INTO jz_bm_calendar_feeds (user_id, token, created_at, updated_at) VALUES (?, ?, ?, ?)
ON CONFLICT (user_id) DO NOTHING`, userID, token, now, now).Error; err != nil {
			return err
		}
		set := map[string]any{}
		if v, ok := in["excluded_course_ids"]; ok {
			set["excluded_course_ids"] = excludedIDs(v)
		}
		if v, ok := in["include_meetings"]; ok {
			set["include_meetings"] = truthy(v)
		}
		if v, ok := in["include_deadlines"]; ok {
			set["include_deadlines"] = truthy(v)
		}
		if len(set) > 0 {
			set["updated_at"] = now
			if err := tx.Model(&models.CalendarFeed{}).Where("user_id = ?", userID).UpdateColumns(set).Error; err != nil {
				return err
			}
		}
		var err error
		feed, err = findFeed(tx, userID)
		return err
	})
	if err != nil || feed == nil {
		writeOpaque500(w)
		return
	}
	writeData(w, h.newFeedJSON(r, feed))
}

// truthy reads a value the boolean rule accepted: true, false, 1, 0, "1",
// "0", "true", "false".
func truthy(v any) bool {
	switch b := v.(type) {
	case bool:
		return b
	case int64:
		return b == 1
	case float64:
		return b == 1
	case string:
		return b == "1" || b == "true"
	}
	return false
}

// RotateCalendarFeed answers POST /calendar-feed/rotate: the caller's feed
// gets a new token, so the old URL stops working. 404 without a feed.
func (h *Handlers) RotateCalendarFeed(w http.ResponseWriter, r *http.Request) {
	userID, ok := h.caller(w, r)
	if !ok {
		return
	}
	db, ok := h.db(w, r)
	if !ok {
		return
	}
	token, err := newToken()
	if err != nil {
		writeOpaque500(w)
		return
	}
	res := db.Model(&models.CalendarFeed{}).Where("user_id = ?", userID).
		UpdateColumns(map[string]any{"token": token, "updated_at": h.now().UTC()})
	if res.Error != nil {
		writeOpaque500(w)
		return
	}
	if res.RowsAffected == 0 {
		writeNotFound(w)
		return
	}
	feed, err := findFeed(db, userID)
	if err != nil || feed == nil {
		writeOpaque500(w)
		return
	}
	writeData(w, h.newFeedJSON(r, feed))
}

// DeleteCalendarFeed answers DELETE /calendar-feed: it deletes the caller's
// feed (204, also when there was none).
func (h *Handlers) DeleteCalendarFeed(w http.ResponseWriter, r *http.Request) {
	userID, ok := h.caller(w, r)
	if !ok {
		return
	}
	db, ok := h.db(w, r)
	if !ok {
		return
	}
	if err := db.Where("user_id = ?", userID).Delete(&models.CalendarFeed{}).Error; err != nil {
		writeOpaque500(w)
		return
	}
	w.WriteHeader(http.StatusNoContent)
}

// feedToken reads {token} with an optional .ics suffix and reports whether
// it has the shape of a token (64 lower-case hex digits).
func feedToken(r *http.Request) (string, bool) {
	token := strings.TrimSuffix(r.PathValue("token"), ".ics")
	if len(token) != 2*tokenBytes {
		return "", false
	}
	for _, c := range token {
		if (c < '0' || c > '9') && (c < 'a' || c > 'f') {
			return "", false
		}
	}
	return token, true
}

// CalendarICS answers GET /_bm/calendar/{token}.ics without authentication:
// the token is the credential. An unknown token is a 404.
func (h *Handlers) CalendarICS(w http.ResponseWriter, r *http.Request) {
	token, ok := feedToken(r)
	if !ok {
		writeNotFound(w)
		return
	}
	db, ok := h.db(w, r)
	if !ok {
		return
	}
	var feed models.CalendarFeed
	res := db.Where("token = ?", token).Limit(1).Find(&feed)
	if res.Error != nil {
		writeOpaque500(w)
		return
	}
	if res.RowsAffected == 0 {
		writeNotFound(w)
		return
	}
	var data classes.CalendarData
	if err := preloadSession(db).Order("starts_at, id").Find(&data.Sessions).Error; err != nil {
		writeOpaque500(w)
		return
	}
	if feed.IncludeMeetings {
		if err := db.Order("number, id").Find(&data.Meetings).Error; err != nil {
			writeOpaque500(w)
			return
		}
	}
	if feed.IncludeDeadlines {
		if err := db.Preload("Course").Order("due_at, id").Find(&data.Deadlines).Error; err != nil {
			writeOpaque500(w)
			return
		}
	}
	body := classes.BuildCalendar(data, classes.CalendarOptions{
		ExcludedCourseIDs: feed.ExcludedCourseIDs,
		IncludeMeetings:   feed.IncludeMeetings,
		IncludeDeadlines:  feed.IncludeDeadlines,
		SiteURL:           h.publicBase(r),
	})
	// One cheap write per feed and minute at most; a failure does not cost
	// the client its calendar.
	now := h.now().UTC()
	_ = db.Exec(`UPDATE jz_bm_calendar_feeds SET last_fetched_at = ?
WHERE id = ? AND (last_fetched_at IS NULL OR last_fetched_at <= ?)`, now, feed.ID, now.Add(-fetchStampEvery)).Error

	sum := sha256.Sum256(body)
	hdr := w.Header()
	hdr.Set("Content-Type", "text/calendar; charset=utf-8")
	hdr.Set("Content-Disposition", `inline; filename="bm.ics"`)
	hdr.Set("Cache-Control", calendarCacheControl)
	hdr.Set("ETag", `"`+hex.EncodeToString(sum[:])[:32]+`"`)
	hdr.Set("X-Content-Type-Options", "nosniff")
	hdr.Set("Referrer-Policy", "no-referrer")
	http.ServeContent(w, r, "bm.ics", time.Time{}, bytes.NewReader(body))
}