package hostops

import (
	"context"
	"errors"
	"io"
	"os"
	"strings"

	"github.com/carlosframework/platform/internal/hostclaim"
	"github.com/carlosframework/platform/internal/lease"
	"github.com/carlosframework/platform/internal/release"
)

// versionedBoundary guards the console's exact-version handle (DBVersions).
// Reads keep their values and errors. CopyVersion, DeleteVersion and
// PutIfAbsent are classified: the control bucket by the bucket classifier,
// data buckets by the claim holder of instances/<host>/ or moves/<host>/.
// Named private fields; never embeds lease.VersionedStore.
type versionedBoundary struct {
	raw     lease.VersionedStore
	control release.Store // raw control store, read-only use
	writer  *ControlWriter
	bucket  string // the control (deployment) bucket
	data    map[string]bool
	observe func(MutationEvent)
}

var (
	_ lease.VersionedStore     = (*versionedBoundary)(nil)
	_ lease.VersionRangeOpener = (*versionedBoundary)(nil)
)

func NewVersionedBoundary(enabled bool, raw lease.VersionedStore, control release.Store, writer *ControlWriter, controlBucket string, dataBuckets []string, observe func(MutationEvent)) (lease.VersionedStore, error) {
	if !enabled {
		return raw, nil
	}
	if raw == nil || control == nil || writer == nil || controlBucket == "" {
		return nil, ErrContract
	}
	data := map[string]bool{}
	for _, b := range dataBuckets {
		if b == "" || b == controlBucket {
			return nil, ErrContract
		}
		data[b] = true
	}
	return &versionedBoundary{raw: raw, control: control, writer: writer, bucket: controlBucket, data: data, observe: observe}, nil
}

func (v *versionedBoundary) ListVersions(ctx context.Context, bucket, prefix string) ([]lease.ObjectVersion, error) {
	return v.raw.ListVersions(ctx, bucket, prefix)
}
func (v *versionedBoundary) OpenVersion(ctx context.Context, bucket, key, versionID string) (io.ReadCloser, error) {
	return v.raw.OpenVersion(ctx, bucket, key, versionID)
}
func (v *versionedBoundary) GetVersion(ctx context.Context, bucket, key, versionID string) ([]byte, error) {
	return v.raw.GetVersion(ctx, bucket, key, versionID)
}
func (v *versionedBoundary) OpenVersionRange(ctx context.Context, bucket, key, versionID string, offset, length int64) (io.ReadCloser, error) {
	if r, ok := v.raw.(lease.VersionRangeOpener); ok {
		return r.OpenVersionRange(ctx, bucket, key, versionID, offset, length)
	}
	return nil, ErrContract
}

func (v *versionedBoundary) authorize(ctx context.Context, method, bucket, key string, before, after []byte) error {
	t := MutationTarget{Surface: "versioned:" + bucket, Method: method, Key: key, Before: before, After: after}
	err := v.classify(ctx, bucket, t)
	if v.observe != nil {
		v.observe(MutationEvent{Target: t, Verdict: err})
	}
	return err
}

func (v *versionedBoundary) classify(ctx context.Context, bucket string, t MutationTarget) error {
	switch {
	case bucket == v.bucket:
		if provisioningKey(t.Key) && t.Method != "CopyVersion:source" {
			// Version replacement/deletion can resurrect a lower counter.
			// Only the typed retired-record sweep may remove old versions.
			key, _ := ctx.Value(retiredRecordSweepKey{}).(string)
			if t.Method != "DeleteVersion" || key != t.Key {
				return ErrContract
			}
			if _, _, err := v.control.Get(ctx, t.Key); !errors.Is(err, os.ErrNotExist) {
				if err != nil {
					return err
				}
				return ErrPending
			}
		}
		if err := structuralRefusal(t.Key); err != nil {
			return err
		}
		c, err := ClassifyMutation(ctx, v.control, v.writer, t)
		if err != nil {
			return err
		}
		if c.NonApp != "" && len(c.Scopes) == 0 && strings.HasPrefix(c.Family, "lifecycle") {
			// Lifecycle roots are never rewritten by exact-version calls.
			return ErrIdentity
		}
		return AuthorizeScopes(ctx, v.control, v.writer, c)
	case v.data[bucket]:
		host := ""
		for _, root := range []string{"instances/", "moves/"} {
			if rest, ok := strings.CutPrefix(t.Key, root); ok {
				host, _, _ = strings.Cut(rest, "/")
			}
		}
		if host == "" {
			return ErrUnclassified
		}
		obs, err := hostclaim.Read(ctx, v.control, host)
		if err != nil {
			return err
		}
		if obs.Absent || obs.Claim.Holder == nil {
			return ErrPending
		}
		h := obs.Claim.Holder
		return AuthorizeScopes(ctx, v.control, v.writer, Classification{Family: "data-bucket", Scopes: []AppScope{{h.Account, h.App}}})
	}
	return ErrUnclassified
}

func (v *versionedBoundary) versionBody(ctx context.Context, bucket, key, versionID string) []byte {
	if bucket != v.bucket {
		return nil
	}
	b, err := v.raw.GetVersion(ctx, bucket, key, versionID)
	if err != nil {
		return nil
	}
	return b
}

// CopyVersion authorizes both the source (its bytes move into another
// scope) and the destination.
func (v *versionedBoundary) CopyVersion(ctx context.Context, srcBucket, srcKey, srcVersionID, dstBucket, dstKey string, createOnly bool) (string, string, error) {
	body := v.versionBody(ctx, srcBucket, srcKey, srcVersionID)
	if err := v.authorize(ctx, "CopyVersion:source", srcBucket, srcKey, body, nil); err != nil {
		return "", "", err
	}
	if err := v.authorize(ctx, "CopyVersion", dstBucket, dstKey, nil, body); err != nil {
		return "", "", err
	}
	MarkAppMutationIssued(ctx)
	return v.raw.CopyVersion(ctx, srcBucket, srcKey, srcVersionID, dstBucket, dstKey, createOnly)
}

func (v *versionedBoundary) DeleteVersion(ctx context.Context, bucket, key, versionID string) error {
	if versionID == "" {
		return lease.ErrNoVersionID
	}
	if err := v.authorize(ctx, "DeleteVersion", bucket, key, v.versionBody(ctx, bucket, key, versionID), nil); err != nil {
		return err
	}
	if bucket == v.bucket && provisioningKey(key) {
		if err := retiredRecordVersion(ctx, v.control, v.raw, bucket, key, versionID); err != nil {
			return err
		}
	}
	MarkAppMutationIssued(ctx)
	return v.raw.DeleteVersion(ctx, bucket, key, versionID)
}

func (v *versionedBoundary) PutIfAbsent(ctx context.Context, bucket, key string, body []byte) (string, error) {
	if err := v.authorize(ctx, "Put", bucket, key, nil, body); err != nil {
		return "", err
	}
	MarkAppMutationIssued(ctx)
	return v.raw.PutIfAbsent(ctx, bucket, key, body)
}