package seeds

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"os"
	"strings"

	"github.com/carlosframework/platform/internal/release"
)

// ProtocolVersion is the seeds protocol this build speaks. A box that
// reports 0 (Plans 3 to 7, and any older build) can never satisfy the
// console's RequiredProtocol, so every seed door stays shut for it.
//
// 1: this build places, swaps and rolls back a seed, refuses moves of an
// unplaced or uncommitted one, and its console sweeps and assigns.
//
// It stayed 0 through Plan 7, although that build placed, swapped and
// rolled back a seed (Plans 4 and 7): spec §5.8's move refusals, the
// seeds sweep and the legacy-routes assign door had to exist before any
// door opens (preflight M9). Plan 8 built them, and its Task 6 raised it
// to 1. Raising it opens nothing alone: a door opens only once an
// operator publishes the seeds floor (spec §10 step 2).
const ProtocolVersion = 1

// RequiredProtocol is what the console requires every box in the region to
// report before it writes any seed state (spec §3.3).
const RequiredProtocol = 1

// FloorKey is the operator-published seeds floor (spec §3.3).
const FloorKey = "control/seeds-protocol.json"

// The box's local copy of the floor and its verdict on carlos.prev, beside
// the moves floor's files under the same floor.lock
// (internal/host/movesfloor.go). The two system units read the second and
// third by fixed path.
const (
	FloorFile           = ".moves/seeds-floor.json"        // under the box's DataDir
	FloorMinReleaseFile = ".moves/seeds-floor.min-release" // under the box's DataDir
	PrevAllowedFile     = "carlos.prev.seeds-allowed"      // beside carlos.prev in the opt dir
)

// Floor is the seeds floor: the protocol every box must speak, and the
// first release that speaks it.
type Floor struct {
	Min        int    `json:"min"`
	MinRelease string `json:"min_release"`
}

// ReadFloor reads the published floor. Absent is (nil, nil); present but
// unreadable is an error, never a silent "no floor".
func ReadFloor(ctx context.Context, s release.Store) (*Floor, error) {
	f, _, err := readFloorETag(ctx, s)
	return f, err
}

func readFloorETag(ctx context.Context, s release.Store) (*Floor, string, error) {
	body, etag, err := s.Get(ctx, FloorKey)
	if errors.Is(err, os.ErrNotExist) {
		return nil, "", nil
	}
	if err != nil {
		return nil, "", fmt.Errorf("seeds: read floor: %w", err)
	}
	var f Floor
	if err := json.Unmarshal(body, &f); err != nil {
		return nil, "", fmt.Errorf("seeds: parse floor: %w", err)
	}
	return &f, etag, nil
}

// ReleaseAtOrAbove reports whether version is at or above minRelease, both
// vMAJOR.MINOR.PATCH. It fails closed: a prerelease or a malformed value is
// false with an error.
func ReleaseAtOrAbove(version, minRelease string) (bool, error) {
	min, ok := release.ParseSemVer(strings.TrimPrefix(minRelease, "v"))
	if !ok {
		return false, fmt.Errorf("seeds: malformed minimum release %q", minRelease)
	}
	v, ok := release.ParseSemVer(strings.TrimPrefix(version, "v"))
	if !ok {
		return false, fmt.Errorf("seeds: unparseable release %q", version)
	}
	return v.Compare(min) >= 0, nil
}

// FloorLowerError is PublishFloor refusing to lower the floor.
type FloorLowerError struct{ Current string }

func (e *FloorLowerError) Error() string {
	return "seeds: the published floor is already " + e.Current
}

// publishAttempts bounds the CAS retry. Each lost race means another
// publisher moved the floor, so a few rounds are plenty.
const publishAttempts = 5

// PublishFloor writes the floor by CAS. A floor only rises: a lower
// min_release or a lower min is a *FloorLowerError; the same one is a no-op
// success. A lost CAS re-reads and decides again against the new floor, so a
// lower publish that raced a higher one is refused, never written over it.
func PublishFloor(ctx context.Context, s release.Store, f Floor) error {
	if ok, err := ReleaseAtOrAbove(f.MinRelease, f.MinRelease); !ok || err != nil {
		return fmt.Errorf("seeds: %q is not a release", f.MinRelease)
	}
	body, err := json.Marshal(f)
	if err != nil {
		return err
	}
	for range publishAttempts {
		cur, etag, err := readFloorETag(ctx, s)
		if err != nil {
			return err
		}
		if cur != nil {
			if ok, err := ReleaseAtOrAbove(f.MinRelease, cur.MinRelease); err != nil {
				return fmt.Errorf("seeds: published floor is unusable: %w", err)
			} else if !ok || f.Min < cur.Min {
				return &FloorLowerError{Current: cur.MinRelease}
			}
			if *cur == f {
				return nil
			}
		}
		_, err = s.Put(ctx, FloorKey, body, etag)
		if !errors.Is(err, release.ErrCASConflict) {
			return err
		}
	}
	return fmt.Errorf("seeds: publish floor: %w", release.ErrCASConflict)
}