package internal

import (
	"cmp"
	"fmt"
	"log"
	"net/http"
	"net/http/httputil"
	"net/url"
	"os"
	"os/exec"
	"strings"
	"sync"
)

const (
	coderContainer = "congo-dev-coder"
	coderImage     = "codercom/code-server:4.111.0"
	coderNetwork   = "internal"
)

var (
	dataDir = cmp.Or(os.Getenv("DATA_DIR"), "/mnt/data")
	// hostDataDir is the host-side path to DATA_DIR. Docker volumes are resolved
	// on the host, not inside this container, so we need the host path for mounts.
	hostDataDir = cmp.Or(os.Getenv("HOST_DATA_DIR"), dataDir)

	proxyOnce    sync.Once
	proxyHandler http.Handler
)

// EnsureCoder starts the code-server container if it isn't already running.
// Non-critical tools (Go, Node, Claude) log warnings on failure but don't
// prevent startup. Only the container itself is critical.
func EnsureCoder() error {
	// Create network (idempotent)
	exec.Command("docker", "network", "create", coderNetwork).Run()

	if IsCoderRunning() {
		log.Println("coder: already running")
		connectSelf()
		provisionTools()
		return nil
	}

	// Prepare workspace directories
	workspaceDir := dataDir + "/workspace"
	for _, dir := range []string{workspaceDir + "/repos", workspaceDir + "/.config"} {
		os.MkdirAll(dir, 0755)
	}
	exec.Command("chown", "-R", "1000:1000", workspaceDir).Run()

	// Remove stale container
	exec.Command("docker", "rm", "-f", coderContainer).Run()

	// Use host paths for Docker volume mounts (resolved on host, not in this container)
	hostWorkspace := hostDataDir + "/workspace"
	args := []string{
		"run", "-d",
		"--name", coderContainer,
		"--network", coderNetwork,
		"--restart", "always",
		"-v", hostWorkspace + ":/home/coder",
		"-v", hostWorkspace + "/.config:/home/coder/.config",
		"-v", hostDataDir + "/repos:/home/coder/repos",
		"-v", hostDataDir + ":/home/coder/data",
		"-v", "/var/run/docker.sock:/var/run/docker.sock",
		coderImage,
		"--auth", "none",
		"--bind-addr", "0.0.0.0:8080",
	}

	log.Printf("coder: starting container: docker %s", strings.Join(args, " "))
	cmd := exec.Command("docker", args...)
	out, err := cmd.CombinedOutput()
	if err != nil {
		return fmt.Errorf("coder: start failed: %s: %w", strings.TrimSpace(string(out)), err)
	}
	log.Printf("coder: container started: %s", strings.TrimSpace(string(out)))

	connectSelf()
	provisionTools()
	return nil
}

// provisionTools installs development tools in the code-server container.
// Each tool logs its own success/failure. Failures are warnings, not errors.
func provisionTools() {
	configureGit()
	setupSSH()

	type tool struct {
		name string
		fn   func() error
	}
	tools := []tool{
		{"Go", ensureGo},
		{"Node.js", ensureNode},
		{"Docker CLI", ensureDocker},
		{"cron", func() error { EnsureCronDaemon(); return nil }},
		{"Claude Code", ensureClaudeCode},
		{"Congo CLI", ensureCongoCLI},
	}

	var failed []string
	for _, t := range tools {
		if err := t.fn(); err != nil {
			log.Printf("coder: %s setup failed: %v", t.name, err)
			failed = append(failed, t.name)
		}
	}

	if len(failed) > 0 {
		log.Printf("coder: some tools failed to install: %s (can be installed manually from the terminal)", strings.Join(failed, ", "))
	} else {
		log.Println("coder: all tools provisioned")
	}
}

// configureGit sets up default git identity in the code-server container.
func configureGit() {
	CoderExec("git config --global user.email 'dev@congo.gg'")
	CoderExec("git config --global user.name 'Congo Dev'")
	CoderExec("git config --global init.defaultBranch main")
	seedWorkspace()
}

// seedWorkspace creates default files in the code-server home directory if they don't exist.
func seedWorkspace() {
	// CLAUDE.md — default twin identity template
	CoderExec(`test -f /home/coder/CLAUDE.md || cat > /home/coder/CLAUDE.md << 'SEED'
# CLAUDE.md — Congo Developer

You are an AI developer running inside Congo Dev. You have full filesystem
access, Docker, Git, and the Congo CLI. Your job is to build and maintain
apps using the Congo framework.

## Congo CLI Tools

Set DB_PATH=/home/coder/data/congo-dev.db before all congo commands.

### Work Management
congo task list                     # JSON list of all tasks
congo task create "title"           # create a task
congo task update ID --status done  # mark task complete
congo plan list                     # JSON list of plans
congo plan get ID                   # plan details
congo log "what you did"            # record activity
congo heartbeat                     # report system health

### Repos & Projects
congo repo list                     # JSON list of repos
congo repo create myapp             # scaffold a new Congo app (congo init)
congo repo clone URL                # clone from git

### Services
congo service list                  # JSON list of running services
congo service deploy myapp          # build Docker image + run container
congo service stop myapp app        # stop a service
congo service start myapp app       # start a service

### Domains
congo domain list                   # JSON list of domain routes
congo domain add host.com container # add domain (validates DNS first)
congo domain remove host.com        # remove domain

### Framework
congo init name                     # scaffold a new project
congo dev                           # run dev server with hot reload
congo build                         # build production binary

## Work Loop

1. congo task list — check for todo tasks
2. Pick the highest priority task
3. Do the work (edit code, create repos, deploy services)
4. congo task update ID --status done
5. congo log "what you did"
6. congo heartbeat
7. Repeat. If idle, heartbeat every 5 minutes.

## Congo Framework Conventions

- Go + HTMX + DaisyUI + SQLite (libsql)
- IDs are always string UUIDs
- SQL columns use PascalCase: WHERE UserID = ?
- Controllers: value receiver on Handle(), pointer on methods
- Templates: {{controllerName.Method}} for data
- HTMX + SameSite=Lax cookies = CSRF protection (no tokens)
- App embeds *http.ServeMux — routes via app.Handle/HandleFunc
- congo init scaffolds: web/main.go, controllers/, models/, views/
- Models embed database.Model (ID, CreatedAt, UpdatedAt)
- Use c.Refresh(w, r) after mutations, c.Redirect for navigation
SEED`)

	// TASKS.md — empty starter
	CoderExec(`test -f /home/coder/TASKS.md || echo '# TASKS.md — Work Items\n\n## Active\n\n## Done\n' > /home/coder/TASKS.md`)

	// LOG.md — empty starter
	CoderExec(`test -f /home/coder/LOG.md || echo '# LOG.md — Activity Log\n' > /home/coder/LOG.md`)

}

// setupSSH ensures SSH keys exist on the host and are available inside code-server.
func setupSSH() {
	// Generate SSH keypair on host if none exists (host's /root/.ssh is bind-mounted)
	if _, err := os.Stat("/root/.ssh/id_ed25519"); os.IsNotExist(err) {
		os.MkdirAll("/root/.ssh", 0700)
		exec.Command("ssh-keygen", "-t", "ed25519", "-f", "/root/.ssh/id_ed25519", "-N", "", "-C", "congo-dev").Run()
		log.Println("coder: generated SSH keypair")

		// Authorize on this host so connecting to self works
		pubKey, _ := os.ReadFile("/root/.ssh/id_ed25519.pub")
		if len(pubKey) > 0 {
			f, err := os.OpenFile("/root/.ssh/authorized_keys", os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
			if err == nil {
				f.Write([]byte(strings.TrimSpace(string(pubKey)) + "\n"))
				f.Close()
			}
		}
	}

	// Copy host SSH keys into code-server container via docker cp
	exec.Command("docker", "cp", "/root/.ssh/.", coderContainer+":/tmp/host-ssh").Run()

	// Fix ownership and permissions (code-server runs as uid 1000)
	exec.Command("docker", "exec", "-u", "root", coderContainer,
		"sh", "-c",
		"mkdir -p /home/coder/.ssh && "+
			"cp /tmp/host-ssh/id_* /home/coder/.ssh/ 2>/dev/null; "+
			"cp /tmp/host-ssh/known_hosts /home/coder/.ssh/ 2>/dev/null; "+
			"printf 'Host *\\n    StrictHostKeyChecking accept-new\\n' > /home/coder/.ssh/config; "+
			"chown -R 1000:1000 /home/coder/.ssh && "+
			"chmod 700 /home/coder/.ssh && "+
			"chmod 600 /home/coder/.ssh/id_* 2>/dev/null; "+
			"chmod 644 /home/coder/.ssh/*.pub /home/coder/.ssh/known_hosts /home/coder/.ssh/config 2>/dev/null; "+
			"rm -rf /tmp/host-ssh; true").Run()
	log.Println("coder: SSH keys synced to code-server")
}

// connectSelf adds our container to the coder network.
func connectSelf() {
	hostname, _ := os.Hostname()
	if hostname == "" {
		return
	}
	exec.Command("docker", "network", "connect", coderNetwork, hostname).Run()
}

// IsCoderRunning checks if the code-server container is running.
func IsCoderRunning() bool {
	return IsContainerRunning(coderContainer)
}

// CoderExec runs a command inside the code-server container.
func CoderExec(command string) (string, error) {
	if !IsCoderRunning() {
		return "", fmt.Errorf("coder: container not running")
	}
	cmd := exec.Command("docker", "exec", coderContainer, "/bin/bash", "-c", command)
	out, err := cmd.CombinedOutput()
	return string(out), err
}

// CoderProxy returns an HTTP reverse proxy to code-server.
func CoderProxy() http.Handler {
	proxyOnce.Do(func() {
		// Resolve container IP (Docker DNS works inside containers but not on host)
		target := "http://" + coderContainer + ":8080"
		if ip := containerIP(coderContainer); ip != "" {
			target = "http://" + ip + ":8080"
		}
		u, _ := url.Parse(target)
		reverseProxy := httputil.NewSingleHostReverseProxy(u)
		proxyHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			// code-server sets its own Content-Security-Policy with nonces/hashes that
			// match its rendered HTML. The gateway's security middleware already set its
			// own CSP on w; since ReverseProxy adds upstream headers rather than replacing
			// them, leaving ours in place would send two CSP headers and the browser
			// enforces their intersection, blocking code-server's own scripts. Drop ours
			// here so only code-server's (correct) policy reaches the browser.
			w.Header().Del("Content-Security-Policy")
			reverseProxy.ServeHTTP(w, r)
		})
	})
	return proxyHandler
}

// ensureClaudeCode installs Claude Code CLI in the code-server container if not present.
func ensureClaudeCode() error {
	if out, _ := CoderExec("test -f /home/coder/.local/bin/claude && echo yes"); strings.TrimSpace(out) == "yes" {
		return nil
	}

	log.Println("coder: installing Claude Code...")
	if _, err := CoderExec("curl -fsSL https://claude.ai/install.sh | bash"); err != nil {
		return fmt.Errorf("install script failed: %w — run 'curl -fsSL https://claude.ai/install.sh | bash' manually", err)
	}

	if out, _ := CoderExec("which claude 2>/dev/null"); strings.TrimSpace(out) == "" {
		return fmt.Errorf("claude binary not found after install (check PATH includes ~/.local/bin)")
	}
	log.Println("coder: Claude Code installed")
	return nil
}

// ensureGo installs Go inside the code-server container if not present.
func ensureGo() error {
	if out, _ := CoderExec("which go 2>/dev/null"); strings.TrimSpace(out) != "" {
		// Go exists, make sure gcc is there too (needed for CGO/libsql)
		if out, _ := CoderExec("which gcc 2>/dev/null"); strings.TrimSpace(out) == "" {
			log.Println("coder: installing build-essential for CGO...")
			exec.Command("docker", "exec", "-u", "root", coderContainer,
				"sh", "-c", "apt-get update -qq && apt-get install -y -qq build-essential").Run()
		}
		return nil
	}

	log.Println("coder: installing Go + build-essential...")
	cmd := exec.Command("docker", "exec", "-u", "root", coderContainer,
		"sh", "-c",
		`apt-get update -qq && apt-get install -y -qq build-essential && `+
			`GO_VERSION=$(curl -s https://go.dev/VERSION?m=text | head -1) && `+
			`ARCH=$(dpkg --print-architecture) && `+
			`curl -fsSL "https://go.dev/dl/${GO_VERSION}.linux-${ARCH}.tar.gz" | tar -C /usr/local -xz && `+
			`ln -sf /usr/local/go/bin/go /usr/local/bin/go && `+
			`ln -sf /usr/local/go/bin/gofmt /usr/local/bin/gofmt`)
	if out, err := cmd.CombinedOutput(); err != nil {
		return fmt.Errorf("Go install failed: %s: %w", strings.TrimSpace(string(out)), err)
	}

	if out, _ := CoderExec("go version 2>/dev/null"); strings.TrimSpace(out) != "" {
		log.Printf("coder: %s", strings.TrimSpace(out))
	} else {
		return fmt.Errorf("go binary not found after install (check /usr/local/go/bin is linked)")
	}
	return nil
}

// ensureNode installs Node.js inside the code-server container if not present.
func ensureNode() error {
	if out, _ := CoderExec("which node 2>/dev/null"); strings.TrimSpace(out) != "" {
		return nil
	}

	log.Println("coder: installing Node.js...")
	cmd := exec.Command("docker", "exec", "-u", "root", coderContainer,
		"sh", "-c",
		`curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && `+
			`apt-get install -y -qq nodejs`)
	if out, err := cmd.CombinedOutput(); err != nil {
		return fmt.Errorf("Node install failed: %s: %w", strings.TrimSpace(string(out)), err)
	}

	if out, _ := CoderExec("node --version 2>/dev/null"); strings.TrimSpace(out) != "" {
		log.Printf("coder: Node %s", strings.TrimSpace(out))
	} else {
		return fmt.Errorf("node binary not found after install")
	}
	return nil
}

// ensureCongoCLI copies the Congo CLI binary into the code-server container
// so that `congo init`, `congo dev`, etc. work from the IDE terminal.
func ensureCongoCLI() error {
	if out, _ := CoderExec("which congo 2>/dev/null"); strings.TrimSpace(out) != "" {
		return nil
	}

	// Try to copy from the host
	if err := exec.Command("docker", "cp", "/usr/local/bin/congo", coderContainer+":/usr/local/bin/congo").Run(); err != nil {
		return fmt.Errorf("could not copy congo binary from host: %w — install manually in code-server terminal", err)
	}

	if out, _ := CoderExec("congo version 2>/dev/null"); strings.TrimSpace(out) != "" {
		log.Printf("coder: Congo CLI: %s", strings.TrimSpace(out))
		return nil
	}
	return fmt.Errorf("congo binary copied but not executable")
}

// ensureDocker installs Docker CLI inside code-server so the agent can manage containers.
func ensureDocker() error {
	if out, _ := CoderExec("which docker 2>/dev/null"); strings.TrimSpace(out) != "" {
		return nil
	}

	log.Println("coder: installing Docker CLI...")
	cmd := exec.Command("docker", "exec", "-u", "root", coderContainer,
		"sh", "-c",
		`apt-get update -qq && `+
			`apt-get install -y -qq ca-certificates curl && `+
			`install -m 0755 -d /etc/apt/keyrings && `+
			`curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc && `+
			`echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable" > /etc/apt/sources.list.d/docker.list && `+
			`apt-get update -qq && apt-get install -y -qq docker-ce-cli`)
	if out, err := cmd.CombinedOutput(); err != nil {
		return fmt.Errorf("Docker CLI install failed: %s: %w", strings.TrimSpace(string(out)), err)
	}

	// Make socket accessible to coder user
	exec.Command("docker", "exec", "-u", "root", coderContainer,
		"sh", "-c", "chmod 666 /var/run/docker.sock").Run()

	if out, _ := CoderExec("docker --version 2>/dev/null"); strings.TrimSpace(out) != "" {
		log.Printf("coder: %s", strings.TrimSpace(out))
	} else {
		return fmt.Errorf("docker binary not found after install")
	}
	return nil
}

// CoderRestart stops and starts the code-server container.
func CoderRestart() error {
	log.Println("coder: restarting...")
	exec.Command("docker", "stop", coderContainer).Run()
	exec.Command("docker", "rm", "-f", coderContainer).Run()
	return EnsureCoder()
}

// TriggerFilePath returns the path to the twin trigger file,
// accessible from both the dev container and the code-server container.
func TriggerFilePath() string {
	return dataDir + "/workspace/.twin-trigger"
}