// The app Settings tab's domain attach/detach door (#82, Task 4): thin
// browser-form handlers over the attachDomain/detachDomain core in
// domainattach.go. Everything that decides whether an attach or detach is
// ALLOWED — platform space, alias-vs-first-route, the claim/record write
// order, the audit row, the serial bump — lives there and is not repeated
// here. What's here is the browser's own shape: session, CSRF, the
// owner-only gate, and turning the core's answer into a page.
//
// Gate order copies handleAppDelete's (appsettings.go) exactly, minus
// requireFreshAuth: session (accountApp) -> CSRF -> owner (byte-identical
// 404) -> refusals -> act. Spec §6: attach/detach are member-reversible, no
// passkey step-up — detach's protection is the typed-host confirm below,
// not a passkey.
package console

import (
	"context"
	"crypto/subtle"
	"log"
	"net/http"
	"strings"
	"time"

	"github.com/carlosframework/platform/internal/domains"
)

// handleAppDomainAttach claims a host for the app and, when the app has no
// route to alias, declares the static route that becomes its first one.
// The browser door never sends a kind — the core infers alias vs
// first-route from whether the app already has a ready route — and the
// channel field is optional, passed through as typed.
func (s *Server) handleAppDomainAttach(w http.ResponseWriter, r *http.Request) {
	addr, raw, acct, role, app, ok := s.accountApp(w, r)
	if !ok {
		return
	}
	if subtle.ConstantTimeCompare([]byte(r.FormValue("csrf")), []byte(raw)) != 1 {
		s.renderMessage(w, r, http.StatusForbidden, "Refused", "Cross-site request blocked.")
		return
	}
	if role != RoleOwner {
		http.NotFound(w, r)
		return
	}
	host := strings.ToLower(strings.TrimSpace(r.FormValue("host")))
	channel := strings.TrimSpace(r.FormValue("channel"))

	ctx, cancel := context.WithTimeout(r.Context(), 20*time.Second)
	defer cancel()
	// "*.<parent>" is an instance catch-all (domaincatchall.go). The owner
	// gate above is the person check: a session is always a person.
	if parent, ok := domains.ParseInstanceCatchallHost(host); ok {
		if channel != "" {
			s.renderAppSettingsForm(w, r, http.StatusUnprocessableEntity, "domains",
				"an instance catch-all takes no channel — each instance keeps its own", map[string]string{"domain": host})
			return
		}
		ref := s.catchallAppReady(ctx, acct, app)
		if ref == nil {
			_, ref = s.attachInstanceCatchall(ctx, acct, app, parent, addr, "")
		}
		if ref != nil {
			s.renderDoorRefusal(w, r, ref)
			return
		}
		s.setFlash(w, "ok", "Attached "+domains.InstanceCatchallHost(parent)+" — each instance now also answers at <label>."+parent+".")
		http.Redirect(w, r, appSettingsURL(acct.Sqid, app, "domains"), http.StatusSeeOther)
		return
	}
	res, ref := s.attachDomain(ctx, acct, app, host, "", channel, addr)
	if ref != nil {
		if ref.Status == http.StatusUnprocessableEntity {
			s.renderAppSettingsForm(w, r, ref.Status, "domains", ref.Msg, map[string]string{
				"domain": host, "channel": channel,
			})
			return
		}
		s.renderDoorRefusal(w, r, ref)
		return
	}
	if res.OperationID != "" {
		s.renderClaimAccepted(w, r, host, res.OperationID, res.OperationPhase)
		return
	}
	msg := "Attached " + host + " — it now aliases the app's existing route."
	if res.FirstRoute {
		msg = "Attached " + host + " as the app's first route, following " + res.Channel + "."
	}
	if res.Pending {
		// #215: stored, not served. The flash carries the exact record, so
		// the member never has to go looking for what to do next.
		msg = "Saved " + host + ", but it is not live yet. " + verifyGuidance(res.Verify)
	}
	s.setFlash(w, "ok", msg)
	http.Redirect(w, r, appSettingsURL(acct.Sqid, app, "domains"), http.StatusSeeOther)
}

// handleAppDomainDetach releases a host's claim. The typed-host confirm is
// the browser door's own gate — spec §6's substitute for a passkey step-up
// on a reversible action — and is checked BEFORE the core is called: a
// mismatch must leave the claim exactly as it was.
func (s *Server) handleAppDomainDetach(w http.ResponseWriter, r *http.Request) {
	addr, raw, acct, role, app, ok := s.accountApp(w, r)
	if !ok {
		return
	}
	if subtle.ConstantTimeCompare([]byte(r.FormValue("csrf")), []byte(raw)) != 1 {
		s.renderMessage(w, r, http.StatusForbidden, "Refused", "Cross-site request blocked.")
		return
	}
	if role != RoleOwner {
		http.NotFound(w, r)
		return
	}
	host := strings.ToLower(strings.TrimSpace(r.FormValue("host")))
	if strings.ToLower(strings.TrimSpace(r.FormValue("confirm"))) != host {
		s.renderMessage(w, r, http.StatusUnprocessableEntity, "Refused", "Type the domain exactly to detach it.")
		return
	}

	ctx, cancel := context.WithTimeout(r.Context(), 20*time.Second)
	defer cancel()
	if parent, ok := domains.ParseInstanceCatchallHost(host); ok {
		if _, err := s.detachInstanceCatchall(ctx, acct, app, parent, addr); err != nil {
			if msg, ok := claimAliasRefusal(err); ok {
				s.renderMessage(w, r, http.StatusConflict, "Refused", msg)
				return
			}
			log.Printf("console: detach %s/%s %s: %v", acct.Sqid, app, host, err)
			s.renderMessage(w, r, http.StatusBadGateway, "Refused", "Could not detach the catch-all — try again.")
			return
		}
		s.setFlash(w, "ok", "Detached "+host+".")
		http.Redirect(w, r, appSettingsURL(acct.Sqid, app, "domains"), http.StatusSeeOther)
		return
	}
	if ref := s.detachDomain(ctx, acct, app, host, addr); ref != nil {
		s.renderDoorRefusal(w, r, ref)
		return
	}
	s.setFlash(w, "ok", "Detached "+host+".")
	http.Redirect(w, r, appSettingsURL(acct.Sqid, app, "domains"), http.StatusSeeOther)
}

// renderDoorRefusal turns a doorRefusal from the Task 3 core into this
// door's page. 404 MUST be http.NotFound: the stranger's byte-identical
// 404, not a rendered message that would tell a prober "an app exists
// here, but this host does not" versus "nothing exists here at all".
// Every other status renders through renderMessage with the refusal's own
// status and member-facing text.
func (s *Server) renderDoorRefusal(w http.ResponseWriter, r *http.Request, ref *doorRefusal) {
	if ref.Status == http.StatusNotFound {
		http.NotFound(w, r)
		return
	}
	setNoCapacityRetryAfter(w, ref)
	s.renderMessage(w, r, ref.Status, "Refused", ref.Msg)
}