package host

import (
	"context"
	"path/filepath"
	"strings"

	"github.com/carlosframework/platform/internal/cgroup"
	"github.com/carlosframework/platform/internal/hostbox"
	"github.com/carlosframework/platform/internal/hostguard"
	"github.com/carlosframework/platform/internal/instancectl"
)

func claimContainmentParent(agent string, t hostguard.FenceTarget) (string, error) {
	rel, err := filepath.Rel("/sys/fs/cgroup", agent)
	if err != nil || !filepath.IsLocal(rel) || rel == "." || filepath.Clean(agent) != agent || !stopComponent(t.Host) || t.Incarnation == "" || t.Stamp == 0 || t.Session == 0 || t.Box == "" || t.Enrollment == "" || t.BootID == "" || t.ControllerID == "" {
		return "", ErrClaimStopInventory
	}
	return filepath.Join(rel, cgroup.ExecName(claimContainmentName(t))), nil
}

func claimRoleChild(parent, p string) bool {
	return filepath.IsLocal(p) && filepath.Clean(p) == p && filepath.Dir(p) == parent && strings.HasPrefix(filepath.Base(p), "role-") && len(filepath.Base(p)) > len("role-")
}

func validateClaimGroups(parent string, groups []hostbox.LaunchGroup) error {
	if len(groups) == 0 {
		return ErrClaimStopInventory
	}
	found := false
	seen := map[string]bool{}
	for _, g := range groups {
		if g.Device == 0 || g.Inode == 0 || seen[g.RelativePath] {
			return ErrClaimStopInventory
		}
		seen[g.RelativePath] = true
		if g.RelativePath == parent {
			if g.InvocationID != "" {
				return ErrClaimStopInventory
			}
			found = true
		} else if !claimRoleChild(parent, g.RelativePath) || g.InvocationID == "" {
			return ErrClaimStopInventory
		}
	}
	if !found {
		return ErrClaimStopInventory
	}
	return nil
}

func validateClaimContainment(in hostbox.LaunchInventory, parent string) error {
	return validateClaimContainmentUnit(in, parent, instancectl.ClaimUnitControlGroup(in.Target.Host))
}

func validateClaimContainmentUnit(in hostbox.LaunchInventory, parent, unitGroup string) error {
	if err := validateClaimGroups(parent, in.Groups); err != nil {
		return err
	}
	var parentGroup hostbox.LaunchGroup
	groups := map[string]hostbox.LaunchGroup{}
	for _, g := range in.Groups {
		groups[g.RelativePath] = g
		if g.RelativePath == parent {
			parentGroup = g
		}
	}
	claimed := map[string]bool{}
	for _, r := range in.Reservations {
		if !hostbox.SameLaunchOwner(in.Target, r.Target) {
			return ErrClaimStopInventory
		}
		if hostbox.IsUnitReservation(r) {
			if r.Parent != (hostbox.LaunchGroup{}) || r.Group.RelativePath != unitGroup {
				return ErrClaimStopInventory
			}
			continue
		}
		if r.Parent != parentGroup || !claimRoleChild(parent, r.Group.RelativePath) || r.Group.InvocationID != r.InvocationID || r.InvocationID == "" || claimed[r.Group.RelativePath] {
			return ErrClaimStopInventory
		}
		claimed[r.Group.RelativePath] = true
		switch r.State {
		case "intended":
			if r.Group.Device != 0 || r.Group.Inode != 0 {
				return ErrClaimStopInventory
			}
		case "reserved", "started", "settled":
			// An intention settled after an absent child retains its zero identity.
			if r.State == "settled" && r.Group.Device == 0 && r.Group.Inode == 0 {
				continue
			}
			if groups[r.Group.RelativePath] != r.Group {
				return ErrClaimStopInventory
			}
		default:
			return ErrClaimStopInventory
		}
	}
	for _, g := range in.Groups {
		if g.RelativePath != parent && !claimed[g.RelativePath] {
			return ErrClaimStopInventory
		}
	}
	return nil
}

func validateClaimJournalContainment(ctx context.Context, q hostbox.JournalRequest, j *hostbox.LaunchJournal) error {
	switch q.Op {
	case "create", "prelaunch", "intend", "reserve":
	default:
		return nil
	}
	target := q.Launch.Target
	if q.Op == "intend" || q.Op == "reserve" {
		target = q.Reservation.Target
	}
	agent, err := claimContainmentAgentRoot(ctx)
	if err != nil {
		return err
	}
	parent, err := claimContainmentParent(agent, target)
	if err != nil {
		return err
	}
	if q.Op == "create" || q.Op == "prelaunch" {
		if len(q.Launch.Groups) != 1 || len(q.Launch.Reservations) != 0 {
			return ErrClaimStopInventory
		}
		if err := validateClaimContainment(q.Launch, parent); err != nil {
			return err
		}
		captured, err := claimContainmentInspect(parent)
		if err != nil {
			return err
		}
		if captured != q.Launch.Groups[0] {
			return ErrClaimStopIdentity
		}
		return nil
	}
	in, err := j.Read(ctx, target)
	if err != nil {
		return err
	}
	if err := validateClaimContainment(in, parent); err != nil {
		return err
	}
	r := q.Reservation
	var expected hostbox.LaunchGroup
	for _, g := range in.Groups {
		if g.RelativePath == parent {
			expected = g
		}
	}
	if r.Parent != expected || !claimRoleChild(parent, r.Group.RelativePath) || r.Group.InvocationID != r.InvocationID || r.InvocationID == "" {
		return ErrClaimStopInventory
	}
	captured, err := claimContainmentInspect(parent)
	if err != nil {
		return err
	}
	if captured != expected {
		return ErrClaimStopIdentity
	}
	if q.Op == "reserve" {
		captured, err = claimContainmentInspect(r.Group.RelativePath)
		if err != nil {
			return err
		}
		captured.InvocationID = r.InvocationID
		if captured != r.Group {
			return ErrClaimStopIdentity
		}
	}
	return nil
}

func validatePersistedClaimContainment(ctx context.Context, in hostbox.LaunchInventory) error {
	agent, err := claimContainmentAgentRoot(ctx)
	if err != nil {
		return err
	}
	parent, err := claimContainmentParent(agent, in.Target)
	if err != nil {
		return err
	}
	return validateClaimContainment(in, parent)
}

func validateStopClaimGroups(t hostguard.FenceTarget, j hostbox.StopKernelJournal, agent string) error {
	if !hostbox.SameLaunchOwner(j.Target, t) {
		return ErrClaimStopInventory
	}
	parent, err := claimContainmentParent(agent, t)
	if err != nil {
		return err
	}
	groups := make([]hostbox.LaunchGroup, 0, len(j.Cgroups))
	for _, g := range j.Cgroups {
		groups = append(groups, hostbox.LaunchGroup{RelativePath: g.RelativePath, Device: g.Device, Inode: g.Inode, InvocationID: g.InvocationID})
	}
	return validateClaimGroups(parent, groups)
}

func validatePersistedUnitContainment(ctx context.Context, in hostbox.LaunchInventory, units ClaimLaunchUnits) error {
	agent, err := claimContainmentAgentRoot(ctx)
	if err != nil {
		return err
	}
	parent, err := claimContainmentParent(agent, in.Target)
	if err != nil {
		return err
	}
	_, group, err := claimLaunchPlacement(units, in.Target.Host)
	if err != nil {
		return err
	}
	return validateClaimContainmentUnit(in, parent, group)
}