package imagemgr

import (
	"bytes"
	"context"
	"fmt"
	"io"
	"os"
	"strings"

	"banger/internal/guestnet"
	"banger/internal/model"
	"banger/internal/opencode"
	"banger/internal/system"
	"banger/internal/vsockagent"
)

const (
	defaultMiseVersion      = "v2025.12.0"
	defaultMiseInstallPath  = "/usr/local/bin/mise"
	defaultMiseActivateLine = `eval "$(/usr/local/bin/mise activate bash)"`
	defaultNodeTool         = "node@22"
	defaultOpenCodeTool     = "github:anomalyco/opencode"
	defaultClaudeCodeTool   = "npm:@anthropic-ai/claude-code"
	defaultPiTool           = "npm:@mariozechner/pi-coding-agent"
	defaultTPMRepo          = "https://github.com/tmux-plugins/tpm"
	defaultResurrectRepo    = "https://github.com/tmux-plugins/tmux-resurrect"
	defaultContinuumRepo    = "https://github.com/tmux-plugins/tmux-continuum"
	defaultTMUXPluginDir    = "/root/.tmux/plugins"
	defaultTMUXResurrectDir = "/root/.tmux/resurrect"
	tmuxManagedBlockStart   = "# >>> banger tmux plugins >>>"
	tmuxManagedBlockEnd     = "# <<< banger tmux plugins <<<"
)

// ResizeRootfs grows a rootfs ext4 image to sizeSpec bytes. sizeSpec must
// parse via model.ParseSize and must be >= the base image size.
func ResizeRootfs(baseRootfs, rootfsPath, sizeSpec string) error {
	sizeBytes, err := model.ParseSize(sizeSpec)
	if err != nil {
		return err
	}
	info, err := os.Stat(baseRootfs)
	if err != nil {
		return err
	}
	if sizeBytes < info.Size() {
		return fmt.Errorf("size must be >= base image size")
	}
	return system.ResizeExt4Image(context.Background(), system.NewRunner(), rootfsPath, sizeBytes)
}

// WriteBuildLog emits a prefixed status line to w. Safe on a nil writer.
func WriteBuildLog(w io.Writer, message string) error {
	if w == nil {
		return nil
	}
	_, err := fmt.Fprintf(w, "[image.build] %s\n", message)
	return err
}

// BuildProvisionScript returns the bash script that configures a freshly
// booted build VM: host/dns files, authorized key, apt packages, mise +
// language shims, guest network unit, opencode service, tmux plugins,
// vsock agent, optional docker, and cleanup.
func BuildProvisionScript(vmName, dnsServer, authorizedKey string, packages []string, installDocker bool) string {
	var script bytes.Buffer
	script.WriteString("set -euo pipefail\n")
	fmt.Fprintf(&script, "printf 'nameserver %%s\\n' %s > /etc/resolv.conf\n", shellQuote(dnsServer))
	fmt.Fprintf(&script, "printf '%%s\\n' %s > /etc/hostname\n", shellQuote(vmName))
	fmt.Fprintf(&script, "printf '127.0.0.1 localhost\\n127.0.1.1 %%s\\n' %s > /etc/hosts\n", shellQuote(vmName))
	script.WriteString("touch /etc/fstab\n")
	script.WriteString("sed -i '\\|^/dev/vdb[[:space:]]\\+/home[[:space:]]|d; \\|^/dev/vdc[[:space:]]\\+/var[[:space:]]|d' /etc/fstab\n")
	script.WriteString("if ! grep -q '^tmpfs /run ' /etc/fstab; then echo 'tmpfs /run tmpfs defaults,nodev,nosuid,mode=0755 0 0' >> /etc/fstab; fi\n")
	script.WriteString("if ! grep -q '^tmpfs /tmp ' /etc/fstab; then echo 'tmpfs /tmp tmpfs defaults,nodev,nosuid,mode=1777 0 0' >> /etc/fstab; fi\n")
	appendAuthorizedKeySetup(&script, authorizedKey)
	script.WriteString("apt-get update\n")
	script.WriteString("DEBIAN_FRONTEND=noninteractive apt-get -y upgrade\n")
	fmt.Fprintf(&script, "PACKAGES=%s\n", shellArray(packages))
	script.WriteString("DEBIAN_FRONTEND=noninteractive apt-get -y install \"${PACKAGES[@]}\"\n")
	appendGuestNetworkSetup(&script)
	appendMiseSetup(&script)
	appendOpenCodeServiceSetup(&script)
	appendTmuxSetup(&script)
	appendVSockPingSetup(&script)
	if installDocker {
		script.WriteString("DEBIAN_FRONTEND=noninteractive apt-get -y remove containerd || true\n")
		script.WriteString("if ! DEBIAN_FRONTEND=noninteractive apt-get -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin; then\n")
		script.WriteString("  DEBIAN_FRONTEND=noninteractive apt-get -y install docker.io\n")
		script.WriteString("fi\n")
		script.WriteString("if command -v systemctl >/dev/null 2>&1; then systemctl enable --now docker || true; fi\n")
	}
	appendGuestCleanup(&script)
	script.WriteString("git config --system init.defaultBranch main\n")
	return script.String()
}

// BuildModulesCommand returns the guest shell command that receives a tar
// stream on stdin, extracts it into /lib/modules/<modulesBase>, runs depmod,
// and writes sysctl/modules-load config for docker networking.
func BuildModulesCommand(modulesBase string) string {
	return fmt.Sprintf("bash -se <<'EOF'\nset -euo pipefail\nmkdir -p /lib/modules\ntar -C /lib/modules -xf -\ndepmod -a %s\nmkdir -p /etc/modules-load.d\nprintf 'nf_tables\\nnft_chain_nat\\nveth\\nbr_netfilter\\noverlay\\n' > /etc/modules-load.d/docker-netfilter.conf\nmkdir -p /etc/sysctl.d\ncat > /etc/sysctl.d/99-docker.conf <<'SYSCTL'\nnet.bridge.bridge-nf-call-iptables = 1\nnet.bridge.bridge-nf-call-ip6tables = 1\nnet.ipv4.ip_forward = 1\nSYSCTL\nsysctl --system >/dev/null 2>&1 || true\nEOF", shellQuote(modulesBase))
}

func appendAuthorizedKeySetup(script *bytes.Buffer, authorizedKey string) {
	script.WriteString("mkdir -p /root/.ssh\n")
	script.WriteString("chmod 700 /root/.ssh\n")
	script.WriteString("cat > /root/.ssh/authorized_keys <<'EOF'\n")
	script.WriteString(strings.TrimSpace(authorizedKey))
	script.WriteString("\nEOF\n")
	script.WriteString("chmod 600 /root/.ssh/authorized_keys\n")
}

func appendMiseSetup(script *bytes.Buffer) {
	const (
		nodeShimPath   = "/root/.local/share/mise/shims/node"
		npmShimPath    = "/root/.local/share/mise/shims/npm"
		claudeShimPath = "/root/.local/share/mise/shims/claude"
		piShimPath     = "/root/.local/share/mise/shims/pi"
	)

	fmt.Fprintf(script, "curl -fsSL https://mise.run | MISE_INSTALL_PATH=%s MISE_VERSION=%s sh\n", shellQuote(defaultMiseInstallPath), shellQuote(defaultMiseVersion))
	fmt.Fprintf(script, "%s use -g %s\n", shellQuote(defaultMiseInstallPath), shellQuote(defaultNodeTool))
	fmt.Fprintf(script, "%s use -g %s\n", shellQuote(defaultMiseInstallPath), shellQuote(defaultOpenCodeTool))
	fmt.Fprintf(script, "%s use -g %s\n", shellQuote(defaultMiseInstallPath), shellQuote(defaultClaudeCodeTool))
	fmt.Fprintf(script, "%s use -g %s\n", shellQuote(defaultMiseInstallPath), shellQuote(defaultPiTool))
	fmt.Fprintf(script, "%s reshim\n", shellQuote(defaultMiseInstallPath))
	fmt.Fprintf(script, "if [[ ! -e %s ]]; then echo 'node shim not found after mise install' >&2; exit 1; fi\n", shellQuote(nodeShimPath))
	fmt.Fprintf(script, "if [[ ! -e %s ]]; then echo 'npm shim not found after mise install' >&2; exit 1; fi\n", shellQuote(npmShimPath))
	fmt.Fprintf(script, "if [[ ! -e %s ]]; then echo 'opencode shim not found after mise install' >&2; exit 1; fi\n", shellQuote(opencode.ShimPath))
	fmt.Fprintf(script, "if [[ ! -e %s ]]; then echo 'claude shim not found after mise install' >&2; exit 1; fi\n", shellQuote(claudeShimPath))
	fmt.Fprintf(script, "if [[ ! -e %s ]]; then echo 'pi shim not found after mise install' >&2; exit 1; fi\n", shellQuote(piShimPath))
	fmt.Fprintf(script, "ln -snf %s %s\n", shellQuote(nodeShimPath), shellQuote("/usr/local/bin/node"))
	fmt.Fprintf(script, "ln -snf %s %s\n", shellQuote(npmShimPath), shellQuote("/usr/local/bin/npm"))
	fmt.Fprintf(script, "ln -snf %s %s\n", shellQuote(opencode.ShimPath), shellQuote(opencode.GuestBinaryPath))
	fmt.Fprintf(script, "ln -snf %s %s\n", shellQuote(claudeShimPath), shellQuote("/usr/local/bin/claude"))
	fmt.Fprintf(script, "ln -snf %s %s\n", shellQuote(piShimPath), shellQuote("/usr/local/bin/pi"))
	script.WriteString("mkdir -p /etc/profile.d\n")
	script.WriteString("cat > /etc/profile.d/mise.sh <<'EOF'\n")
	fmt.Fprintf(script, "if [ -n \"${BASH_VERSION:-}\" ] && [ -x %s ]; then\n", shellQuote(defaultMiseInstallPath))
	fmt.Fprintf(script, "  %s\n", defaultMiseActivateLine)
	script.WriteString("fi\n")
	script.WriteString("EOF\n")
	script.WriteString("chmod 0644 /etc/profile.d/mise.sh\n")
	appendLineIfMissing(script, "/etc/bash.bashrc", defaultMiseActivateLine)
}

func appendGuestNetworkSetup(script *bytes.Buffer) {
	script.WriteString("mkdir -p /usr/local/libexec /etc/systemd/system\n")
	script.WriteString("cat > " + guestnet.GuestScriptPath + " <<'EOF'\n")
	script.WriteString(guestnet.BootstrapScript())
	script.WriteString("EOF\n")
	script.WriteString("chmod 0755 " + guestnet.GuestScriptPath + "\n")
	script.WriteString("cat > /etc/systemd/system/" + guestnet.SystemdServiceName + " <<'EOF'\n")
	script.WriteString(guestnet.SystemdServiceUnit())
	script.WriteString("EOF\n")
	script.WriteString("chmod 0644 /etc/systemd/system/" + guestnet.SystemdServiceName + "\n")
	script.WriteString("if command -v systemctl >/dev/null 2>&1; then systemctl daemon-reload || true; systemctl enable --now " + guestnet.SystemdServiceName + " || true; fi\n")
}

func appendOpenCodeServiceSetup(script *bytes.Buffer) {
	script.WriteString("mkdir -p /etc/systemd/system\n")
	script.WriteString("cat > /etc/systemd/system/" + opencode.ServiceName + " <<'EOF'\n")
	script.WriteString(opencode.ServiceUnit())
	script.WriteString("EOF\n")
	script.WriteString("chmod 0644 /etc/systemd/system/" + opencode.ServiceName + "\n")
	script.WriteString("if command -v systemctl >/dev/null 2>&1; then systemctl daemon-reload || true; systemctl enable --now " + opencode.ServiceName + " || true; fi\n")
}

func appendTmuxSetup(script *bytes.Buffer) {
	fmt.Fprintf(script, "TMUX_PLUGIN_DIR=%s\n", shellQuote(defaultTMUXPluginDir))
	fmt.Fprintf(script, "TMUX_RESURRECT_DIR=%s\n", shellQuote(defaultTMUXResurrectDir))
	script.WriteString("mkdir -p \"$TMUX_PLUGIN_DIR\" \"$TMUX_RESURRECT_DIR\"\n")
	appendGitRepo(script, "$TMUX_PLUGIN_DIR/tpm", defaultTPMRepo)
	appendGitRepo(script, "$TMUX_PLUGIN_DIR/tmux-resurrect", defaultResurrectRepo)
	appendGitRepo(script, "$TMUX_PLUGIN_DIR/tmux-continuum", defaultContinuumRepo)
	script.WriteString("TMUX_CONF=/root/.tmux.conf\n")
	fmt.Fprintf(script, "TMUX_MANAGED_START=%s\n", shellQuote(tmuxManagedBlockStart))
	fmt.Fprintf(script, "TMUX_MANAGED_END=%s\n", shellQuote(tmuxManagedBlockEnd))
	script.WriteString("tmp_tmux_conf=$(mktemp)\n")
	script.WriteString("if [[ -f \"$TMUX_CONF\" ]]; then\n")
	script.WriteString("  awk -v begin=\"$TMUX_MANAGED_START\" -v end=\"$TMUX_MANAGED_END\" '$0 == begin { skip = 1; next } $0 == end { skip = 0; next } !skip { print }' \"$TMUX_CONF\" > \"$tmp_tmux_conf\"\n")
	script.WriteString("else\n")
	script.WriteString("  : > \"$tmp_tmux_conf\"\n")
	script.WriteString("fi\n")
	script.WriteString("if [[ -s \"$tmp_tmux_conf\" ]]; then\n")
	script.WriteString("  printf '\\n' >> \"$tmp_tmux_conf\"\n")
	script.WriteString("fi\n")
	script.WriteString("cat >> \"$tmp_tmux_conf\" <<'EOF'\n")
	script.WriteString(tmuxManagedBlockStart + "\n")
	script.WriteString("set -g @plugin 'tmux-plugins/tpm'\n")
	script.WriteString("set -g @plugin 'tmux-plugins/tmux-resurrect'\n")
	script.WriteString("set -g @plugin 'tmux-plugins/tmux-continuum'\n")
	script.WriteString("set -g @continuum-save-interval '15'\n")
	script.WriteString("set -g @continuum-restore 'off'\n")
	script.WriteString("set -g @resurrect-dir '/root/.tmux/resurrect'\n")
	script.WriteString("run '~/.tmux/plugins/tpm/tpm'\n")
	script.WriteString(tmuxManagedBlockEnd + "\n")
	script.WriteString("EOF\n")
	script.WriteString("mv \"$tmp_tmux_conf\" \"$TMUX_CONF\"\n")
	script.WriteString("chmod 0644 \"$TMUX_CONF\"\n")
}

func appendVSockPingSetup(script *bytes.Buffer) {
	script.WriteString("mkdir -p /etc/modules-load.d /etc/systemd/system\n")
	script.WriteString("cat > /etc/modules-load.d/banger-vsock.conf <<'EOF'\n")
	script.WriteString(vsockagent.ModulesLoadConfig())
	script.WriteString("EOF\n")
	script.WriteString("chmod 0644 /etc/modules-load.d/banger-vsock.conf\n")
	script.WriteString("cat > /etc/systemd/system/" + vsockagent.ServiceName + " <<'EOF'\n")
	script.WriteString(vsockagent.ServiceUnit())
	script.WriteString("EOF\n")
	script.WriteString("chmod 0644 /etc/systemd/system/" + vsockagent.ServiceName + "\n")
	script.WriteString("if command -v systemctl >/dev/null 2>&1; then systemctl daemon-reload || true; systemctl enable --now " + vsockagent.ServiceName + " || true; fi\n")
}

func appendGitRepo(script *bytes.Buffer, dir, repo string) {
	fmt.Fprintf(script, "if [[ -d \"%s/.git\" ]]; then\n", dir)
	fmt.Fprintf(script, "  git -C \"%s\" fetch --depth 1 origin\n", dir)
	fmt.Fprintf(script, "  git -C \"%s\" reset --hard FETCH_HEAD\n", dir)
	script.WriteString("else\n")
	fmt.Fprintf(script, "  rm -rf \"%s\"\n", dir)
	fmt.Fprintf(script, "  git clone --depth 1 %s \"%s\"\n", shellQuote(repo), dir)
	script.WriteString("fi\n")
}

func appendGuestCleanup(script *bytes.Buffer) {
	script.WriteString("rm -f /root/get-docker /root/get-docker.sh /tmp/get-docker /tmp/get-docker.sh\n")
}

func appendLineIfMissing(script *bytes.Buffer, path, line string) {
	fmt.Fprintf(script, "touch %s\n", shellQuote(path))
	fmt.Fprintf(script, "if ! grep -Fqx %s %s; then\n", shellQuote(line), shellQuote(path))
	fmt.Fprintf(script, "  printf '\\n%%s\\n' %s >> %s\n", shellQuote(line), shellQuote(path))
	script.WriteString("fi\n")
}

func shellArray(values []string) string {
	quoted := make([]string, 0, len(values))
	for _, value := range values {
		quoted = append(quoted, shellQuote(value))
	}
	return "(" + strings.Join(quoted, " ") + ")"
}

func shellQuote(value string) string {
	return "'" + strings.ReplaceAll(value, "'", `'"'"'`) + "'"
}