// The `carlos domains` verb family (Task 10, issue #151): attach a
// customer's own hostname to an app's route, detach it, or list what an app
// currently holds — the CLI front over internal/console/apidomains.go, the
// same instance-gated console door titogo's router speaks with its
// CARLOS_INSTANCE_TOKEN. API mode only, the same as `carlos instances
// create/list/delete`: a claim is a console-authorized write, and there is
// no store-mode equivalent.
package main

import (
	"context"
	"flag"
	"fmt"
	"log"
	"os"
	"sort"
	"strings"
	"time"
)

const domainsUsage = `usage: carlos domains <attach|verify|detach|list|paths> [flags]

  attach --app <a> [--route <r>] [--wildcard] [--catchall] [--platform] [flags] <hostname>
                  claim a customer's hostname for the app, pointed at
                  --route (default: the app's single instance record, if it
                  has exactly one — otherwise --route is required).
                  --wildcard/--catchall are capability flips: naming either
                  one changes it, an unset flag leaves it as it was.
                  --platform attaches a hostname in this deployment's own
                  domains. Platform operators only.
                  Where the deployment requires proof of control, the
                  hostname is not served until you add the TXT record
                  attach prints.
  attach --app <a> '*.<parent>'
                  an instance catch-all: each of the app's instances also
                  answers at <label>.<parent>, where <label> is its host's
                  first label. <parent> must already be attached to an app
                  in this account. Signed-in people only; takes no other
                  flag. Detach it with: detach --app <a> '*.<parent>'.
  verify --app <a> [--channel <c>] [flags] <hostname>
                  check the TXT record and, once it is there, make the
                  hostname live. --channel is for a hostname that will be
                  the app's first route, when the app follows several.
  detach --app <a> [flags] <hostname>
                  release a hostname claim
  list   --app <a> [flags]
                  this app's hostname claims, joined to the fleet's own
                  readings sweep (DNS/CERT-EXPIRES/WILDCARD/CATCHALL/DELEGATION)
  paths  --app <a> [flags] <hostname>
                  the leading path segments this hostname's traffic is split
                  by, as PUBLISHED. Read-only: the platform that owns the
                  hostname republishes the whole map, so there is no verb
                  here that writes one.

  --account    <a>       account (sqid or name; default "ops")
  --account-id <id>      account sqid, matched as a sqid ONLY
  --console    <origin>  console to act through (default: the only logged-in one)

Signed-in only (carlos auth login): a claim is a console-authorized write —
the console checks the hostname against the deploy's deny list, resolves the
route, and writes it. The hostname comes live on the box that owns the route
at its next domains pass.
`

const domainsAttachUsage = `usage: carlos domains attach --app <a> [--route <r>] [--wildcard] [--catchall] [--platform] [--account <a>] [--account-id <id>] [--console <origin>] <hostname>
`

const domainsVerifyUsage = `usage: carlos domains verify --app <a> [--channel <c>] [--account <a>] [--account-id <id>] [--console <origin>] <hostname>
`

const domainsDetachUsage = `usage: carlos domains detach --app <a> [--account <a>] [--account-id <id>] [--console <origin>] <hostname>
`

const domainsListUsage = `usage: carlos domains list --app <a> [--account <a>] [--account-id <id>] [--console <origin>]
`

const domainsPathsUsage = `usage: carlos domains paths --app <a> [--account <a>] [--account-id <id>] [--console <origin>] <hostname>
`

// runDomains dispatches the domains sub-verbs. attach/detach/list are
// positional words, not flags, and must never reach fs.Parse — the same
// shape runInstances uses for its own sub-verbs.
func runDomains(args []string) {
	if len(args) > 0 {
		switch args[0] {
		case "attach":
			runDomainsAttach(args[1:])
			return
		case "verify":
			runDomainsVerify(args[1:])
			return
		case "detach":
			runDomainsDetach(args[1:])
			return
		case "list":
			runDomainsList(args[1:])
			return
		case "paths":
			runDomainsPaths(args[1:])
			return
		}
	}
	log.Fatal(domainsUsage)
}

func runDomainsAttach(args []string) {
	fs := flag.NewFlagSet("domains attach", flag.ExitOnError)
	app := appFlag(fs, "app the hostname belongs to")
	route := fs.String("route", "", "route hostname to attach to")
	wildcard := fs.Bool("wildcard", false, "enable a delegated wildcard cert for this hostname (needs a CNAME — see the 422 message if refused)")
	catchall := fs.Bool("catchall", false, "derive a *.<host> catch-all alias to the same route (needs --wildcard)")
	platform := fs.Bool("platform", false, "attach a hostname in this deployment's own domains (platform operators only)")
	consoleFlag := consoleOption(fs, "console to attach through (default: the only logged-in one)")
	acctRaw := fs.String("account", "", "account (sqid or name) the app belongs to (default: your only account, or the configured/chosen one)")
	acctIDRaw := fs.String("account-id", "", "account sqid, matched as a sqid ONLY — supersedes --account")
	fs.Usage = flagUsage(fs, domainsAttachUsage)
	fs.Parse(args)
	host := strings.TrimSpace(fs.Arg(0))
	if host == "" || fs.NArg() > 1 {
		log.Fatal(domainsAttachUsage)
	}
	// --wildcard/--catchall are tri-state, the same reason apps place's
	// --target is: an omitted flag must leave the claim's current capability
	// untouched, and the bool value alone cannot distinguish "not named"
	// from "named, false" (an explicit --catchall=false is a real request to
	// turn it off). fs.Visit reports only flags actually present on the
	// command line.
	var wildcardArg, catchallArg *bool
	fs.Visit(func(f *flag.Flag) {
		switch f.Name {
		case "wildcard":
			v := *wildcard
			wildcardArg = &v
		case "catchall":
			v := *catchall
			catchallArg = &v
		}
	})
	sess := requireAPISession("attach", *consoleFlag)
	printUsing(stdout, sess)
	acct := resolvedAccount(sess, acctRaw, acctIDRaw)
	app2 := resolvedApp(sess, acct, *app, domainsAttachUsage)
	ctx := context.Background()
	res, err := sess.postDomainAttachFull(ctx, acct, app2, domainAttachIn{
		Host: host, Route: strings.TrimSpace(*route),
		Wildcard: wildcardArg, Catchall: catchallArg, Platform: *platform,
	})
	if err != nil {
		log.Fatalf("domains attach: %v", err)
	}
	created, resolvedRoute := res.Created, res.Route
	if !res.Verified {
		// Stored, not served (#215). Said first, before any "attached"
		// wording a member would read as "it's live".
		fmt.Fprintf(stdout, "%s %s -> %s, waiting for you to prove you control it\n", colorFor(stdout).warn("reserved"), host, resolvedRoute)
		if !printDomainDNSLine(ctx, sess, acct, app2, host) {
			printDomainVerifyHint(res.Verify, app2, host)
			return
		}
		printDomainVerifyHint(nil, app2, host)
		return
	}
	if strings.HasPrefix(host, "*.") {
		// An instance catch-all: no route of its own to report.
		resolvedRoute = "<label>." + strings.TrimPrefix(host, "*.") + " for each instance"
	}
	if created {
		fmt.Fprintf(stdout, "%s %s -> %s\n", colorFor(stdout).ok("attached"), host, resolvedRoute)
	} else {
		fmt.Fprintf(stdout, "%s %s -> %s\n", colorFor(stdout).ok("already attached"), host, resolvedRoute)
	}
	printDomainDNSLine(ctx, sess, acct, app2, host)
}

// printDomainDNSLine completes the job `carlos domains attach` promises
// (spec §5: "Attach output always ends with the DNS records to create and
// the current stamp — the command completes the job or says exactly what is
// left"): it re-fetches the domain list and prints the just-attached host's
// own DNS stamp, so the member never needs a second command (let alone a
// console visit) to learn whether the domain is live. Degrades quietly on a
// list failure or a missing row (an old console, or a claim the sweep has
// not reached yet with no readable answer) — the attach line above already
// reported the thing that matters (whether the write happened), so a DNS
// line this call cannot back up is skipped rather than guessed at.
//
// It reports whether it printed anything, so a caller with something it must
// not leave unsaid (the proof record) can say it itself when this could not.
func printDomainDNSLine(ctx context.Context, sess *apiSession, acct apiAcct, app, host string) bool {
	domains, err := sess.domainList(ctx, acct, app)
	if err != nil {
		return false
	}
	for _, d := range domains {
		if d.Host != host {
			continue
		}
		// The door's own derived state and sentence, so the attach line and
		// `carlos domains list` cannot describe the same hostname two ways.
		// Falls back to the pre-state wording for an older console.
		if d.State != "" {
			if d.Detail != "" {
				fmt.Fprintf(stdout, "STATE: %s — %s\n", d.State, d.Detail)
			} else {
				fmt.Fprintf(stdout, "STATE: %s\n", d.State)
			}
			printDomainRecords(d.Records)
			return true
		}
		if d.DNSStatus == "pointing" {
			fmt.Fprintln(stdout, "DNS: pointing")
			return true
		}
		dns := d.DNSStatus
		if dns == "" {
			dns = "pending"
		}
		if d.Guidance != "" {
			fmt.Fprintf(stdout, "DNS: %s — %s\n", dns, d.Guidance)
		} else {
			fmt.Fprintf(stdout, "DNS: %s\n", dns)
		}
		return true
	}
	return false
}

// printDomainVerifyHint says exactly which record proves control of host
// and what to run once it exists. A console that sent no record (it cannot
// happen with verified false, but an answer is not a promise) gets the
// command alone.
func printDomainVerifyHint(v *apiDomainDNSRecord, app, host string) {
	if v != nil && v.Name != "" {
		fmt.Fprintf(stdout, "Add:  TXT %s -> %s\n", v.Name, v.Value)
	}
	fmt.Fprintf(stdout, "Then: carlos domains verify --app %s %s\n", app, host)
}

// runDomainsVerify proves control of an attached hostname (#215). It is the
// attach door again rather than a door of its own: repeating an attach is
// what verifies a pending claim, because the door looks the TXT record up
// whenever the claim is still pending. This verb only works out WHICH
// attach to repeat — the claim's own route, or a first route for a claim
// that has none — so the member does not have to remember how it was made.
func runDomainsVerify(args []string) {
	fs := flag.NewFlagSet("domains verify", flag.ExitOnError)
	app := appFlag(fs, "app the hostname belongs to")
	channel := fs.String("channel", "", "channel a first-route hostname serves (only needed when the app follows several)")
	consoleFlag := consoleOption(fs, "console to verify through (default: the only logged-in one)")
	acctRaw := fs.String("account", "", "account (sqid or name) the app belongs to (default: your only account, or the configured/chosen one)")
	acctIDRaw := fs.String("account-id", "", "account sqid, matched as a sqid ONLY — supersedes --account")
	fs.Usage = flagUsage(fs, domainsVerifyUsage)
	fs.Parse(args)
	host := strings.ToLower(strings.TrimSuffix(strings.TrimSpace(fs.Arg(0)), "."))
	if host == "" || fs.NArg() > 1 {
		log.Fatal(domainsVerifyUsage)
	}
	sess := requireAPISession("verify", *consoleFlag)
	printUsing(stdout, sess)
	acct := resolvedAccount(sess, acctRaw, acctIDRaw)
	app2 := resolvedApp(sess, acct, *app, domainsVerifyUsage)
	ctx := context.Background()
	recs, err := sess.domainList(ctx, acct, app2)
	if err != nil {
		log.Fatalf("domains verify: %v", err)
	}
	var cur *apiDomainRecord
	for i := range recs {
		if recs[i].Host == host {
			cur = &recs[i]
		}
	}
	if cur == nil {
		log.Fatalf("domains verify: %s is not attached to %s — carlos domains attach it first", host, app2)
	}
	if domainVerified(*cur) {
		fmt.Fprintf(stdout, "%s %s\n", colorFor(stdout).ok("verified"), host)
		printDomainDNSLine(ctx, sess, acct, app2, host)
		return
	}
	kind, route := "", cur.Route
	if route == "" || route == host {
		kind, route = "static", ""
	}
	res, err := sess.domainAttachFull(ctx, acct, app2, host, route, kind, strings.TrimSpace(*channel), nil, nil)
	if err != nil {
		log.Fatalf("domains verify: %v", err)
	}
	if !res.Verified {
		fmt.Fprintf(stdout, "%s %s: the TXT record is not there yet (DNS changes can take a few minutes to show)\n", colorFor(stdout).warn("not verified"), host)
		printDomainVerifyHint(res.Verify, app2, host)
		os.Exit(1)
	}
	fmt.Fprintf(stdout, "%s %s -> %s\n", colorFor(stdout).ok("verified"), host, res.Route)
	printDomainDNSLine(ctx, sess, acct, app2, host)
}

func runDomainsDetach(args []string) {
	fs := flag.NewFlagSet("domains detach", flag.ExitOnError)
	app := appFlag(fs, "app the hostname belongs to")
	consoleFlag := consoleOption(fs, "console to detach through (default: the only logged-in one)")
	acctRaw := fs.String("account", "", "account (sqid or name) the app belongs to (default: your only account, or the configured/chosen one)")
	acctIDRaw := fs.String("account-id", "", "account sqid, matched as a sqid ONLY — supersedes --account")
	fs.Usage = flagUsage(fs, domainsDetachUsage)
	fs.Parse(args)
	host := strings.TrimSpace(fs.Arg(0))
	if host == "" || fs.NArg() > 1 {
		log.Fatal(domainsDetachUsage)
	}
	sess := requireAPISession("detach", *consoleFlag)
	printUsing(stdout, sess)
	acct := resolvedAccount(sess, acctRaw, acctIDRaw)
	app2 := resolvedApp(sess, acct, *app, domainsDetachUsage)
	removed, err := sess.domainDetach(context.Background(), acct, app2, host)
	if err != nil {
		log.Fatalf("domains detach: %v", err)
	}
	if removed {
		fmt.Fprintf(stdout, "%s %s\n", colorFor(stdout).ok("detached"), host)
	} else {
		fmt.Fprintf(stdout, "%s %s\n", colorFor(stdout).ok("was not attached"), host)
	}
}

func runDomainsList(args []string) {
	fs := flag.NewFlagSet("domains list", flag.ExitOnError)
	app := appFlag(fs, "app whose hostname claims to list")
	consoleFlag := consoleOption(fs, "console to list through (default: the only logged-in one)")
	acctRaw := fs.String("account", "", "account (sqid or name) the app belongs to (default: your only account, or the configured/chosen one)")
	acctIDRaw := fs.String("account-id", "", "account sqid, matched as a sqid ONLY — supersedes --account")
	fs.Usage = flagUsage(fs, domainsListUsage)
	fs.Parse(args)
	sess := requireAPISession("list", *consoleFlag)
	printUsing(stdout, sess)
	acct := resolvedAccount(sess, acctRaw, acctIDRaw)
	app2 := resolvedApp(sess, acct, *app, domainsListUsage)
	recs, err := sess.domainList(context.Background(), acct, app2)
	if err != nil {
		log.Fatalf("domains list: %v", err)
	}
	w := newTable(stdout)
	// WILDCARD/CATCHALL print "yes" or "" (the route table's --hibernate/HIB
	// convention, cli.go), never "no" — a blank cell reads as "not set"
	// without shouting it. DELEGATION is a tri-state the door itself never
	// fabricates: "-" covers both "no delegation zone configured" and
	// "wildcard is off", the two cases the door omits the field for.
	// GUIDANCE (last — it is the long free-text column) is the door's own
	// point-your-DNS-here instruction, "-" when the domain is pointing.
	// STATE is the door's derived lifecycle word (#299) and is the column to
	// read. The older STATUS only ever meant "some box reported something",
	// so it says "live" for a hostname pointing at the wrong place; it is
	// kept off the table entirely rather than shown beside a word that
	// contradicts it. A console that predates state sends "", and the row
	// falls back to that legacy status so an older deployment still prints
	// something true.
	fmt.Fprintln(w, "HOST\tROUTE\tSTATE\tDNS\tCERT-EXPIRES\tWILDCARD\tCATCHALL\tDELEGATION\tGUIDANCE")
	for _, r := range recs {
		state := r.State
		if state == "" {
			state = r.Status
		}
		dns := r.DNSStatus
		if dns == "" {
			dns = "-"
		}
		cert := "-"
		if r.CertExpiresAt > 0 {
			cert = time.Unix(r.CertExpiresAt, 0).UTC().Format("2006-01-02")
		}
		wildcard := ""
		if r.Wildcard {
			wildcard = "yes"
		}
		catchall := ""
		if r.Catchall {
			catchall = "yes"
		}
		// An instance catch-all has no single route: each instance serves
		// at <label>.<parent>. Its derived names follow it, marked with the
		// catch-all they came from.
		route := r.Route
		switch {
		case r.Instances:
			// Which labels it holds against other accounts: all of them once
			// the parent is proved in DNS, else only existing instances'.
			route, catchall = "per-instance", "instances"
			if r.Reserves != "" {
				catchall += "(reserves:" + r.Reserves + ")"
			}
		case r.Via != "":
			catchall = "via " + r.Via
		}
		delegation := r.DelegationStatus
		if delegation == "" {
			delegation = "-"
		}
		guidance := r.Guidance
		if guidance == "" {
			guidance = "-"
		}
		fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n",
			r.Host, route, state, dns, cert, wildcard, catchall, delegation, guidance)
	}
	w.Flush()
}

// runDomainsPaths prints one hostname's PUBLISHED prefix map — the leading
// path segments its traffic is split by, and the route each is served by.
//
// This is desired state, and the distinction from `carlos routes` is the whole
// reason the verb exists. `carlos routes` prints the route_paths rows a box
// derived, and the reconcile pass silently drops any entry whose target is not
// a route of the same account on that box. So a prefix that appears HERE and
// not there is a flip the platform published and the deployment refused —
// which is the state an operator debugs, and which no other surface shows. The
// footer says so rather than leaving the reader to know it.
//
// READ-ONLY, and there is deliberately no sibling that writes: the platform
// that owns the hostname regenerates this map from its own database and
// republishes it wholesale, so a CLI writer would be a second writer of state
// whose source of truth is elsewhere, and the two would drift the first time
// anyone used it.
func runDomainsPaths(args []string) {
	fs := flag.NewFlagSet("domains paths", flag.ExitOnError)
	app := appFlag(fs, "app the hostname belongs to")
	consoleFlag := consoleOption(fs, "console to read through (default: the only logged-in one)")
	acctRaw := fs.String("account", "", "account (sqid or name) the app belongs to (default: your only account, or the configured/chosen one)")
	acctIDRaw := fs.String("account-id", "", "account sqid, matched as a sqid ONLY — supersedes --account")
	fs.Usage = flagUsage(fs, domainsPathsUsage)
	fs.Parse(args)
	host := strings.TrimSpace(fs.Arg(0))
	if host == "" || fs.NArg() > 1 {
		log.Fatal(domainsPathsUsage)
	}
	sess := requireAPISession("paths", *consoleFlag)
	printUsing(stdout, sess)
	acct := resolvedAccount(sess, acctRaw, acctIDRaw)
	app2 := resolvedApp(sess, acct, *app, domainsPathsUsage)
	paths, err := sess.domainPaths(context.Background(), acct, app2, host)
	if err != nil {
		log.Fatalf("domains paths: %v", err)
	}
	if len(paths) == 0 {
		mutedf(stdout, "%s splits no traffic by path", host)
		return
	}
	// Sorted by prefix: a map has no order, and a listing that reshuffles
	// between calls is one nobody can diff.
	prefixes := make([]string, 0, len(paths))
	for p := range paths {
		prefixes = append(prefixes, p)
	}
	sort.Strings(prefixes)
	w := newTable(stdout)
	fmt.Fprintln(w, "PREFIX\tTARGET")
	for _, p := range prefixes {
		fmt.Fprintf(w, "/%s\t%s\n", p, paths[p])
	}
	w.Flush()
	mutedf(stdout, "(published desired state; \"carlos routes --app %s\" shows which of these a box is actually serving)", app2)
}

// printDomainRecords prints the records the member must create, grouped by
// alternative. Nothing is printed when the door sent none — a pointing
// hostname has nothing left to do, and an older console sends no records at
// all.
//
// The "or" between groups is the whole point of the set marker: with steering
// the platform offers a CNAME *or* a set of A records, and a member who
// created both would publish a CNAME beside A records for one name, which is
// illegal. Required records print separately because they are needed
// whichever alternative is chosen.
func printDomainRecords(recs []apiDomainDNSRecord) {
	if len(recs) == 0 {
		return
	}
	var order []string
	groups := map[string][]apiDomainDNSRecord{}
	var required []apiDomainDNSRecord
	for _, r := range recs {
		if r.Required {
			required = append(required, r)
			continue
		}
		if _, seen := groups[r.Set]; !seen {
			order = append(order, r.Set)
		}
		groups[r.Set] = append(groups[r.Set], r)
	}
	for i, set := range order {
		lead := "Create:"
		if i > 0 {
			lead = "    or:"
		}
		for j, r := range groups[set] {
			if j > 0 {
				lead = "       "
			}
			fmt.Fprintf(stdout, "%s %s %s -> %s (TTL %d)\n", lead, r.Type, r.Name, r.Value, r.TTL)
		}
	}
	for _, r := range required {
		fmt.Fprintf(stdout, "   Also: %s %s -> %s (TTL %d)\n", r.Type, r.Name, r.Value, r.TTL)
	}
}