package agent

import (
	"context"
	"crypto/sha256"
	"encoding/hex"
	"errors"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"os"
	"strings"
	"time"

	agentv1 "git.ipao.vip/rogee/go-sip/gen/agent/v1"
)

// UploadClient performs the Agent-direct data-plane upload using a restricted
// Dispatcher grant. It never sends file bytes through Dispatcher or writes an
// OSS credential to logs. It never deletes or moves the source asset; the
// lifecycle owner retains it until the verified handoff is durably recorded.
type UploadClient struct {
	HTTPClient          *http.Client
	AllowedHosts        map[string]struct{}
	AllowInsecureHTTP   bool
	MaxResponseBodySize int64
	Now                 func() time.Time
}

var ErrUploadGrantExpired = errors.New("upload grant is expired")

type UploadResult struct {
	StatusCode int
	SizeBytes  int64
	SHA256     string
	ETag       string
}

func (c UploadClient) UploadFile(ctx context.Context, grant *agentv1.UploadGrant, path string) (result UploadResult, err error) {
	if grant == nil {
		return UploadResult{}, errors.New("upload grant is required")
	}
	if grant.TargetUrl == "" || grant.UploadId == "" || grant.ObjectKey == "" {
		return UploadResult{}, errors.New("upload URL, ID and object key are required")
	}
	if grant.ExpiresAtUnixMs <= 0 {
		return UploadResult{}, errors.New("upload grant expiry is required")
	}
	now := time.Now
	if c.Now != nil {
		now = c.Now
	}
	if !now().Before(time.UnixMilli(grant.ExpiresAtUnixMs)) {
		return UploadResult{}, ErrUploadGrantExpired
	}
	parsed, err := url.Parse(grant.TargetUrl)
	if err != nil || parsed.Host == "" {
		return UploadResult{}, errors.New("upload URL is invalid")
	}
	if parsed.Scheme != "https" && !(c.AllowInsecureHTTP && parsed.Scheme == "http") {
		return UploadResult{}, errors.New("upload URL must use HTTPS")
	}
	if len(c.AllowedHosts) > 0 {
		if _, ok := c.AllowedHosts[strings.ToLower(parsed.Host)]; !ok {
			return UploadResult{}, fmt.Errorf("upload host %q is not allowed", parsed.Host)
		}
	}
	if err := ctx.Err(); err != nil {
		return UploadResult{}, err
	}
	file, err := os.Open(path)
	if err != nil {
		return UploadResult{}, err
	}
	stat, err := file.Stat()
	if err != nil {
		_ = file.Close()
		return UploadResult{}, err
	}
	if stat.IsDir() {
		_ = file.Close()
		return UploadResult{}, errors.New("upload path is a directory")
	}
	if grant.MaxBytes > 0 && stat.Size() > grant.MaxBytes {
		_ = file.Close()
		return UploadResult{}, fmt.Errorf("asset exceeds grant limit: %d > %d", stat.Size(), grant.MaxBytes)
	}
	digest, err := digestFile(file)
	closeErr := file.Close()
	if err != nil {
		return UploadResult{}, err
	}
	if closeErr != nil {
		return UploadResult{}, closeErr
	}
	if grant.RequiredChecksumSha256 != "" && !strings.EqualFold(grant.RequiredChecksumSha256, digest) {
		return UploadResult{}, errors.New("asset checksum does not match upload grant")
	}

	file, err = os.Open(path)
	if err != nil {
		return UploadResult{}, err
	}
	defer func() {
		if closeErr := file.Close(); err == nil && closeErr != nil && !errors.Is(closeErr, os.ErrClosed) {
			result = UploadResult{}
			err = closeErr
		}
	}()
	req, err := http.NewRequestWithContext(ctx, http.MethodPut, parsed.String(), file)
	if err != nil {
		return UploadResult{}, err
	}
	req.ContentLength = stat.Size()
	for _, header := range grant.Headers {
		if strings.EqualFold(header.Name, "host") || strings.EqualFold(header.Name, "content-length") {
			return UploadResult{}, errors.New("upload grant contains a forbidden header")
		}
		req.Header.Set(header.Name, header.Value)
	}
	client := c.HTTPClient
	if client == nil {
		client = &http.Client{}
	}
	copyClient := *client
	copyClient.CheckRedirect = func(_ *http.Request, _ []*http.Request) error { return http.ErrUseLastResponse }
	resp, err := copyClient.Do(req)
	if err != nil {
		return UploadResult{}, err
	}
	defer resp.Body.Close()
	maxResponse := c.MaxResponseBodySize
	if maxResponse <= 0 {
		maxResponse = 64 << 10
	}
	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
		_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, maxResponse))
		return UploadResult{}, fmt.Errorf("upload returned HTTP %d", resp.StatusCode)
	}
	_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, maxResponse))
	return UploadResult{StatusCode: resp.StatusCode, SizeBytes: stat.Size(), SHA256: digest, ETag: resp.Header.Get("ETag")}, nil
}

func digestFile(file *os.File) (string, error) {
	if _, err := file.Seek(0, io.SeekStart); err != nil {
		return "", err
	}
	hash := sha256.New()
	if _, err := io.Copy(hash, file); err != nil {
		return "", err
	}
	return hex.EncodeToString(hash.Sum(nil)), nil
}