// Package docker is a thin wrapper over the official Docker Engine Go SDK
// (decision 8, tx9-cli-design.md). It exposes only what box lifecycle
// commands need — images, containers, networks, volumes, exec — behind a
// small struct so a remote daemon (SSH tunnel / DOCKER_HOST) can slot in
// later without restructuring callers.
package docker

import (
	"bytes"
	"context"
	"fmt"
	"io"

	"github.com/docker/docker/api/types/build"
	"github.com/docker/docker/api/types/container"
	"github.com/docker/docker/api/types/filters"
	"github.com/docker/docker/api/types/image"
	"github.com/docker/docker/api/types/network"
	"github.com/docker/docker/api/types/volume"
	"github.com/docker/docker/client"
	"github.com/docker/docker/pkg/jsonmessage"
	"github.com/docker/docker/pkg/stdcopy"
	"github.com/docker/go-connections/nat"

	"github.com/davis7dotsh/tx9/internal/assets"
)

// Client wraps the Docker Engine API client with tx9-shaped helpers.
type Client struct {
	cli *client.Client
}

// NewClient connects to the Docker daemon from the environment
// (DOCKER_HOST/DOCKER_CERT_PATH/etc, same as the docker CLI) and negotiates
// the API version so it works across a range of daemon versions.
func NewClient(ctx context.Context) (*Client, error) {
	cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
	if err != nil {
		return nil, fmt.Errorf("docker: new client: %w", err)
	}
	if _, err := cli.Ping(ctx); err != nil {
		cli.Close()
		return nil, fmt.Errorf("docker: daemon unreachable: %w", err)
	}
	return &Client{cli: cli}, nil
}

// Close releases the underlying HTTP client's connections.
func (c *Client) Close() error {
	return c.cli.Close()
}

// Raw exposes the underlying SDK client for calls this wrapper doesn't
// (yet) cover.
func (c *Client) Raw() *client.Client {
	return c.cli
}

// ImageExists reports whether tag is present in the local image store.
func (c *Client) ImageExists(ctx context.Context, tag string) (bool, error) {
	_, err := c.cli.ImageInspect(ctx, tag)
	if err == nil {
		return true, nil
	}
	if client.IsErrNotFound(err) {
		return false, nil
	}
	return false, fmt.Errorf("docker: image inspect %s: %w", tag, err)
}

// BuildImage builds tag from buildContext (a tar stream — see
// internal/assets.BuildContextTar), streaming daemon build progress as
// human-readable lines to progress.
func (c *Client) BuildImage(ctx context.Context, buildContext io.Reader, tag string, progress io.Writer) error {
	resp, err := c.cli.ImageBuild(ctx, buildContext, build.ImageBuildOptions{
		Tags:       []string{tag},
		Dockerfile: assets.DockerfilePath,
		Remove:     true,
	})
	if err != nil {
		return fmt.Errorf("docker: image build %s: %w", tag, err)
	}
	defer resp.Body.Close()

	if err := jsonmessage.DisplayJSONMessagesStream(resp.Body, progress, 0, false, nil); err != nil {
		return fmt.Errorf("docker: image build %s: %w", tag, err)
	}
	return nil
}

// ListBoxContainers returns every container tx9 has ever labeled
// (LabelManaged), running or not, so `tx9 list` can reconstruct state from
// the daemon alone.
func (c *Client) ListBoxContainers(ctx context.Context) ([]container.Summary, error) {
	f := filters.NewArgs(filters.Arg("label", LabelManaged+"=1"))
	containers, err := c.cli.ContainerList(ctx, container.ListOptions{All: true, Filters: f})
	if err != nil {
		return nil, fmt.Errorf("docker: list containers: %w", err)
	}
	return containers, nil
}

// NetworkCreate creates a private bridge network for a box, with IPv6
// explicitly disabled at the network level (dossier §1.4 — compose's
// default when no IPv6 config is requested; tx9 replicates it explicitly).
func (c *Client) NetworkCreate(ctx context.Context, name string, labels map[string]string) (string, error) {
	enableIPv6 := false
	resp, err := c.cli.NetworkCreate(ctx, name, network.CreateOptions{
		Driver:     "bridge",
		EnableIPv6: &enableIPv6,
		Labels:     labels,
	})
	if err != nil {
		return "", fmt.Errorf("docker: network create %s: %w", name, err)
	}
	return resp.ID, nil
}

// NetworkRemove removes a network by ID or name.
func (c *Client) NetworkRemove(ctx context.Context, id string) error {
	if err := c.cli.NetworkRemove(ctx, id); err != nil {
		return fmt.Errorf("docker: network remove %s: %w", id, err)
	}
	return nil
}

// VolumeCreate creates a named volume.
func (c *Client) VolumeCreate(ctx context.Context, name string, labels map[string]string) (string, error) {
	v, err := c.cli.VolumeCreate(ctx, volume.CreateOptions{Name: name, Labels: labels})
	if err != nil {
		return "", fmt.Errorf("docker: volume create %s: %w", name, err)
	}
	return v.Name, nil
}

// VolumeRemove removes a named volume.
func (c *Client) VolumeRemove(ctx context.Context, name string, force bool) error {
	if err := c.cli.VolumeRemove(ctx, name, force); err != nil {
		return fmt.Errorf("docker: volume remove %s: %w", name, err)
	}
	return nil
}

// ContainerSpec describes a container tx9 wants created. It only covers the
// fields the box topology (dossier §1) actually uses — not the full Engine
// API surface.
type ContainerSpec struct {
	Name           string
	Image          string
	Entrypoint     []string
	Env            []string
	Labels         map[string]string
	Hostname       string
	NetworkID      string
	NetworkAliases []string
	Binds          []string // "volume:/container/path" or "volume:/path:ro"
	ExposedPorts   nat.PortSet
	PortBindings   nat.PortMap
	Sysctls        map[string]string
	NanoCPUs       int64
	MemoryBytes    int64
}

// ContainerCreate creates (but does not start) a container per spec, with
// `--init` and `restart: unless-stopped` baked in (dossier §1.3 — every box
// container uses both).
func (c *Client) ContainerCreate(ctx context.Context, spec ContainerSpec) (string, error) {
	initEnabled := true
	cfg := &container.Config{
		Image:        spec.Image,
		Entrypoint:   spec.Entrypoint,
		Env:          spec.Env,
		Labels:       spec.Labels,
		Hostname:     spec.Hostname,
		ExposedPorts: spec.ExposedPorts,
	}
	hostCfg := &container.HostConfig{
		Binds:        spec.Binds,
		PortBindings: spec.PortBindings,
		Sysctls:      spec.Sysctls,
		Init:         &initEnabled,
		RestartPolicy: container.RestartPolicy{
			Name: container.RestartPolicyUnlessStopped,
		},
		Resources: container.Resources{
			NanoCPUs: spec.NanoCPUs,
			Memory:   spec.MemoryBytes,
		},
	}

	var netCfg *network.NetworkingConfig
	if spec.NetworkID != "" {
		netCfg = &network.NetworkingConfig{
			EndpointsConfig: map[string]*network.EndpointSettings{
				spec.NetworkID: {Aliases: spec.NetworkAliases},
			},
		}
	}

	resp, err := c.cli.ContainerCreate(ctx, cfg, hostCfg, netCfg, nil, spec.Name)
	if err != nil {
		return "", fmt.Errorf("docker: container create %s: %w", spec.Name, err)
	}
	return resp.ID, nil
}

// ContainerStart starts a previously-created container.
func (c *Client) ContainerStart(ctx context.Context, id string) error {
	if err := c.cli.ContainerStart(ctx, id, container.StartOptions{}); err != nil {
		return fmt.Errorf("docker: container start %s: %w", id, err)
	}
	return nil
}

// ContainerStop stops a running container (nil timeout uses the daemon
// default grace period).
func (c *Client) ContainerStop(ctx context.Context, id string, timeoutSeconds *int) error {
	if err := c.cli.ContainerStop(ctx, id, container.StopOptions{Timeout: timeoutSeconds}); err != nil {
		return fmt.Errorf("docker: container stop %s: %w", id, err)
	}
	return nil
}

// ContainerRemove removes a container. force also kills it if running.
func (c *Client) ContainerRemove(ctx context.Context, id string, force bool) error {
	if err := c.cli.ContainerRemove(ctx, id, container.RemoveOptions{Force: force, RemoveVolumes: false}); err != nil {
		return fmt.Errorf("docker: container remove %s: %w", id, err)
	}
	return nil
}

// ContainerInspect returns full container state.
func (c *Client) ContainerInspect(ctx context.Context, id string) (container.InspectResponse, error) {
	resp, err := c.cli.ContainerInspect(ctx, id)
	if err != nil {
		return container.InspectResponse{}, fmt.Errorf("docker: container inspect %s: %w", id, err)
	}
	return resp, nil
}

// ImageInspect returns full image metadata (used by `list` to show
// per-box image version drift).
func (c *Client) ImageInspect(ctx context.Context, tag string) (image.InspectResponse, error) {
	resp, err := c.cli.ImageInspect(ctx, tag)
	if err != nil {
		return image.InspectResponse{}, fmt.Errorf("docker: image inspect %s: %w", tag, err)
	}
	return resp, nil
}

// ImageList returns image summaries matching a reference filter (e.g.
// "tx9-box:*"), used by `tx9 prune` to find stale box images.
func (c *Client) ImageList(ctx context.Context, referenceFilter string) ([]image.Summary, error) {
	f := filters.NewArgs(filters.Arg("reference", referenceFilter))
	images, err := c.cli.ImageList(ctx, image.ListOptions{Filters: f})
	if err != nil {
		return nil, fmt.Errorf("docker: list images %s: %w", referenceFilter, err)
	}
	return images, nil
}

// ImageRemove removes an image by ID or tag.
func (c *Client) ImageRemove(ctx context.Context, ref string) error {
	if _, err := c.cli.ImageRemove(ctx, ref, image.RemoveOptions{}); err != nil {
		return fmt.Errorf("docker: image remove %s: %w", ref, err)
	}
	return nil
}

// ExecResult is the outcome of a non-interactive Exec call.
type ExecResult struct {
	Stdout   string
	Stderr   string
	ExitCode int
}

// Exec runs cmd inside containerID (no TTY), waits for completion, and
// returns its combined stdout/stderr and exit code. This is the
// "remote-control" pattern used to invoke `hb` inside the agent container
// (dossier §3, `_guest_hb`) for calls like `up`/`doctor`/`wire-once`.
//
// Interactive/TTY exec (e.g. `tx9 enter`) needs raw terminal handling this
// helper doesn't provide and should use Raw() directly.
func (c *Client) Exec(ctx context.Context, containerID string, cmd []string, env []string, user string) (ExecResult, error) {
	created, err := c.cli.ContainerExecCreate(ctx, containerID, container.ExecOptions{
		Cmd:          cmd,
		Env:          env,
		User:         user,
		AttachStdout: true,
		AttachStderr: true,
	})
	if err != nil {
		return ExecResult{}, fmt.Errorf("docker: exec create: %w", err)
	}

	attach, err := c.cli.ContainerExecAttach(ctx, created.ID, container.ExecAttachOptions{})
	if err != nil {
		return ExecResult{}, fmt.Errorf("docker: exec attach: %w", err)
	}
	defer attach.Close()

	var stdout, stderr bytes.Buffer
	if _, err := stdcopy.StdCopy(&stdout, &stderr, attach.Reader); err != nil {
		return ExecResult{}, fmt.Errorf("docker: exec read output: %w", err)
	}

	inspect, err := c.cli.ContainerExecInspect(ctx, created.ID)
	if err != nil {
		return ExecResult{}, fmt.Errorf("docker: exec inspect: %w", err)
	}

	return ExecResult{
		Stdout:   stdout.String(),
		Stderr:   stderr.String(),
		ExitCode: inspect.ExitCode,
	}, nil
}