//! `spectra serve`: the daemon (spec §7.1, §21.1). It holds the ledger,
//! serves Tuner, the API and Radar on the Unix socket and on a TCP port,
//! over TLS beyond loopback (§8.6), and writes a checkpoint when it stops.

use super::{ui, Ctx};
use anyhow::{bail, Context, Result};
use spectra_core::daemon::Daemon;
use spectra_mcp::client::Client;
use spectra_mcp::http::{AppState, PeerInfo};
use std::net::SocketAddr;
use std::sync::Arc;

/// `[server]` of spectra.toml, with the command line's overrides.
struct ServerCfg {
    bind: String,
    tls: String,
    files: Option<(std::path::PathBuf, std::path::PathBuf)>,
    names: Vec<String>,
}

fn server_cfg(ctx: &Ctx, bind: Option<String>, tls: Option<String>) -> Result<ServerCfg> {
    let text = std::fs::read_to_string(ctx.data.join("spectra.toml")).unwrap_or_default();
    let t: toml::Table = text.parse().with_context(|| format!("reading {}", ctx.data.join("spectra.toml").display()))?;
    let server = t.get("server").and_then(|s| s.as_table()).cloned().unwrap_or_default();
    let (mut mode, mut files) = (String::from("auto"), None);
    match server.get("tls") {
        Some(toml::Value::String(m)) => mode = m.clone(),
        Some(toml::Value::Table(f)) => {
            let path = |k: &str| f.get(k).and_then(|v| v.as_str()).map(std::path::PathBuf::from);
            files = Some((path("cert").context("[server] tls needs cert")?, path("key").context("[server] tls needs key")?));
            mode = "on".into();
        }
        _ => {}
    }
    if let Some(m) = tls {
        mode = m;
    }
    if !matches!(mode.as_str(), "auto" | "on" | "off") {
        bail!("TLS is auto, on or off, not {mode}");
    }
    let names = match server.get("names").and_then(|n| n.as_array()) {
        Some(a) => a.iter().filter_map(|v| v.as_str().map(String::from)).collect(),
        None => default_names(),
    };
    let bind = bind.or_else(|| server.get("bind").and_then(|b| b.as_str()).map(String::from)).unwrap_or_else(|| "127.0.0.1:7350".into());
    Ok(ServerCfg { bind, tls: mode, files, names })
}

/// The host name, its fully qualified name, and localhost.
fn default_names() -> Vec<String> {
    let mut names = Vec::new();
    let short = std::fs::read_to_string("/etc/hostname").ok().map(|h| h.trim().to_string()).filter(|h| !h.is_empty());
    let fqdn = std::process::Command::new("hostname")
        .arg("--fqdn")
        .output()
        .ok()
        .filter(|o| o.status.success())
        .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())
        .filter(|h| !h.is_empty());
    for n in [short, fqdn, Some("localhost".to_string())].into_iter().flatten() {
        if !names.contains(&n) {
            names.push(n);
        }
    }
    names
}

type Served = std::pin::Pin<Box<dyn std::future::Future<Output = std::io::Result<()>> + Send>>;

pub async fn serve(ctx: &Ctx, bind: Option<String>, tls: Option<String>, insecure: bool, open: bool) -> Result<i32> {
    let cfg = server_cfg(ctx, bind, tls)?;
    let addr: SocketAddr = cfg.bind.parse().with_context(|| format!("{} is not an address and port", cfg.bind))?;
    let use_tls = match cfg.tls.as_str() {
        "on" => true,
        "off" => false,
        _ => !addr.ip().is_loopback(),
    };
    if !addr.ip().is_loopback() && !use_tls && !insecure {
        bail!("Spectra serves other machines over TLS only (spec §21.1); drop --tls off, or pass --insecure to bind {addr} in plain HTTP anyway");
    }
    let socket = ctx.socket();
    if socket.exists() {
        if Client::alive(&socket).await {
            bail!("Spectra is already serving {} (its socket answers)", ctx.data.display());
        }
        std::fs::remove_file(&socket).ok();
    }
    let daemon = Daemon::start(&ctx.data).await?;
    let unix = tokio::net::UnixListener::bind(&socket).with_context(|| format!("binding {}", socket.display()))?;
    #[cfg(unix)]
    {
        use std::os::unix::fs::PermissionsExt;
        std::fs::set_permissions(&socket, std::fs::Permissions::from_mode(0o660))?;
    }
    let tcp = tokio::net::TcpListener::bind(addr).await.with_context(|| format!("binding {addr}"))?;
    let port = tcp.local_addr()?.port();
    let mut origins = vec![format!("http://127.0.0.1:{port}"), format!("http://localhost:{port}"), format!("http://{addr}")];
    let tls = if use_tls {
        let source = match &cfg.files {
            Some((cert, key)) => spectra_mcp::tls::CertSource::Files { cert: cert.clone(), key: key.clone() },
            None => spectra_mcp::tls::CertSource::Own { names: cfg.names.clone() },
        };
        let t = spectra_mcp::tls::ServerTls::load(&ctx.data, &source)?;
        let instance = spectra_core::keys::KeyPair::instance(&ctx.data, "spectra")?;
        spectra_mcp::instance::record_tls(&daemon.ledger, &instance, &t.spki_sha256, &t.names).await?;
        for n in &cfg.names {
            origins.push(format!("https://{n}:{port}"));
        }
        origins.push(format!("https://{addr}"));
        Some(t)
    } else {
        None
    };
    let state = AppState { daemon: daemon.clone(), origins: Arc::new(origins), sessions: Default::default() };
    let app = spectra_mcp::http::router(state.clone()).merge(spectra_mcp::api::router(state.clone())).merge(radar::router(state));

    let (head, _) = daemon.ledger.head().await;
    let agents = sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM agents WHERE disabled_ms IS NULL")
        .fetch_one(daemon.ledger.pool())
        .await
        .unwrap_or(0);
    println!("{} {}", ui::done("Serving"), ui::subject("Spectra"));
    println!("{}", ui::kv("socket", ui::path(socket.display())));
    match &tls {
        Some(t) => {
            let host = if addr.ip().is_unspecified() {
                cfg.names.first().cloned().unwrap_or_else(|| "localhost".into())
            } else {
                addr.ip().to_string()
            };
            println!("{}", ui::kv("https", format!("https://{host}:{port}")));
            println!(
                "{}",
                ui::kv(
                    "certificate",
                    format!("{}{}", ui::hash(hex::encode(&t.spki_sha256[..8])), ui::dim(" (signed by the instance key)"))
                )
            );
        }
        None => println!("{}", ui::kv("http", format!("http://{}:{port}", addr.ip()))),
    }
    println!("{}", ui::kv("ledger", format!("{head} events{}{agents} agent(s)", ui::sep())));
    println!("  {} {}", ui::note(), ui::dim("agents connect with: spectra mcp --agent NAME"));
    println!("  {} {}", ui::note(), ui::dim("open Radar with: spectra open"));
    if open {
        let ctx2 = Ctx { data: ctx.data.clone() };
        tokio::spawn(async move {
            // Once the socket answers, sign the link as the owner and open it.
            tokio::time::sleep(std::time::Duration::from_millis(200)).await;
            if let Err(e) = super::open::open(&ctx2, None, true).await {
                eprintln!("{} {e:#}", ui::caution());
            }
        });
    }

    let (stop_tx, stop_rx) = tokio::sync::watch::channel(false);
    let stop = |mut rx: tokio::sync::watch::Receiver<bool>| async move {
        let _ = rx.wait_for(|s| *s).await;
    };
    let unix_srv =
        axum::serve(unix, app.clone().into_make_service_with_connect_info::<PeerInfo>()).with_graceful_shutdown(stop(stop_rx.clone()));
    let tcp_srv: Served = match &tls {
        Some(t) => {
            let listener = spectra_mcp::tls::TlsListener::new(tcp, t.config.clone())?;
            let srv = axum::serve(listener, app.into_make_service_with_connect_info::<PeerInfo>()).with_graceful_shutdown(stop(stop_rx));
            Box::pin(async move { srv.await })
        }
        None => {
            let srv = axum::serve(tcp, app.into_make_service_with_connect_info::<PeerInfo>()).with_graceful_shutdown(stop(stop_rx));
            Box::pin(async move { srv.await })
        }
    };
    let signal = async move {
        shutdown_signal().await;
        let _ = stop_tx.send(true);
    };
    // After the signal, open connections get five seconds to finish: a
    // `subscriptions/listen` stream never does by itself.
    let (stopping_tx, mut stopping) = tokio::sync::watch::channel(false);
    tokio::spawn(async move {
        signal.await;
        let _ = stopping_tx.send(true);
    });
    let servers = async { tokio::join!(unix_srv, tcp_srv) };
    tokio::select! {
        (u, t) = servers => {
            u?;
            t?;
        }
        _ = async {
            let _ = stopping.wait_for(|s| *s).await;
            tokio::time::sleep(std::time::Duration::from_secs(5)).await;
        } => {
            tracing::info!("connections still open five seconds after the signal; stopping anyway");
        }
    }
    daemon.shutdown().await;
    std::fs::remove_file(&socket).ok();
    println!("{} {}", ui::done("Stopped"), ui::dim(format!("ledger checkpointed at {} events", daemon.ledger.head().await.0)));
    Ok(0)
}

async fn shutdown_signal() {
    #[cfg(unix)]
    {
        let mut term = tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate()).expect("a SIGTERM handler");
        tokio::select! {
            _ = tokio::signal::ctrl_c() => {}
            _ = term.recv() => {}
        }
    }
    #[cfg(not(unix))]
    let _ = tokio::signal::ctrl_c().await;
}