import * as Crypto from "node:crypto";

import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient";
import * as NodeServices from "@effect/platform-node/NodeServices";
import { NetService } from "@t3tools/shared/Net";
import type {
  AuthBearerBootstrapResult,
  AuthSessionState,
  AuthWebSocketTokenResult,
  DesktopDiscoveredSshHost,
  DesktopSshEnvironmentTarget,
  DesktopSshPasswordPromptRequest,
  ExecutionEnvironmentDescriptor,
} from "@t3tools/contracts";
import {
  SshPasswordPrompt,
  type SshPasswordPromptShape,
  type SshPasswordRequest,
} from "@t3tools/ssh/auth";
import { discoverSshHosts } from "@t3tools/ssh/config";
import { SshPasswordPromptError } from "@t3tools/ssh/errors";
import {
  fetchLoopbackSshJson,
  SshEnvironmentManager,
  type RemoteT3RunnerOptions,
} from "@t3tools/ssh/tunnel";
import { Effect, Exit, Layer, ManagedRuntime, Scope } from "effect";

export { resolveRemoteT3CliPackageSpec } from "@t3tools/ssh/command";

const DISCOVER_SSH_HOSTS_CHANNEL = "desktop:discover-ssh-hosts";
const ENSURE_SSH_ENVIRONMENT_CHANNEL = "desktop:ensure-ssh-environment";
const DISCONNECT_SSH_ENVIRONMENT_CHANNEL = "desktop:disconnect-ssh-environment";
const FETCH_SSH_ENVIRONMENT_DESCRIPTOR_CHANNEL = "desktop:fetch-ssh-environment-descriptor";
const BOOTSTRAP_SSH_BEARER_SESSION_CHANNEL = "desktop:bootstrap-ssh-bearer-session";
const FETCH_SSH_SESSION_STATE_CHANNEL = "desktop:fetch-ssh-session-state";
const ISSUE_SSH_WEBSOCKET_TOKEN_CHANNEL = "desktop:issue-ssh-websocket-token";
const SSH_PASSWORD_PROMPT_CHANNEL = "desktop:ssh-password-prompt";
const RESOLVE_SSH_PASSWORD_PROMPT_CHANNEL = "desktop:resolve-ssh-password-prompt";
const DEFAULT_SSH_PASSWORD_PROMPT_TIMEOUT_MS = 3 * 60 * 1000;
const SSH_PASSWORD_PROMPT_CANCELLED_RESULT = "ssh-password-prompt-cancelled";

interface DesktopSshEnvironmentManagerOptions {
  readonly passwordProvider?: (request: SshPasswordRequest) => Promise<string | null>;
  readonly resolveCliPackageSpec?: () => string;
  readonly resolveCliRunner?: () => RemoteT3RunnerOptions;
}

const sshRuntime = ManagedRuntime.make(
  Layer.mergeAll(NodeServices.layer, NodeHttpClient.layerUndici, NetService.layer),
);

function createDesktopSshRuntime(
  passwordPrompt: SshPasswordPromptShape,
  scope: Scope.Scope,
  options: DesktopSshEnvironmentManagerOptions,
) {
  return ManagedRuntime.make(
    Layer.mergeAll(
      NodeServices.layer,
      NodeHttpClient.layerUndici,
      NetService.layer,
      Layer.succeed(Scope.Scope, scope),
      Layer.succeed(SshPasswordPrompt, SshPasswordPrompt.of(passwordPrompt)),
      SshEnvironmentManager.layer({
        ...(options.resolveCliPackageSpec === undefined
          ? {}
          : { resolveCliPackageSpec: options.resolveCliPackageSpec }),
        ...(options.resolveCliRunner === undefined
          ? {}
          : { resolveCliRunner: options.resolveCliRunner }),
      }),
    ),
  );
}

export async function discoverDesktopSshHosts(input?: {
  readonly homeDir?: string;
}): Promise<readonly DesktopDiscoveredSshHost[]> {
  return await sshRuntime.runPromise(discoverSshHosts(input ?? {}));
}

export class DesktopSshEnvironmentManager {
  private readonly runtime: ReturnType<typeof createDesktopSshRuntime>;
  private readonly scope: Scope.Scope;

  constructor(options: DesktopSshEnvironmentManagerOptions = {}) {
    const passwordPrompt: SshPasswordPromptShape = {
      isAvailable: options.passwordProvider !== undefined,
      request: (request) => {
        const passwordProvider = options.passwordProvider;
        if (!passwordProvider) {
          return Effect.succeed(null);
        }

        return Effect.tryPromise({
          try: () => passwordProvider(request),
          catch: (cause) =>
            new SshPasswordPromptError({
              message: cause instanceof Error ? cause.message : "SSH password prompt failed.",
              cause,
            }),
        });
      },
    };
    this.scope = Effect.runSync(Scope.make());
    this.runtime = createDesktopSshRuntime(passwordPrompt, this.scope, options);
  }

  async discoverHosts(): Promise<readonly DesktopDiscoveredSshHost[]> {
    return await discoverDesktopSshHosts();
  }

  async ensureEnvironment(
    target: DesktopSshEnvironmentTarget,
    options?: { readonly issuePairingToken?: boolean },
  ) {
    return await this.runtime.runPromise(
      Effect.service(SshEnvironmentManager).pipe(
        Effect.flatMap((manager) => manager.ensureEnvironment(target, options)),
      ),
    );
  }

  async disconnectEnvironment(target: DesktopSshEnvironmentTarget): Promise<void> {
    await this.runtime.runPromise(
      Effect.service(SshEnvironmentManager).pipe(
        Effect.flatMap((manager) => manager.disconnectEnvironment(target)),
      ),
    );
  }

  async dispose(): Promise<void> {
    await this.runtime.runPromise(Scope.close(this.scope, Exit.void));
    await this.runtime.dispose();
  }
}

function getSafeDesktopSshTarget(rawTarget: unknown): DesktopSshEnvironmentTarget | null {
  if (typeof rawTarget !== "object" || rawTarget === null) {
    return null;
  }

  const target = rawTarget as Partial<DesktopSshEnvironmentTarget>;
  if (typeof target.alias !== "string" || typeof target.hostname !== "string") {
    return null;
  }
  if (
    target.username !== null &&
    target.username !== undefined &&
    typeof target.username !== "string"
  ) {
    return null;
  }
  if (target.port !== null && target.port !== undefined && !Number.isInteger(target.port)) {
    return null;
  }

  const alias = target.alias.trim();
  const hostname = target.hostname.trim();
  if (alias.length === 0 || hostname.length === 0) {
    return null;
  }

  return {
    alias,
    hostname,
    username: target.username?.trim() || null,
    port: target.port ?? null,
  };
}

/** Minimal subset of Electron's BrowserWindow used by the SSH bridge. */
export interface DesktopSshBridgeWindow {
  isDestroyed(): boolean;
  isMinimized(): boolean;
  restore(): void;
  focus(): void;
  readonly webContents: {
    send(channel: string, ...args: readonly unknown[]): void;
  };
}

/** Minimal subset of Electron's ipcMain used by the SSH bridge. */
export interface DesktopSshBridgeIpcMain {
  removeHandler(channel: string): void;
  handle(
    channel: string,
    listener: (event: unknown, ...args: readonly unknown[]) => unknown | Promise<unknown>,
  ): void;
}

export interface DesktopSshEnvironmentBridgeOptions {
  readonly getMainWindow: () => DesktopSshBridgeWindow | null;
  readonly resolveCliPackageSpec?: () => string;
  readonly resolveCliRunner?: () => RemoteT3RunnerOptions;
  readonly passwordPromptTimeoutMs?: number;
}

interface PendingSshPasswordPrompt {
  readonly resolve: (password: string | null) => void;
  readonly reject: (error: Error) => void;
  readonly timeout: ReturnType<typeof setTimeout>;
}

export function isSshPasswordPromptCancellation(error: unknown): error is SshPasswordPromptError {
  const message = error instanceof SshPasswordPromptError ? error.message.toLowerCase() : "";
  return (
    error instanceof SshPasswordPromptError &&
    (message.includes("cancelled") || message.includes("timed out"))
  );
}

/**
 * Wires the SSH environment manager to Electron IPC, owning the renderer-facing
 * password prompt state so `main.ts` only needs to register, cancel, and dispose.
 */
export class DesktopSshEnvironmentBridge {
  private readonly options: DesktopSshEnvironmentBridgeOptions;
  private readonly manager: DesktopSshEnvironmentManager;
  private readonly pendingPrompts = new Map<string, PendingSshPasswordPrompt>();
  private readonly passwordPromptTimeoutMs: number;

  constructor(options: DesktopSshEnvironmentBridgeOptions) {
    this.options = options;
    this.passwordPromptTimeoutMs =
      options.passwordPromptTimeoutMs ?? DEFAULT_SSH_PASSWORD_PROMPT_TIMEOUT_MS;
    this.manager = new DesktopSshEnvironmentManager({
      passwordProvider: (request) => this.requestPasswordFromRenderer(request),
      ...(options.resolveCliPackageSpec === undefined
        ? {}
        : { resolveCliPackageSpec: options.resolveCliPackageSpec }),
      ...(options.resolveCliRunner === undefined
        ? {}
        : { resolveCliRunner: options.resolveCliRunner }),
    });
  }

  registerIpcHandlers(ipcMain: DesktopSshBridgeIpcMain): void {
    ipcMain.removeHandler(DISCOVER_SSH_HOSTS_CHANNEL);
    ipcMain.handle(DISCOVER_SSH_HOSTS_CHANNEL, async () => this.manager.discoverHosts());

    ipcMain.removeHandler(ENSURE_SSH_ENVIRONMENT_CHANNEL);
    ipcMain.handle(ENSURE_SSH_ENVIRONMENT_CHANNEL, async (_event, rawTarget, rawOptions) => {
      const target = getSafeDesktopSshTarget(rawTarget);
      if (!target) {
        throw new Error("Invalid desktop SSH target.");
      }

      const issuePairingToken =
        typeof rawOptions === "object" &&
        rawOptions !== null &&
        "issuePairingToken" in rawOptions &&
        (rawOptions as { issuePairingToken?: unknown }).issuePairingToken === true;

      try {
        return await this.manager.ensureEnvironment(target, {
          issuePairingToken,
        });
      } catch (error) {
        if (isSshPasswordPromptCancellation(error)) {
          return {
            type: SSH_PASSWORD_PROMPT_CANCELLED_RESULT,
            message: error.message,
          };
        }
        throw error;
      }
    });

    ipcMain.removeHandler(DISCONNECT_SSH_ENVIRONMENT_CHANNEL);
    ipcMain.handle(DISCONNECT_SSH_ENVIRONMENT_CHANNEL, async (_event, rawTarget) => {
      const target = getSafeDesktopSshTarget(rawTarget);
      if (!target) {
        throw new Error("Invalid desktop SSH target.");
      }

      await this.manager.disconnectEnvironment(target);
    });

    ipcMain.removeHandler(FETCH_SSH_ENVIRONMENT_DESCRIPTOR_CHANNEL);
    ipcMain.handle(FETCH_SSH_ENVIRONMENT_DESCRIPTOR_CHANNEL, async (_event, rawHttpBaseUrl) =>
      sshRuntime.runPromise(
        fetchLoopbackSshJson<ExecutionEnvironmentDescriptor>({
          httpBaseUrl: rawHttpBaseUrl,
          pathname: "/.well-known/t3/environment",
        }),
      ),
    );

    ipcMain.removeHandler(BOOTSTRAP_SSH_BEARER_SESSION_CHANNEL);
    ipcMain.handle(
      BOOTSTRAP_SSH_BEARER_SESSION_CHANNEL,
      async (_event, rawHttpBaseUrl, rawCredential) =>
        sshRuntime.runPromise(
          fetchLoopbackSshJson<AuthBearerBootstrapResult>({
            httpBaseUrl: rawHttpBaseUrl,
            pathname: "/api/auth/bootstrap/bearer",
            method: "POST",
            body: { credential: rawCredential },
          }),
        ),
    );

    ipcMain.removeHandler(FETCH_SSH_SESSION_STATE_CHANNEL);
    ipcMain.handle(
      FETCH_SSH_SESSION_STATE_CHANNEL,
      async (_event, rawHttpBaseUrl, rawBearerToken) =>
        sshRuntime.runPromise(
          fetchLoopbackSshJson<AuthSessionState>({
            httpBaseUrl: rawHttpBaseUrl,
            pathname: "/api/auth/session",
            bearerToken: rawBearerToken,
          }),
        ),
    );

    ipcMain.removeHandler(ISSUE_SSH_WEBSOCKET_TOKEN_CHANNEL);
    ipcMain.handle(
      ISSUE_SSH_WEBSOCKET_TOKEN_CHANNEL,
      async (_event, rawHttpBaseUrl, rawBearerToken) =>
        sshRuntime.runPromise(
          fetchLoopbackSshJson<AuthWebSocketTokenResult>({
            httpBaseUrl: rawHttpBaseUrl,
            pathname: "/api/auth/ws-token",
            method: "POST",
            bearerToken: rawBearerToken,
          }),
        ),
    );

    ipcMain.removeHandler(RESOLVE_SSH_PASSWORD_PROMPT_CHANNEL);
    ipcMain.handle(
      RESOLVE_SSH_PASSWORD_PROMPT_CHANNEL,
      async (_event, rawRequestId, rawPassword) => {
        if (typeof rawRequestId !== "string" || rawRequestId.trim().length === 0) {
          throw new Error("Invalid SSH password prompt id.");
        }
        if (rawPassword !== null && typeof rawPassword !== "string") {
          throw new Error("Invalid SSH password prompt response.");
        }

        const pending = this.pendingPrompts.get(rawRequestId);
        if (!pending) {
          throw new Error("SSH password prompt expired. Try connecting again.");
        }

        clearTimeout(pending.timeout);
        this.pendingPrompts.delete(rawRequestId);
        pending.resolve(rawPassword);
      },
    );
  }

  cancelPendingPasswordPrompts(reason: string): void {
    for (const [requestId, pending] of this.pendingPrompts) {
      clearTimeout(pending.timeout);
      this.pendingPrompts.delete(requestId);
      pending.reject(new Error(reason));
    }
  }

  async dispose(): Promise<void> {
    this.cancelPendingPasswordPrompts("SSH environment bridge disposed.");
    await this.manager.dispose();
  }

  private async requestPasswordFromRenderer(input: SshPasswordRequest): Promise<string | null> {
    const window = this.options.getMainWindow();
    if (!window || window.isDestroyed()) {
      throw new Error("T3 Code window is not available for SSH authentication.");
    }

    const request: DesktopSshPasswordPromptRequest = {
      requestId: Crypto.randomUUID(),
      destination: input.destination,
      username: input.username,
      prompt: input.prompt,
      expiresAt: new Date(Date.now() + this.passwordPromptTimeoutMs).toISOString(),
    };

    return await new Promise<string | null>((resolve, reject) => {
      const rejectPrompt = (error: Error) => {
        clearTimeout(timeout);
        this.pendingPrompts.delete(request.requestId);
        reject(error);
      };
      const timeout = setTimeout(() => {
        this.pendingPrompts.delete(request.requestId);
        reject(new Error(`SSH authentication timed out for ${input.destination}.`));
      }, this.passwordPromptTimeoutMs);
      timeout.unref();

      this.pendingPrompts.set(request.requestId, { resolve, reject, timeout });

      try {
        if (window.isDestroyed()) {
          throw new Error("T3 Code window is not available for SSH authentication.");
        }
        window.webContents.send(SSH_PASSWORD_PROMPT_CHANNEL, request);
        if (window.isDestroyed()) {
          throw new Error("T3 Code window is not available for SSH authentication.");
        }
        if (window.isMinimized()) {
          window.restore();
        }
        if (window.isDestroyed()) {
          throw new Error("T3 Code window is not available for SSH authentication.");
        }
        window.focus();
      } catch (error) {
        rejectPrompt(
          error instanceof Error
            ? error
            : new Error("T3 Code window is not available for SSH authentication."),
        );
      }
    });
  }
}