package cgroup

import (
	"errors"
	"fmt"
	"os"
	"os/exec"
	"path/filepath"
	"slices"
	"strconv"
	"strings"
	"syscall"

	"github.com/carlosframework/platform/internal/controlname"
)

// The generation layout (zero-downtime deploys spec §7.3). A host's
// carlos-exec@<host> becomes a PARENT that holds no processes. Each
// instance spawn lands in its own generation child g<n>, which carries the
// tier's full limits and memory.oom.group=1, so a successor that overruns
// dies alone and the incumbent is untouched. The legacy co-spawned sidecar
// and the seed land in role- children with no limit of their own. The
// parent carries the tier with memory.oom.group=0: a backstop for the
// instance as a whole, raised to OverlapLimit while two generations run.
// Nothing here runs unless the exec backend's GenContainment is set
// (plan 5's CARLOS_SWAP).

// GenChild is generation n's child cgroup: "g<n>".
func GenChild(n uint64) string { return "g" + strconv.FormatUint(n, 10) }

// RoleChild is the child cgroup a non-generation spawn of a host lands in
// under the generation layout: "role-<role>", the name PrepareRoleChild
// pins.
func RoleChild(role string) string { return "role-" + role }

// isChildName reports whether name is one of the layout's child names:
// g<n> with n canonical and above zero, or role-<label>. Only these are
// ever created, removed or swept.
func isChildName(name string) bool {
	if rest, ok := strings.CutPrefix(name, "role-"); ok {
		return controlname.ValidLabel(rest)
	}
	rest, ok := strings.CutPrefix(name, "g")
	if !ok || rest == "" {
		return false
	}
	n, err := strconv.ParseUint(rest, 10, 64)
	return err == nil && n > 0 && strconv.FormatUint(n, 10) == rest
}

// isGenName reports whether name is a generation child's name.
func isGenName(name string) bool { return strings.HasPrefix(name, "g") && isChildName(name) }

// OverlapLimit is the parent's limit while two generations overlap: the two
// tiers summed. With equal tiers that is the spec's "twice the tier". When
// a release changes tier it still has room for both (plan 2, D3).
func OverlapLimit(incumbent, successor Limit) Limit {
	return Limit{MemoryMax: incumbent.MemoryMax + successor.MemoryMax}
}

// ValidParentLimit reports whether l is a limit a generation parent may
// carry: one tier, or the sum of two. Strict containment and the root
// control service accept nothing else.
func ValidParentLimit(l Limit) bool {
	tiers := []int64{TierDefault.MemoryMax, TierChildren.MemoryMax}
	for _, a := range tiers {
		if l.MemoryMax == a {
			return true
		}
		for _, b := range tiers {
			if l.MemoryMax == a+b {
				return true
			}
		}
	}
	return false
}

// delegatedControllers is the subtree_control write that hands a parent's
// children every controller of cpu, memory, io and pids that the parent
// itself has (its cgroup.controllers). A user manager delegates no io, for
// one, and a write naming a controller the parent lacks fails as a whole.
func delegatedControllers(have string) string {
	fields := strings.Fields(have)
	var want []string
	for _, c := range []string{"cpu", "memory", "io", "pids"} {
		if slices.Contains(fields, c) {
			want = append(want, "+"+c)
		}
	}
	return strings.Join(want, " ")
}

// enableChildren delegates dir's controllers to its children. Memory must
// be among them, or a generation's limits could not exist.
func enableChildren(dir string) error {
	have, err := os.ReadFile(filepath.Join(dir, "cgroup.controllers"))
	if err != nil {
		return err
	}
	want := delegatedControllers(string(have))
	if !strings.Contains(want, "+memory") {
		return errors.New("no memory controller to delegate")
	}
	return writeSubtreeControl(filepath.Join(dir, "cgroup.subtree_control"), []byte(want))
}

// writeSubtreeControl is enableChildren's write, a seam so a test can
// answer it as the kernel would (EBUSY for a parent a process landed in).
var writeSubtreeControl = func(path string, b []byte) error { return os.WriteFile(path, b, 0o644) }

// parentPopulated reads dir's cgroup.events. An absent file means nothing
// has ever run there: not populated. A file that cannot be read counts as
// populated, so a raised limit is never lowered on a guess.
func parentPopulated(dir string) bool {
	b, err := os.ReadFile(filepath.Join(dir, "cgroup.events"))
	if errors.Is(err, os.ErrNotExist) {
		return false
	}
	if err != nil {
		return true
	}
	return !strings.Contains(string(b), "populated 0")
}

// ErrLegacyParentPopulated is a generation start refused because the host's
// parent cgroup holds a process directly. A cgroup with processes of its own
// cannot delegate the memory controller to children (cgroup v2's
// no-internal-process rule), so a generation started under it would run with
// no memory limit at all, silently (amadan #272, real-unit check (d), kernel
// 6.12, systemd 257). An older agent's flat start is the usual way a parent
// gets one. The start fails closed instead: nothing is created and nothing
// is exec'd, and it is no fault of the build.
var ErrLegacyParentPopulated = errors.New("cgroup: the host's parent cgroup holds a process directly")

// ErrLimitNotApplied is a generation start refused because a limit it would
// run under could not be put in place: the parent could not be made, its
// controllers could not be delegated (or a live parent does not delegate
// memory), the parent's backstop could not be written, the generation's own
// child could not be made or one of its four limit writes failed, or the
// placement shim is not available in this process, so the process could
// only be started outside its cgroup and moved after, or the shim could
// not place it before exec (a placement error, never the command's own
// failure). The flat start (StartGated) stays best-effort and never
// returns it. Nothing is exec'd, and it is no fault of the build: like
// ErrLegacyParentPopulated, the condition is the box's (Task 7, zdd flag
// readiness round 2).
var ErrLimitNotApplied = errors.New("cgroup: a generation's limits could not be applied")

// delegatesMemory reports whether dir hands the memory controller to its
// children: its cgroup.subtree_control lists memory. The kernel reads it
// back without the "+" this package writes; either spelling counts. An
// absent or unreadable file is not known to delegate, so it is refused as
// one that does not.
func delegatesMemory(dir string) error {
	b, err := os.ReadFile(filepath.Join(dir, "cgroup.subtree_control"))
	if err != nil {
		return fmt.Errorf("%w: cannot read the parent's cgroup.subtree_control: %w", ErrLimitNotApplied, err)
	}
	for _, f := range strings.Fields(string(b)) {
		if strings.TrimPrefix(f, "+") == "memory" {
			return nil
		}
	}
	return fmt.Errorf("%w: the parent does not delegate memory (cgroup.subtree_control %q)", ErrLimitNotApplied, strings.TrimSpace(string(b)))
}

// parentProcs counts the processes dir holds directly: its own cgroup.procs,
// not cgroup.events, whose "populated" also counts every descendant. An
// absent file is a directory nothing has run in. A file that cannot be read
// is an error, so the caller never takes it for empty.
func parentProcs(dir string) (int, error) {
	b, err := os.ReadFile(filepath.Join(dir, "cgroup.procs"))
	if errors.Is(err, os.ErrNotExist) {
		return 0, nil
	}
	if err != nil {
		return 0, err
	}
	return len(strings.Fields(string(b))), nil
}

// ensureParent makes carlos-exec@<host> a generation parent. It first
// refuses a parent that holds a process directly, whatever children it has
// (plan review #12): a stale empty g<n> beside a legacy process does not make
// the parent one. A process being placed (the in-flight registry) counts as
// one already there: into the parent itself, as a direct process; anywhere
// below it, as something alive under it. Then, when nothing is alive under
// it (a cold wake), it delegates the controllers and writes the tier with
// memory.oom.group=0. With a live generation under it, the parent is left
// as it is, because a swap raised it on purpose, once it is shown to
// delegate memory to its children.
//
// The decision and the writes it allows are one step against the registry
// (whole-branch review, finding 1): from before the first read until the
// limits are written, no placement into the parent or below it can
// register (holdPlacements), and the placements already in flight are
// counted when the hold begins. So no sibling can move from "being placed"
// to "in the kernel's view" unseen between the reads, and none can start
// while a cold parent is being reset. A placement that waits on the hold
// waits only for these cgroupfs reads and writes.
//
// Nothing here is best-effort (Task 7): a generation started past any of
// these failures would run without a limit, with nothing to say so. A
// populated parent is ErrLegacyParentPopulated, and an unreadable
// cgroup.procs is refused as the same (unknown is not empty), as is a
// subtree_control write the kernel answers EBUSY (a process landed in the
// parent after the check). A parent that cannot be made, a live parent that
// does not delegate memory, controllers that cannot be delegated, and a
// parent backstop that cannot be written are ErrLimitNotApplied.
func (m *Manager) ensureParent(host string, tier Limit) error {
	dir := m.hostDir(host)
	if err := os.MkdirAll(dir, 0o755); err != nil {
		m.logf("cgroup: %s: create parent cgroup: %v (generation start refused)", host, err)
		return fmt.Errorf("%w: %s: create parent: %w", ErrLimitNotApplied, host, err)
	}
	inflightAt, inflightUnder, release := m.holdPlacements(dir)
	defer release()
	n, err := parentProcs(dir)
	if err != nil {
		m.logf("cgroup: %s: generation start refused: cannot read the parent's cgroup.procs: %v", host, err)
		return fmt.Errorf("%w (cgroup.procs unreadable, treated as populated): %v", ErrLegacyParentPopulated, err)
	}
	// A flat start being placed into the parent itself is a direct process
	// the moment it lands (Ruling 6): count it now.
	n += inflightAt
	if n > 0 {
		m.logf("cgroup: %s: generation start refused: the parent cgroup holds %d process(es) directly, so no memory limit could apply to a generation under it; stop them or let them exit", host, n)
		return fmt.Errorf("%w: %s holds %d process(es)", ErrLegacyParentPopulated, host, n)
	}
	// A sibling generation being placed is a live one: the parent is not
	// cold, and its limits (a swap may have raised them) are left alone.
	populated := parentPopulated(dir)
	if placementReadHook != nil {
		placementReadHook(dir)
	}
	if populated || inflightUnder > 0 {
		if err := delegatesMemory(dir); err != nil {
			m.logf("cgroup: %s: generation start refused: %v", host, err)
			return fmt.Errorf("%s: %w", host, err)
		}
		return nil
	}
	if err := enableChildren(dir); err != nil {
		if errors.Is(err, syscall.EBUSY) {
			m.logf("cgroup: %s: generation start refused: delegate controllers: %v (a process holds the parent directly)", host, err)
			return fmt.Errorf("%w: %s: delegate controllers: %w", ErrLegacyParentPopulated, host, err)
		}
		m.logf("cgroup: %s: delegate controllers to generations: %v (generation start refused)", host, err)
		return fmt.Errorf("%w: %s: delegate controllers: %w", ErrLimitNotApplied, host, err)
	}
	if tier.MemoryMax > 0 {
		if err := m.SetParentLimit(host, tier); err != nil {
			m.logf("cgroup: %s: parent limit: %v (generation start refused)", host, err)
			return fmt.Errorf("%w: %w", ErrLimitNotApplied, err)
		}
	}
	return nil
}

// StartChild is Start for the generation layout: the child lands in
// carlos-exec@<host>/<child>. own is the child's own limit: the tier for a
// generation, zero for a role child, which then lives under the parent's
// limit alone. parent is the tier the parent takes when this spawn finds
// nothing alive under it. Nil-safe like Start, but not best-effort: a
// generation whose limits cannot all be applied is refused with
// ErrLimitNotApplied before anything is built or exec'd (ensureParent,
// startIn), and it is never started outside its cgroup and moved by PID.
func (m *Manager) StartChild(host, child string, parent, own Limit, build func() *exec.Cmd) (*exec.Cmd, error) {
	return m.StartChildGated(host, child, parent, own, build, nil)
}

// StartChildGated is StartChild with StartGated's before-start hook: asked
// after the parent and the child are prepared and the process is placed in
// the child, immediately before it execs. A refusal runs nothing of the
// command, leaves the child removed (if empty) and the parent as a failed
// start leaves it, and comes back as before's own error. A nil before is
// StartChild exactly. A parent that holds a process directly refuses the
// start with ErrLegacyParentPopulated before anything is created or exec'd
// (ensureParent).
func (m *Manager) StartChildGated(host, child string, parent, own Limit, build func() *exec.Cmd, before func() error) (*exec.Cmd, error) {
	if !isChildName(child) {
		return nil, fmt.Errorf("cgroup: %s: %q is not a child cgroup name", host, child)
	}
	if m == nil {
		return startPlain(build, before)
	}
	// A parent or child that took cgroup.kill is removed and made again
	// first (amadan #272): KillSidecar keeps role-sidecar, and KillHost keeps
	// the parent. ensureParent and startIn then build them as on a cold start.
	if err := m.freshen(host, filepath.Join(m.hostDir(host), child)); err != nil {
		return nil, err
	}
	if err := m.ensureParent(host, parent); err != nil {
		return nil, err
	}
	return m.startIn(host, filepath.Join(m.hostDir(host), child), own, true, build, before)
}

// SetParentLimit writes l onto host's parent: memory.max, memory.high
// (HighOf), memory.swap.max, and memory.oom.group=0 (spec §7.3). The swap
// raises it to OverlapLimit before the successor spawns and restores the
// tier once the retiring child is empty. Unlike applyLimit it reports the
// first failure, because a raise that did not land must stop the overlap.
// A nil manager has no parent to set and answers nil.
func (m *Manager) SetParentLimit(host string, l Limit) error {
	if m == nil {
		return nil
	}
	if l.MemoryMax <= 0 {
		return fmt.Errorf("cgroup: %s: parent limit %d is not a limit", host, l.MemoryMax)
	}
	dir := m.hostDir(host)
	for _, w := range []struct{ name, value string }{
		{"memory.max", strconv.FormatInt(l.MemoryMax, 10)},
		{"memory.high", strconv.FormatInt(HighOf(l.MemoryMax), 10)},
		{"memory.swap.max", strconv.FormatInt(l.MemoryMax, 10)},
		{"memory.oom.group", "0"},
	} {
		if err := os.WriteFile(filepath.Join(dir, w.name), []byte(w.value), 0o644); err != nil {
			return fmt.Errorf("cgroup: %s: parent %s: %w", host, w.name, err)
		}
	}
	m.logf("cgroup: %s: parent memory.max=%dM", host, l.MemoryMax>>20)
	return nil
}

// RemoveChild removes host's child cgroup once it is empty. Nil-safe and
// rmdir-tolerant like CleanupHost, and it touches only the layout's own
// child names. The parent is CleanupHost's to remove.
func (m *Manager) RemoveChild(host, child string) {
	if m == nil || !isChildName(child) {
		return
	}
	_ = removeEmptyDir(filepath.Join(m.hostDir(host), child))
}