//! `oxygenhub`: `init`, `serve`, `admin`, `check` (hub spec §17.3).

use clap::{Parser, Subcommand};
use hub_api::Visibility;
use oxygenhub::config::Config;
use oxygenhub::repos::RepoName;
use oxygenhub::{db, keys};
use std::path::PathBuf;

#[derive(Parser)]
#[command(name = "oxygenhub", version, about = "A forge for Oxygen repositories")]
struct Cli {
    /// The data directory (hub spec §3.2)
    #[arg(long, global = true, env = "OXYHUB_DATA", default_value = "data")]
    data: PathBuf,
    #[command(subcommand)]
    cmd: Cmd,
}

#[derive(Subcommand)]
enum Cmd {
    /// Create the data directory, keys, database and a default hub.toml
    Init {
        /// What links and clone URLs start with
        #[arg(long)]
        base_url: Option<String>,
        /// Generate a self-signed TLS certificate (developer edition)
        #[arg(long)]
        self_signed: bool,
    },
    /// Run the hub
    Serve,
    /// Offline administration
    Admin {
        #[command(subcommand)]
        cmd: AdminCmd,
    },
    /// Verify every repository's objects and signatures
    Check,
    /// Garbage-collect every repository now, as the nightly job does
    Gc,
}

#[derive(Subcommand)]
enum AdminCmd {
    /// Repositories
    Repo {
        #[command(subcommand)]
        cmd: RepoCmd,
    },
    /// Accounts
    User {
        #[command(subcommand)]
        cmd: UserCmd,
    },
    /// Backups (docs/backups.md)
    Backup {
        #[command(subcommand)]
        cmd: BackupCmd,
    },
}

#[derive(Subcommand)]
enum BackupCmd {
    /// Back up a user's or organisation's repositories now, as its settings say
    Run { owner: String },
    /// Restore every repository of a whole run from a backup directory
    /// (the one holding LATEST, runs/ and blobs/) into this hub
    Restore {
        #[arg(long)]
        from: std::path::PathBuf,
        /// The run (runs/<RUN>); the latest whole one when not given
        #[arg(long)]
        run: Option<String>,
    },
}

#[derive(Subcommand)]
enum UserCmd {
    /// Create an account with a generated password, printed once
    Create {
        username: String,
        #[arg(long, default_value = "")]
        email: String,
        /// Make it a site administrator
        #[arg(long)]
        admin: bool,
    },
    /// Reset an account's password to a new generated one, printed once
    ResetPassword { username: String },
    /// List accounts
    List,
}

#[derive(Subcommand)]
enum RepoCmd {
    /// Create an empty repository OWNER/NAME
    Create {
        slug: String,
        #[arg(long, default_value = "")]
        description: String,
        #[arg(long, default_value = "public")]
        visibility: String,
        /// Bind to this repository id now (32 hex characters, from `.oxy/id`);
        /// otherwise the first push binds it
        #[arg(long)]
        id: Option<String>,
    },
    /// List repositories
    List,
    /// Move a repository to the trash
    Delete { slug: String },
    /// Change the description, default bookmark or visibility
    Set {
        slug: String,
        #[arg(long)]
        description: Option<String>,
        #[arg(long)]
        default_bookmark: Option<String>,
        #[arg(long)]
        visibility: Option<String>,
    },
}

fn main() -> anyhow::Result<()> {
    tune_allocator();
    let rt = tokio::runtime::Builder::new_multi_thread().enable_all().build()?;
    rt.spawn(return_freed_memory());
    let out = rt.block_on(run());
    oxygenhub::shutdown::finish(rt);
    out
}

/// glibc's allocator gives each thread that allocates an arena of its own
/// and keeps what is freed in it: under the hub's worker threads, loaded
/// states that the cache had let go still held their pages, and the hub
/// grew to 12 GB with its state cache capped at 3 GiB (oxygenhub#117).
/// Two arenas, as oxy found for its own threads; MALLOC_ARENA_MAX in the
/// environment still has the last word. Called before any thread starts.
fn tune_allocator() {
    #[cfg(all(target_os = "linux", target_env = "gnu"))]
    if std::env::var_os("MALLOC_ARENA_MAX").is_none() {
        // SAFETY: mallopt is called once, before any other thread exists.
        unsafe {
            libc::mallopt(libc::M_ARENA_MAX, 2);
        }
    }
}

/// Hand freed memory back to the system every minute, so the hub's size
/// follows what it holds rather than its peak (oxygenhub#117).
async fn return_freed_memory() {
    #[cfg(all(target_os = "linux", target_env = "gnu"))]
    loop {
        tokio::time::sleep(std::time::Duration::from_secs(60)).await;
        // SAFETY: malloc_trim only releases free pages.
        let _ = tokio::task::spawn_blocking(|| unsafe { libc::malloc_trim(0) }).await;
    }
}

async fn run() -> anyhow::Result<()> {
    tracing_subscriber::fmt()
        .with_env_filter(tracing_subscriber::EnvFilter::from_default_env().add_directive("oxygenhub=info".parse()?))
        .init();
    let cli = Cli::parse();
    match cli.cmd {
        Cmd::Init { base_url, self_signed } => init(&cli.data, base_url, self_signed).await,
        Cmd::Serve => {
            let config = Config::load(&cli.data)?;
            let app = oxygenhub::build(config).await?;
            oxygenhub::serve(app).await
        }
        Cmd::Admin { cmd: AdminCmd::Repo { cmd } } => {
            let config = Config::load(&cli.data)?;
            let app = oxygenhub::build(config).await?;
            repo_admin(&app, cmd).await
        }
        Cmd::Admin { cmd: AdminCmd::Backup { cmd } } => {
            let config = Config::load(&cli.data)?;
            let app = oxygenhub::build(config).await?;
            match cmd {
                BackupCmd::Run { owner } => {
                    let r = oxygenhub::backups::run(&app, &owner, "now").await?;
                    println!(
                        "{} {}: {} repositories, {} of {} files sent ({} KiB){}",
                        r.status,
                        r.at,
                        r.repos,
                        r.sent,
                        r.files,
                        r.bytes / 1024,
                        if r.detail.is_empty() { String::new() } else { format!(": {}", r.detail) }
                    );
                    if r.status == "failed" {
                        std::process::exit(1);
                    }
                    Ok(())
                }
                BackupCmd::Restore { from, run } => {
                    let dest: std::sync::Arc<dyn oxygenhub::backups::Destination> =
                        std::sync::Arc::new(oxygenhub::backups::Directory { root: from });
                    for d in oxygenhub::backups::restore_into_hub(&app, dest, run).await? {
                        println!("restored {d}");
                    }
                    Ok(())
                }
            }
        }
        Cmd::Admin { cmd: AdminCmd::User { cmd } } => {
            let config = Config::load(&cli.data)?;
            let app = oxygenhub::build(config).await?;
            user_admin(&app, cmd).await
        }
        Cmd::Check => {
            let config = Config::load(&cli.data)?;
            let app = oxygenhub::build(config).await?;
            check(&app).await
        }
        Cmd::Gc => {
            let config = Config::load(&cli.data)?;
            let app = oxygenhub::build(config).await?;
            let done = oxygenhub::maintenance::gc_all(&app).await;
            for d in &done {
                println!("{d}");
            }
            if done.iter().any(|d| d.failed) {
                anyhow::bail!("a repository could not be garbage collected");
            }
            Ok(())
        }
    }
}

async fn init(data: &PathBuf, base_url: Option<String>, self_signed: bool) -> anyhow::Result<()> {
    std::fs::create_dir_all(data)?;
    let toml_path = data.join("hub.toml");
    if !toml_path.exists() {
        let base = base_url.clone().unwrap_or_else(|| "http://127.0.0.1:7300".into());
        let mut text = String::from("# OxygenHub configuration (docs/spec.md section 17.1)\n\n[site]\nname = \"OxygenHub\"\n\n[server]\nbind = \"127.0.0.1:7300\"\n");
        if self_signed {
            text.push_str("tls_bind = \"0.0.0.0:7343\"\n");
        }
        text.push_str(&format!("base_url = \"{base}\"\n\n[tls]\nself_signed = {self_signed}\n\n[auth]\n# Bearer tokens allowed to push until accounts exist.\npush_tokens = []\n"));
        std::fs::write(&toml_path, text)?;
        println!("wrote {}", toml_path.display());
    }
    let mut config = Config::load(data)?;
    if let Some(b) = base_url {
        config.server.base_url = b;
    }
    let app = oxygenhub::build(config).await?;
    println!("hub key {}", app.hub_key.key.to_hex());
    if (self_signed || app.config.tls.self_signed)
        && keys::ensure_self_signed(&app.config.tls_cert(), &app.config.tls_key(), app.config.base_url())?
    {
        println!("wrote self-signed certificate {}", app.config.tls_cert().display());
    }
    println!("data directory {} is ready", data.display());
    Ok(())
}

async fn repo_admin(app: &oxygenhub::Shared, cmd: RepoCmd) -> anyhow::Result<()> {
    match cmd {
        RepoCmd::Create { slug, description, visibility, id } => {
            let name = RepoName::parse(&slug).ok_or_else(|| anyhow::anyhow!("{slug:?} is not a valid owner/name"))?;
            let visibility = Visibility::parse(&visibility).ok_or_else(|| anyhow::anyhow!("visibility is public, internal or private"))?;
            let id = match id {
                Some(h) => {
                    let bytes = hex::decode(h.trim()).ok().and_then(|v| <[u8; 16]>::try_from(v).ok());
                    Some(bytes.ok_or_else(|| anyhow::anyhow!("--id takes 32 hex characters"))?)
                }
                None => None,
            };
            if db::repos::get(&app.db, &name.owner, &name.name).await?.is_some() {
                anyhow::bail!("{name} already exists");
            }
            app.repos.create(&name, id)?;
            db::repos::create(&app.db, &name.owner, &name.name, &description, visibility).await?;
            println!("created {name}: oxy clone {}/{name}", app.config.base_url());
        }
        RepoCmd::List => {
            for r in db::repos::list(&app.db).await? {
                println!("{:<40} {:<8} {}", r.slug(), r.visibility, r.description);
            }
        }
        RepoCmd::Delete { slug } => {
            let name = RepoName::parse(&slug).ok_or_else(|| anyhow::anyhow!("{slug:?} is not a valid owner/name"))?;
            let row = db::repos::get(&app.db, &name.owner, &name.name).await?.ok_or_else(|| anyhow::anyhow!("{name} does not exist"))?;
            let dest = app.repos.trash(&name)?;
            db::repos::delete(&app.db, row.id).await?;
            println!("moved {name} to {}", dest.display());
        }
        RepoCmd::Set { slug, description, default_bookmark, visibility } => {
            let name = RepoName::parse(&slug).ok_or_else(|| anyhow::anyhow!("{slug:?} is not a valid owner/name"))?;
            let row = db::repos::get(&app.db, &name.owner, &name.name).await?.ok_or_else(|| anyhow::anyhow!("{name} does not exist"))?;
            if let Some(d) = description {
                db::repos::set_description(&app.db, row.id, &d).await?;
            }
            if let Some(b) = default_bookmark {
                db::repos::set_default_bookmark(&app.db, row.id, &b).await?;
            }
            if let Some(v) = visibility {
                let v = Visibility::parse(&v).ok_or_else(|| anyhow::anyhow!("visibility is public, internal or private"))?;
                db::repos::set_visibility(&app.db, row.id, v).await?;
            }
            println!("updated {name}");
        }
    }
    Ok(())
}

async fn user_admin(app: &oxygenhub::Shared, cmd: UserCmd) -> anyhow::Result<()> {
    use oxygenhub::auth;
    use oxygenhub::db::accounts;
    match cmd {
        UserCmd::Create { username, email, admin } => {
            if !oxygenhub::repos::names::valid_owner(&username) {
                anyhow::bail!("{username:?} is not a valid username");
            }
            if accounts::account_by_name(&app.db, &username).await?.is_some() || accounts::org_by_name(&app.db, &username).await?.is_some()
            {
                anyhow::bail!("{username} is taken");
            }
            let password = auth::random_hex(12);
            let hash = auth::hash_password(&password)?;
            accounts::create_account(&app.db, &username, &email, &hash, &auth::random_hex(16), admin).await?;
            accounts::audit(&app.db, None, "admin.user.create", &username, if admin { "administrator" } else { "" }).await?;
            println!("created {username}{}; one-time password: {password}", if admin { " (administrator)" } else { "" });
            println!("sign in at {}/login and change it under Settings", app.config.base_url());
        }
        UserCmd::ResetPassword { username } => {
            let account = accounts::account_by_name(&app.db, &username).await?.ok_or_else(|| anyhow::anyhow!("no such account"))?;
            let password = auth::random_hex(12);
            let hash = auth::hash_password(&password)?;
            accounts::set_password(&app.db, account.id, &hash, &auth::random_hex(16)).await?;
            accounts::audit(&app.db, None, "admin.user.reset_password", &username, "").await?;
            println!("new one-time password for {username}: {password}");
        }
        UserCmd::List => {
            for a in accounts::accounts(&app.db).await? {
                println!(
                    "{:<24} {:<32} {}{}{}",
                    a.username,
                    a.email,
                    if a.is_admin { "admin " } else { "" },
                    if a.banned { "banned " } else { "" },
                    if a.disabled { "disabled" } else { "" }
                );
            }
        }
    }
    Ok(())
}

async fn check(app: &oxygenhub::Shared) -> anyhow::Result<()> {
    let mut problems = 0;
    for r in db::repos::list(&app.db).await? {
        let name = RepoName::new(&r.owner, &r.name).unwrap();
        let report = app.repos.read(&name, |r, cache| oxygenhub::repos::view::verification(r, cache)).await;
        match report {
            Ok(v) => {
                println!(
                    "{:<40} {} changes, {} signed, {} sealed, {} unsigned, {} invalid",
                    name,
                    v.total,
                    v.signed,
                    v.sealed,
                    v.unsigned,
                    v.invalid.len()
                );
                problems += v.invalid.len();
            }
            Err(e) => {
                println!("{name:<40} ERROR {e}");
                problems += 1;
            }
        }
    }
    if problems > 0 {
        anyhow::bail!("{problems} problem(s)");
    }
    Ok(())
}