package box

import (
	"context"
	"errors"
	"fmt"

	dockernetwork "github.com/docker/docker/api/types/network"
	dockerclient "github.com/docker/docker/client"

	"github.com/davis7dotsh/tx9/internal/docker"
	"github.com/davis7dotsh/tx9/internal/names"
)

// ErrObjectsExist identifies a fresh box name that collides with Docker objects.
var ErrObjectsExist = errors.New("box objects already exist")

// PreflightFreshObjects rejects names whose containers have been removed but
// whose durable volumes or network remain. Fresh create/import must call this
// under the box lock, before writing a new token or changing Docker objects.
// Upgrade intentionally reuses owned objects through ensureNetwork/Volume.
func PreflightFreshObjects(ctx context.Context, cli *docker.Client, name string) error {
	if err := names.Validate(name); err != nil {
		return err
	}
	agent, executor := ContainerNames(name)
	for _, container := range []string{agent, executor} {
		if _, err := cli.ContainerInspect(ctx, container); err == nil {
			return existingObjectError(name, "container", container)
		} else if !dockerclient.IsErrNotFound(err) {
			return err
		}
	}
	network := NetworkName(name)
	if _, err := cli.Raw().NetworkInspect(ctx, network, dockernetwork.InspectOptions{}); err == nil {
		return existingObjectError(name, "network", network)
	} else if !dockerclient.IsErrNotFound(err) {
		return fmt.Errorf("inspect network %s: %w", network, err)
	}
	agentVolume, executorVolume := VolumeNames(name)
	for _, volume := range []string{agentVolume, executorVolume} {
		if _, err := cli.Raw().VolumeInspect(ctx, volume); err == nil {
			return existingObjectError(name, "volume", volume)
		} else if !dockerclient.IsErrNotFound(err) {
			return fmt.Errorf("inspect volume %s: %w", volume, err)
		}
	}
	return nil
}

func existingObjectError(box, kind, name string) error {
	return fmt.Errorf("box %q already has Docker %s %q; choose a different box name or recover/remove the existing resources explicitly: %w", box, kind, name, ErrObjectsExist)
}

// PreflightExistingObjects verifies ownership of every existing object and
// returns all container IDs upgrade must remove before recreating the box.
// Missing objects remain recreatable. Callers must hold the box lock through
// teardown and remove this complete set, including duplicate or unknown roles.
func PreflightExistingObjects(ctx context.Context, cli *docker.Client, name string) ([]string, error) {
	targets, err := inspectDestroyTargets(ctx, cli, name)
	if err != nil {
		return nil, err
	}
	return targets.containerIDs, nil
}

func ownedByBox(labels map[string]string, name string) bool {
	return labels[docker.LabelManaged] == "1" && labels[docker.LabelBox] == name
}

type destroyTargets struct {
	containerIDs []string
	networkID    string
	volumes      []string
}

// Inspect every deletion target before allowing any mutation. Derived names
// are checked even when labels find a container, so a foreign sibling cannot
// be missed in a partially created box. Labels also find renamed containers.
func inspectDestroyTargets(ctx context.Context, cli *docker.Client, name string) (destroyTargets, error) {
	if err := names.Validate(name); err != nil {
		return destroyTargets{}, err
	}
	agent, executor := ContainerNames(name)
	containerRefs := []string{agent, executor}
	containers, err := cli.ListBoxContainers(ctx)
	if err != nil {
		return destroyTargets{}, err
	}
	for _, container := range containers {
		if ownedByBox(container.Labels, name) {
			containerRefs = append(containerRefs, container.ID)
		}
	}
	var targets destroyTargets
	seen := make(map[string]bool)
	for _, ref := range containerRefs {
		if ref == "" || seen[ref] {
			continue
		}
		id, err := inspectOwnedContainer(ctx, cli, ref, name)
		if err != nil {
			return destroyTargets{}, err
		}
		if id != "" && !seen[id] {
			targets.containerIDs = append(targets.containerIDs, id)
			seen[id] = true
		}
	}
	targets.networkID, err = inspectOwnedNetwork(ctx, cli, NetworkName(name), name)
	if err != nil {
		return destroyTargets{}, err
	}
	agentVolume, executorVolume := VolumeNames(name)
	for _, ref := range []string{agentVolume, executorVolume} {
		volume, err := inspectOwnedVolume(ctx, cli, ref, name)
		if err != nil {
			return destroyTargets{}, err
		}
		if volume != "" {
			targets.volumes = append(targets.volumes, volume)
		}
	}
	return targets, nil
}

func inspectOwnedContainer(ctx context.Context, cli *docker.Client, id, name string) (string, error) {
	inspect, err := cli.ContainerInspect(ctx, id)
	if dockerclient.IsErrNotFound(err) {
		return "", nil
	}
	if err != nil {
		return "", err
	}
	if inspect.Config == nil || !ownedByBox(inspect.Config.Labels, name) {
		return "", fmt.Errorf("refusing to use container %s: it is not owned by box %s", id, name)
	}
	if inspect.ContainerJSONBase == nil || inspect.ID == "" {
		return "", fmt.Errorf("inspect container %s: missing container ID", id)
	}
	return inspect.ID, nil
}

func inspectOwnedNetwork(ctx context.Context, cli *docker.Client, network, name string) (string, error) {
	inspect, err := cli.Raw().NetworkInspect(ctx, network, dockernetwork.InspectOptions{})
	if dockerclient.IsErrNotFound(err) {
		return "", nil
	}
	if err != nil {
		return "", fmt.Errorf("inspect network %s: %w", network, err)
	}
	if !ownedByBox(inspect.Labels, name) {
		return "", fmt.Errorf("refusing to use network %s: it is not owned by box %s", network, name)
	}
	if inspect.ID == "" {
		return "", fmt.Errorf("inspect network %s: missing network ID", network)
	}
	return inspect.ID, nil
}

func inspectOwnedVolume(ctx context.Context, cli *docker.Client, volume, name string) (string, error) {
	inspect, err := cli.Raw().VolumeInspect(ctx, volume)
	if dockerclient.IsErrNotFound(err) {
		return "", nil
	}
	if err != nil {
		return "", fmt.Errorf("inspect volume %s: %w", volume, err)
	}
	if !ownedByBox(inspect.Labels, name) {
		return "", fmt.Errorf("refusing to use volume %s: it is not owned by box %s", volume, name)
	}
	return volume, nil
}