package cmd

import (
	"fmt"
	"os"
	"strings"

	"github.com/Pingu-Studio/MaidnCLI/internal/k8s"
	"github.com/Pingu-Studio/MaidnCLI/internal/ui"
	"github.com/Pingu-Studio/MaidnCLI/internal/utils"
	"github.com/Pingu-Studio/MaidnCLI/internal/vault"
	"github.com/spf13/cobra"
)

var vaultCmd = &cobra.Command{
	Use:   "vault",
	Short: "Manage Vault secrets for CI/CD.",
}

func init() {
	rootCmd.AddCommand(vaultCmd)
	vaultCmd.AddCommand(createDockerSecretCmd)
	vaultCmd.AddCommand(createGhcrSecretCmd)
	vaultCmd.AddCommand(createGithubSecretCmd)
}

var createDockerSecretCmd = &cobra.Command{
	Use:   "create-docker-secret",
	Short: "Creates a secret in Vault for Docker Hub and applies it to Kubernetes.",
	Run:   runCreateDockerSecret,
}

var createGhcrSecretCmd = &cobra.Command{
	Use:   "create-ghcr-secret",
	Short: "Creates secrets in Vault for GHCR.",
	Run:   runCreateGhcrSecret,
}

var createGithubSecretCmd = &cobra.Command{
	Use:   "create-github-secret",
	Short: "Creates a GitHub authentication secret in Vault.",
	Run:   runCreateGithubSecret,
}

func runCreateDockerSecret(cmd *cobra.Command, args []string) {
	if err := k8s.CheckExternalSecretCRD(); err != nil {
		fmt.Printf("[ERROR] Prerequisite check failed: %v\n", err)
		os.Exit(1)
	}

	vm, err := vault.NewVaultManager()
	if err != nil {
		fmt.Printf("[ERROR] Failed to initialize Vault manager: %v\n", err)
		os.Exit(1)
	}

	username, password, err := ui.GetUserInputForDockerHub()
	if err != nil {
		fmt.Printf("[ERROR] %v\n", err)
		os.Exit(1)
	}

	dockerConfigJSON, err := vault.CreateDockerConfig(vault.DockerHubRegistry, username, password)
	if err != nil {
		fmt.Printf("[ERROR] Failed to create Docker config: %v\n", err)
		os.Exit(1)
	}

	secretData := map[string]string{vault.DockerConfigJSONKey: dockerConfigJSON}
	if err := vm.StoreSecret(vault.DockerHubSecretPath, secretData); err != nil {
		fmt.Printf("[ERROR] Failed to store Docker Hub secret in Vault: %v\n", err)
		os.Exit(1)
	}

	if err := k8s.CreateDockerHubExternalSecret(); err != nil {
		// Call our new universal handler for the specific cache error.
		utils.HandleKubectlCacheError(err)

		// Provide a generic warning for all other potential errors.
		if !strings.Contains(err.Error(), "no matches for kind") {
			fmt.Printf("[WARNING] The secret was stored in Vault, but failed to create the ExternalSecret: %v\n", err)
		}
		os.Exit(1) // Exit after handling the error to prompt the user to re-run.
	}
}

func runCreateGhcrSecret(cmd *cobra.Command, args []string) {
	vm, err := vault.NewVaultManager()
	if err != nil {
		fmt.Printf("[ERROR] Failed to initialize Vault manager: %v\n", err)
		os.Exit(1)
	}

	username, registryToken, orgToken, err := ui.GetUserInputForGhcr()
	if err != nil {
		fmt.Printf("[ERROR] %v\n", err)
		os.Exit(1)
	}

	dockerConfigJSON, err := vault.CreateDockerConfig(vault.GhcrRegistry, username, registryToken)
	if err != nil {
		fmt.Printf("[ERROR] Failed to create Docker config for GHCR: %v\n", err)
		os.Exit(1)
	}

	dockerSecretData := map[string]string{vault.DockerConfigJSONKey: dockerConfigJSON}
	if err := vm.StoreSecret(vault.GhcrSecretPath, dockerSecretData); err != nil {
		fmt.Printf("[ERROR] Failed to store GHCR secret in Vault: %v\n", err)
		os.Exit(1)
	}

	orgSecretData := map[string]string{vault.OrgManagementPATKey: orgToken}
	if err := vm.StoreSecret(vault.OrgManagementSecretPath, orgSecretData); err != nil {
		fmt.Printf("[ERROR] Failed to store organization management PAT in Vault: %v\n", err)
		os.Exit(1)
	}
}

func runCreateGithubSecret(cmd *cobra.Command, args []string) {
	vm, err := vault.NewVaultManager()
	if err != nil {
		fmt.Printf("[ERROR] Failed to initialize Vault manager: %v\n", err)
		os.Exit(1)
	}

	username, token, err := ui.GetUserInputForGithubAuth()
	if err != nil {
		fmt.Printf("[ERROR] %v\n", err)
		os.Exit(1)
	}

	secretData := map[string]string{"username": username, "password": token}
	if err := vm.StoreSecret(vault.GithubAuthSecretPath, secretData); err != nil {
		fmt.Printf("[ERROR] Failed to store GitHub auth secret in Vault: %v\n", err)
		os.Exit(1)
	}
}