// The `carlos fleets` verbs: mint an account-owned fleet, add/rotate/detach
// its boxes, and list what an account owns. A fleet is a named group of
// remote boxes (customer-fleets plan) that dial this console over a channel
// identified by "<fleet>/<label>" — console-tracked state
// (internal/registry's fleets/fleet_boxes tables), reached only through the
// console's API doors (internal/console/fleets.go). There is no
// bucket-direct fallback, the same posture `carlos apps create` takes: a
// fleet cannot exist without a console to claim its name and mint its
// boxes' tokens.
//
// `carlos apps place` — which repoints an EXISTING app onto a fleet, and
// apps create's --place flag, which does the same at create time — live in
// apps.go, not here: their subject is an app, and a fleet name is only ever
// data in their request body (mirroring where the console itself put the
// /place route — see fleets.go's package doc there).
package main

import (
	"context"
	"flag"
	"fmt"
	"log"
	"os"
	"strings"
	"text/tabwriter"

	"github.com/carlosframework/platform/internal/registry"
)

const fleetsUsage = `usage: carlos fleets <create|add-box|rotate-token|tag-box|detach-box|ls> [flags]

  create --bucket <bucket> [--account <sqid|name>] <name>
                  mint an account-owned fleet: a named group of remote boxes
                  that dial this console over a channel identified by
                  "<fleet>/<label>". <bucket> is the customer's OWN data
                  bucket, taken on trust that it already exists. The fleets
                  namespace is flat and global across every account — a name
                  once taken (by ANY account) cannot be reused, so the "that
                  name is taken" refusal on a retry does not necessarily mean
                  YOU took it.

  add-box [--account <sqid|name>] <fleet> <label>
                  register one box to a fleet and mint its bearer token. THE
                  TOKEN IS PRINTED EXACTLY ONCE, HERE — the console never
                  stores or re-shows the plaintext, so losing this output
                  means rotate-token, not a re-run of add-box (which just
                  409s on the label). Put it in the box's credential store
                  right away.
                  ROTATION IS NOT REVOCATION: rotating a token later (below)
                  refuses the box's NEXT dial-in with the OLD token but does
                  NOT evict a channel it already holds — a box whose
                  credential may be COMPROMISED needs detach-box, not
                  rotate-token.

  rotate-token [--account <sqid|name>] <fleet> <label>
                  mint a FRESH token for a box that already exists, printed
                  exactly once, same as add-box. THIS REFUSES THE BOX'S NEXT
                  DIAL-IN with the old token, but does NOT evict a channel it
                  is already connected on — a box whose credential may be
                  COMPROMISED needs detach-box, not this.

  tag-box --tags <tags> [--account <sqid|name>] <fleet> <label>
                  replace a box's tags IN FULL: comma-separated segments of
                  1-24 lowercase a-z/0-9/hyphen characters each (hyphens
                  interior only, never leading or trailing), max 8 tags.
                  --tags "" clears every tag. This is a full replace, not a
                  merge — the tags sent are exactly the tags that land.

  detach-box [--account <sqid|name>] <fleet> <label>
                  the hard revocation rotate-token is not: flips the box to
                  "detached", which refuses its next dial-in AND closes any
                  channel it already holds. This is what a compromised box
                  needs.

  ls [--account <sqid|name>]
                  list every fleet the account owns, with each box's label,
                  status and tags.

  --account <sqid|name>  account the fleet belongs to (default: your only
                        account, or the configured/chosen one) —
                        resolved by the console against your own
                        memberships.
  --account-id <sqid>    account sqid, matched as a sqid ONLY — supersedes
                        --account
  --console <origin>     which logged-in console to use (only needed with
                        several)

Every verb here is signed-in only (carlos auth login) — fleets are
console-tracked state, with no bucket-direct fallback.
`

// RunFleets dispatches the fleets sub-verbs.
func RunFleets(args []string) {
	if len(args) == 0 {
		fmt.Fprint(os.Stderr, fleetsUsage)
		os.Exit(1)
	}
	switch args[0] {
	case "create":
		runFleetsCreate(args[1:])
	case "add-box":
		runFleetsAddBox(args[1:])
	case "rotate-token":
		runFleetsRotateToken(args[1:])
	case "tag-box":
		runFleetsTagBox(args[1:])
	case "detach-box":
		runFleetsDetachBox(args[1:])
	case "ls":
		runFleetsList(args[1:])
	default:
		fmt.Fprint(os.Stderr, fleetsUsage)
		os.Exit(1)
	}
}

// fleetsSignedInSession resolves API mode and fatals with a fleets-specific
// message when this shell is in direct bucket mode — every fleets verb is
// console-API-only, the same posture apps create takes (apps.go's
// runAppsCreate): a fleet is console-tracked state with nothing in the
// bucket to fall back to.
func fleetsSignedInSession(consoleFlag string) *apiSession {
	sess, err := resolveMode(consoleFlag)
	if err != nil {
		log.Fatal(err)
	}
	if sess == nil {
		log.Fatal("fleets works through a console, and this shell is in direct bucket mode\n" +
			"(CARLOS_DEPLOYMENT_BUCKET/CARLOS_DEPLOYMENT_DIR is set). Fleets are console-tracked\n" +
			"state with no bucket-direct fallback: unset the store env and run\n" +
			"carlos auth login --console <url> instead.")
	}
	return sess
}

// validFleetName and validBoxLabel are the client-side gates for the two
// name shapes every fleets verb below takes — checked BEFORE any API call,
// on the same "a shape the server is certain to refuse should cost nothing"
// principle apps.go's validAppName states. Both use
// registry.ValidTunnelName: a fleet name and a box label are the two halves
// of the "<fleet>/<label>" channel identity, and share its grammar exactly.
func validFleetName(name string) error {
	if registry.ValidTunnelName(name) {
		return nil
	}
	return fmt.Errorf("%q is not a usable fleet name — 1-32 characters of a-z, 0-9 and hyphen", name)
}

func validBoxLabel(label string) error {
	if registry.ValidTunnelName(label) {
		return nil
	}
	return fmt.Errorf("%q is not a usable box label — 1-32 characters of a-z, 0-9 and hyphen", label)
}

func runFleetsCreate(args []string) {
	fs := flag.NewFlagSet("fleets create", flag.ExitOnError)
	bucket := fs.String("bucket", "", "the customer's own data bucket (must already exist)")
	acctRaw := fs.String("account", "", "account (sqid or name) to own the fleet (default: your only account, or the configured/chosen one)")
	acctIDRaw := fs.String("account-id", "", "account sqid, matched as a sqid ONLY — supersedes --account")
	consoleFlag := consoleOption(fs, "console to create it through (default: the only logged-in one)")
	fs.Usage = flagUsage(fs, "")
	fs.Parse(args)
	if fs.NArg() != 1 || strings.TrimSpace(*bucket) == "" {
		log.Fatal("usage: carlos fleets create --bucket <bucket> [--account <sqid|name>] " +
			"[--account-id <sqid>] [--console <origin>] <name>")
	}
	name := strings.TrimSpace(fs.Arg(0))
	if err := validFleetName(name); err != nil {
		log.Fatalf("fleets create: %v", err)
	}
	bucketV := strings.TrimSpace(*bucket)

	sess := fleetsSignedInSession(*consoleFlag)
	fmt.Fprintf(stdout, "using %s as %s\n", sess.console, sess.address)
	acct := resolvedAccount(sess, acctRaw, acctIDRaw)
	f, err := sess.createFleet(context.Background(), acct, name, bucketV)
	if err != nil {
		log.Fatalf("fleets create: %v", err)
	}
	fmt.Fprintf(stdout, "created fleet %s (bucket %s)\n", f.Name, f.Bucket)
	fmt.Fprintf(stdout, "  add a box: carlos fleets add-box %s <label>\n", f.Name)
}

func runFleetsAddBox(args []string) {
	fs := flag.NewFlagSet("fleets add-box", flag.ExitOnError)
	acctRaw := fs.String("account", "", "account (sqid or name) the fleet belongs to (default: your only account, or the configured/chosen one)")
	acctIDRaw := fs.String("account-id", "", "account sqid, matched as a sqid ONLY — supersedes --account")
	consoleFlag := consoleOption(fs, "console to add the box through (default: the only logged-in one)")
	fs.Usage = flagUsage(fs, "")
	fs.Parse(args)
	if fs.NArg() != 2 {
		log.Fatal("usage: carlos fleets add-box [--account <sqid|name>] [--account-id <sqid>] " +
			"[--console <origin>] <fleet> <label>")
	}
	fleet, label := strings.TrimSpace(fs.Arg(0)), strings.TrimSpace(fs.Arg(1))
	if err := validFleetName(fleet); err != nil {
		log.Fatalf("fleets add-box: %v", err)
	}
	if err := validBoxLabel(label); err != nil {
		log.Fatalf("fleets add-box: %v", err)
	}

	sess := fleetsSignedInSession(*consoleFlag)
	fmt.Fprintf(stdout, "using %s as %s\n", sess.console, sess.address)
	acct := resolvedAccount(sess, acctRaw, acctIDRaw)
	token, err := sess.addFleetBox(context.Background(), acct, fleet, label)
	if err != nil {
		log.Fatalf("fleets add-box: %v", err)
	}
	printFleetToken(fleet, label, token, false)
}

func runFleetsRotateToken(args []string) {
	fs := flag.NewFlagSet("fleets rotate-token", flag.ExitOnError)
	acctRaw := fs.String("account", "", "account (sqid or name) the fleet belongs to (default: your only account, or the configured/chosen one)")
	acctIDRaw := fs.String("account-id", "", "account sqid, matched as a sqid ONLY — supersedes --account")
	consoleFlag := consoleOption(fs, "console to rotate through (default: the only logged-in one)")
	fs.Usage = flagUsage(fs, "")
	fs.Parse(args)
	if fs.NArg() != 2 {
		log.Fatal("usage: carlos fleets rotate-token [--account <sqid|name>] [--account-id <sqid>] " +
			"[--console <origin>] <fleet> <label>")
	}
	fleet, label := strings.TrimSpace(fs.Arg(0)), strings.TrimSpace(fs.Arg(1))
	if err := validFleetName(fleet); err != nil {
		log.Fatalf("fleets rotate-token: %v", err)
	}
	if err := validBoxLabel(label); err != nil {
		log.Fatalf("fleets rotate-token: %v", err)
	}

	sess := fleetsSignedInSession(*consoleFlag)
	fmt.Fprintf(stdout, "using %s as %s\n", sess.console, sess.address)
	acct := resolvedAccount(sess, acctRaw, acctIDRaw)
	token, err := sess.rotateFleetBoxToken(context.Background(), acct, fleet, label)
	if err != nil {
		log.Fatalf("fleets rotate-token: %v", err)
	}
	printFleetToken(fleet, label, token, true)
}

// printFleetToken is the ONE place a fleet box token reaches stdout — for
// both add-box and rotate-token, so the two verbs can never drift apart on
// the warning that matters most (carried from Task 3's review, per this
// task's brief): rotating (or minting) a token refuses a box's NEXT dial-in
// with the credential just replaced, but does NOT evict a channel the box
// already holds — a COMPROMISED box needs `fleets detach-box`, not
// rotate-token. Printed exactly once, immediately after the token itself,
// on every call — never logged, never re-shown.
func printFleetToken(fleet, label, token string, rotated bool) {
	fmt.Fprintf(stdout, "%s/%s token: %s\n", fleet, label, token)
	fmt.Fprintln(stdout, "  (shown once — the console does not store or re-show the plaintext)")
	if rotated {
		fmt.Fprintln(stdout, "  ROTATION IS NOT REVOCATION: this refuses the box's NEXT dial-in with the OLD")
		fmt.Fprintln(stdout, "  token, but does NOT evict a channel it already holds — a COMPROMISED box needs")
		fmt.Fprintln(stdout, "  `carlos fleets detach-box`, not another rotate-token.")
		return
	}
	fmt.Fprintln(stdout, "  NOTE: rotating this token later (rotate-token) refuses the box's next dial-in but")
	fmt.Fprintln(stdout, "  does NOT evict a live session — a COMPROMISED box needs `fleets detach-box` instead.")
}

// runFleetsTagBox implements `carlos fleets tag-box`: a full replace of a
// box's tags, checked client-side with registry.ValidBoxTags BEFORE the API
// call — the same "a shape the server is certain to refuse should cost
// nothing" principle validFleetName/validBoxLabel already state above.
//
// --tags is TRI-state, the exact hazard runAppsPlace's --target comment
// documents (apps.go): "" is a LEGAL, meaningful value here — it clears
// every tag — so a flag left unmentioned and one explicitly set to "" are
// not the same request, and the flag's own zero value cannot tell them
// apart. Without a positive check, a forgotten `--tags` would silently wipe
// a box's tags and print "cleared" as if that were asked for. fs.Visit
// reports only flags actually present on the command line, so — exactly
// like runAppsPlace's targetSet — that is what decides "not named" from
// "named, empty", not the value in *tags.
func runFleetsTagBox(args []string) {
	fs := flag.NewFlagSet("fleets tag-box", flag.ExitOnError)
	acctRaw := fs.String("account", "", "account (sqid or name) the fleet belongs to (default: your only account, or the configured/chosen one)")
	acctIDRaw := fs.String("account-id", "", "account sqid, matched as a sqid ONLY — supersedes --account")
	consoleFlag := consoleOption(fs, "console to tag through (default: the only logged-in one)")
	tags := fs.String("tags", "", `comma-separated tags, full replace ("" clears every tag) — required`)
	const tagBoxUsage = "usage: carlos fleets tag-box --tags <tags> [--account <sqid|name>] [--account-id <sqid>] " +
		"[--console <origin>] <fleet> <label>"
	fs.Usage = flagUsage(fs, tagBoxUsage)
	fs.Parse(args)
	if fs.NArg() != 2 {
		log.Fatal(tagBoxUsage)
	}
	tagsSet := false
	fs.Visit(func(f *flag.Flag) {
		if f.Name == "tags" {
			tagsSet = true
		}
	})
	if !tagsSet {
		log.Fatal(tagBoxUsage)
	}
	fleet, label := strings.TrimSpace(fs.Arg(0)), strings.TrimSpace(fs.Arg(1))
	if err := validFleetName(fleet); err != nil {
		log.Fatalf("fleets tag-box: %v", err)
	}
	if err := validBoxLabel(label); err != nil {
		log.Fatalf("fleets tag-box: %v", err)
	}
	tagsV := strings.TrimSpace(*tags)
	if !registry.ValidBoxTags(tagsV) {
		log.Fatal("fleets tag-box: invalid tags — comma-separated [a-z0-9-] (hyphens interior), max 8")
	}

	sess := fleetsSignedInSession(*consoleFlag)
	fmt.Fprintf(stdout, "using %s as %s\n", sess.console, sess.address)
	acct := resolvedAccount(sess, acctRaw, acctIDRaw)
	if err := sess.tagFleetBox(context.Background(), acct, fleet, label, tagsV); err != nil {
		log.Fatalf("fleets tag-box: %v", err)
	}
	if tagsV == "" {
		fmt.Fprintf(stdout, "cleared tags for %s/%s\n", fleet, label)
	} else {
		fmt.Fprintf(stdout, "tagged %s/%s [%s]\n", fleet, label, tagsV)
	}
}

func runFleetsDetachBox(args []string) {
	fs := flag.NewFlagSet("fleets detach-box", flag.ExitOnError)
	acctRaw := fs.String("account", "", "account (sqid or name) the fleet belongs to (default: your only account, or the configured/chosen one)")
	acctIDRaw := fs.String("account-id", "", "account sqid, matched as a sqid ONLY — supersedes --account")
	consoleFlag := consoleOption(fs, "console to detach through (default: the only logged-in one)")
	fs.Usage = flagUsage(fs, "")
	fs.Parse(args)
	if fs.NArg() != 2 {
		log.Fatal("usage: carlos fleets detach-box [--account <sqid|name>] [--account-id <sqid>] " +
			"[--console <origin>] <fleet> <label>")
	}
	fleet, label := strings.TrimSpace(fs.Arg(0)), strings.TrimSpace(fs.Arg(1))
	if err := validFleetName(fleet); err != nil {
		log.Fatalf("fleets detach-box: %v", err)
	}
	if err := validBoxLabel(label); err != nil {
		log.Fatalf("fleets detach-box: %v", err)
	}

	sess := fleetsSignedInSession(*consoleFlag)
	fmt.Fprintf(stdout, "using %s as %s\n", sess.console, sess.address)
	acct := resolvedAccount(sess, acctRaw, acctIDRaw)
	if err := sess.detachFleetBox(context.Background(), acct, fleet, label); err != nil {
		log.Fatalf("fleets detach-box: %v", err)
	}
	fmt.Fprintf(stdout, "detached %s/%s — its next dial-in is refused and any live channel is closed\n", fleet, label)
}

func runFleetsList(args []string) {
	fs := flag.NewFlagSet("fleets ls", flag.ExitOnError)
	acctRaw := fs.String("account", "", "account (sqid or name) to list fleets for (default: your only account, or the configured/chosen one)")
	acctIDRaw := fs.String("account-id", "", "account sqid, matched as a sqid ONLY — supersedes --account")
	consoleFlag := consoleOption(fs, "console to list through (default: the only logged-in one)")
	fs.Usage = flagUsage(fs, "")
	fs.Parse(args)

	sess := fleetsSignedInSession(*consoleFlag)
	fmt.Fprintf(stdout, "using %s as %s\n", sess.console, sess.address)
	acct := resolvedAccount(sess, acctRaw, acctIDRaw)
	fleets, err := sess.listFleets(context.Background(), acct)
	if err != nil {
		log.Fatalf("fleets ls: %v", err)
	}
	if len(fleets) == 0 {
		fmt.Fprintln(stdout, "no fleets")
		return
	}
	w := tabwriter.NewWriter(stdout, 0, 4, 2, ' ', 0)
	fmt.Fprintln(w, "FLEET\tBUCKET\tBOX\tSTATUS\tTAGS")
	for _, f := range fleets {
		if len(f.Boxes) == 0 {
			fmt.Fprintf(w, "%s\t%s\t-\t-\t-\n", f.Name, f.Bucket)
			continue
		}
		for _, b := range f.Boxes {
			tags := b.Tags
			if tags == "" {
				tags = "-"
			}
			fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n", f.Name, f.Bucket, b.Label, b.Status, tags)
		}
	}
	w.Flush()
}