using System.Security.Cryptography;
using System.Text.Json;
using Microsoft.AspNetCore.SignalR;
using Microsoft.EntityFrameworkCore;
using Renci.SshNet;
using OTSSignsOrchestrator.Core.Configuration;
using OTSSignsOrchestrator.Core.Services;
using OTSSignsOrchestrator.Server.Clients;
using OTSSignsOrchestrator.Server.Data;
using OTSSignsOrchestrator.Server.Data.Entities;
using OTSSignsOrchestrator.Server.Hubs;
using static OTSSignsOrchestrator.Core.Configuration.AppConstants;

namespace OTSSignsOrchestrator.Server.Workers;

/// <summary>
/// Phase 1 provisioning pipeline — infrastructure setup. Handles <c>JobType = "provision"</c>.
///
/// Steps:
///   1. mysql-setup        — Create DB + user on external MySQL via SSH tunnel
///   2. docker-secrets     — Create Docker Swarm secrets via SSH
///   3. nfs-dirs           — Create NFS sub-directories via SSH
///   4. authentik-provision — SAML provider, application, groups, invitation flow in Authentik
///   5. stack-deploy       — Render compose YAML and deploy via <c>docker stack deploy</c>
///   6. credential-store   — Store generated credentials in Bitwarden Secrets Manager
/// </summary>
public sealed class Phase1Pipeline : IProvisioningPipeline
{
    public string HandlesJobType => "provision";

    private const int TotalSteps = 6;

    private readonly IServiceProvider _services;
    private readonly ILogger<Phase1Pipeline> _logger;

    public Phase1Pipeline(
        IServiceProvider services,
        ILogger<Phase1Pipeline> logger)
    {
        _services = services;
        _logger = logger;
    }

    public async Task ExecuteAsync(Job job, CancellationToken ct)
    {
        await using var scope = _services.CreateAsyncScope();
        var db = scope.ServiceProvider.GetRequiredService<OrchestratorDbContext>();
        var hub = scope.ServiceProvider.GetRequiredService<IHubContext<FleetHub, IFleetClient>>();
        var authentikClient = scope.ServiceProvider.GetRequiredService<IAuthentikClient>();
        var composeRenderer = scope.ServiceProvider.GetRequiredService<ComposeRenderService>();
        var gitService = scope.ServiceProvider.GetRequiredService<GitTemplateService>();
        var bws = scope.ServiceProvider.GetRequiredService<IBitwardenSecretService>();
        var settings = scope.ServiceProvider.GetRequiredService<SettingsService>();

        var ctx = await BuildContextAsync(job, db, ct);
        var runner = new StepRunner(db, hub, _logger, job.Id, TotalSteps);

        var abbrev = ctx.Abbreviation;
        var stackName = ctx.DockerStackName;

        // Mutable state accumulated across steps
        var mysqlPassword = GenerateRandomPassword(32);
        var mysqlDbName = $"xibo_{abbrev}";
        var mysqlUserName = $"xibo_{abbrev}";
        string? authentikProviderId = null;

        // ── Step 1: mysql-setup ─────────────────────────────────────────────
        await runner.RunAsync("mysql-setup", async () =>
        {
            var mysqlHost = await settings.GetAsync(SettingsService.MySqlHost, "localhost");
            var mysqlPort = await settings.GetAsync(SettingsService.MySqlPort, "3306");
            var mysqlAdminUser = await settings.GetAsync(SettingsService.MySqlAdminUser, "root");
            var mysqlAdminPassword = await settings.GetAsync(SettingsService.MySqlAdminPassword, string.Empty);

            if (!int.TryParse(mysqlPort, out var port)) port = 3306;

            // SSH to MySQL host, create database and user
            // Reuse pattern from InstanceService.CreateMySqlDatabaseAsync — runs SQL
            // via SSH tunnel to the MySQL server.
            var sshHost = await GetSwarmSshHostAsync(settings);
            using var sshClient = CreateSshClient(sshHost);
            sshClient.Connect();

            try
            {
                // Create database
                var createDbCmd = $"mysql -h {mysqlHost} -P {port} -u {mysqlAdminUser} " +
                    $"-p'{mysqlAdminPassword}' -e " +
                    $"\"CREATE DATABASE IF NOT EXISTS \\`{mysqlDbName}\\`\"";
                RunSshCommand(sshClient, createDbCmd);

                // Create user
                var createUserCmd = $"mysql -h {mysqlHost} -P {port} -u {mysqlAdminUser} " +
                    $"-p'{mysqlAdminPassword}' -e " +
                    $"\"CREATE USER IF NOT EXISTS '{mysqlUserName}'@'%' IDENTIFIED BY '{mysqlPassword}'\"";
                RunSshCommand(sshClient, createUserCmd);

                // Grant privileges
                var grantCmd = $"mysql -h {mysqlHost} -P {port} -u {mysqlAdminUser} " +
                    $"-p'{mysqlAdminPassword}' -e " +
                    $"\"GRANT ALL PRIVILEGES ON \\`{mysqlDbName}\\`.* TO '{mysqlUserName}'@'%'; FLUSH PRIVILEGES;\"";
                RunSshCommand(sshClient, grantCmd);

                return $"Database '{mysqlDbName}' and user '{mysqlUserName}' created on {mysqlHost}:{port}.";
            }
            finally
            {
                sshClient.Disconnect();
            }
        }, ct);

        // ── Step 2: docker-secrets ──────────────────────────────────────────
        await runner.RunAsync("docker-secrets", async () =>
        {
            // Reuse IDockerSecretsService pattern — create secrets via SSH docker CLI
            var sshHost = await GetSwarmSshHostAsync(settings);
            using var sshClient = CreateSshClient(sshHost);
            sshClient.Connect();

            try
            {
                var secrets = new Dictionary<string, string>
                {
                    [CustomerMysqlPasswordSecretName(abbrev)] = mysqlPassword,
                    [CustomerMysqlUserSecretName(abbrev)] = mysqlUserName,
                    [GlobalMysqlHostSecretName] = await settings.GetAsync(SettingsService.MySqlHost, "localhost"),
                    [GlobalMysqlPortSecretName] = await settings.GetAsync(SettingsService.MySqlPort, "3306"),
                };

                var created = new List<string>();
                foreach (var (name, value) in secrets)
                {
                    // Remove existing secret if present (idempotent rotate)
                    RunSshCommandAllowFailure(sshClient, $"docker secret rm {name}");

                    var safeValue = value.Replace("'", "'\\''");
                    var cmd = $"printf '%s' '{safeValue}' | docker secret create {name} -";
                    RunSshCommand(sshClient, cmd);
                    created.Add(name);
                }

                return $"Docker secrets created: {string.Join(", ", created)}.";
            }
            finally
            {
                sshClient.Disconnect();
            }
        }, ct);

        // ── Step 3: nfs-dirs ────────────────────────────────────────────────
        await runner.RunAsync("nfs-dirs", async () =>
        {
            var nfsServer = await settings.GetAsync(SettingsService.NfsServer);
            var nfsExport = await settings.GetAsync(SettingsService.NfsExport);
            var nfsExportFolder = await settings.GetAsync(SettingsService.NfsExportFolder);

            if (string.IsNullOrWhiteSpace(nfsServer))
                return "NFS server not configured — skipping directory creation.";

            var sshHost = await GetSwarmSshHostAsync(settings);
            using var sshClient = CreateSshClient(sshHost);
            sshClient.Connect();

            try
            {
                // Build the base path for NFS dirs
                var export = (nfsExport ?? string.Empty).TrimEnd('/');
                var folder = (nfsExportFolder ?? string.Empty).Trim('/');
                var basePath = string.IsNullOrEmpty(folder) ? export : $"{export}/{folder}";

                var subdirs = new[]
                {
                    $"{abbrev}/cms-custom",
                    $"{abbrev}/cms-backup",
                    $"{abbrev}/cms-library",
                    $"{abbrev}/cms-userscripts",
                    $"{abbrev}/cms-ca-certs",
                };

                // Create directories via sudo on the NFS host
                // The swarm node mounts NFS, so we can create directories by
                // temporarily mounting, creating, then unmounting.
                var mountPoint = $"/tmp/nfs-provision-{abbrev}";
                RunSshCommand(sshClient, $"sudo mkdir -p {mountPoint}");
                RunSshCommand(sshClient,
                    $"sudo mount -t nfs4 {nfsServer}:{basePath} {mountPoint}");

                try
                {
                    foreach (var subdir in subdirs)
                    {
                        RunSshCommand(sshClient, $"sudo mkdir -p {mountPoint}/{subdir}");
                    }
                }
                finally
                {
                    RunSshCommandAllowFailure(sshClient, $"sudo umount {mountPoint}");
                    RunSshCommandAllowFailure(sshClient, $"sudo rmdir {mountPoint}");
                }

                return $"NFS directories created under {basePath}: {string.Join(", ", subdirs)}.";
            }
            finally
            {
                sshClient.Disconnect();
            }
        }, ct);

        // ── Step 4: authentik-provision ─────────────────────────────────────
        await runner.RunAsync("authentik-provision", async () =>
        {
            var instanceUrl = ctx.InstanceUrl;
            var authFlowSlug = await settings.GetAsync(SettingsService.AuthentikAuthorizationFlowSlug, "default-provider-authorization-implicit-consent");
            var signingKpId = await settings.GetAsync(SettingsService.AuthentikSigningKeypairId);

            // 1. Create SAML provider
            var providerResponse = await authentikClient.CreateSamlProviderAsync(new CreateSamlProviderRequest(
                Name: $"xibo-{abbrev}",
                AuthorizationFlow: authFlowSlug,
                AcsUrl: $"{instanceUrl}/saml/acs",
                Issuer: $"xibo-{abbrev}",
                SpBinding: "post",
                Audience: instanceUrl,
                SigningKp: signingKpId));

            EnsureSuccess(providerResponse);
            var providerData = providerResponse.Content
                ?? throw new InvalidOperationException("Authentik SAML provider creation returned empty response.");
            authentikProviderId = providerData["pk"]?.ToString();

            // 2. Create Authentik application linked to provider
            var appResponse = await authentikClient.CreateApplicationAsync(new CreateAuthentikApplicationRequest(
                Name: $"xibo-{abbrev}",
                Slug: $"xibo-{abbrev}",
                Provider: authentikProviderId!,
                MetaLaunchUrl: instanceUrl));
            EnsureSuccess(appResponse);

            // 3. Create 4 tenant groups
            var groupNames = new[]
            {
                $"customer-{abbrev}",
                $"customer-{abbrev}-viewer",
                $"customer-{abbrev}-editor",
                $"customer-{abbrev}-admin",
            };

            foreach (var groupName in groupNames)
            {
                var groupResp = await authentikClient.CreateGroupAsync(new CreateAuthentikGroupRequest(
                    Name: groupName,
                    IsSuperuser: false,
                    Parent: null));
                EnsureSuccess(groupResp);
            }

            // 4. Create invitation flow
            var inviteResponse = await authentikClient.CreateInvitationAsync(new CreateFlowRequest(
                Name: $"invite-{abbrev}",
                SingleUse: true,
                Expires: DateTimeOffset.UtcNow.AddDays(30)));
            EnsureSuccess(inviteResponse);

            // Store Authentik provider ID on the Instance entity
            var instance = await db.Instances.FirstOrDefaultAsync(i => i.Id == ctx.InstanceId, ct);
            if (instance is not null)
            {
                instance.AuthentikProviderId = authentikProviderId;
                await db.SaveChangesAsync(ct);
            }

            return $"Authentik SAML provider '{authentikProviderId}', application 'xibo-{abbrev}', " +
                   $"4 groups, and invitation flow created.";
        }, ct);

        // ── Step 5: stack-deploy ────────────────────────────────────────────
        await runner.RunAsync("stack-deploy", async () =>
        {
            // Fetch template
            var repoUrl = await settings.GetAsync(SettingsService.GitRepoUrl);
            var repoPat = await settings.GetAsync(SettingsService.GitRepoPat);

            if (string.IsNullOrWhiteSpace(repoUrl))
                throw new InvalidOperationException("Git template repository URL is not configured.");

            var templateConfig = await gitService.FetchAsync(repoUrl, repoPat);

            // Build render context
            var renderCtx = new RenderContext
            {
                CustomerName = ctx.CompanyName,
                CustomerAbbrev = abbrev,
                StackName = stackName,
                CmsServerName = await settings.GetAsync(SettingsService.DefaultCmsServerNameTemplate, "app.ots-signs.com"),
                HostHttpPort = 80,
                CmsImage = await settings.GetAsync(SettingsService.DefaultCmsImage, "ghcr.io/xibosignage/xibo-cms:release-4.2.3"),
                MemcachedImage = await settings.GetAsync(SettingsService.DefaultMemcachedImage, "memcached:alpine"),
                QuickChartImage = await settings.GetAsync(SettingsService.DefaultQuickChartImage, "ianw/quickchart"),
                NewtImage = await settings.GetAsync(SettingsService.DefaultNewtImage, "fosrl/newt"),
                ThemeHostPath = await settings.GetAsync(SettingsService.DefaultThemeHostPath, "/cms/ots-theme"),
                MySqlHost = await settings.GetAsync(SettingsService.MySqlHost, "localhost"),
                MySqlPort = await settings.GetAsync(SettingsService.MySqlPort, "3306"),
                MySqlDatabase = mysqlDbName,
                MySqlUser = mysqlUserName,
                MySqlPassword = mysqlPassword,
                SmtpServer = await settings.GetAsync(SettingsService.SmtpServer, string.Empty),
                SmtpUsername = await settings.GetAsync(SettingsService.SmtpUsername, string.Empty),
                SmtpPassword = await settings.GetAsync(SettingsService.SmtpPassword, string.Empty),
                SmtpUseTls = await settings.GetAsync(SettingsService.SmtpUseTls, "YES"),
                SmtpUseStartTls = await settings.GetAsync(SettingsService.SmtpUseStartTls, "YES"),
                SmtpRewriteDomain = await settings.GetAsync(SettingsService.SmtpRewriteDomain, string.Empty),
                SmtpHostname = await settings.GetAsync(SettingsService.SmtpHostname, string.Empty),
                SmtpFromLineOverride = await settings.GetAsync(SettingsService.SmtpFromLineOverride, "NO"),
                PhpPostMaxSize = await settings.GetAsync(SettingsService.DefaultPhpPostMaxSize, "10G"),
                PhpUploadMaxFilesize = await settings.GetAsync(SettingsService.DefaultPhpUploadMaxFilesize, "10G"),
                PhpMaxExecutionTime = await settings.GetAsync(SettingsService.DefaultPhpMaxExecutionTime, "600"),
                PangolinEndpoint = await settings.GetAsync(SettingsService.PangolinEndpoint, "https://app.pangolin.net"),
                NfsServer = await settings.GetAsync(SettingsService.NfsServer),
                NfsExport = await settings.GetAsync(SettingsService.NfsExport),
                NfsExportFolder = await settings.GetAsync(SettingsService.NfsExportFolder),
                NfsExtraOptions = await settings.GetAsync(SettingsService.NfsOptions, string.Empty),
            };

            var composeYaml = composeRenderer.Render(templateConfig.Yaml, renderCtx);

            // Deploy via SSH: pipe compose YAML to docker stack deploy
            var sshHost = await GetSwarmSshHostAsync(settings);
            using var sshClient = CreateSshClient(sshHost);
            sshClient.Connect();

            try
            {
                var safeYaml = composeYaml.Replace("'", "'\\''");
                var deployCmd = $"printf '%s' '{safeYaml}' | docker stack deploy -c - {stackName}";
                var result = RunSshCommand(sshClient, deployCmd);
                return $"Stack '{stackName}' deployed. Output: {result}";
            }
            finally
            {
                sshClient.Disconnect();
            }
        }, ct);

        // ── Step 6: credential-store ────────────────────────────────────────
        await runner.RunAsync("credential-store", async () =>
        {
            // Bitwarden item structure:
            //   Key:   "{abbrev}/mysql-password"    → MySQL password for xibo_{abbrev} user
            //   Key:   "{abbrev}/mysql-database"    → Database name (for reference)
            //   Key:   "{abbrev}/mysql-user"        → MySQL username (for reference)
            // All stored in the instance Bitwarden project via IBitwardenSecretService.

            await bws.CreateInstanceSecretAsync(
                key: $"{abbrev}/mysql-password",
                value: mysqlPassword,
                note: $"MySQL password for instance {abbrev}. DB: {mysqlDbName}, User: {mysqlUserName}");

            // Also persist in settings for Phase2 and future redeploys
            await settings.SetAsync(
                SettingsService.InstanceMySqlPassword(abbrev),
                mysqlPassword,
                SettingsService.CatInstance,
                isSensitive: true);

            // Clear in-memory password
            mysqlPassword = string.Empty;

            return $"Credentials stored in Bitwarden for instance '{abbrev}'.";
        }, ct);

        _logger.LogInformation("Phase1Pipeline completed for job {JobId} (abbrev={Abbrev})", job.Id, abbrev);
    }

    // ─────────────────────────────────────────────────────────────────────────
    // Helpers
    // ─────────────────────────────────────────────────────────────────────────

    private static async Task<PipelineContext> BuildContextAsync(Job job, OrchestratorDbContext db, CancellationToken ct)
    {
        var customer = await db.Customers
            .Include(c => c.Instances)
            .FirstOrDefaultAsync(c => c.Id == job.CustomerId, ct)
            ?? throw new InvalidOperationException($"Customer {job.CustomerId} not found for job {job.Id}.");

        var instance = customer.Instances.FirstOrDefault()
            ?? throw new InvalidOperationException($"No instance found for customer {job.CustomerId}.");

        var abbrev = customer.Abbreviation.ToLowerInvariant();

        return new PipelineContext
        {
            JobId = job.Id,
            CustomerId = customer.Id,
            InstanceId = instance.Id,
            Abbreviation = abbrev,
            CompanyName = customer.CompanyName,
            AdminEmail = customer.AdminEmail,
            AdminFirstName = customer.AdminFirstName,
            InstanceUrl = instance.XiboUrl,
            DockerStackName = instance.DockerStackName,
            ParametersJson = job.Parameters,
        };
    }

    /// <summary>
    /// Reads SSH connection details for the Docker Swarm host from settings.
    /// Expects settings keys: "Ssh.SwarmHost", "Ssh.SwarmPort", "Ssh.SwarmUser", "Ssh.SwarmKeyPath".
    /// </summary>
    private static async Task<SshConnectionInfo> GetSwarmSshHostAsync(SettingsService settings)
    {
        var host = await settings.GetAsync("Ssh.SwarmHost")
            ?? throw new InvalidOperationException("SSH Swarm host not configured (Ssh.SwarmHost).");
        var portStr = await settings.GetAsync("Ssh.SwarmPort", "22");
        var user = await settings.GetAsync("Ssh.SwarmUser", "root");
        var keyPath = await settings.GetAsync("Ssh.SwarmKeyPath");
        var password = await settings.GetAsync("Ssh.SwarmPassword");

        if (!int.TryParse(portStr, out var port)) port = 22;

        return new SshConnectionInfo(host, port, user, keyPath, password);
    }

    private static SshClient CreateSshClient(SshConnectionInfo info)
    {
        var authMethods = new List<AuthenticationMethod>();

        if (!string.IsNullOrEmpty(info.KeyPath))
        {
            authMethods.Add(new PrivateKeyAuthenticationMethod(
                info.Username, new PrivateKeyFile(info.KeyPath)));
        }

        if (!string.IsNullOrEmpty(info.Password))
        {
            authMethods.Add(new PasswordAuthenticationMethod(info.Username, info.Password));
        }

        if (authMethods.Count == 0)
        {
            var defaultKeyPath = Path.Combine(
                Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), ".ssh", "id_rsa");
            if (File.Exists(defaultKeyPath))
            {
                authMethods.Add(new PrivateKeyAuthenticationMethod(
                    info.Username, new PrivateKeyFile(defaultKeyPath)));
            }
            else
            {
                throw new InvalidOperationException(
                    $"No SSH authentication method available for {info.Host}:{info.Port}. " +
                    "Configure Ssh.SwarmKeyPath or Ssh.SwarmPassword in settings.");
            }
        }

        var connInfo = new Renci.SshNet.ConnectionInfo(info.Host, info.Port, info.Username, authMethods.ToArray());
        return new SshClient(connInfo);
    }

    private static string RunSshCommand(SshClient client, string command)
    {
        using var cmd = client.RunCommand(command);
        if (cmd.ExitStatus != 0)
            throw new InvalidOperationException(
                $"SSH command failed (exit {cmd.ExitStatus}): {cmd.Error}");
        return cmd.Result;
    }

    private static void RunSshCommandAllowFailure(SshClient client, string command)
    {
        using var cmd = client.RunCommand(command);
        // Intentionally ignore exit code — used for idempotent cleanup operations
    }

    private static string GenerateRandomPassword(int length)
    {
        const string chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*";
        return RandomNumberGenerator.GetString(chars, length);
    }

    private static void EnsureSuccess<T>(Refit.IApiResponse<T> response)
    {
        if (!response.IsSuccessStatusCode)
            throw new InvalidOperationException(
                $"API call failed with status {response.StatusCode}: {response.Error?.Content}");
    }

    /// <summary>SSH connection details read from Bitwarden settings.</summary>
    internal sealed record SshConnectionInfo(
        string Host,
        int Port,
        string Username,
        string? KeyPath,
        string? Password);
}