package main

import (
	"bufio"
	"context"
	"fmt"
	"log"
	"net/http"
	"os"
	"os/signal"
	"strings"
	"syscall"
	"time"

	"neuralhunt/internal/artifact"
	"neuralhunt/internal/auth"
	"neuralhunt/internal/data"
	rtx "neuralhunt/internal/runtime"
	"neuralhunt/internal/server"
	"neuralhunt/internal/settings"
	wsx "neuralhunt/internal/ws"
)

func env(k, d string) string {
	if v := os.Getenv(k); v != "" {
		return v
	}
	return d
}

func loadDotEnv(path string) {
	f, err := os.Open(path)
	if err != nil {
		return
	}
	defer f.Close()
	s := bufio.NewScanner(f)
	for s.Scan() {
		line := strings.TrimSpace(s.Text())
		if line == "" || strings.HasPrefix(line, "#") {
			continue
		}
		if strings.HasPrefix(line, "export ") {
			line = strings.TrimSpace(strings.TrimPrefix(line, "export "))
		}
		k, v, ok := strings.Cut(line, "=")
		if !ok {
			continue
		}
		k = strings.TrimSpace(k)
		if k == "" {
			continue
		}
		if _, exists := os.LookupEnv(k); exists {
			continue
		}
		v = strings.TrimSpace(v)
		if len(v) >= 2 && ((v[0] == '"' && v[len(v)-1] == '"') || (v[0] == '\'' && v[len(v)-1] == '\'')) {
			v = v[1 : len(v)-1]
		}
		_ = os.Setenv(k, v)
	}
}

func validateSecurityConfig() error {
	if strings.EqualFold(strings.TrimSpace(os.Getenv("ALLOW_INSECURE_DEV_DEFAULTS")), "1") {
		return nil
	}
	jwt := strings.TrimSpace(os.Getenv("JWT_SECRET"))
	if len(jwt) < 32 || jwt == "dev-secret-change-me" || jwt == "change-me-to-a-long-random-secret" {
		return fmt.Errorf("JWT_SECRET must be set to a unique random value of at least 32 characters (or set ALLOW_INSECURE_DEV_DEFAULTS=1 for local development only)")
	}
	pass := strings.TrimSpace(os.Getenv("ADMIN_PASSWORD"))
	if len(pass) < 16 || pass == "change-me" {
		return fmt.Errorf("ADMIN_PASSWORD must be set to a unique value of at least 16 characters")
	}
	return nil
}

func main() {
	loadDotEnv(".env")
	if err := validateSecurityConfig(); err != nil {
		log.Fatal(err)
	}
	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
	defer cancel()

	db, err := data.OpenSQLite(ctx, env("SQLITE_PATH", "./data/neuralhunt.db"))
	if err != nil {
		log.Fatal(err)
	}
	defer db.Close()

	sm, err := settings.New(ctx, db)
	if err != nil {
		log.Fatal(err)
	}
	go sm.Run(ctx)

	store := data.New(db)
	a := auth.New(db, env("JWT_SECRET", "dev-secret-change-me"))
	hub := wsx.New()
	runtimeState := rtx.New()
	go hub.Run(ctx)

	artifactDir := env("ARTIFACT_DIR", "./data/artifacts")
	aw, err := artifact.New(db, artifactDir, sm)
	if err != nil {
		log.Fatal(err)
	}
	go aw.Run(ctx)

	srv := server.New(store, a, sm, hub, runtimeState, artifactDir, aw)
	go srv.Scheduler(ctx)

	publicSrv := &http.Server{Addr: env("HTTP_ADDR", ":8080"), Handler: srv.PublicRoutes(), ReadHeaderTimeout: 5 * time.Second, IdleTimeout: 60 * time.Second}
	adminSrv := &http.Server{Addr: env("ADMIN_HTTP_ADDR", ":8081"), Handler: srv.AdminRoutes(), ReadHeaderTimeout: 5 * time.Second, IdleTimeout: 60 * time.Second}
	go func() {
		log.Printf("public listener on %s", publicSrv.Addr)
		if err := publicSrv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
			log.Fatal(err)
		}
	}()
	go func() {
		log.Printf("admin listener on %s (do not expose publicly)", adminSrv.Addr)
		if err := adminSrv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
			log.Fatal(err)
		}
	}()

	<-ctx.Done()
	shutdown, done := context.WithTimeout(context.Background(), 10*time.Second)
	defer done()
	_ = publicSrv.Shutdown(shutdown)
	_ = adminSrv.Shutdown(shutdown)
}