package main

import (
	"auto-ssl/auth"
	"auto-ssl/config"
	"auto-ssl/handlers"
	"auto-ssl/notify"
	"auto-ssl/services"
	"fmt"
	"log"
	"net/http"
	"os"
	"strings"
	"time"

	"github.com/gin-contrib/cors"
	"github.com/gin-gonic/gin"
	"github.com/robfig/cron/v3"
)

func main() {
	cfg := config.Load()

	// Initialize certificate store (JSON file persistence)
	config.InitStore(cfg)

	// Setup Gin
	gin.SetMode(gin.ReleaseMode)
	r := gin.Default()

	// CORS for Vue frontend
	r.Use(cors.New(cors.Config{
		AllowOrigins:     []string{"*"},
		AllowMethods:     []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
		AllowHeaders:     []string{"Origin", "Content-Type", "Accept", "Authorization"},
		AllowCredentials: true,
	}))

	// Serve static files for frontend
	r.Static("/assets", "./dist/assets")
	r.StaticFile("/favicon.ico", "./dist/favicon.ico")
	r.StaticFile("/favicon.svg", "./dist/favicon.svg")
	r.StaticFile("/", "./dist/index.html")

	// Public routes (no auth required)
	r.POST("/api/login", handleLogin)
	r.GET("/api/health", func(c *gin.Context) {
		c.JSON(http.StatusOK, gin.H{"status": "ok"})
	})

	// API routes with auth
	api := r.Group("/api")
	api.Use(authMiddleware())
	{
		certHandler := handlers.NewCertHandler(cfg)

		// Certificate management
		api.GET("/certificates", certHandler.ListCertificates)
		api.GET("/certificates/:id", certHandler.GetCertificate)
		api.POST("/certificates", certHandler.CreateCertificate)
		api.PUT("/certificates/:id", certHandler.UpdateCertificate)
		api.DELETE("/certificates/:id", certHandler.DeleteCertificate)
		api.POST("/certificates/:id/renew", certHandler.RenewCertificate)
		api.GET("/certificates/:id/files", certHandler.GetCertFiles)

		// Utility
		api.GET("/renewals/check", certHandler.CheckRenewals)
		api.GET("/stats", certHandler.Stats)
	}

	r.NoRoute(func(c *gin.Context) {
		// 静态资源请求直接返回404，避免返回html导致MIME类型错误
		if strings.HasPrefix(c.Request.URL.Path, "/assets/") ||
			strings.HasSuffix(c.Request.URL.Path, ".js") ||
			strings.HasSuffix(c.Request.URL.Path, ".css") ||
			strings.HasSuffix(c.Request.URL.Path, ".png") ||
			strings.HasSuffix(c.Request.URL.Path, ".svg") ||
			strings.HasSuffix(c.Request.URL.Path, ".ico") {
			c.AbortWithStatus(http.StatusNotFound)
			return
		}
		// 其他路由返回index.html给前端处理
		c.File("./dist/index.html")
	})

	// Setup cron scheduler
	c := cron.New()

	// Daily renewal check at 3:00 AM
	c.AddFunc("0 3 * * *", func() {
		log.Println("Running scheduled certificate renewal check...")
		certs := config.Store.GetActiveWithAutoRenew()

		for _, cert := range certs {
			if cert.ExpiresAt != nil && time.Until(*cert.ExpiresAt).Hours() < float64(cert.RenewDays*24) {
				log.Printf("Auto-renewing certificate for %s (expires %s)", cert.Domain, cert.ExpiresAt.Format(time.RFC3339))
				if err := services.RenewCertificate(cert, cfg); err != nil {
					cert.Status = "error"
					cert.ErrorMessage = "auto renew: " + err.Error()
					log.Printf("Auto-renew failed for %s: %v", cert.Domain, err)
				} else {
					log.Printf("Auto-renew succeeded for %s", cert.Domain)
				}
				config.Store.Upsert(cert)
			}
		}
	})

	// Certificate expiry notification check at 8:00 AM daily
	c.AddFunc("0 8 * * *", func() {
		notifyCfg := notify.LoadNotifyConfig()
		if !notifyCfg.IsConfigured() {
			log.Println("Notification not configured, skipping expiry check notification")
			return
		}
		runExpiryNotification(notifyCfg)
	})

	c.Start()

	// Set ACME HTTP-01 challenge port from env (default 8082)
	// Nginx on port 80 should proxy .well-known/acme-challenge/ to this port
	acmePort := os.Getenv("ACME_PORT")
	if acmePort == "" {
		acmePort = "8082"
	}
	services.SetHTTP01Port(acmePort)
	log.Printf("ACME HTTP-01 challenge port: %s (nginx should proxy .well-known/acme-challenge/ to this port)", acmePort)

	log.Printf("AutoSSL server starting on :%s", cfg.Port)
	if err := r.Run(":" + cfg.Port); err != nil {
		log.Fatalf("Failed to start server: %v", err)
	}
}

// handleLogin authenticates user and returns JWT token
func handleLogin(c *gin.Context) {
	var req auth.LoginRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "请输入用户名和密码"})
		return
	}

	if !auth.Authenticate(req.Username, req.Password) {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "用户名或密码错误"})
		return
	}

	token, expiresAt, err := auth.GenerateToken(req.Username)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "生成token失败"})
		return
	}

	c.JSON(http.StatusOK, auth.LoginResponse{
		Token:     token,
		Username:  req.Username,
		ExpiresAt: expiresAt,
	})
}

// authMiddleware validates JWT token on protected routes
func authMiddleware() gin.HandlerFunc {
	return func(c *gin.Context) {
		authHeader := c.GetHeader("Authorization")
		if authHeader == "" {
			// Also check query param (for websocket / event-stream compatibility)
			authHeader = c.Query("token")
			if authHeader == "" {
				c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "未授权，请先登录"})
				return
			}
			// Validate as-is (query param is the raw token)
			claims, err := auth.ValidateToken(authHeader)
			if err != nil {
				c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "token已过期或无效"})
				return
			}
			c.Set("username", claims.Username)
			c.Next()
			return
		}

		// Extract Bearer token
		tokenString := strings.TrimPrefix(authHeader, "Bearer ")
		if tokenString == authHeader {
			tokenString = authHeader
		}

		claims, err := auth.ValidateToken(tokenString)
		if err != nil {
			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "token已过期或无效"})
			return
		}

		c.Set("username", claims.Username)
		c.Next()
	}
}

// runExpiryNotification checks all certificates and sends notifications for expiring ones
func runExpiryNotification(notifyCfg *notify.Config) {
	certs := config.Store.GetAll()

	var expiringCerts []notify.CertInfo
	for _, cert := range certs {
		if cert.Status != "active" || cert.ExpiresAt == nil {
			continue
		}

		daysLeft := int(time.Until(*cert.ExpiresAt).Hours() / 24)

		// Notify if within 30 days of expiry (or already expired)
		if daysLeft <= 30 {
			info := notify.CertInfo{
				Domain:    cert.Domain,
				Status:    cert.Status,
				ExpiresAt: cert.ExpiresAt,
				DaysLeft:  daysLeft,
			}
			if daysLeft < 0 {
				info.Status = "expired"
			}
			expiringCerts = append(expiringCerts, info)
		}
	}

	if len(expiringCerts) > 0 {
		log.Printf("Found %d expiring certificates, sending notifications", len(expiringCerts))
		if err := notifyCfg.NotifyCertExpiring(expiringCerts); err != nil {
			log.Printf("Failed to send expiry notifications: %v", err)
		}
	} else {
		log.Println("No expiring certificates found, skipping notification")
	}
}

func init() {
	// Check if notification is configured and run once at startup
	time.AfterFunc(10*time.Second, func() {
		notifyCfg := notify.LoadNotifyConfig()
		if notifyCfg.IsConfigured() {
			log.Println("Running startup certificate expiry check...")
			runExpiryNotification(notifyCfg)
		}
	})

	// Validate ADMIN_USER / ADMIN_PASSWORD env setting
	adminUser := os.Getenv("ADMIN_USER")
	adminPass := os.Getenv("ADMIN_PASSWORD")
	if adminUser != "" || adminPass != "" {
		log.Printf("Admin credentials configured via environment (user: %s)", adminUser)
	}
	_ = fmt.Sprintf // import usage, prevent unused import error
}