from __future__ import annotations

import json
import re
import time
from typing import Any
from urllib.parse import quote

from ..connectors.portainer import PortainerConnector
from ..core.redaction import redact_message

_REPOSITORY = re.compile(r"^jens/[a-z0-9_.-]+$")
_REVISION = re.compile(r"^[0-9a-f]{40}$")
_BRANCH = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._/-]{0,119}$")
_SLUG = re.compile(r"^[a-z0-9][a-z0-9_.-]{0,62}$")
_COMPOSE_PROJECT = re.compile(r"^[a-z0-9][a-z0-9_-]{0,62}$")
_CONTAINER = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$")
_CONTROLLER = "gitea-deploy-control"
_MAX_CONTAINERS = 32

# Fixed application-owned mutation. Callers never provide a command or host
# path. Repository-derived topology is validated before it reaches this script,
# then re-bound to the exact immutable Git revision inside the controller.
_REGISTER_SCRIPT = r'''
import fcntl
import json
import os
from pathlib import Path
import shutil
import stat
import subprocess
import sys
import time

path = Path("/opt/gitea-deploy/projects.json")
host_path = Path("/mnt/cache/appdata/gitea-deploy-runners/controller/projects.json")
lock_path = Path("/mnt/cache/appdata/gitea-deploy-runners/deploy.lock")
repository, revision, branch, raw_project = sys.argv[1:5]
project = json.loads(raw_project)

if path.is_symlink() or not path.is_file():
    raise SystemExit(20)
info = path.stat()
if not stat.S_ISREG(info.st_mode):
    raise SystemExit(21)

try:
    if host_path.is_symlink() or not host_path.is_file() or not os.path.samefile(path, host_path):
        raise SystemExit(36)
except OSError:
    raise SystemExit(36)
mutation_path = host_path

if project.get("branch") != branch:
    raise SystemExit(37)
compose_files = project.get("compose_files")
if not isinstance(compose_files, list) or len(compose_files) != 1:
    raise SystemExit(38)
compose_file = compose_files[0]
if not isinstance(compose_file, str) or not compose_file:
    raise SystemExit(38)

owner, name = repository.split("/", 1)
bare_repo = Path("/gitea-repositories") / owner / f"{name}.git"
if not bare_repo.is_dir():
    raise SystemExit(24)

def git_run(*args):
    return subprocess.run(
        ["git", f"--git-dir={bare_repo}", *args],
        text=True,
        stdout=subprocess.PIPE,
        stderr=subprocess.DEVNULL,
        timeout=10,
        check=False,
    )

try:
    commit_result = git_run("rev-parse", f"{revision}^{{commit}}")
except Exception:
    raise SystemExit(25)
commit = commit_result.stdout.strip()
if commit_result.returncode != 0 or commit != revision:
    raise SystemExit(25)

try:
    branch_result = git_run("rev-parse", f"refs/heads/{branch}")
except Exception:
    raise SystemExit(26)
branch_head = branch_result.stdout.strip()
if branch_result.returncode != 0 or not branch_head:
    raise SystemExit(26)

try:
    ancestry = git_run("merge-base", "--is-ancestor", revision, branch_head)
except Exception:
    raise SystemExit(27)
if ancestry.returncode != 0:
    raise SystemExit(27)

try:
    compose = git_run("cat-file", "-e", f"{revision}:{compose_file}")
except Exception:
    raise SystemExit(28)
if compose.returncode != 0:
    raise SystemExit(28)

try:
    lock_handle = lock_path.open("a+", encoding="utf-8")
except Exception:
    raise SystemExit(29)

with lock_handle as lock:
    try:
        fcntl.flock(lock, fcntl.LOCK_EX)
    except Exception:
        raise SystemExit(30)

    try:
        projects = json.loads(mutation_path.read_text(encoding="utf-8"))
    except Exception:
        raise SystemExit(31)
    if not isinstance(projects, dict):
        raise SystemExit(22)

    current = projects.get(repository)
    changed = current is None
    if current is not None:
        if not isinstance(current, dict):
            raise SystemExit(23)
        allowed_extra_keys = {
            "env_source",
            "environment",
            "gitea_repository_id",
            "gitea_webhook_secret_file",
            "validation",
        }
        extra_keys = set(current) - set(project)
        if not extra_keys.issubset(allowed_extra_keys):
            raise SystemExit(23)
        canonical_current = {key: current.get(key) for key in project}
        if canonical_current != project:
            raise SystemExit(23)
        env_source = current.get("env_source")
        if env_source is not None:
            if (
                not isinstance(env_source, str)
                or not env_source.startswith("/srv/example/appdata/")
                or len(env_source) > 512
                or ".." in Path(env_source).parts
            ):
                raise SystemExit(23)
        environment = current.get("environment")
        if environment is not None:
            if not isinstance(environment, dict) or len(environment) > 64:
                raise SystemExit(23)
            for key, value in environment.items():
                if (
                    not isinstance(key, str)
                    or not key
                    or len(key) > 128
                    or not isinstance(value, str)
                    or len(value) > 4096
                ):
                    raise SystemExit(23)
        runnerless_keys = {
            "gitea_repository_id",
            "gitea_webhook_secret_file",
            "validation",
        }
        present_runnerless_keys = runnerless_keys.intersection(current)
        if present_runnerless_keys and present_runnerless_keys != runnerless_keys:
            raise SystemExit(23)
        repository_id = current.get("gitea_repository_id")
        if repository_id is not None and (
            not isinstance(repository_id, int)
            or isinstance(repository_id, bool)
            or repository_id <= 0
        ):
            raise SystemExit(23)
        webhook_secret_file = current.get("gitea_webhook_secret_file")
        if webhook_secret_file is not None:
            expected_secret_file = repository.replace("/", "__")
            if webhook_secret_file != expected_secret_file:
                raise SystemExit(23)
        validation = current.get("validation")
        if validation is not None:
            expected_validation = {
                "validation_gate_version": 1,
                "required": True,
                "contexts": ["Managed validation / full (push)"],
            "timeout_seconds": 3600 if repository == "jens/mediarr" else 1800,
                "poll_interval_seconds": 5,
                "max_poll_interval_seconds": 30,
            }
            if validation != expected_validation:
                raise SystemExit(23)

    if changed:
        backup = mutation_path.with_name(
            f"projects.json.appops-backup-{int(time.time())}-{os.getpid()}"
        )
        try:
            shutil.copy2(mutation_path, backup)
        except Exception:
            raise SystemExit(32)

        updated = dict(projects)
        updated[repository] = project
        temporary = mutation_path.with_name(f".{mutation_path.name}.{os.getpid()}.tmp")
        payload = json.dumps(updated, indent=2, sort_keys=True) + "\n"
        try:
            with temporary.open("w", encoding="utf-8") as handle:
                handle.write(payload)
                handle.flush()
                os.fsync(handle.fileno())
            os.chmod(temporary, stat.S_IMODE(info.st_mode))
        except Exception:
            try:
                temporary.unlink(missing_ok=True)
            except Exception:
                pass
            raise SystemExit(33)

        try:
            os.replace(temporary, mutation_path)
        except Exception:
            try:
                temporary.unlink(missing_ok=True)
            except Exception:
                pass
            raise SystemExit(34)

        directory_fd = None
        try:
            directory_fd = os.open(str(mutation_path.parent), os.O_RDONLY)
            os.fsync(directory_fd)
        except Exception:
            raise SystemExit(35)
        finally:
            if directory_fd is not None:
                os.close(directory_fd)

    print("registered" if changed else "already-registered", flush=True)
'''


def _safe_compose_file(value: str) -> str:
    path = str(value or "").strip().replace("\\", "/")
    if not path or path.startswith("/") or len(path) > 240:
        raise ValueError("Compose file must be a bounded repository-relative path")
    parts = path.split("/")
    if any(part in {"", ".", ".."} for part in parts):
        raise ValueError("Compose file path cannot contain empty or traversal segments")
    if not path.lower().endswith((".yml", ".yaml")):
        raise ValueError("Compose file must use a .yml or .yaml suffix")
    return path


class DeploymentTargetRegistry:
    """Narrow bridge for exact-SHA Compose deployment target onboarding."""

    def __init__(self, portainer: PortainerConnector | None = None):
        self.portainer = portainer or PortainerConnector()

    @staticmethod
    def _slug(repository: str) -> str:
        return repository.split("/", 1)[1]

    @staticmethod
    def default_compose_project(repository: str) -> str:
        raw = DeploymentTargetRegistry._slug(repository).lower()
        value = re.sub(r"[^a-z0-9_-]+", "-", raw).strip("-_")
        if not value:
            raise ValueError("Repository name cannot be converted to a Compose project")
        return value[:63]

    @staticmethod
    def _project(
        repository: str,
        *,
        branch: str,
        compose_file: str,
        compose_project: str,
        containers: list[str],
        health_timeout: int,
        verify_oci_revision: bool,
    ) -> dict[str, object]:
        slug = DeploymentTargetRegistry._slug(repository)
        return {
            "branch": branch,
            "slug": slug,
            "source_dir": f"/mnt/cache/appdata/gitea-deploy-runners/sources/{slug}",
            "exact_source": True,
            "compose_files": [compose_file],
            "compose_project": compose_project,
            "containers": containers,
            "verify_oci_revision": verify_oci_revision,
            "health_timeout": health_timeout,
        }

    @staticmethod
    def validate(
        repository: str,
        revision: str,
        *,
        branch: str = "main",
        compose_file: str = "docker-compose.yml",
        compose_project: str | None = None,
        containers: list[str] | None = None,
        health_timeout: int = 180,
    ) -> tuple[str, str, str, str, str, list[str], int]:
        normalized_repository = str(repository or "").strip().lower()
        normalized_revision = str(revision or "").strip().lower()
        normalized_branch = str(branch or "").strip()
        if not _REPOSITORY.fullmatch(normalized_repository):
            raise ValueError("Repository must be a canonical Jens owner/name identifier")
        slug = DeploymentTargetRegistry._slug(normalized_repository)
        if not _SLUG.fullmatch(slug):
            raise ValueError("Repository name cannot be used as a bounded deployment slug")
        if not _REVISION.fullmatch(normalized_revision):
            raise ValueError("Revision must be a full lowercase 40-character Git SHA")
        if (
            not _BRANCH.fullmatch(normalized_branch)
            or ".." in normalized_branch
            or "//" in normalized_branch
            or normalized_branch.endswith("/")
        ):
            raise ValueError("Default branch is outside the bounded Git ref contract")
        normalized_compose_file = _safe_compose_file(compose_file)
        normalized_project = str(
            compose_project
            or DeploymentTargetRegistry.default_compose_project(normalized_repository)
        ).strip().lower()
        if not _COMPOSE_PROJECT.fullmatch(normalized_project):
            raise ValueError("Compose project is outside the bounded naming contract")
        normalized_containers = [str(item or "").strip() for item in (containers or [slug])]
        if not normalized_containers or len(normalized_containers) > _MAX_CONTAINERS:
            raise ValueError("Deployment target must contain between 1 and 32 containers")
        if any(not _CONTAINER.fullmatch(item) for item in normalized_containers):
            raise ValueError("Container name is outside the bounded naming contract")
        if len(set(normalized_containers)) != len(normalized_containers):
            raise ValueError("Container names must be unique")
        timeout = int(health_timeout)
        if timeout < 30 or timeout > 900:
            raise ValueError("Health timeout must be between 30 and 900 seconds")
        return (
            normalized_repository,
            normalized_revision,
            normalized_branch,
            normalized_compose_file,
            normalized_project,
            normalized_containers,
            timeout,
        )

    def register_compose_target(
        self,
        repository: str,
        revision: str,
        *,
        branch: str = "main",
        compose_file: str = "docker-compose.yml",
        compose_project: str | None = None,
        containers: list[str] | None = None,
        health_timeout: int = 180,
        verify_oci_revision: bool = False,
    ) -> dict[str, Any]:
        try:
            (
                repository,
                revision,
                branch,
                compose_file,
                compose_project,
                containers,
                health_timeout,
            ) = self.validate(
                repository,
                revision,
                branch=branch,
                compose_file=compose_file,
                compose_project=compose_project,
                containers=containers,
                health_timeout=health_timeout,
            )
        except (TypeError, ValueError) as exc:
            return {"status": "invalid", "reason": str(exc)}

        status = self.portainer.get_container_status(_CONTROLLER)
        if status.get("status") != "ok":
            return {
                "status": "controller_unavailable",
                "reason": redact_message(
                    str(status.get("reason") or status.get("status") or "unavailable")
                ),
            }
        controller = dict(status.get("container") or {})
        if controller.get("name") != _CONTROLLER or controller.get("state") != "running":
            return {
                "status": "controller_unavailable",
                "reason": "deployment controller is not running",
            }
        container_id = str(controller.get("id") or "")
        config = self.portainer._config()
        if not config or not container_id:
            return {
                "status": "connector_unavailable",
                "reason": "Portainer deployment control is unavailable",
            }

        project = self._project(
            repository,
            branch=branch,
            compose_file=compose_file,
            compose_project=compose_project,
            containers=containers,
            health_timeout=health_timeout,
            verify_oci_revision=bool(verify_oci_revision),
        )
        command = [
            "python3",
            "-c",
            _REGISTER_SCRIPT,
            repository,
            revision,
            branch,
            json.dumps(project, separators=(",", ":"), sort_keys=True),
        ]
        endpoint = quote(str(config.endpoint_id), safe="")
        safe_container = quote(container_id, safe="")
        try:
            created = self.portainer._request(
                "POST",
                f"/api/endpoints/{endpoint}/docker/containers/{safe_container}/exec",
                json={
                    "AttachStdout": False,
                    "AttachStderr": False,
                    "Tty": False,
                    "Cmd": command,
                },
            ).json()
            exec_id = str(created.get("Id") or "")
            if not exec_id:
                return {
                    "status": "error",
                    "reason": "deployment target registration could not start",
                }
            safe_exec = quote(exec_id, safe="")
            self.portainer._request(
                "POST",
                f"/api/endpoints/{endpoint}/docker/exec/{safe_exec}/start",
                json={"Detach": True, "Tty": False},
            )

            deadline = time.monotonic() + 25
            exit_code: int | None = None
            while time.monotonic() < deadline:
                inspected = self.portainer._request(
                    "GET", f"/api/endpoints/{endpoint}/docker/exec/{safe_exec}/json"
                ).json()
                if not bool(inspected.get("Running")):
                    raw_exit = inspected.get("ExitCode")
                    exit_code = int(raw_exit) if raw_exit is not None else -1
                    break
                time.sleep(0.25)
        except (RuntimeError, ValueError, TypeError) as exc:
            return {"status": "error", "reason": redact_message(str(exc))}

        if exit_code is None:
            return {
                "status": "error",
                "reason": "deployment target registration timed out",
            }
        if exit_code == 23:
            return {
                "status": "conflict",
                "reason": "repository already has a different deployment target",
            }
        preflight_reasons = {
            20: "deployment projects registry is unavailable or unsafe",
            21: "deployment projects registry is not a regular file",
            22: "deployment projects registry does not contain an object",
            24: "mounted bare repository is unavailable",
            25: "exact revision cannot be resolved in the mounted bare repository",
            26: "default branch cannot be resolved in the mounted bare repository",
            27: "exact revision is not an ancestor of the default branch in the mounted bare repository",
            28: "configured Compose file is absent at the exact revision",
            29: "deployment registry lock file cannot be opened",
            30: "deployment registry lock cannot be acquired",
            31: "deployment projects registry cannot be read as JSON",
            32: "deployment projects registry backup cannot be created",
            33: "deployment projects registry replacement file cannot be durably written",
            34: "deployment projects registry replacement cannot be installed atomically",
            35: "deployment projects registry directory durability sync failed after replacement",
            36: "deployment projects registry host alias is unavailable or does not match the controller registry",
            37: "controller project branch does not match the requested default branch",
            38: "controller project Compose contract is invalid",
        }
        if exit_code in preflight_reasons:
            return {
                "status": "validation_failed",
                "reason": preflight_reasons[exit_code],
            }
        if exit_code != 0:
            return {
                "status": "validation_failed",
                "reason": "controller rejected the bounded repository/revision preflight; projects.json was not changed",
            }
        return {
            "status": "registered",
            "repository": repository,
            "revision": revision,
            "branch": branch,
            "slug": self._slug(repository),
            "compose_file": compose_file,
            "compose_project": compose_project,
            "container": containers[0] if len(containers) == 1 else None,
            "containers": containers,
        }

    def register_single_container(
        self,
        repository: str,
        revision: str,
        *,
        branch: str = "main",
        compose_file: str = "docker-compose.yml",
    ) -> dict[str, Any]:
        slug = str(repository or "").strip().lower().split("/", 1)[-1]
        return self.register_compose_target(
            repository,
            revision,
            branch=branch,
            compose_file=compose_file,
            containers=[slug],
        )