// Instance catch-alls — a claim on "*.<parent>" that serves each of an
// app's instances at <label>.<parent> (docs/superpowers/specs/
// 2026-10-05-instance-catchall-design.md). The claim is written here; the
// alias rows are derived box-side (domains.ReconcileAliases).
//
// Both doors share this core, the way attachDomain is shared: the CLI API
// door (handleAPIDomainAttach/Detach, which branch here on a "*." host) and
// the app Domains page.
package console

import (
	"context"
	"errors"
	"log"
	"net/http"
	"os"
	"slices"
	"strings"
	"time"

	"golang.org/x/net/publicsuffix"

	"github.com/carlosframework/platform/internal/certwarm"
	"github.com/carlosframework/platform/internal/domains"
	"github.com/carlosframework/platform/internal/provision"
	"github.com/carlosframework/platform/internal/status"
)

// catchallParentMsg is the refusal for a catch-all whose parent the account
// does not hold. One message whether nobody holds it or someone else does:
// AttachInstanceCatchall does not tell the two apart, and neither does this.
func catchallParentMsg(parent string) string {
	return "attach " + parent + " to an app in this account first — an instance catch-all on *." + parent + " needs " + parent + " itself held by the same account"
}

// catchallParentRefused reports whether parent may never carry an instance
// catch-all on this deployment, decided from the name and the config alone.
//
// A catch-all claims every one-label name under parent at once, so the
// refusal looks at the names UNDER parent as well as parent itself:
//
//   - parent, or anything under it, in the deny tiers (domainHostPolicy):
//     the deployment's own zones are never a tenant's catch-all, operators
//     included;
//   - any reserved, platform or console hostname strictly under parent,
//     which a derived name could otherwise land on (the box cannot see the
//     deny lists, so the door is the only place this can be refused);
//   - the apps domain, or anything under it: the account-sqid and app-apex
//     namespace, where instance hosts already live;
//   - a public suffix (co.uk, github.io): a catch-all reserves the names
//     under its parent to one account at the attach door, and that must
//     never cover a registry's whole namespace;
//   - the reserved sidecar suffix.
func (s *Server) catchallParentRefused(parent, account string) bool {
	if s.domainHostPolicy(parent, account) != hostOpen {
		return true
	}
	if strings.HasSuffix(parent, provision.SidecarSuffix) {
		return true
	}
	if suffix, _ := publicsuffix.PublicSuffix(parent); suffix == parent {
		return true
	}
	under := func(entry string) bool {
		entry = strings.TrimSuffix(strings.ToLower(strings.TrimSpace(entry)), ".")
		return entry != "" && (entry == parent || strings.HasSuffix(entry, "."+parent) || strings.HasSuffix(parent, "."+entry))
	}
	if under(s.cfg.AppsDomain) {
		return true
	}
	entries := slices.Concat(s.consoleHosts(), s.reservedDomains(false), s.platformDomains(false))
	return slices.ContainsFunc(entries, under)
}

// attachInstanceCatchall claims "*.<parent>" for acct's app. The caller has
// established that principal is a person in this account.
//
// A temporary app is refused here, as attachDomainAs refuses one: the
// browser door reaches this without passing through attachDomain.
func (s *Server) attachInstanceCatchall(ctx context.Context, acct *Account, app, parent, principal, message string) (created bool, ref *doorRefusal) {
	// Host-claim consoles: catch-all claims are written only by the legacy
	// capability path, an intentionally unsupported operation here.
	if s.cfg.HostClaim {
		return false, &doorRefusal{http.StatusConflict, claimRefusalText(errClaimAliasCapabilitiesUnsupported)}
	}
	if ref := s.bucketRefusal(); ref != nil {
		return false, ref
	}
	if msg, status := s.temporaryRefusal(acct, app, "attach a domain to it"); msg != "" {
		return false, &doorRefusal{Status: status, Msg: msg}
	}
	if s.catchallParentRefused(parent, acct.Sqid) {
		return false, &doorRefusal{http.StatusBadRequest, "that hostname is platform-managed"}
	}
	// Plans 3a: a catch-all is a custom domain too.
	if ref := s.customDomainRefusal(acct, parent); ref != nil {
		return false, ref
	}
	created, err := domains.AttachInstanceCatchall(ctx, s.cfg.Releases, parent, acct.Sqid, app,
		time.Now().UTC().Format(time.RFC3339), principal)
	switch {
	case errors.Is(err, domains.ErrParentNotHeld):
		return false, &doorRefusal{http.StatusConflict, catchallParentMsg(parent)}
	case err != nil:
		return false, claimRefusal(domains.InstanceCatchallHost(parent), err)
	}
	if created {
		host := domains.InstanceCatchallHost(parent)
		s.auditActivity(acct, app, principal, Activity{
			Action: "domain-attach", TargetType: "app", Target: app, Message: message,
			Detail: "attached instance catch-all " + host + " -> <label>." + parent + " for each instance",
		})
		s.bumpSerial(ctx)
	}
	return created, nil
}

// detachInstanceCatchall releases acct's app's "*.<parent>". Quiet in both
// directions, like every detach: removed=false whether it was never there or
// is someone else's.
func (s *Server) detachInstanceCatchall(ctx context.Context, acct *Account, app, parent, principal string) (removed bool, err error) {
	if s.cfg.Releases == nil {
		return false, errors.New("no deployment bucket on this host")
	}
	host := domains.InstanceCatchallHost(parent)
	removed, err = s.detachDomainClaim(ctx, host, acct.Sqid, app)
	if err != nil {
		return false, err
	}
	if removed {
		s.audit(acct, app, principal, "domain-detach", "detached instance catch-all "+host)
		s.bumpSerial(ctx)
	}
	return removed, nil
}

// heldElsewhere is the attach doors' last check before a claim write: a
// real route another app serves (deploymentRouteTaken), or a live instance's
// name under another account's instance catch-all (catchallInstanceName).
// Both answer with the same neutral 409, from the same place in each door,
// so neither reads apart from an ordinary "someone holds it".
//
// A bucket read the catch-all check could not make is answered as a
// retryable error rather than a guess: refusing would read as "someone
// holds it", and admitting would skip the guard.
func (s *Server) heldElsewhere(ctx context.Context, host, sqid, app string) *doorRefusal {
	if s.deploymentRouteTaken(ctx, host, sqid, app) {
		return claimRefusal(host, domains.ErrHostUnavailable)
	}
	held, err := s.catchallInstanceName(ctx, host, sqid, app)
	if err != nil {
		log.Printf("console: attach %s: instance catch-all check: %v", host, err)
		return &doorRefusal{http.StatusBadGateway, "could not check the hostname — try again"}
	}
	if held {
		return claimRefusal(host, domains.ErrHostUnavailable)
	}
	return nil
}

// catchallInstanceName reports whether host is a one-label name under
// another account's live instance catch-all that the catch-all reserves.
//
// What it reserves depends on whether the catch-all's account has proved it
// controls the parent in DNS (catchallProven):
//
//   - PROVED: every one-label name under the parent. A team's name is then
//     safe before its instance exists, and a deleted team's label is not up
//     for grabs either. With wildcard DNS pointing at the edge, an
//     unreserved label would be one any account could attach and serve,
//     with a real certificate, on somebody else's domain.
//   - NOT PROVED: only the labels the catch-all's app actually has instances
//     at, under any instance domain it has ever used. Attach needs no DNS
//     proof, so a parent claim alone proves nothing, and holding every label
//     would let one unproven apex claim plus a catch-all block the domain's
//     real owner from every name under it.
//
// The caller's own existing claim on host is never refused here: a claim
// made before the catch-all keeps working, re-attaches (titogo's router
// re-attaches every hostname on each pass) and route converges included.
// The same allowance deploymentRouteTaken makes, for the same reason.
//
// Costs one GET in the common case (no catch-all over the name); the rest
// is paid only when another account's catch-all is there.
func (s *Server) catchallInstanceName(ctx context.Context, host, sqid, app string) (bool, error) {
	c, err := domains.ForeignInstanceCatchall(ctx, s.cfg.Releases, host, sqid)
	if err != nil || c == nil {
		return false, err
	}
	if own, err := domains.GetClaim(ctx, s.cfg.Releases, host); err == nil && own.Account == sqid && own.App == app {
		return false, nil
	} else if err != nil && !errors.Is(err, os.ErrNotExist) {
		return false, err
	}
	parent, _ := domains.ParseInstanceCatchallHost(c.Host)
	if s.catchallProven(ctx, parent, c.Account) {
		return true, nil
	}
	counts, err := domains.InstanceLabelCounts(ctx, s.cfg.Releases, c.Account, c.App)
	if err != nil {
		return false, err
	}
	label, _, _ := strings.Cut(host, ".")
	return counts[label] > 0, nil
}

// catchallProven reports whether parent's DNS carries account's catch-all
// proof (domains.CatchallProofName/Value). Asked live, every time, so the
// answer follows the domain's DNS rather than a stamp taken once: a domain
// that changes hands stops proving the old account's catch-all the moment
// its new owner's zone stops carrying the record.
//
// Any lookup failure is "not proved" — the narrower reservation, never a
// refusal — exactly as the mail ownership proof treats one (#216).
func (s *Server) catchallProven(ctx context.Context, parent, account string) bool {
	if s.lookupTXT == nil || parent == "" {
		return false
	}
	vals, err := s.lookupTXT(ctx, domains.CatchallProofName(parent))
	if err != nil {
		return false
	}
	want := domains.CatchallProofValue(account)
	for _, v := range vals {
		if strings.TrimSpace(v) == want {
			return true
		}
	}
	return false
}

// catchallAppReady refuses a catch-all for an app with no instance
// manifest. Such an app has no instances to serve, and it is the one shape a
// rename can still move (handleAppRename renames only apps that never
// shipped), which would leave the claim naming an app that no longer exists.
//
// A temporary app is refused first, so the answer names carlos apps keep
// rather than an instances step the app cannot take.
func (s *Server) catchallAppReady(ctx context.Context, acct *Account, app string) *doorRefusal {
	if ref := s.bucketRefusal(); ref != nil {
		return ref
	}
	if msg, status := s.temporaryRefusal(acct, app, "attach a domain to it"); msg != "" {
		return &doorRefusal{Status: status, Msg: msg}
	}
	_, err := provision.GetManifest(ctx, s.cfg.Releases, acct.Sqid, app)
	switch {
	case errors.Is(err, os.ErrNotExist):
		return &doorRefusal{http.StatusConflict,
			app + " has no instances — enable them first (carlos instances enable), then attach the catch-all"}
	case err != nil:
		log.Printf("console: instance catch-all %s/%s: manifest: %v", acct.Sqid, app, err)
		return &doorRefusal{http.StatusBadGateway, "could not read this app's instance settings — try again"}
	}
	return nil
}

// derivedName is one name an instance catch-all serves, as the fleet
// reports it.
type derivedName struct {
	Host, Route string
	Reading     status.AliasReading
}

// catchallDerived lists the names parent's catch-all is serving for acct's
// app, from the fleet's readings (aliasReadings), host-sorted.
//
// The readings carry a hostname and the route it points at, and nothing
// about whose they are, so a name is only reported as this app's when all
// of these hold: it is one label under parent; nobody claims it (a derived
// row exists only where no claim does, and a claimed name is listed as its
// own claim — or, if it is someone else's, not at all); its route is
// exactly that label under the app's own instance domain. Another account's
// instance can never be under that domain, so no other tenant's hostname or
// route reaches this answer.
//
// One manifest read. A failure lists no derived names, never wrong ones.
func (s *Server) catchallDerived(ctx context.Context, acct *Account, app, parent string, claimed map[string]bool, readings map[string]status.AliasReading) []derivedName {
	m, err := provision.GetManifest(ctx, s.cfg.Releases, acct.Sqid, app)
	if err != nil {
		if !errors.Is(err, os.ErrNotExist) {
			log.Printf("console: instance catch-all %s/%s: manifest: %v", acct.Sqid, app, err)
		}
		return nil
	}
	var out []derivedName
	for host, reading := range readings {
		label, rest, ok := strings.Cut(host, ".")
		if !ok || rest != parent || claimed[host] {
			continue
		}
		if reading.Route != label+"."+m.Domain {
			continue
		}
		out = append(out, derivedName{Host: host, Route: reading.Route, Reading: reading})
	}
	slices.SortFunc(out, func(a, b derivedName) int { return strings.Compare(a.Host, b.Host) })
	return out
}

// catchallListItems is the list door's answer for one catch-all: its own
// row, then a row per derived name marked Via. The catch-all row has no
// reading of its own (no box resolves "*.<parent>"), so its state speaks
// for the names under it: live once any of them is, checking until then.
func (s *Server) catchallListItems(ctx context.Context, acct *Account, app string, c domains.Claim, claimed map[string]bool, readings map[string]status.AliasReading, warm map[string]*certwarm.Record, targets DNSTargets, now time.Time) []domainListItem {
	parent, _ := domains.ParseInstanceCatchallHost(c.Host)
	derived := s.catchallDerived(ctx, acct, app, parent, claimed, readings)
	head := domainListItem{Host: c.Host, Status: "pending", Instances: true,
		State: StateChecking, Reason: "no-instances-reported",
		Detail: "Serves each instance at <label>." + parent + ". No edge has reported one yet: an instance needs its route on a box running this build, and checks run every few minutes."}
	rows := make([]domainListItem, 0, len(derived))
	pointing := false
	for _, d := range derived {
		item := s.domainItem(ctx, domains.Claim{Host: d.Host, Route: d.Route}, readings, warm[d.Host], targets, now, false)
		item.Via = c.Host
		rows = append(rows, item)
		pointing = pointing || d.Reading.DNSStatus == "pointing"
	}
	if len(derived) > 0 {
		head.Status, head.State, head.Reason = "live", StateLive, "instances"
		head.Detail = "Serves each instance at <label>." + parent + "; the names the fleet reports are listed below it."
	}
	if !pointing {
		// The wildcard record is what makes every label resolve here; the
		// guidance for "*.<parent>" says exactly that.
		head.Guidance = domainGuidance(c.Host, targets)
		head.Records = domainRecords(c.Host, targets, false, "")
	}
	// Whether the catch-all reserves every label, or only its instances'
	// (catchallInstanceName). Said on every listing, with the record to
	// publish when it is missing, because the difference is exactly whether
	// another account can take a team's name before the team exists.
	head.Reserves = "instances"
	if s.catchallProven(ctx, parent, acct.Sqid) {
		head.Reserves = "all"
		head.Detail += " Every <label>." + parent + " is reserved for this account."
	} else {
		head.Detail += " Only the names of existing instances are reserved; another account could claim any other <label>." + parent +
			". Publish TXT " + domains.CatchallProofName(parent) + " = \"" + domains.CatchallProofValue(acct.Sqid) + "\" to reserve them all."
		head.Records = append(head.Records, dnsRecord{
			Type: "TXT", Name: domains.CatchallProofName(parent), Value: domains.CatchallProofValue(acct.Sqid),
			TTL: domainRecordTTL, Set: "proof",
		})
	}
	return append([]domainListItem{head}, rows...)
}

// catchallDomainViews is the Settings page's form of catchallListItems: the
// catch-all's own row (detachable, by typing "*.<parent>") and one row per
// derived name, which is not.
func (s *Server) catchallDomainViews(ctx context.Context, acct *Account, app string, c domains.Claim, claimed map[string]bool, readings map[string]status.AliasReading, warm map[string]*certwarm.Record, now time.Time) []DomainView {
	items := s.catchallListItems(ctx, acct, app, c, claimed, readings, warm, s.dnsTargets(), now)
	out := make([]DomainView, 0, len(items))
	for _, it := range items {
		dv := DomainView{Domain: it.Host, Guidance: it.Guidance, State: it.State, Reason: it.Reason, Detail: it.Detail}
		if it.Instances {
			dv.Type, dv.Claimed = "instance catch-all", true
		} else {
			dv.Type = "via " + it.Via
		}
		out = append(out, dv)
	}
	return out
}