package httpserver

import (
	"crypto/rand"
	"encoding/hex"
	"fmt"
	"html/template"
	"log/slog"
	"net"
	"net/http"
	"strings"
	"time"

	"git.michelsen.id/phill/preface-tools/internal/auth"
	"git.michelsen.id/phill/preface-tools/internal/tools"
)

type Server struct {
	auth     *auth.Service
	registry *tools.Registry
	log      *slog.Logger
	handler  http.Handler
}

func New(a *auth.Service, r *tools.Registry, log *slog.Logger) *Server {
	s := &Server{auth: a, registry: r, log: log}
	mux := http.NewServeMux()
	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) { w.Write([]byte("ok\n")) })
	mux.HandleFunc("GET /readyz", func(w http.ResponseWriter, r *http.Request) { w.Write([]byte("ready\n")) })
	mux.HandleFunc("GET /static/app.css", css)
	mux.HandleFunc("GET /static/app.js", js)
	mux.HandleFunc("GET /login", s.loginPage)
	mux.HandleFunc("POST /login/{role}", s.login)
	mux.Handle("POST /logout", s.withAuth("", s.csrf(http.HandlerFunc(s.logout))))
	mux.HandleFunc("GET /", s.root)
	for _, tool := range r.List() {
		key := tool.Definition().Key
		studentPrefix := "/tools/" + key
		suffix := http.StripPrefix(studentPrefix, tool.StudentHandler())
		mux.Handle(studentPrefix+"/provider-media/", suffix)
		mux.Handle(studentPrefix+"/", s.withAuth(auth.Student, s.csrf(s.shell(tool, suffix, false))))
		if it, ok := tool.(tools.InstructorTool); ok {
			prefix := "/instructor/tools/" + key
			mux.Handle(prefix+"/", s.withAuth(auth.Instructor, s.csrf(s.shell(tool, http.StripPrefix(prefix, it.InstructorHandler()), true))))
		}
	}
	mux.Handle("GET /instructor", s.withAuth(auth.Instructor, http.HandlerFunc(s.instructorRoot)))
	s.handler = s.middleware(mux)
	return s
}
func (s *Server) Handler() http.Handler { return s.handler }
func (s *Server) root(w http.ResponseWriter, r *http.Request) {
	c, err := s.auth.FromRequest(r)
	if err != nil {
		http.Redirect(w, r, "/login", http.StatusSeeOther)
		return
	}
	if c.Role == auth.Instructor {
		http.Redirect(w, r, "/instructor", 303)
		return
	}
	list := s.registry.List()
	if len(list) == 0 {
		http.Error(w, "no tools configured", 503)
		return
	}
	http.Redirect(w, r, "/tools/"+list[0].Definition().Key+"/", 303)
}
func (s *Server) loginPage(w http.ResponseWriter, r *http.Request) { render(w, loginTemplate, nil) }
func (s *Server) login(w http.ResponseWriter, r *http.Request) {
	r.Body = http.MaxBytesReader(w, r.Body, 4096)
	role := auth.Role(r.PathValue("role"))
	if role != auth.Student && role != auth.Instructor {
		http.NotFound(w, r)
		return
	}
	c, err := s.auth.Authenticate(role, r.FormValue("pin"), clientIP(r)+":"+string(role))
	if err != nil {
		renderStatus(w, loginTemplate, map[string]any{"Error": "Login was not accepted."}, 401)
		return
	}
	s.auth.SetCookie(w, c)
	if role == auth.Instructor {
		http.Redirect(w, r, "/instructor", 303)
	} else {
		http.Redirect(w, r, "/", 303)
	}
}
func (s *Server) logout(w http.ResponseWriter, r *http.Request) {
	s.auth.ClearCookie(w)
	http.Redirect(w, r, "/login", 303)
}
func (s *Server) instructorRoot(w http.ResponseWriter, r *http.Request) {
	list := s.registry.List()
	for _, t := range list {
		if _, ok := t.(tools.InstructorTool); ok {
			http.Redirect(w, r, "/instructor/tools/"+t.Definition().Key+"/", 303)
			return
		}
	}
	http.Error(w, "no instructor tools", 404)
}
func (s *Server) withAuth(role auth.Role, next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		c, err := s.auth.FromRequest(r)
		if err != nil {
			http.Redirect(w, r, "/login", 303)
			return
		}
		if role != "" && c.Role != role {
			http.Error(w, "forbidden", 403)
			return
		}
		next.ServeHTTP(w, auth.WithClaims(r, c))
	})
}
func (s *Server) csrf(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.Method == http.MethodGet || r.Method == http.MethodHead {
			next.ServeHTTP(w, r)
			return
		}
		c, _ := auth.ClaimsFrom(r)
		token := r.Header.Get("X-CSRF-Token")
		if token == "" {
			token = r.FormValue("csrf_token")
		}
		if token == "" || token != c.CSRFToken {
			http.Error(w, "invalid CSRF token", 403)
			return
		}
		if origin := r.Header.Get("Origin"); origin != "" && !strings.HasPrefix(origin, "http://"+r.Host) && !strings.HasPrefix(origin, "https://"+r.Host) {
			http.Error(w, "invalid origin", 403)
			return
		}
		next.ServeHTTP(w, r)
	})
}
func (s *Server) shell(tool tools.Tool, next http.Handler, instructor bool) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path != "/" {
			next.ServeHTTP(w, r)
			return
		}
		rw := &capture{header: http.Header{}}
		next.ServeHTTP(rw, r)
		if rw.status >= 400 {
			copyHeader(w.Header(), rw.header)
			w.WriteHeader(rw.status)
			w.Write(rw.body)
			return
		}
		c, _ := auth.ClaimsFrom(r)
		data := map[string]any{"Title": tool.Definition().Name, "Content": template.HTML(rw.body), "Tools": s.registry.List(), "Selected": tool.Definition().Key, "Instructor": instructor, "CSRF": c.CSRFToken}
		render(w, shellTemplate, data)
	})
}

type capture struct {
	header http.Header
	body   []byte
	status int
}

func (c *capture) Header() http.Header { return c.header }
func (c *capture) WriteHeader(n int)   { c.status = n }
func (c *capture) Write(b []byte) (int, error) {
	if c.status == 0 {
		c.status = 200
	}
	c.body = append(c.body, b...)
	return len(b), nil
}
func copyHeader(dst, src http.Header) {
	for k, v := range src {
		dst[k] = v
	}
}
func (s *Server) middleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		start := time.Now()
		b := make([]byte, 8)
		rand.Read(b)
		rid := hex.EncodeToString(b)
		w.Header().Set("X-Request-ID", rid)
		w.Header().Set("X-Content-Type-Options", "nosniff")
		w.Header().Set("Referrer-Policy", "same-origin")
		w.Header().Set("X-Frame-Options", "DENY")
		w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=()")
		w.Header().Set("Content-Security-Policy", "default-src 'self'; style-src 'self' https://cdn.jsdelivr.net; script-src 'self' https://cdn.jsdelivr.net; img-src 'self' data:; media-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'")
		defer func() {
			if v := recover(); v != nil {
				s.log.Error("request panic", "request_id", rid, "error", v)
				http.Error(w, "internal server error", 500)
			}
			s.log.Info("request", "request_id", rid, "method", r.Method, "path", r.URL.Path, "duration", time.Since(start))
		}()
		next.ServeHTTP(w, r)
	})
}
func clientIP(r *http.Request) string {
	host, _, err := net.SplitHostPort(r.RemoteAddr)
	if err == nil {
		return host
	}
	return r.RemoteAddr
}
func render(w http.ResponseWriter, src string, data any) { renderStatus(w, src, data, 200) }
func renderStatus(w http.ResponseWriter, src string, data any, status int) {
	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	w.WriteHeader(status)
	template.Must(template.New("page").Parse(src)).Execute(w, data)
}

const head = `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="htmx-config" content='{"responseHandling":[{"code":"204","swap":false},{"code":"[23]..","swap":true},{"code":"[45]..","swap":true,"error":true},{"code":"...","swap":false,"error":true}]}'><title>{{if .Title}}{{.Title}} · {{end}}Preface Tools</title><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/basecoat-css@1.0.2/dist/basecoat.cdn.min.css"><link rel="stylesheet" href="/static/app.css"><script src="https://cdn.jsdelivr.net/npm/basecoat-css@1.0.2/dist/js/all.min.js" defer></script><script src="https://cdn.jsdelivr.net/npm/htmx.org@2.0.8/dist/htmx.min.js" defer></script><script src="/static/app.js" defer></script></head><body>`
const loginTemplate = head + `<main class="login"><h1>PREFACE TOOLS</h1>{{with .Error}}<p class="error">{{.}}</p>{{end}}<div class="login-grid"><form class="card" method="post" action="/login/student"><h2>Student Login</h2><p>Access classroom tools</p><input type="password" name="pin" required autocomplete="current-password" aria-label="Student PIN"><button class="btn primary">Log in</button></form><form class="card" method="post" action="/login/instructor"><h2>Instructor Login</h2><p>Review generated outputs</p><input type="password" name="pin" required autocomplete="current-password" aria-label="Instructor PIN"><button class="btn">Log in</button></form></div></main></body></html>`
const shellTemplate = head + `<header><a href="/">PREFACE TOOLS</a><nav>{{if .Instructor}}<span>Instructor</span>{{else}}<select id="tool-selector" aria-label="Choose tool">{{range .Tools}}<option value="/tools/{{.Definition.Key}}/" {{if eq .Definition.Key $.Selected}}selected{{end}}>{{.Definition.Name}}</option>{{end}}</select>{{end}}<form method="post" action="/logout"><input type="hidden" name="csrf_token" value="{{.CSRF}}"><button>Log out</button></form></nav></header><main>{{.Content}}</main></body></html>`

func css(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Type", "text/css")
	fmt.Fprint(w, `body{margin:0;background:#f7f7fa;color:#172033;font-family:ui-sans-serif,system-ui}header{height:64px;background:#fff;border-bottom:1px solid #e5e7eb;display:flex;align-items:center;justify-content:space-between;padding:0 max(1rem,4vw)}header>a{font-weight:800;letter-spacing:.08em}nav{display:flex;gap:1rem;align-items:center}main{max-width:1400px;margin:0 auto;padding:2rem}.card{background:#fff;border:1px solid #e5e7eb;border-radius:12px;padding:1.25rem;box-shadow:0 1px 2px #1018280d}.login{max-width:760px;text-align:center;padding-top:12vh}.login-grid{display:grid;grid-template-columns:1fr 1fr;gap:1rem;text-align:left}.tool-grid{display:grid;grid-template-columns:1fr 1.3fr .8fr;gap:1rem}.recent{margin-top:1rem}.preview img,.generation video{width:100%;max-height:420px;object-fit:contain;border-radius:8px}.generation{border-top:1px solid #e5e7eb;padding:1rem 0}.generation>div{display:flex;justify-content:space-between}.muted,small{color:#667085}.error{color:#b42318}.htmx-indicator{display:none}.htmx-request .htmx-indicator,.htmx-request.htmx-indicator{display:inline}textarea,input,select{width:100%;margin:.35rem 0 1rem}.btn{display:inline-flex;margin-top:.5rem}.primary{background:#4f46e5;color:#fff}dialog{max-width:440px;width:calc(100% - 2rem)}@media(max-width:900px){.tool-grid{grid-template-columns:1fr 1fr}.tool-grid>*:last-child{grid-column:1/-1}}@media(max-width:640px){main{padding:1rem}.tool-grid,.login-grid{grid-template-columns:1fr}.tool-grid>*:last-child{grid-column:auto}}`)
}
func js(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Type", "application/javascript")
	fmt.Fprint(w, `document.addEventListener("htmx:afterSwap",()=>window.basecoat?.initAll());document.addEventListener("htmx:historyRestore",()=>window.basecoat?.initAll({force:true}));document.addEventListener("change",e=>{if(e.target.id==="tool-selector")location.href=e.target.value});document.addEventListener("click",e=>{if(e.target.closest("[data-open-approval]"))document.querySelector("#approval-dialog")?.showModal();if(e.target.closest("[data-close-approval]"))document.querySelector("#approval-dialog")?.close()});document.addEventListener("generationQueued",()=>{const d=document.querySelector("#approval-dialog"),p=d?.querySelector('[name="instructor_pin"]');if(p)p.value="";d?.close()});`)
}