package customer

import (
	"context"
	"crypto/subtle"
	"database/sql"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"log"
	"math"
	"net/http"
	"net/url"
	"strconv"
	"strings"
	"sync"
	"time"

	"github.com/go-chi/chi/v5"
)

type CreditPackage struct {
	ID            string `json:"id"`
	AmountCents   int64  `json:"amount_cents"`
	Currency      string `json:"currency"`
	CreditsMicros int64  `json:"credits_micros"`
}

type Config struct {
	PublicAddr, AdminAddr, InternalAddr                      string
	PublicBaseURL                                            string
	GamePublicURL, GameAdminURL, SharedSecret                string
	DockerHost, WorkerImage, WorkerEntrypoint, WorkerNetwork string
	WorkerRegisterURL                                        string
	WorkerRegistryUsername                                   string
	WorkerRegistryPassword                                   string
	WorkerRegistryServer                                     string
	WorkerAutoPull                                           bool
	WorkerRateMicrosPerMinute                                int64
	MaxWorkersPerCustomer                                    int
	MaxWorkersGlobal                                         int
	MaxRunningPerCustomer                                    int
	MaxRunningGlobal                                         int
	SessionTTL                                               time.Duration
	CookieSecure                                             bool
	AdminCookieSecureMode                                    string
	AdminUser, AdminPassword                                 string
	AllowManualCredits                                       bool
	LoginEnabled                                             bool
	RegistrationEnabled                                      bool
	RegistrationPOWBits                                      int
	RegistrationInviteRequired                               bool
	NewCustomerCreditsMicros                                 int64
	PositiveTipCreditsMicros                                 int64
	PayPalEnabled                                            bool
	PayPalEnvironment                                        string
	PayPalWebhookID                                          string
	PayPalLiveApprovalAck                                    string
	Packages                                                 []CreditPackage
}

type Service struct {
	store         *Store
	docker        *DockerClient
	paypal        *PayPalClient
	cfg           Config
	adminSessions sync.Map
	workerImageMu sync.Mutex
	hc            *http.Client
}

func NewService(store *Store, docker *DockerClient, paypal *PayPalClient, cfg Config) *Service {
	if cfg.SessionTTL <= 0 {
		cfg.SessionTTL = 24 * time.Hour
	}
	if cfg.WorkerRateMicrosPerMinute <= 0 {
		cfg.WorkerRateMicrosPerMinute = 1_000_000
	}
	if cfg.MaxWorkersPerCustomer <= 0 {
		cfg.MaxWorkersPerCustomer = 20
	}
	if cfg.MaxWorkersGlobal <= 0 {
		cfg.MaxWorkersGlobal = 1000
	}
	if cfg.MaxRunningPerCustomer <= 0 {
		cfg.MaxRunningPerCustomer = 10
	}
	if cfg.MaxRunningGlobal <= 0 {
		cfg.MaxRunningGlobal = 100
	}
	return &Service{store: store, docker: docker, paypal: paypal, cfg: cfg, hc: &http.Client{Timeout: 10 * time.Second}}
}

func requestIsHTTPS(r *http.Request) bool {
	if r.TLS != nil {
		return true
	}
	proto := strings.TrimSpace(strings.Split(r.Header.Get("X-Forwarded-Proto"), ",")[0])
	return strings.EqualFold(proto, "https")
}

func (s *Service) security(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("X-Content-Type-Options", "nosniff")
		w.Header().Set("X-Frame-Options", "DENY")
		w.Header().Set("Referrer-Policy", "no-referrer")
		w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=()")
		w.Header().Set("Content-Security-Policy", "default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; form-action 'self' https://www.paypal.com https://www.sandbox.paypal.com")
		// HSTS is meaningful only for HTTPS responses. In particular, do not emit it
		// on the VPN-only plain-HTTP admin listener.
		if requestIsHTTPS(r) {
			w.Header().Set("Strict-Transport-Security", "max-age=31536000")
		}
		next.ServeHTTP(w, r)
	})
}
func jsonOut(w http.ResponseWriter, status int, v any) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(status)
	_ = json.NewEncoder(w).Encode(v)
}
func decode(r *http.Request, v any) error {
	d := json.NewDecoder(io.LimitReader(r.Body, 1<<20))
	d.DisallowUnknownFields()
	return d.Decode(v)
}

const customerCookie = "neuralhunt_customer_session"
const csAdminCookie = "neuralhunt_customer_admin"

func (s *Service) cookieSameSite(name string) http.SameSite {
	// The public customer portal may return from external payment providers. Lax
	// still blocks cross-site fetch/POST cookie use while allowing normal top-level
	// navigation back to the portal. Keep the private admin cookie Strict.
	if name == customerCookie {
		return http.SameSiteLaxMode
	}
	return http.SameSiteStrictMode
}

func (s *Service) cookieSecure(r *http.Request, name string) bool {
	if name != csAdminCookie {
		// The public customer portal should normally stay HTTPS-only.
		return s.cfg.CookieSecure
	}

	// The Customer-Service admin listener is commonly reachable only through an
	// encrypted VPN but over plain HTTP. Keep its cookie policy independent from
	// the public customer portal. "auto" means Secure behind HTTPS and non-Secure
	// for a direct HTTP/VPN connection.
	switch strings.ToLower(strings.TrimSpace(s.cfg.AdminCookieSecureMode)) {
	case "0", "false", "no", "off":
		return false
	case "1", "true", "yes", "on":
		return true
	case "", "auto":
		return requestIsHTTPS(r)
	default:
		return true
	}
}

func (s *Service) setCookie(w http.ResponseWriter, r *http.Request, name, value string, ttl time.Duration) {
	now := time.Now().UTC()
	http.SetCookie(w, &http.Cookie{
		Name:     name,
		Value:    value,
		Path:     "/",
		HttpOnly: true,
		Secure:   s.cookieSecure(r, name),
		SameSite: s.cookieSameSite(name),
		MaxAge:   int(ttl.Seconds()),
		Expires:  now.Add(ttl),
	})
}
func (s *Service) clearCookie(w http.ResponseWriter, r *http.Request, name string) {
	http.SetCookie(w, &http.Cookie{
		Name:     name,
		Value:    "",
		Path:     "/",
		HttpOnly: true,
		Secure:   s.cookieSecure(r, name),
		SameSite: s.cookieSameSite(name),
		MaxAge:   -1,
		Expires:  time.Unix(1, 0).UTC(),
	})
}
func (s *Service) customerID(r *http.Request) (string, error) {
	c, err := r.Cookie(customerCookie)
	if err != nil {
		return "", err
	}
	return s.store.SessionCustomer(r.Context(), c.Value)
}
func (s *Service) requireCustomer(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		cid, err := s.customerID(r)
		if err != nil {
			jsonOut(w, 401, map[string]string{"error": "unauthorized"})
			return
		}
		ctx := context.WithValue(r.Context(), ctxKey("customer"), cid)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}

type ctxKey string

func customerID(r *http.Request) string {
	v, _ := r.Context().Value(ctxKey("customer")).(string)
	return v
}

func (s *Service) PublicRoutes(ui http.Handler) http.Handler {
	r := chi.NewRouter()
	r.Use(s.security)
	r.Get("/api/healthz", func(w http.ResponseWriter, r *http.Request) { jsonOut(w, 200, map[string]bool{"ok": true}) })
	r.Get("/api/registration/config", s.registrationConfig)
	r.Post("/api/register/challenge", s.registrationChallenge)
	r.Post("/api/register", s.register)
	r.Post("/api/login", s.login)
	r.Post("/api/logout", s.logout)
	r.Post("/api/paypal/webhook", s.paypalWebhook)
	r.Group(func(r chi.Router) {
		r.Use(s.requireCustomer)
		r.Get("/api/me", s.me)
		r.Get("/api/ledger", s.ledger)
		r.Put("/api/reward-identity", s.rewardIdentity)
		r.Get("/api/tasks", s.tasks)
		r.Get("/api/workers", s.workers)
		r.Post("/api/workers", s.createWorker)
		r.Put("/api/workers/{id}", s.updateWorker)
		r.Post("/api/workers/{id}/start", s.startWorker)
		r.Post("/api/workers/{id}/stop", s.stopWorker)
		r.Delete("/api/workers/{id}", s.deleteWorker)
		r.Get("/api/workers/{id}/identity", s.workerIdentityGet)
		r.Put("/api/workers/{id}/identity", s.workerIdentityPut)
		r.Get("/api/billing/packages", s.billingPackages)
		r.Post("/api/billing/paypal/order", s.paypalCreateOrder)
		r.Post("/api/billing/paypal/capture", s.paypalCapture)
	})
	r.Mount("/", ui)
	return r
}
func (s *Service) AdminRoutes(ui http.Handler) http.Handler {
	r := chi.NewRouter()
	r.Use(s.security)
	r.Post("/api/admin/login", s.adminLogin)
	r.Post("/api/admin/logout", s.adminLogout)
	r.Group(func(r chi.Router) {
		r.Use(s.requireAdmin)
		r.Get("/api/admin/overview", s.adminOverview)
		r.Get("/api/admin/settings", s.adminSettings)
		r.Put("/api/admin/settings", s.adminUpdateSettings)
		r.Post("/api/admin/credits/grant", s.adminCreditGrant)
		r.Post("/api/admin/customers/{id}/block", s.adminBlockCustomer)
		r.Post("/api/admin/customers/{id}/unblock", s.adminUnblockCustomer)
		r.Post("/api/admin/customers/{id}/workers/stop", s.adminStopCustomerWorkers)
		r.Put("/api/admin/customers/{id}/worker-limit", s.adminSetCustomerWorkerLimit)
		r.Get("/api/admin/tasks", s.adminTaskCatalog)
		r.Post("/api/admin/customers/{id}/workers", s.adminCreateWorkerForCustomer)
		r.Post("/api/admin/workers/{id}/stop", s.adminStopAnyWorker)
		r.Post("/api/admin/workers/{id}/update-image", s.adminUpdateWorkerImage)
		r.Post("/api/admin/workers/update-image", s.adminUpdateAllWorkerImages)
		r.Post("/api/admin/invites", s.adminCreateInvite)
	})
	r.Mount("/", ui)
	return r
}
func (s *Service) InternalRoutes() http.Handler {
	r := chi.NewRouter()
	r.Use(s.security)
	r.Post("/internal/workers/register", s.internalWorkerRegister)
	r.Post("/internal/workers/lease", s.internalWorkerLease)
	r.Post("/internal/game/positive-tip", s.internalGamePositiveTip)
	r.Get("/api/healthz", func(w http.ResponseWriter, r *http.Request) { jsonOut(w, 200, map[string]bool{"ok": true}) })
	return r
}

func (s *Service) register(w http.ResponseWriter, r *http.Request) {
	cfg := s.portalSettings(r.Context())
	if !cfg.RegistrationEnabled {
		jsonOut(w, http.StatusServiceUnavailable, map[string]string{"error": "Registrierungen sind derzeit deaktiviert."})
		return
	}
	var in struct {
		Username     string `json:"Username"`
		Password     string `json:"Password"`
		Challenge    string `json:"Challenge"`
		ProofCounter uint64 `json:"ProofCounter"`
		InviteCode   string `json:"InviteCode"`
	}
	if decode(r, &in) != nil {
		jsonOut(w, 400, map[string]string{"error": "bad json"})
		return
	}
	in.Username = strings.TrimSpace(in.Username)
	if len(in.Username) < 3 || len(in.Username) > 80 {
		jsonOut(w, 400, map[string]string{"error": "username must be 3..80 characters"})
		return
	}
	if cfg.RegistrationPOWBits > 0 {
		if !VerifyRegistrationChallenge(s.cfg.SharedSecret, in.Username, in.Challenge) || !VerifyRegistrationProof(in.Username, in.Challenge, in.ProofCounter, cfg.RegistrationPOWBits) {
			jsonOut(w, http.StatusBadRequest, map[string]string{"error": "Registrierungs-Proof-of-Work ist ungültig oder abgelaufen."})
			return
		}
	}
	inviteHash := ""
	if cfg.InviteRequired {
		if strings.TrimSpace(in.InviteCode) == "" {
			jsonOut(w, http.StatusForbidden, map[string]string{"error": "Für die Registrierung ist ein einmaliger Invite-Code erforderlich."})
			return
		}
		inviteHash = HashInviteCode(in.InviteCode)
	}
	salt, hash, err := NewPasswordHash(in.Password)
	if err != nil {
		jsonOut(w, 400, map[string]string{"error": err.Error()})
		return
	}
	cid := "cust_" + RandomToken(16)
	if err := s.store.CreateCustomer(r.Context(), cid, in.Username, salt, hash, cfg.SignupBonusMicros, inviteHash); err != nil {
		if errors.Is(err, ErrInvalidInvite) {
			jsonOut(w, http.StatusForbidden, map[string]string{"error": "Invite-Code ist ungültig, abgelaufen oder bereits verwendet."})
			return
		}
		jsonOut(w, 409, map[string]string{"error": "username already exists"})
		return
	}
	sid := RandomToken(32)
	if err := s.store.CreateSession(r.Context(), sid, cid, s.cfg.SessionTTL); err != nil {
		jsonOut(w, 500, map[string]string{"error": "session failed"})
		return
	}
	s.setCookie(w, r, customerCookie, sid, s.cfg.SessionTTL)
	jsonOut(w, 201, map[string]any{"id": cid, "username": in.Username, "signup_bonus_micros": cfg.SignupBonusMicros})
}

func (s *Service) login(w http.ResponseWriter, r *http.Request) {
	if !s.portalSettings(r.Context()).LoginEnabled {
		jsonOut(w, http.StatusServiceUnavailable, map[string]string{"error": "Anmeldung ist momentan administrativ deaktiviert."})
		return
	}
	var in struct{ Username, Password string }
	if decode(r, &in) != nil {
		jsonOut(w, 400, map[string]string{"error": "bad json"})
		return
	}
	c, salt, hash, err := s.store.CustomerByUsername(r.Context(), in.Username)
	if err != nil || !VerifyPassword(in.Password, salt, hash) {
		time.Sleep(250 * time.Millisecond)
		jsonOut(w, 401, map[string]string{"error": "invalid credentials"})
		return
	}
	if c.Blocked {
		jsonOut(w, http.StatusForbidden, map[string]string{"error": "Dieses Kundenkonto ist gesperrt."})
		return
	}
	sid := RandomToken(32)
	if err := s.store.CreateSession(r.Context(), sid, c.ID, s.cfg.SessionTTL); err != nil {
		jsonOut(w, 500, map[string]string{"error": "session failed"})
		return
	}
	s.setCookie(w, r, customerCookie, sid, s.cfg.SessionTTL)
	jsonOut(w, 200, map[string]any{"ok": true})
}
func (s *Service) logout(w http.ResponseWriter, r *http.Request) {
	if c, err := r.Cookie(customerCookie); err == nil {
		s.store.DeleteSession(r.Context(), c.Value)
	}
	s.clearCookie(w, r, customerCookie)
	jsonOut(w, 200, map[string]bool{"ok": true})
}
func (s *Service) me(w http.ResponseWriter, r *http.Request) {
	cid := customerID(r)
	c, err := s.store.CustomerByID(r.Context(), cid)
	if err != nil {
		jsonOut(w, 404, map[string]string{"error": "customer missing"})
		return
	}
	bal, _ := s.store.BalanceMicros(r.Context(), cid)
	jsonOut(w, 200, map[string]any{"customer": c, "balance_micros": bal, "worker_rate_micros_per_minute": s.cfg.WorkerRateMicrosPerMinute, "paypal_enabled": s.paypalAllowed()})
}
func (s *Service) ledger(w http.ResponseWriter, r *http.Request) {
	x, err := s.store.LedgerSummary(r.Context(), customerID(r), 60)
	if err != nil {
		jsonOut(w, 500, map[string]string{"error": err.Error()})
		return
	}
	jsonOut(w, 200, x)
}

func (s *Service) rewardIdentity(w http.ResponseWriter, r *http.Request) {
	cid := customerID(r)
	var in struct {
		LinkCode string `json:"link_code"`
		Clear    bool   `json:"clear"`
	}
	if decode(r, &in) != nil {
		jsonOut(w, 400, map[string]string{"error": "bad json"})
		return
	}

	workers, _ := s.store.Workers(r.Context(), cid)
	if in.Clear {
		// Clearing must reach the game first; otherwise old worker delegations
		// could silently remain active while the portal already looks unlinked.
		if err := s.checkGameControlPlane(r.Context()); err != nil {
			jsonOut(w, http.StatusBadGateway, map[string]string{"error": err.Error()})
			return
		}
		for _, wk := range workers {
			if wk.WorkerClientID == "" {
				continue
			}
			if err := s.syncDelegation(r.Context(), wk.WorkerClientID, ""); err != nil {
				jsonOut(w, http.StatusBadGateway, map[string]string{"error": "Reward-Kopplung konnte im Spiel nicht entfernt werden: " + err.Error()})
				return
			}
		}
		if err := s.store.SetRewardClientID(r.Context(), cid, ""); err != nil {
			jsonOut(w, 500, map[string]string{"error": err.Error()})
			return
		}
		jsonOut(w, 200, map[string]any{"ok": true, "reward_client_id": ""})
		return
	}

	if strings.TrimSpace(in.LinkCode) == "" {
		jsonOut(w, 400, map[string]string{"error": "Hosted-Code fehlt. Erzeuge ihn im Neural-Hunt-Spiel mit der gewünschten Haupt-Identität."})
		return
	}
	clientID, err := s.redeemRewardLink(r.Context(), in.LinkCode)
	if err != nil {
		log.Printf("customer reward identity %s pairing failed: %v", cid, err)
		jsonOut(w, http.StatusBadGateway, map[string]string{"error": "Hosted-Code konnte nicht gekoppelt werden: " + err.Error()})
		return
	}

	// The one-shot code has now been consumed. Persist the proven owner before
	// syncing already-known workers so a transient delegation failure does not
	// destroy a valid pairing and force the customer to generate another code.
	if err := s.store.SetRewardClientID(r.Context(), cid, clientID); err != nil {
		jsonOut(w, 500, map[string]string{"error": "Hosted-Code wurde bestätigt, aber die Haupt-Identität konnte lokal nicht gespeichert werden: " + err.Error()})
		return
	}

	var warnings []string
	for _, wk := range workers {
		if wk.WorkerClientID == "" {
			continue
		}
		if err := s.syncDelegation(r.Context(), wk.WorkerClientID, clientID); err != nil {
			warnings = append(warnings, fmt.Sprintf("Worker %s: %v", wk.ID, err))
		}
	}
	out := map[string]any{"ok": true, "reward_client_id": clientID}
	if len(warnings) > 0 {
		out["warning"] = "Haupt-Identität ist gekoppelt; bestehende Worker konnten noch nicht vollständig synchronisiert werden: " + strings.Join(warnings, "; ")
		log.Printf("customer reward identity %s coupled with delegation warnings: %s", cid, strings.Join(warnings, "; "))
	}
	jsonOut(w, 200, out)
}

func (s *Service) proxyGET(ctx context.Context, path string, out any) error {
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, strings.TrimRight(s.cfg.GamePublicURL, "/")+path, nil)
	if err != nil {
		return err
	}
	resp, err := s.hc.Do(req)
	if err != nil {
		return err
	}
	defer resp.Body.Close()
	b, _ := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
	if resp.StatusCode/100 != 2 {
		return fmt.Errorf("game HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(b)))
	}
	return json.Unmarshal(b, out)
}
func (s *Service) tasks(w http.ResponseWriter, r *http.Request) {
	var out any
	if err := s.proxyGET(r.Context(), "/api/public/tasks", &out); err != nil {
		jsonOut(w, 502, map[string]string{"error": err.Error()})
		return
	}
	jsonOut(w, 200, out)
}
func (s *Service) taskAvailable(ctx context.Context, taskID string) (bool, error) {
	var tasks []struct {
		ID     string `json:"id"`
		Paused bool   `json:"paused"`
	}
	if err := s.proxyGET(ctx, "/api/public/tasks", &tasks); err != nil {
		return false, err
	}
	for _, t := range tasks {
		if t.ID == strings.TrimSpace(taskID) {
			return true, nil
		}
	}
	return false, nil
}

func normalizePath(v string) string {
	v = strings.ToLower(strings.TrimSpace(v))
	switch v {
	case "pulse", "flux", "orbit", "auto":
		return v
	default:
		return "auto"
	}
}
func (s *Service) workers(w http.ResponseWriter, r *http.Request) {
	x, err := s.store.Workers(r.Context(), customerID(r))
	if err != nil {
		jsonOut(w, 500, map[string]string{"error": err.Error()})
		return
	}
	jsonOut(w, 200, x)
}
func (s *Service) createWorkerRecord(ctx context.Context, cid, taskID, beaconPath string, ignoreCustomerLimit bool) (Worker, error) {
	cust, err := s.store.CustomerByID(ctx, cid)
	if err != nil {
		return Worker{}, fmt.Errorf("customer not found")
	}
	if !ignoreCustomerLimit && !cust.WorkerLimitBypass {
		n, err := s.store.WorkerCount(ctx, cid, false)
		if err != nil {
			return Worker{}, err
		}
		if n >= s.cfg.MaxWorkersPerCustomer {
			return Worker{}, fmt.Errorf("worker limit reached (%d)", s.cfg.MaxWorkersPerCustomer)
		}
	}
	n, err := s.store.TotalWorkerCount(ctx)
	if err != nil {
		return Worker{}, err
	}
	if n >= s.cfg.MaxWorkersGlobal {
		return Worker{}, fmt.Errorf("global hosted worker inventory limit reached")
	}
	available, err := s.taskAvailable(ctx, taskID)
	if err != nil {
		return Worker{}, fmt.Errorf("task catalog: %w", err)
	}
	if !available {
		return Worker{}, fmt.Errorf("task is not active/available")
	}
	wid := "wrk_" + RandomToken(12)
	wk := Worker{ID: wid, CustomerID: cid, TaskID: strings.TrimSpace(taskID), BeaconPath: normalizePath(beaconPath), Volume: "nh_identity_" + strings.ReplaceAll(wid, "-", "_"), RegisterToken: RandomToken(24), RateMicrosPerMinute: s.cfg.WorkerRateMicrosPerMinute}
	if err := s.store.CreateWorker(ctx, wk); err != nil {
		return Worker{}, err
	}
	return wk, nil
}

func (s *Service) createWorker(w http.ResponseWriter, r *http.Request) {
	var in struct{ TaskID, BeaconPath string }
	if decode(r, &in) != nil || strings.TrimSpace(in.TaskID) == "" {
		jsonOut(w, 400, map[string]string{"error": "task_id required"})
		return
	}
	wk, err := s.createWorkerRecord(r.Context(), customerID(r), in.TaskID, in.BeaconPath, false)
	if err != nil {
		status := http.StatusBadRequest
		if strings.Contains(err.Error(), "limit reached") {
			status = http.StatusConflict
		}
		if strings.Contains(err.Error(), "global hosted") || strings.Contains(err.Error(), "task catalog") {
			status = http.StatusServiceUnavailable
		}
		jsonOut(w, status, map[string]string{"error": err.Error()})
		return
	}
	jsonOut(w, 201, wk)
}

func (s *Service) adminTaskCatalog(w http.ResponseWriter, r *http.Request) {
	var out any
	if err := s.proxyGET(r.Context(), "/api/public/tasks", &out); err != nil {
		jsonOut(w, http.StatusBadGateway, map[string]string{"error": err.Error()})
		return
	}
	jsonOut(w, http.StatusOK, out)
}

func (s *Service) adminCreateWorkerForCustomer(w http.ResponseWriter, r *http.Request) {
	cid := chi.URLParam(r, "id")
	var in struct {
		TaskID     string `json:"task_id"`
		BeaconPath string `json:"beacon_path"`
	}
	if decode(r, &in) != nil || strings.TrimSpace(in.TaskID) == "" {
		jsonOut(w, http.StatusBadRequest, map[string]string{"error": "task_id required"})
		return
	}
	wk, err := s.createWorkerRecord(r.Context(), cid, in.TaskID, in.BeaconPath, true)
	if err != nil {
		status := http.StatusBadRequest
		if strings.Contains(err.Error(), "global hosted") {
			status = http.StatusServiceUnavailable
		}
		if strings.Contains(err.Error(), "customer not found") {
			status = http.StatusNotFound
		}
		jsonOut(w, status, map[string]string{"error": err.Error()})
		return
	}
	jsonOut(w, http.StatusCreated, wk)
}
func (s *Service) updateWorker(w http.ResponseWriter, r *http.Request) {
	cid, wid := customerID(r), chi.URLParam(r, "id")
	wk, err := s.store.Worker(r.Context(), cid, wid)
	if err != nil {
		jsonOut(w, 404, map[string]string{"error": "worker not found"})
		return
	}
	var in struct{ TaskID, BeaconPath string }
	if decode(r, &in) != nil || strings.TrimSpace(in.TaskID) == "" {
		jsonOut(w, 400, map[string]string{"error": "task_id required"})
		return
	}
	available, err := s.taskAvailable(r.Context(), in.TaskID)
	if err != nil {
		jsonOut(w, 502, map[string]string{"error": "task catalog: " + err.Error()})
		return
	}
	if !available {
		jsonOut(w, 400, map[string]string{"error": "task is not active/available"})
		return
	}
	if wk.ContainerID != "" {
		_ = s.docker.Stop(r.Context(), wk.ContainerID, 5)
		_ = s.docker.Remove(r.Context(), wk.ContainerID)
		_ = s.store.SetWorkerRuntime(r.Context(), wid, "stopped", "", "")
	}
	if err := s.store.UpdateWorkerConfig(r.Context(), cid, wid, strings.TrimSpace(in.TaskID), normalizePath(in.BeaconPath)); err != nil {
		jsonOut(w, 500, map[string]string{"error": err.Error()})
		return
	}
	jsonOut(w, 200, map[string]bool{"ok": true})
}

func (s *Service) ensurePaidSlice(ctx context.Context, wk Worker) (ok bool, newlyCharged bool, chargedAt time.Time, err error) {
	now := time.Now().UTC()
	if wk.LastChargeAt != nil && now.Sub(*wk.LastChargeAt) < time.Minute {
		return true, false, time.Time{}, nil
	}
	ok, err = s.store.ChargeWorkerMinute(ctx, wk, now)
	return ok, ok && err == nil, now, err
}
func (s *Service) workerContainerConfig(wk Worker, name string) WorkerContainerConfig {
	registerURL := strings.TrimSpace(s.cfg.WorkerRegisterURL)
	if registerURL == "" {
		registerURL = "http://customer-service:8092/internal/workers/register"
	}
	return WorkerContainerConfig{Image: s.cfg.WorkerImage, Entrypoint: s.cfg.WorkerEntrypoint, Network: s.cfg.WorkerNetwork, GameURL: s.cfg.GamePublicURL, RegisterURL: registerURL, WorkerID: wk.ID, RegisterToken: wk.RegisterToken, TaskID: wk.TaskID, BeaconPath: wk.BeaconPath, Volume: wk.Volume, Name: name}
}

func (s *Service) ensureWorkerImage(ctx context.Context) error {
	// Avoid several customer requests triggering concurrent pulls of the same
	// image. The local inspect is cheap once the image is available.
	s.workerImageMu.Lock()
	defer s.workerImageMu.Unlock()
	auth, err := RegistryAuthHeader(s.cfg.WorkerRegistryUsername, s.cfg.WorkerRegistryPassword, s.cfg.WorkerRegistryServer)
	if err != nil {
		return err
	}
	return s.docker.EnsureImage(ctx, s.cfg.WorkerImage, s.cfg.WorkerAutoPull, auth)
}

// pullWorkerImage always asks Docker to refresh CS_WORKER_IMAGE, even if the
// tag already exists locally. This is intentionally admin-only behavior for
// mutable release tags such as worker_latest; normal worker starts keep the
// cheaper EnsureImage behavior.
func (s *Service) pullWorkerImage(ctx context.Context) error {
	s.workerImageMu.Lock()
	defer s.workerImageMu.Unlock()
	auth, err := RegistryAuthHeader(s.cfg.WorkerRegistryUsername, s.cfg.WorkerRegistryPassword, s.cfg.WorkerRegistryServer)
	if err != nil {
		return err
	}
	if err := s.docker.PullImage(ctx, s.cfg.WorkerImage, auth); err != nil {
		return fmt.Errorf("pull worker image %q: %w", s.cfg.WorkerImage, err)
	}
	return nil
}

// recreateWorkerWithCurrentImage preserves the named identity volume and the
// worker's task/beacon configuration. Running workers are resumed after the
// container was recreated; stopped workers remain stopped. Pulling is done by
// the caller so bulk updates need only one registry request.
func (s *Service) recreateWorkerWithCurrentImage(ctx context.Context, wk Worker) error {
	resume := wk.Status == "running" || wk.Status == "starting"
	if resume {
		if cust, err := s.store.CustomerByID(ctx, wk.CustomerID); err != nil || cust.Blocked {
			resume = false
		}
	}
	oldID := wk.ContainerID
	if oldID != "" {
		_ = s.docker.Stop(ctx, oldID, 5)
		if err := s.docker.Remove(ctx, oldID); err != nil {
			return fmt.Errorf("remove old worker container: %w", err)
		}
	}
	name := "neuralhunt-worker-" + strings.TrimPrefix(wk.ID, "wrk_")
	// Clear a crash-orphan with the deterministic name. Remove is idempotent for
	// 404s and never removes the named identity volume (v=false).
	_ = s.docker.Remove(ctx, name)
	containerID, err := s.docker.CreateWorker(ctx, s.workerContainerConfig(wk, name))
	if err != nil {
		_ = s.store.SetWorkerRuntime(ctx, wk.ID, "error", "", "image update: "+err.Error())
		return err
	}
	if resume {
		if err := s.docker.Start(ctx, containerID); err != nil {
			_ = s.docker.Remove(ctx, containerID)
			_ = s.store.SetWorkerRuntime(ctx, wk.ID, "error", "", "image update start: "+err.Error())
			return err
		}
		if err := s.store.SetWorkerRuntime(ctx, wk.ID, "running", containerID, ""); err != nil {
			_ = s.docker.Stop(ctx, containerID, 2)
			return err
		}
		return nil
	}
	return s.store.SetWorkerRuntime(ctx, wk.ID, "stopped", containerID, "")
}

// ensureWorkerContainer makes the worker identity volume addressable through
// Docker's archive API even when a previous config change removed the old
// container. The helper container remains stopped until the customer starts it.
func (s *Service) ensureWorkerContainer(ctx context.Context, wk Worker) (Worker, error) {
	if wk.ContainerID != "" {
		return wk, nil
	}
	if err := s.ensureWorkerImage(ctx); err != nil {
		return wk, err
	}
	name := "neuralhunt-worker-" + strings.TrimPrefix(wk.ID, "wrk_")
	id, err := s.docker.CreateWorker(ctx, s.workerContainerConfig(wk, name))
	if err != nil {
		return wk, err
	}
	wk.ContainerID = id
	if err := s.store.SetWorkerRuntime(ctx, wk.ID, "stopped", id, ""); err != nil {
		_ = s.docker.Remove(ctx, id)
		return wk, err
	}
	return wk, nil
}

func (s *Service) startWorker(w http.ResponseWriter, r *http.Request) {
	cid, wid := customerID(r), chi.URLParam(r, "id")
	wk, err := s.store.Worker(r.Context(), cid, wid)
	if err != nil {
		jsonOut(w, 404, map[string]string{"error": "worker not found"})
		return
	}
	if wk.Status != "running" {
		cust, custErr := s.store.CustomerByID(r.Context(), cid)
		if custErr != nil {
			jsonOut(w, 404, map[string]string{"error": "customer not found"})
			return
		}
		if !cust.WorkerLimitBypass {
			if n, _ := s.store.WorkerCount(r.Context(), cid, true); n >= s.cfg.MaxRunningPerCustomer {
				jsonOut(w, 409, map[string]string{"error": fmt.Sprintf("running worker limit reached (%d)", s.cfg.MaxRunningPerCustomer)})
				return
			}
		}
		if n, _ := s.store.RunningWorkerCount(r.Context()); n >= s.cfg.MaxRunningGlobal {
			jsonOut(w, 503, map[string]string{"error": "hosted worker capacity reached"})
			return
		}
	}
	available, err := s.taskAvailable(r.Context(), wk.TaskID)
	if err != nil {
		jsonOut(w, 502, map[string]string{"error": "task catalog: " + err.Error()})
		return
	}
	if !available {
		jsonOut(w, 409, map[string]string{"error": "assigned task is no longer active; choose another task"})
		return
	}
	cust, err := s.store.CustomerByID(r.Context(), cid)
	if err != nil || strings.TrimSpace(cust.RewardClientID) == "" {
		jsonOut(w, 409, map[string]string{"error": "configure and verify a main reward identity before starting hosted workers"})
		return
	}
	if err := s.ensureWorkerImage(r.Context()); err != nil {
		jsonOut(w, 502, map[string]string{"error": err.Error()})
		return
	}
	claimed, err := s.store.ClaimWorkerStart(r.Context(), cid, wid)
	if err != nil {
		jsonOut(w, 500, map[string]string{"error": err.Error()})
		return
	}
	if !claimed {
		jsonOut(w, 409, map[string]string{"error": "worker is already running or starting"})
		return
	}
	ok, newlyCharged, chargedAt, err := s.ensurePaidSlice(r.Context(), wk)
	if err != nil {
		_ = s.store.SetWorkerRuntime(r.Context(), wid, "error", wk.ContainerID, err.Error())
		jsonOut(w, 500, map[string]string{"error": err.Error()})
		return
	}
	if !ok {
		_ = s.store.SetWorkerRuntime(r.Context(), wid, "stopped", wk.ContainerID, "prepaid balance exhausted")
		jsonOut(w, 402, map[string]string{"error": "prepaid balance exhausted"})
		return
	}
	if wk.ContainerID != "" {
		_ = s.docker.Remove(r.Context(), wk.ContainerID)
	}
	name := "neuralhunt-worker-" + strings.TrimPrefix(wid, "wrk_")
	_ = s.docker.Remove(r.Context(), name) // clears a crash-orphan with the deterministic name
	containerID, err := s.docker.CreateWorker(r.Context(), s.workerContainerConfig(wk, name))
	if err == nil {
		err = s.docker.Start(r.Context(), containerID)
	}
	if err != nil {
		if containerID != "" {
			_ = s.docker.Stop(r.Context(), containerID, 2)
			_ = s.docker.Remove(r.Context(), containerID)
		}
		if newlyCharged {
			_ = s.store.RefundWorkerStartMinute(r.Context(), wk, chargedAt, "docker_start_failed")
		}
		_ = s.store.SetWorkerRuntime(r.Context(), wid, "error", "", err.Error())
		jsonOut(w, 502, map[string]string{"error": err.Error()})
		return
	}
	if err := s.store.SetWorkerRuntime(r.Context(), wid, "running", containerID, ""); err != nil {
		_ = s.docker.Stop(r.Context(), containerID, 2)
		_ = s.docker.Remove(r.Context(), containerID)
		if newlyCharged {
			_ = s.store.RefundWorkerStartMinute(r.Context(), wk, chargedAt, "runtime_state_failed")
		}
		jsonOut(w, 500, map[string]string{"error": "worker state could not be persisted"})
		return
	}
	jsonOut(w, 200, map[string]any{"ok": true, "container_id": containerID})
}
func (s *Service) stopWorker(w http.ResponseWriter, r *http.Request) {
	cid, wid := customerID(r), chi.URLParam(r, "id")
	wk, err := s.store.Worker(r.Context(), cid, wid)
	if err != nil {
		jsonOut(w, 404, map[string]string{"error": "worker not found"})
		return
	}
	if err := s.stopWorkerInternal(r.Context(), wk, "stopped"); err != nil {
		jsonOut(w, 502, map[string]string{"error": err.Error()})
		return
	}
	jsonOut(w, 200, map[string]bool{"ok": true})
}
func (s *Service) stopWorkerInternal(ctx context.Context, wk Worker, status string) error {
	// Revoke the lease in SQLite first. Even if Docker itself is temporarily
	// unavailable, the worker's next lease renewal will fail and its agent will
	// self-terminate instead of continuing with a blocked/stopped account.
	if err := s.store.SetWorkerRuntime(ctx, wk.ID, status, wk.ContainerID, ""); err != nil {
		return err
	}
	if wk.ContainerID != "" {
		if err := s.docker.Stop(ctx, wk.ContainerID, 5); err != nil && !strings.Contains(err.Error(), "304") {
			return err
		}
	}
	return nil
}
func (s *Service) deleteWorker(w http.ResponseWriter, r *http.Request) {
	cid, wid := customerID(r), chi.URLParam(r, "id")
	wk, err := s.store.Worker(r.Context(), cid, wid)
	if err != nil {
		jsonOut(w, 404, map[string]string{"error": "worker not found"})
		return
	}
	if wk.ContainerID != "" {
		_ = s.docker.Stop(r.Context(), wk.ContainerID, 3)
		_ = s.docker.Remove(r.Context(), wk.ContainerID)
	}
	if wk.WorkerClientID != "" {
		_ = s.syncDelegation(r.Context(), wk.WorkerClientID, "")
	}
	if err := s.store.DeleteWorker(r.Context(), cid, wid); err != nil {
		jsonOut(w, 500, map[string]string{"error": err.Error()})
		return
	}
	_ = s.docker.RemoveVolume(r.Context(), wk.Volume)
	jsonOut(w, 200, map[string]bool{"ok": true})
}
func (s *Service) workerIdentityGet(w http.ResponseWriter, r *http.Request) {
	wk, err := s.store.Worker(r.Context(), customerID(r), chi.URLParam(r, "id"))
	if err != nil {
		jsonOut(w, 404, map[string]string{"error": "worker not found"})
		return
	}
	if wk.ContainerID == "" {
		jsonOut(w, 409, map[string]string{"error": "worker identity does not exist yet; start the worker once or upload an identity first"})
		return
	}
	b, err := s.docker.GetFile(r.Context(), wk.ContainerID, "/identity/identity.json")
	if err != nil {
		jsonOut(w, 502, map[string]string{"error": err.Error()})
		return
	}
	w.Header().Set("Content-Type", "application/json")
	w.Header().Set("Content-Disposition", `attachment; filename="neuralhunt-worker-identity.json"`)
	w.Header().Set("Cache-Control", "no-store")
	_, _ = w.Write(b)
}
func (s *Service) workerIdentityPut(w http.ResponseWriter, r *http.Request) {
	wk, err := s.store.Worker(r.Context(), customerID(r), chi.URLParam(r, "id"))
	if err != nil {
		jsonOut(w, 404, map[string]string{"error": "worker not found"})
		return
	}
	wk, err = s.ensureWorkerContainer(r.Context(), wk)
	if err != nil {
		jsonOut(w, 502, map[string]string{"error": err.Error()})
		return
	}
	b, err := io.ReadAll(io.LimitReader(r.Body, 256<<10))
	if err != nil || len(b) == 0 {
		jsonOut(w, 400, map[string]string{"error": "identity JSON required"})
		return
	}
	if err := ValidateRawIdentity(b); err != nil {
		jsonOut(w, 400, map[string]string{"error": err.Error()})
		return
	}
	if wk.Status == "running" {
		_ = s.docker.Stop(r.Context(), wk.ContainerID, 5)
	}
	if err := s.docker.PutFile(r.Context(), wk.ContainerID, "/identity", "identity.json", b); err != nil {
		jsonOut(w, 502, map[string]string{"error": err.Error()})
		return
	}
	_ = s.store.SetWorkerClient(r.Context(), wk.ID, "")
	_ = s.store.SetWorkerRuntime(r.Context(), wk.ID, "stopped", wk.ContainerID, "")
	jsonOut(w, 200, map[string]bool{"ok": true})
}

func (s *Service) authenticateWorkerInternal(r *http.Request, workerID string) (Worker, bool) {
	wk, err := s.store.WorkerByID(r.Context(), workerID)
	if err != nil {
		return Worker{}, false
	}
	provided := strings.TrimSpace(strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer "))
	if len(provided) != len(wk.RegisterToken) || subtle.ConstantTimeCompare([]byte(provided), []byte(wk.RegisterToken)) != 1 {
		return Worker{}, false
	}
	return wk, true
}

func (s *Service) internalWorkerLease(w http.ResponseWriter, r *http.Request) {
	var in struct {
		WorkerID string `json:"worker_id"`
	}
	if decode(r, &in) != nil || strings.TrimSpace(in.WorkerID) == "" {
		jsonOut(w, 400, map[string]string{"error": "worker_id required"})
		return
	}
	wk, ok := s.authenticateWorkerInternal(r, in.WorkerID)
	if !ok {
		jsonOut(w, 401, map[string]string{"error": "unauthorized"})
		return
	}
	if wk.Status != "running" && wk.Status != "starting" {
		jsonOut(w, 409, map[string]string{"error": "worker lease revoked"})
		return
	}
	if cust, err := s.store.CustomerByID(r.Context(), wk.CustomerID); err != nil || cust.Blocked {
		jsonOut(w, 409, map[string]string{"error": "worker lease revoked"})
		return
	}
	jsonOut(w, 200, map[string]any{"ok": true, "lease_sec": 45})
}

func (s *Service) internalWorkerRegister(w http.ResponseWriter, r *http.Request) {
	var in struct {
		WorkerID string `json:"worker_id"`
		ClientID string `json:"client_id"`
	}
	if decode(r, &in) != nil {
		jsonOut(w, 400, map[string]string{"error": "bad json"})
		return
	}
	wk, ok := s.authenticateWorkerInternal(r, in.WorkerID)
	if !ok {
		jsonOut(w, 401, map[string]string{"error": "unauthorized"})
		return
	}
	// RestartPolicy=unless-stopped is a recovery mechanism, never a lease bypass.
	// A container that was explicitly revoked/blocked must fail before it can
	// reconnect to the game and submit guesses.
	if wk.Status != "running" && wk.Status != "starting" {
		jsonOut(w, 409, map[string]string{"error": "worker lease revoked"})
		return
	}
	if cust, err := s.store.CustomerByID(r.Context(), wk.CustomerID); err != nil || cust.Blocked {
		jsonOut(w, 409, map[string]string{"error": "worker lease revoked"})
		return
	}
	if err := s.store.SetWorkerClient(r.Context(), wk.ID, in.ClientID); err != nil {
		jsonOut(w, 500, map[string]string{"error": err.Error()})
		return
	}
	cust, _ := s.store.CustomerByID(r.Context(), wk.CustomerID)
	if err := s.syncDelegation(r.Context(), in.ClientID, cust.RewardClientID); err != nil {
		_ = s.store.SetWorkerRuntime(r.Context(), wk.ID, "error", wk.ContainerID, "delegation failed: "+err.Error())
		jsonOut(w, 502, map[string]string{"error": "delegation failed: " + err.Error()})
		return
	}
	jsonOut(w, 200, map[string]bool{"ok": true})
}

// CheckGameControlPlane verifies that the configured private game listener is
// reachable and that both services use the same hosted-service secret. It is
// safe to call at startup and does not consume a Hosted Code.
func (s *Service) CheckGameControlPlane(ctx context.Context) error {
	return s.checkGameControlPlane(ctx)
}

func (s *Service) checkGameControlPlane(ctx context.Context) error {
	if strings.TrimSpace(s.cfg.SharedSecret) == "" {
		return errors.New("CUSTOMER_SERVICE_SHARED_SECRET fehlt")
	}
	base := strings.TrimRight(strings.TrimSpace(s.cfg.GameAdminURL), "/")
	if base == "" {
		return errors.New("CS_GAME_ADMIN_URL fehlt")
	}
	endpoint := base + "/api/internal/customer-service/health"
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
	if err != nil {
		return err
	}
	req.Header.Set("Authorization", "Bearer "+s.cfg.SharedSecret)
	resp, err := s.hc.Do(req)
	if err != nil {
		return fmt.Errorf("Game-Control-Plane unter %s nicht erreichbar: %w. Bei lokalem 'go run' normalerweise CS_GAME_ADMIN_URL=http://127.0.0.1:8081; im Compose-Netz http://app:8081", base, err)
	}
	defer resp.Body.Close()
	b, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
	if resp.StatusCode == http.StatusUnauthorized {
		return errors.New("Game-Control-Plane erreichbar, aber CUSTOMER_SERVICE_SHARED_SECRET stimmt zwischen Game Server und Customer Service nicht überein")
	}
	if resp.StatusCode == http.StatusNotFound {
		return fmt.Errorf("Game-Control-Plane antwortet mit HTTP 404. CS_GAME_ADMIN_URL=%s zeigt wahrscheinlich auf den öffentlichen Listener/Reverse-Proxy oder auf ein älteres Game-Image ohne Hosted-Control-Plane", base)
	}
	if resp.StatusCode/100 != 2 {
		return fmt.Errorf("Game-Control-Plane HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(b)))
	}
	var out struct {
		OK                    bool   `json:"ok"`
		Service               string `json:"service"`
		CustomerLinkSupported bool   `json:"customer_link_supported"`
	}
	if err := json.Unmarshal(b, &out); err != nil {
		return fmt.Errorf("Game-Control-Plane liefert keine gültige JSON-Antwort: %w", err)
	}
	if !out.OK || out.Service != "neuralhunt-game-control-plane" || !out.CustomerLinkSupported {
		return errors.New("Game-Control-Plane ist erreichbar, unterstützt aber die erwartete Hosted-Code-Schnittstelle nicht")
	}
	return nil
}

func (s *Service) redeemRewardLink(ctx context.Context, code string) (string, error) {
	if err := s.checkGameControlPlane(ctx); err != nil {
		return "", err
	}
	body, _ := json.Marshal(map[string]string{"code": strings.TrimSpace(code)})
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(s.cfg.GameAdminURL, "/")+"/api/internal/customer-link/consume", strings.NewReader(string(body)))
	if err != nil {
		return "", err
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer "+s.cfg.SharedSecret)
	resp, err := s.hc.Do(req)
	if err != nil {
		return "", err
	}
	defer resp.Body.Close()
	b, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
	if resp.StatusCode == http.StatusUnauthorized {
		return "", errors.New("Game Server lehnt CUSTOMER_SERVICE_SHARED_SECRET ab")
	}
	if resp.StatusCode == http.StatusNotFound {
		return "", errors.New("Hosted-Code ist abgelaufen, ungültig oder bereits verwendet")
	}
	if resp.StatusCode/100 != 2 {
		return "", fmt.Errorf("Game-Pairing HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(b)))
	}
	var out struct {
		ClientID string `json:"client_id"`
	}
	if err := json.Unmarshal(b, &out); err != nil {
		return "", err
	}
	if strings.TrimSpace(out.ClientID) == "" {
		return "", errors.New("game returned empty reward identity")
	}
	return strings.TrimSpace(out.ClientID), nil
}

func (s *Service) rewardIdentityExists(ctx context.Context, clientID string) (bool, error) {
	if strings.TrimSpace(s.cfg.SharedSecret) == "" {
		return false, errors.New("CUSTOMER_SERVICE_SHARED_SECRET missing")
	}
	body, _ := json.Marshal(map[string]string{"client_id": clientID})
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(s.cfg.GameAdminURL, "/")+"/api/internal/identity-exists", strings.NewReader(string(body)))
	if err != nil {
		return false, err
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer "+s.cfg.SharedSecret)
	resp, err := s.hc.Do(req)
	if err != nil {
		return false, err
	}
	defer resp.Body.Close()
	b, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
	if resp.StatusCode/100 != 2 {
		return false, fmt.Errorf("game identity HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(b)))
	}
	var out struct {
		Exists bool `json:"exists"`
	}
	if err := json.Unmarshal(b, &out); err != nil {
		return false, err
	}
	return out.Exists, nil
}

func (s *Service) syncDelegation(ctx context.Context, worker, owner string) error {
	if strings.TrimSpace(s.cfg.SharedSecret) == "" {
		return errors.New("CUSTOMER_SERVICE_SHARED_SECRET missing")
	}
	body, _ := json.Marshal(map[string]string{"worker_client_id": worker, "owner_client_id": owner})
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(s.cfg.GameAdminURL, "/")+"/api/internal/delegations", strings.NewReader(string(body)))
	if err != nil {
		return err
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer "+s.cfg.SharedSecret)
	resp, err := s.hc.Do(req)
	if err != nil {
		return err
	}
	defer resp.Body.Close()
	b, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
	if resp.StatusCode/100 != 2 {
		return fmt.Errorf("game delegation HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(b)))
	}
	return nil
}

func (s *Service) RunBilling(ctx context.Context) {
	ticker := time.NewTicker(2 * time.Second)
	defer ticker.Stop()
	for {
		select {
		case <-ctx.Done():
			return
		case <-ticker.C:
			s.billOnce(ctx)
		}
	}
}
func (s *Service) billOnce(ctx context.Context) {
	workers, err := s.store.RunningWorkers(ctx)
	if err != nil {
		log.Printf("customer billing: %v", err)
		return
	}
	now := time.Now().UTC()
	for _, wk := range workers {
		if cust, err := s.store.CustomerByID(ctx, wk.CustomerID); err == nil && cust.Blocked {
			_ = s.stopWorkerInternal(ctx, wk, "stopped")
			log.Printf("billing worker %s stopped: customer account blocked", wk.ID)
			continue
		}
		if wk.ContainerID == "" {
			continue
		}
		running, err := s.docker.Running(ctx, wk.ContainerID)
		if err != nil || !running {
			_ = s.store.SetWorkerRuntime(ctx, wk.ID, "stopped", wk.ContainerID, "")
			continue
		}
		last := wk.LastChargeAt
		if last == nil {
			t := now
			last = &t
		}
		for now.Sub(*last) >= time.Minute {
			next := last.Add(time.Minute)
			ok, err := s.store.ChargeWorkerMinute(ctx, wk, next)
			if err != nil {
				log.Printf("billing worker %s: %v", wk.ID, err)
				break
			}
			if !ok {
				_ = s.stopWorkerInternal(ctx, wk, "stopped")
				log.Printf("billing worker %s stopped: prepaid balance exhausted", wk.ID)
				break
			}
			last = &next
			wk.LastChargeAt = last
		}
	}
}

func (s *Service) billingPackages(w http.ResponseWriter, r *http.Request) {
	enabled := s.paypalAllowed()
	packages := s.cfg.Packages
	if !enabled {
		packages = nil
	}
	jsonOut(w, 200, map[string]any{"paypal_enabled": enabled, "environment": s.cfg.PayPalEnvironment, "packages": packages})
}
func (s *Service) paypalAllowed() bool {
	if !s.cfg.PayPalEnabled || s.paypal == nil || !s.paypal.Ready() {
		return false
	}
	if strings.EqualFold(s.cfg.PayPalEnvironment, "live") && s.cfg.PayPalLiveApprovalAck != "I_HAVE_PAYPAL_APPROVAL" {
		return false
	}
	return true
}
func (s *Service) packageByID(id string) (CreditPackage, bool) {
	for _, p := range s.cfg.Packages {
		if p.ID == id {
			return p, true
		}
	}
	return CreditPackage{}, false
}
func centsValue(c int64) string {
	return fmt.Sprintf("%d.%02d", c/100, int64(math.Abs(float64(c%100))))
}
func parseMoneyCents(v string) (int64, error) {
	v = strings.TrimSpace(v)
	if v == "" || strings.HasPrefix(v, "-") || strings.HasPrefix(v, "+") {
		return 0, errors.New("invalid money value")
	}
	whole, frac, hasDot := strings.Cut(v, ".")
	if whole == "" {
		whole = "0"
	}
	if hasDot {
		if len(frac) > 2 {
			return 0, errors.New("money value has more than two decimals")
		}
		for len(frac) < 2 {
			frac += "0"
		}
	} else {
		frac = "00"
	}
	w, err := strconv.ParseInt(whole, 10, 64)
	if err != nil || w < 0 {
		return 0, errors.New("invalid money value")
	}
	f, err := strconv.ParseInt(frac, 10, 64)
	if err != nil || f < 0 || f > 99 {
		return 0, errors.New("invalid money value")
	}
	if w > (math.MaxInt64-f)/100 {
		return 0, errors.New("money value too large")
	}
	return w*100 + f, nil
}
func (s *Service) paypalCreateOrder(w http.ResponseWriter, r *http.Request) {
	if !s.paypalAllowed() {
		jsonOut(w, 503, map[string]string{"error": "PayPal is disabled or live approval acknowledgement is missing"})
		return
	}
	var in struct {
		PackageID string `json:"package_id"`
	}
	if decode(r, &in) != nil {
		jsonOut(w, 400, map[string]string{"error": "bad json"})
		return
	}
	pkg, ok := s.packageByID(in.PackageID)
	if !ok {
		jsonOut(w, 400, map[string]string{"error": "unknown package"})
		return
	}
	cid := customerID(r)
	base := strings.TrimRight(s.cfg.PublicBaseURL, "/")
	order, err := s.paypal.CreateOrder(r.Context(), "credits:"+cid+":"+pkg.ID, "Neural Hunt hosted worker credits", centsValue(pkg.AmountCents), pkg.Currency, base+"/?paypal=return", base+"/?paypal=cancel")
	if err != nil {
		jsonOut(w, 502, map[string]string{"error": err.Error()})
		return
	}
	approve := ApprovalURL(order)
	if order.ID == "" || approve == "" {
		jsonOut(w, 502, map[string]string{"error": "PayPal did not return an approval URL"})
		return
	}
	if err := s.store.UpsertPayPalOrder(r.Context(), order.ID, cid, pkg.ID, pkg.AmountCents, pkg.Currency, pkg.CreditsMicros, order.Status); err != nil {
		jsonOut(w, 500, map[string]string{"error": err.Error()})
		return
	}
	jsonOut(w, 201, map[string]string{"order_id": order.ID, "approval_url": approve})
}
func (s *Service) paypalCapture(w http.ResponseWriter, r *http.Request) {
	if !s.paypalAllowed() {
		jsonOut(w, 503, map[string]string{"error": "PayPal disabled"})
		return
	}
	var in struct {
		OrderID string `json:"order_id"`
	}
	if decode(r, &in) != nil {
		jsonOut(w, 400, map[string]string{"error": "bad json"})
		return
	}
	stored, err := s.store.PayPalOrder(r.Context(), in.OrderID)
	if err != nil || stored.CustomerID != customerID(r) {
		jsonOut(w, 404, map[string]string{"error": "order not found"})
		return
	}
	view, err := s.paypal.CaptureOrder(r.Context(), stored.OrderID)
	if err != nil {
		view, err = s.paypal.GetOrder(r.Context(), stored.OrderID)
	}
	if err != nil {
		jsonOut(w, 502, map[string]string{"error": err.Error()})
		return
	}
	if err := s.reconcilePayPal(r.Context(), stored, view); err != nil {
		jsonOut(w, 409, map[string]string{"error": err.Error()})
		return
	}
	bal, _ := s.store.BalanceMicros(r.Context(), stored.CustomerID)
	jsonOut(w, 200, map[string]any{"ok": true, "balance_micros": bal})
}
func (s *Service) reconcilePayPal(ctx context.Context, stored PayPalOrder, view PayPalOrderView) error {
	if !strings.EqualFold(view.Status, "COMPLETED") {
		return fmt.Errorf("PayPal order status is %s", view.Status)
	}
	if len(view.PurchaseUnits) < 1 {
		return errors.New("PayPal order has no purchase unit")
	}
	cents, err := parseMoneyCents(view.PurchaseUnits[0].Amount.Value)
	if err != nil {
		return err
	}
	if cents != stored.AmountCents || !strings.EqualFold(view.PurchaseUnits[0].Amount.CurrencyCode, stored.Currency) {
		return errors.New("PayPal captured amount/currency does not match requested credit package")
	}
	captureID := ""
	for _, c := range view.PurchaseUnits[0].Payments.Captures {
		if !strings.EqualFold(c.Status, "COMPLETED") {
			continue
		}
		cc, err := parseMoneyCents(c.Amount.Value)
		if err == nil && cc == stored.AmountCents && strings.EqualFold(c.Amount.CurrencyCode, stored.Currency) {
			captureID = c.ID
			break
		}
	}
	if captureID == "" {
		return errors.New("PayPal order has no matching completed capture")
	}
	return s.store.CompletePayPalOrder(ctx, stored.OrderID, captureID)
}
func findOrderID(v any) string {
	switch x := v.(type) {
	case map[string]any:
		if sd, ok := x["supplementary_data"].(map[string]any); ok {
			if rel, ok := sd["related_ids"].(map[string]any); ok {
				if id, ok := rel["order_id"].(string); ok {
					return id
				}
			}
		}
		for k, v := range x {
			if k == "order_id" {
				if id, ok := v.(string); ok {
					return id
				}
			}
			if id := findOrderID(v); id != "" {
				return id
			}
		}
	case []any:
		for _, v := range x {
			if id := findOrderID(v); id != "" {
				return id
			}
		}
	}
	return ""
}
func (s *Service) paypalWebhook(w http.ResponseWriter, r *http.Request) {
	if !s.paypalAllowed() {
		jsonOut(w, 503, map[string]string{"error": "PayPal disabled"})
		return
	}
	raw, err := io.ReadAll(io.LimitReader(r.Body, 2<<20))
	if err != nil {
		jsonOut(w, 400, map[string]string{"error": "bad body"})
		return
	}
	ok, err := s.paypal.VerifyWebhook(r.Context(), s.cfg.PayPalWebhookID, r.Header, raw)
	if err != nil || !ok {
		jsonOut(w, 401, map[string]string{"error": "invalid PayPal webhook signature"})
		return
	}
	var ev any
	if json.Unmarshal(raw, &ev) != nil {
		jsonOut(w, 400, map[string]string{"error": "bad event"})
		return
	}
	orderID := findOrderID(ev)
	if orderID != "" {
		if stored, err := s.store.PayPalOrder(r.Context(), orderID); err == nil {
			if view, err := s.paypal.GetOrder(r.Context(), orderID); err == nil {
				_ = s.reconcilePayPal(r.Context(), stored, view)
			}
		}
	}
	jsonOut(w, 200, map[string]bool{"ok": true})
}

func (s *Service) adminLogin(w http.ResponseWriter, r *http.Request) {
	var in struct{ Username, Password string }
	if decode(r, &in) != nil {
		jsonOut(w, 400, map[string]string{"error": "bad json"})
		return
	}
	uok := len(in.Username) == len(s.cfg.AdminUser) && subtle.ConstantTimeCompare([]byte(in.Username), []byte(s.cfg.AdminUser)) == 1
	pok := len(in.Password) == len(s.cfg.AdminPassword) && subtle.ConstantTimeCompare([]byte(in.Password), []byte(s.cfg.AdminPassword)) == 1
	if !uok || !pok {
		time.Sleep(300 * time.Millisecond)
		jsonOut(w, 401, map[string]string{"error": "invalid credentials"})
		return
	}
	sid := RandomToken(32)
	s.adminSessions.Store(sid, time.Now().Add(12*time.Hour))
	s.setCookie(w, r, csAdminCookie, sid, 12*time.Hour)
	jsonOut(w, 200, map[string]bool{"ok": true})
}
func (s *Service) requireAdmin(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		c, err := r.Cookie(csAdminCookie)
		if err != nil {
			jsonOut(w, 401, map[string]string{"error": "unauthorized"})
			return
		}
		v, ok := s.adminSessions.Load(c.Value)
		exp, _ := v.(time.Time)
		if !ok || time.Now().After(exp) {
			s.adminSessions.Delete(c.Value)
			jsonOut(w, 401, map[string]string{"error": "unauthorized"})
			return
		}
		next.ServeHTTP(w, r)
	})
}
func (s *Service) adminLogout(w http.ResponseWriter, r *http.Request) {
	if c, err := r.Cookie(csAdminCookie); err == nil {
		s.adminSessions.Delete(c.Value)
	}
	s.clearCookie(w, r, csAdminCookie)
	jsonOut(w, 200, map[string]bool{"ok": true})
}
func (s *Service) adminOverview(w http.ResponseWriter, r *http.Request) {
	rows, err := s.store.DB.QueryContext(r.Context(), `SELECT c.id,c.username,c.reward_client_id,c.blocked,c.blocked_reason,c.blocked_at,c.worker_limit_bypass,c.created_at,COALESCE((SELECT sum(delta_micros) FROM credit_ledger l WHERE l.customer_id=c.id),0) FROM customers c ORDER BY c.created_at DESC LIMIT 500`)
	if err != nil {
		jsonOut(w, 500, map[string]string{"error": err.Error()})
		return
	}
	defer rows.Close()
	var out []map[string]any
	for rows.Next() {
		var id, user, reward, blockedReason string
		var blocked, workerLimitBypass int
		var blockedAt sql.NullInt64
		var created, bal int64
		if err := rows.Scan(&id, &user, &reward, &blocked, &blockedReason, &blockedAt, &workerLimitBypass, &created, &bal); err != nil {
			continue
		}
		workers, _ := s.store.Workers(r.Context(), id)
		running := 0
		for _, wk := range workers {
			if wk.Status == "running" {
				running++
			}
		}
		item := map[string]any{
			"id": id, "username": user, "reward_client_id": reward,
			"blocked": blocked != 0, "blocked_reason": blockedReason, "worker_limit_bypass": workerLimitBypass != 0,
			"created_at": time.UnixMilli(created).UTC(), "balance_micros": bal,
			"workers": len(workers), "running": running, "worker_items": workers,
		}
		if blockedAt.Valid {
			item["blocked_at"] = time.UnixMilli(blockedAt.Int64).UTC()
		}
		out = append(out, item)
	}
	jsonOut(w, 200, map[string]any{
		"manual_credits_enabled": s.cfg.AllowManualCredits,
		"paypal_enabled":         s.paypalAllowed(),
		"worker_image":           s.cfg.WorkerImage,
		"settings":               s.portalSettings(r.Context()),
		"customers":              out,
	})
}

func (s *Service) adminUpdateWorkerImage(w http.ResponseWriter, r *http.Request) {
	wid := strings.TrimSpace(chi.URLParam(r, "id"))
	wk, err := s.store.WorkerByID(r.Context(), wid)
	if err != nil {
		jsonOut(w, http.StatusNotFound, map[string]string{"error": "worker not found"})
		return
	}
	if err := s.pullWorkerImage(r.Context()); err != nil {
		jsonOut(w, http.StatusBadGateway, map[string]string{"error": err.Error()})
		return
	}
	if err := s.recreateWorkerWithCurrentImage(r.Context(), wk); err != nil {
		jsonOut(w, http.StatusBadGateway, map[string]string{"error": "worker image update: " + err.Error()})
		return
	}
	jsonOut(w, http.StatusOK, map[string]any{"ok": true, "worker_id": wk.ID, "image": s.cfg.WorkerImage, "resumed": wk.Status == "running" || wk.Status == "starting"})
}

func (s *Service) adminUpdateAllWorkerImages(w http.ResponseWriter, r *http.Request) {
	if err := s.pullWorkerImage(r.Context()); err != nil {
		jsonOut(w, http.StatusBadGateway, map[string]string{"error": err.Error()})
		return
	}
	rows, err := s.store.DB.QueryContext(r.Context(), `SELECT `+workerCols+` FROM workers ORDER BY created_at`)
	if err != nil {
		jsonOut(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}
	var workers []Worker
	for rows.Next() {
		wk, scanErr := scanWorker(rows)
		if scanErr != nil {
			_ = rows.Close()
			jsonOut(w, http.StatusInternalServerError, map[string]string{"error": scanErr.Error()})
			return
		}
		workers = append(workers, wk)
	}
	_ = rows.Close()
	updated := 0
	var warnings []string
	for _, wk := range workers {
		if err := s.recreateWorkerWithCurrentImage(r.Context(), wk); err != nil {
			warnings = append(warnings, wk.ID+": "+err.Error())
			continue
		}
		updated++
	}
	jsonOut(w, http.StatusOK, map[string]any{"ok": len(warnings) == 0, "image": s.cfg.WorkerImage, "updated": updated, "total": len(workers), "warnings": warnings})
}

func (s *Service) adminCreditGrant(w http.ResponseWriter, r *http.Request) {
	if !s.cfg.AllowManualCredits {
		jsonOut(w, 403, map[string]string{"error": "manual credit bypass disabled; set CS_ALLOW_MANUAL_CREDITS=1 on the private admin service"})
		return
	}
	var in struct {
		CustomerID string  `json:"customer_id"`
		Credits    float64 `json:"credits"`
		Reason     string  `json:"reason"`
	}
	if decode(r, &in) != nil || in.Credits <= 0 || in.Credits > 1_000_000 {
		jsonOut(w, 400, map[string]string{"error": "invalid grant"})
		return
	}
	micros := int64(math.Round(in.Credits * 1_000_000))
	ref := "manual:" + RandomToken(12)
	reason := "manual_test_grant"
	if strings.TrimSpace(in.Reason) != "" {
		reason += ":" + strings.TrimSpace(in.Reason)
	}
	if err := s.store.AddLedger(r.Context(), strings.TrimSpace(in.CustomerID), micros, reason, ref); err != nil {
		jsonOut(w, 400, map[string]string{"error": err.Error()})
		return
	}
	jsonOut(w, 200, map[string]any{"ok": true, "reference": ref})
}

// Keep sql imported in this file because several handlers intentionally treat
// sql.ErrNoRows as a 404 without leaking database details.
var _ = sql.ErrNoRows
var _ = url.PathEscape