package host

import (
	"context"
	"log"
	"net/http"
	"path/filepath"
	"time"

	"github.com/carlosframework/platform/internal/hostbox"
	"github.com/carlosframework/platform/internal/hostclaim"
	"github.com/carlosframework/platform/internal/hostguard"
	"github.com/carlosframework/platform/internal/hostwrite"
	"github.com/carlosframework/platform/internal/moves"
	"github.com/carlosframework/platform/internal/park"
	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/release"
	"github.com/carlosframework/platform/internal/rootstate"
)

// WithProductionMovesHeldRelease adds the moves held-release route (Task
// 7b) to the claim-mode root handler WithProductionClaimLaunch returned,
// only while CARLOS_MOVES_PHASE1 is on; otherwise the handler is returned
// unchanged and the route refuses, exactly main's behaviour. It reuses the
// claim root's peer authentication and the assembly's roster identity,
// guard, policy and local authority, and builds root's held-release
// selection from them as the assembly builds the agent's (Build's
// WorkSource, without Prepare: participation is the agent's). A release
// key that does not parse leaves the route unwired, so every request is
// refused and T7 says MV-N455: fail closed, without stopping
// instance-control.
func WithProductionMovesHeldRelease(ctx context.Context, handler http.Handler, reg *registry.Registry, getenv func(string) string) (http.Handler, error) {
	if !moves.Enabled(getenv) {
		return handler, nil
	}
	root, ok := handler.(ClaimRootWithLaunch)
	if !ok {
		return nil, ErrClaimStopUnavailable
	}
	entry, _ := ctx.Value(claimEntryKey{}).(claimEntry)
	a := entry.Assembly
	if a == nil || entry.Store == nil || reg == nil || a.Guard.Root == nil || a.Guard.DataDir == "" || !filepath.IsAbs(a.ManagedRoots["opt"]) || root.Root.Stop.Authenticate == nil {
		return nil, &ClaimDependencyError{Contracts: []string{"moves Task 7b held release: production claim assembly, registry and root peer authentication"}}
	}
	pub, err := release.ParsePublicKey(getenv("CARLOS_RELEASE_PUBKEY"), "CARLOS_RELEASE_PUBKEY")
	if err != nil {
		log.Printf("moves: held releases are refused: %v", err)
		return root, nil
	}
	store := entry.Store
	guard := a.Guard
	guard.Claims = hostguard.StoreReader{Store: store}
	optDir, dataDir := a.ManagedRoots["opt"], a.Guard.DataDir
	policy, identity, local := a.Policy, a.Identity, a.Local
	var continues func(kind, from, to string) bool
	if a.Wake != nil {
		continues = a.Wake.Continue
	}
	root.HeldRelease = &movesHeldReleaseRoot{
		generationPins: productionRootGenerationPins(),
		OpenRelease:    func() (rootstate.Store, error) { return rootstate.Open(rootReleasePrivate, true, false) },
		Authenticate:   root.Root.Stop.Authenticate,
		Actor:          identity.Verify,
		Store:          store,
		Claims: func(ctx context.Context, host string) (hostclaim.Observed, error) {
			return hostclaim.Read(ctx, store, host)
		},
		Records: MovesRecordsFrom(store),
		Route:   reg.Get,
		Works: func(ctx context.Context, actor hostbox.Actor, host, action string) (hostwrite.Work, error) {
			return hostbox.WorkSource{FleetHomeRegion: actor.FleetHomeRegion, HomeRegion: actor.HomeRegion, Guard: guard, Box: actor.Box,
				Region: park.PlacementRegion(actor.Region), Now: time.Now, Policy: policy.Check, Local: identity.Local(local), Continue: continues}.Select(ctx, host, action)
		},
		Selected:   hostbox.Selected,
		Pub:        pub,
		Ratchet:    func() *release.DigestRatchet { return pointerRatchet(true, optDir, dataDir, getenv) },
		Proof:      func() *release.ProofGate { return release.NewRootProofGate(release.ProofPolicyPath, dataDir) },
		OptDir:     optDir,
		DataDir:    dataDir,
		ReceiptDir: heldReleaseReceiptDir,
	}
	return root, nil
}