package openbao

import (
	"bytes"
	"encoding/json"
	"fmt"
	"os"
	"os/exec"
	"path/filepath"
	"regexp"
	"sort"
	"strings"
	"time"

	"gopkg.in/yaml.v3"
)

type status struct {
	Initialized bool `json:"initialized"`
	Sealed      bool `json:"sealed"`
}

type recovery struct {
	UnsealKeysB64   []string `json:"unseal_keys_b64"`
	UnsealThreshold int      `json:"unseal_threshold"`
	RootToken       string   `json:"root_token"`
}

type operationalSecrets struct {
	Secrets map[string]map[string]string `yaml:"secrets"`
}

func EnsureRecoveryIdentity(identityPath string) (string, error) {
	if _, err := os.Stat(identityPath); os.IsNotExist(err) {
		if err := os.MkdirAll(filepath.Dir(identityPath), 0700); err != nil {
			return "", err
		}
		if err := exec.Command("age-keygen", "-o", identityPath).Run(); err != nil {
			return "", fmt.Errorf("create OpenBao recovery identity: %w", err)
		}
	} else if err != nil {
		return "", err
	}
	recipient, err := exec.Command("age-keygen", "-y", identityPath).Output()
	if err != nil {
		return "", fmt.Errorf("derive OpenBao recovery recipient: %w", err)
	}
	if value := strings.TrimSpace(string(recipient)); value != "" {
		return value, nil
	}
	return "", fmt.Errorf("OpenBao recovery recipient is empty")
}

func Initialize(kubeconfig, recipient, identityPath, bundlePath, ageKeyPath, operationalSecretsPath string) (map[string]map[string]string, error) {
	if err := validateRecoveryRecipient(recipient, bundlePath); err != nil {
		return nil, err
	}
	if err := waitForPod(kubeconfig); err != nil {
		return nil, err
	}
	current, err := getStatus(kubeconfig)
	if err != nil {
		return nil, err
	}
	var material recovery
	if !current.Initialized {
		output, err := execInPod(kubeconfig, nil, "bao", "operator", "init", "-format=json")
		if err != nil {
			return nil, fmt.Errorf("initialize OpenBao: %w", err)
		}
		if err := json.Unmarshal(output, &material); err != nil {
			return nil, fmt.Errorf("parse OpenBao recovery material: %w", err)
		}
		if err := encryptRecovery(recipient, bundlePath, output); err != nil {
			return nil, err
		}
	} else {
		output, err := decryptRecovery(identityPath, bundlePath)
		if err != nil {
			return nil, err
		}
		if err := json.Unmarshal(output, &material); err != nil {
			return nil, fmt.Errorf("parse encrypted OpenBao recovery material: %w", err)
		}
	}
	if current.Sealed {
		if err := unseal(kubeconfig, material); err != nil {
			return nil, err
		}
	}
	reviewerToken, err := kubectlOutput(kubeconfig, "-n", "openbao", "create", "token", "openbao-auth")
	if err != nil {
		return nil, fmt.Errorf("create OpenBao Kubernetes token reviewer token: %w", err)
	}
	if err := configureKubernetesAuth(kubeconfig, material.RootToken, string(bytes.TrimSpace(reviewerToken))); err != nil {
		return nil, err
	}
	return seedOperationalSecrets(kubeconfig, material.RootToken, ageKeyPath, operationalSecretsPath)
}

func seedOperationalSecrets(kubeconfig, rootToken, ageKeyPath, path string) (map[string]map[string]string, error) {
	cmd := exec.Command("sops", "--decrypt", "--output-type", "yaml", path)
	cmd.Env = append(os.Environ(), "SOPS_AGE_KEY_FILE="+ageKeyPath)
	plaintext, err := cmd.Output()
	if err != nil {
		return nil, fmt.Errorf("decrypt operational SOPS secrets: %w", err)
	}
	var document operationalSecrets
	if err := yaml.Unmarshal(plaintext, &document); err != nil {
		return nil, fmt.Errorf("parse operational SOPS secrets: %w", err)
	}
	if len(document.Secrets) == 0 {
		return nil, fmt.Errorf("operational SOPS secrets contains no secrets")
	}
	paths := make([]string, 0, len(document.Secrets))
	for secretPath := range document.Secrets {
		paths = append(paths, secretPath)
	}
	sort.Strings(paths)
	for _, secretPath := range paths {
		values := document.Secrets[secretPath]
		if err := writeSecret(kubeconfig, rootToken, secretPath, values); err != nil {
			return nil, err
		}
	}
	return document.Secrets, nil
}

func validateRecoveryRecipient(recipient, bundlePath string) error {
	if err := os.MkdirAll(filepath.Dir(bundlePath), 0700); err != nil {
		return err
	}
	probe, err := os.CreateTemp(filepath.Dir(bundlePath), "age-recipient-*")
	if err != nil {
		return err
	}
	probePath := probe.Name()
	if err := probe.Close(); err != nil {
		return err
	}
	defer os.Remove(probePath)
	cmd := exec.Command("age", "-r", recipient, "-o", probePath)
	if output, err := cmd.CombinedOutput(); err != nil {
		return fmt.Errorf("validate OpenBao recovery recipient: %w: %s", err, bytes.TrimSpace(output))
	}
	return nil
}

func writeSecret(kubeconfig, rootToken, secretPath string, values map[string]string) error {
	if !regexp.MustCompile(`^[a-z0-9][a-z0-9/_-]*$`).MatchString(secretPath) || len(values) == 0 {
		return fmt.Errorf("invalid OpenBao secret path %q", secretPath)
	}
	keys := make([]string, 0, len(values))
	for key := range values {
		if !regexp.MustCompile(`^[A-Za-z0-9_.-]+$`).MatchString(key) {
			return fmt.Errorf("invalid OpenBao secret key %q", key)
		}
		keys = append(keys, key)
	}
	sort.Strings(keys)
	arguments := make([]string, 0, len(keys))
	input := strings.Builder{}
	input.WriteString(rootToken)
	input.WriteByte('\n')
	for _, key := range keys {
		arguments = append(arguments, fmt.Sprintf("%s=\"$value%d\"", key, len(arguments)))
		input.WriteString(values[key])
		input.WriteByte('\n')
	}
	reads := make([]string, 0, len(keys))
	for index := range keys {
		reads = append(reads, fmt.Sprintf("read -r value%d", index))
	}
	script := "read -r root_token\n" + strings.Join(reads, "\n") + "\nexport BAO_TOKEN=\"$root_token\"\nbao kv put secret/" + secretPath + " " + strings.Join(arguments, " ") + " >/dev/null"
	_, err := execInPod(kubeconfig, []byte(input.String()), "sh", "-ec", script)
	return err
}

func waitForPod(kubeconfig string) error {
	deadline := time.Now().Add(10 * time.Minute)
	for time.Now().Before(deadline) {
		if _, err := kubectlOutput(kubeconfig, "-n", "openbao", "get", "pod", "openbao-0"); err == nil {
			if output, _ := execInPod(kubeconfig, nil, "bao", "status", "-format=json"); len(output) > 0 {
				return nil
			}
		}
		time.Sleep(2 * time.Second)
	}
	return fmt.Errorf("OpenBao pod did not become ready")
}

func getStatus(kubeconfig string) (status, error) {
	output, err := execInPod(kubeconfig, nil, "bao", "status", "-format=json")
	if err != nil && len(output) == 0 {
		return status{}, fmt.Errorf("get OpenBao status: %w", err)
	}
	var current status
	if err := json.Unmarshal(output, &current); err != nil {
		return status{}, fmt.Errorf("parse OpenBao status: %w", err)
	}
	return current, nil
}

func unseal(kubeconfig string, material recovery) error {
	threshold := material.UnsealThreshold
	if threshold == 0 {
		threshold = 3
	}
	if len(material.UnsealKeysB64) < threshold {
		return fmt.Errorf("OpenBao recovery bundle contains fewer than %d unseal keys", threshold)
	}
	for _, key := range material.UnsealKeysB64[:threshold] {
		if _, err := execInPod(kubeconfig, []byte(key+"\n"), "sh", "-ec", "read -r key; bao operator unseal \"$key\" >/dev/null"); err != nil {
			return fmt.Errorf("unseal OpenBao: %w", err)
		}
	}
	return nil
}

func configureKubernetesAuth(kubeconfig, rootToken, reviewerToken string) error {
	const script = `read -r root_token
read -r reviewer_token
export BAO_TOKEN="$root_token"
bao secrets enable -path=secret kv-v2 >/dev/null 2>&1 || true
bao auth enable kubernetes >/dev/null 2>&1 || true
bao write auth/kubernetes/config token_reviewer_jwt="$reviewer_token" kubernetes_host="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt >/dev/null
cat >/tmp/external-secrets.hcl <<'EOF'
path "secret/data/*" {
  capabilities = ["read"]
}
path "secret/metadata/*" {
  capabilities = ["list", "read"]
}
EOF
bao policy write external-secrets /tmp/external-secrets.hcl >/dev/null
rm -f /tmp/external-secrets.hcl
bao write auth/kubernetes/role/external-secrets bound_service_account_names=external-secrets bound_service_account_namespaces=external-secrets policies=external-secrets ttl=1h >/dev/null`
	input := []byte(rootToken + "\n" + reviewerToken + "\n")
	_, err := execInPod(kubeconfig, input, "sh", "-ec", script)
	return err
}

func encryptRecovery(recipient, bundlePath string, plaintext []byte) error {
	if err := os.MkdirAll(filepath.Dir(bundlePath), 0700); err != nil {
		return err
	}
	cmd := exec.Command("age", "-r", recipient, "-o", bundlePath)
	cmd.Stdin = bytes.NewReader(plaintext)
	if output, err := cmd.CombinedOutput(); err != nil {
		return fmt.Errorf("encrypt OpenBao recovery material: %w: %s", err, bytes.TrimSpace(output))
	}
	return os.Chmod(bundlePath, 0600)
}

func decryptRecovery(identityPath, bundlePath string) ([]byte, error) {
	cmd := exec.Command("age", "-d", "-i", identityPath, bundlePath)
	output, err := cmd.Output()
	if err != nil {
		return nil, fmt.Errorf("decrypt OpenBao recovery material: %w", err)
	}
	return output, nil
}

func execInPod(kubeconfig string, input []byte, args ...string) ([]byte, error) {
	command := append([]string{"--kubeconfig", kubeconfig, "-n", "openbao", "exec", "-i", "openbao-0", "--"}, args...)
	cmd := exec.Command("kubectl", command...)
	cmd.Stdin = bytes.NewReader(input)
	return cmd.CombinedOutput()
}

func kubectlOutput(kubeconfig string, args ...string) ([]byte, error) {
	command := append([]string{"--kubeconfig", kubeconfig}, args...)
	return exec.Command("kubectl", command...).Output()
}