// Package domains manages an app's public hostnames and TLS. Unlike other
// app config, a domain/cert change never touches the jail, so it skips
// Skiff's usual snapshot-and-restart safety net entirely.
package domains

import (
	"context"
	"fmt"
	"io"
	"os"

	"skiff/internal/appmeta"
	"skiff/internal/certbot"
	"skiff/internal/layout"
	"skiff/internal/nginx"
)

// Add registers hostname for app and syncs routing/TLS. Safe to retry: a
// DNS-not-ready cert failure just leaves the app on plain HTTP.
func Add(ctx context.Context, out io.Writer, cfg layout.Config, app, hostname string, primary bool) error {
	meta, err := appmeta.Read(cfg.MetaPath(app))
	if err != nil {
		return fmt.Errorf("read app metadata: %w", err)
	}

	makePrimary := primary || len(meta.Domains) == 0
	found := false
	for i := range meta.Domains {
		if meta.Domains[i].Hostname == hostname {
			found = true
			break
		}
	}
	if makePrimary {
		for i := range meta.Domains {
			meta.Domains[i].Primary = meta.Domains[i].Hostname == hostname
		}
	}
	if !found {
		meta.Domains = append(meta.Domains, appmeta.Domain{Hostname: hostname, Primary: makePrimary})
	}

	if err := appmeta.Write(cfg.MetaPath(app), meta); err != nil {
		return fmt.Errorf("write app metadata: %w", err)
	}

	if err := syncCert(ctx, out, cfg, app, meta); err != nil {
		return err
	}
	fmt.Fprintf(out, "==> %s added for %s\n", hostname, app)
	return nil
}

// Remove deregisters hostname and updates routing only - unlike Add, it
// never calls certbot, so it can't fail or block on it. Removing the
// primary while others remain is refused - reassign primary first with
// `skiff domains add --primary`.
func Remove(ctx context.Context, out io.Writer, cfg layout.Config, app, hostname string) error {
	meta, err := appmeta.Read(cfg.MetaPath(app))
	if err != nil {
		return fmt.Errorf("read app metadata: %w", err)
	}

	idx := -1
	for i, d := range meta.Domains {
		if d.Hostname == hostname {
			idx = i
			break
		}
	}
	if idx == -1 {
		return fmt.Errorf("%s is not registered for %s", hostname, app)
	}
	if meta.Domains[idx].Primary && len(meta.Domains) > 1 {
		return fmt.Errorf("%s is %s's primary domain - reassign primary to another domain first (skiff domains add --primary <hostname>)", hostname, app)
	}
	meta.Domains = append(meta.Domains[:idx], meta.Domains[idx+1:]...)

	if err := appmeta.Write(cfg.MetaPath(app), meta); err != nil {
		return fmt.Errorf("write app metadata: %w", err)
	}

	if len(meta.Domains) == 0 {
		if err := nginx.Remove(ctx, out, cfg, app); err != nil {
			return err
		}
	} else if err := nginx.EnsureRoute(ctx, out, cfg, app, meta); err != nil {
		return fmt.Errorf("nginx: %w", err)
	}

	fmt.Fprintf(out, "==> %s removed from %s\n", hostname, app)
	return nil
}

// syncCert routes over plain HTTP first, so a newly added hostname is
// reachable for the HTTP-01 challenge, then requests/expands the cert and
// re-routes with TLS enabled for whatever it now covers.
func syncCert(ctx context.Context, out io.Writer, cfg layout.Config, app string, meta appmeta.Meta) error {
	primary, ok := meta.PrimaryDomain()
	if !ok {
		return fmt.Errorf("%s has domains but none marked primary", app)
	}

	if err := nginx.EnsureRoute(ctx, out, cfg, app, meta); err != nil {
		return fmt.Errorf("nginx: %w", err)
	}

	if err := os.MkdirAll(cfg.AcmeWebrootDir, 0755); err != nil {
		return fmt.Errorf("create acme webroot: %w", err)
	}

	hostnames := make([]string, len(meta.Domains))
	for i, d := range meta.Domains {
		hostnames[i] = d.Hostname
	}

	fmt.Fprintln(out, "==> requesting certificate")
	if err := certbot.Sync(ctx, out, cfg.AcmeWebrootDir, primary.Hostname, hostnames); err != nil {
		return fmt.Errorf("certificate not issued (%w) - fix DNS and re-run this command", err)
	}

	meta.TLSDomains = hostnames
	if err := appmeta.Write(cfg.MetaPath(app), meta); err != nil {
		return fmt.Errorf("write app metadata: %w", err)
	}

	return nginx.EnsureRoute(ctx, out, cfg, app, meta)
}