import argparse
import asyncio
import json
import logging
import os
from urllib.parse import urlparse

from fastapi_vue.hostutil import parse_endpoint
from uvicorn import Config as UvicornConfig
from uvicorn import Server
from uvicorn import run as uvicorn_run

from paskia import globals as _globals
from paskia.bootstrap import bootstrap_if_needed
from paskia.config import PaskiaConfig
from paskia.db import get_config, set_config
from paskia.db import init as db_init
from paskia.db.background import flush
from paskia.db.structs import Config
from paskia.util import startupbox
from paskia.util.hostutil import normalize_origin

DEFAULT_PORT = 4401
DEVMODE = bool(os.getenv("PASKIA_FRONTEND_URL"))

EPILOG = """\
Example:
  paskia --rp-id example.com --rp-name "Example Corporation" --auth-host auth.example.com
"""


def is_subdomain(sub: str, domain: str) -> bool:
    """Check if sub is a subdomain of domain (or equal)."""
    sub_parts = sub.lower().split(".")
    domain_parts = domain.lower().split(".")
    if len(sub_parts) < len(domain_parts):
        return False
    return sub_parts[-len(domain_parts) :] == domain_parts


def validate_auth_host(auth_host: str, rp_id: str) -> None:
    """Validate that auth_host is a subdomain of rp_id."""
    parsed = urlparse(auth_host if "://" in auth_host else f"//{auth_host}")
    host = parsed.hostname or parsed.path
    if not host:
        raise SystemExit(f"Invalid auth-host: '{auth_host}'")
    if not is_subdomain(host, rp_id):
        raise SystemExit(
            f"auth-host '{auth_host}' is not a subdomain of rp-id '{rp_id}'"
        )


def add_common_options(p: argparse.ArgumentParser) -> None:
    p.add_argument(
        "--rp-id", default="localhost", help="Relying Party ID (default: localhost)"
    )
    p.add_argument("--rp-name", help="Relying Party name (default: same as rp-id)")
    p.add_argument(
        "--origin",
        action="append",
        dest="origins",
        metavar="URL",
        help="Allowed origin URL(s). May be specified multiple times. If any are specified, only those origins are permitted for WebSocket authentication.",
    )
    p.add_argument(
        "--auth-host",
        help=("Dedicated authentication site (optionally with scheme/port)"),
    )
    p.add_argument(
        "--save",
        action="store_true",
        help="Save the CLI options to database for future runs.",
    )


def main():
    # Configure logging to remove the "ERROR:root:" prefix
    logging.basicConfig(level=logging.INFO, format="%(message)s", force=True)

    parser = argparse.ArgumentParser(
        prog="paskia",
        description="Paskia authentication server",
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog=EPILOG,
    )

    parser.add_argument(
        "-l",
        "--listen",
        metavar="LISTEN",
        help=(
            "Endpoint to listen on (default: localhost:4401). "
            "Forms: host:port  port  :port  [ipv6]:port  unix:path  /path.sock"
        ),
    )
    add_common_options(parser)

    args = parser.parse_args()

    # Handle clearing options
    if getattr(args, "auth_host", None) == "":
        args.auth_host = None
    if getattr(args, "rp_name", None) == "":
        args.rp_name = None
    if getattr(args, "listen", None) == "":
        args.listen = None

    # Init db and load stored config
    asyncio.run(db_init(rp_id=args.rp_id))
    stored_config = get_config()

    # Apply defaults from stored config
    if args.rp_name is None and stored_config.rp_name is not None:
        args.rp_name = stored_config.rp_name
    if args.origins is None and stored_config.origins is not None:
        args.origins = stored_config.origins
    if args.auth_host is None and stored_config.auth_host is not None:
        args.auth_host = stored_config.auth_host
    if args.listen is None and stored_config.listen is not None:
        args.listen = stored_config.listen

    # Parse endpoint using fastapi_vue.hostutil
    endpoints = parse_endpoint(args.listen, DEFAULT_PORT)

    # Extract host/port/uds from first endpoint for config display and site_url
    ep = endpoints[0] if endpoints else {}
    host = ep.get("host")
    port = ep.get("port")
    uds = ep.get("uds")

    # Collect and normalize origins, handle auth_host
    origins = [normalize_origin(o) for o in (getattr(args, "origins", None) or [])]
    if args.auth_host:
        # Normalize auth_host with scheme
        if "://" not in args.auth_host:
            args.auth_host = f"https://{args.auth_host}"

        validate_auth_host(args.auth_host, args.rp_id)

        # If origins are configured, ensure auth_host is included at top
        if origins:
            # Insert auth_host at the beginning
            origins.insert(0, args.auth_host)

    # Remove duplicates while preserving order
    seen = set()
    origins = [x for x in origins if not (x in seen or seen.add(x))]

    # Compute site_url and site_path for reset links
    # Priority: PASKIA_SITE_URL (explicit) > auth_host > first origin with localhost > http://localhost:port
    explicit_site_url = os.environ.get("PASKIA_SITE_URL")
    if explicit_site_url:
        # Explicit site URL from devserver or deployment config
        site_url = explicit_site_url.rstrip("/")
        site_path = "/" if args.auth_host else "/auth/"
    elif args.auth_host:
        site_url = args.auth_host.rstrip("/")
        site_path = "/"
    elif origins:
        # Find localhost origin if rp_id is localhost, else use first origin
        localhost_origin = (
            next((o for o in origins if "://localhost" in o), None)
            if args.rp_id == "localhost"
            else None
        )
        site_url = (localhost_origin or origins[0]).rstrip("/")
        site_path = "/auth/"
    elif args.rp_id == "localhost" and port:
        # Dev mode: use http with port
        site_url = f"http://localhost:{port}"
        site_path = "/auth/"
    else:
        site_url = f"https://{args.rp_id}"
        site_path = "/auth/"

    # Build runtime configuration
    config = PaskiaConfig(
        rp_id=args.rp_id,
        rp_name=args.rp_name or None,
        origins=origins or None,
        auth_host=args.auth_host or None,
        site_url=site_url,
        site_path=site_path,
        host=host,
        port=port,
        uds=uds,
    )

    # Export configuration via single JSON env variable for worker processes
    config_json = {
        "rp_id": config.rp_id,
        "rp_name": config.rp_name,
        "origins": config.origins,
        "auth_host": config.auth_host,
        "site_url": config.site_url,
        "site_path": config.site_path,
    }
    os.environ["PASKIA_CONFIG"] = json.dumps(config_json)

    startupbox.print_startup_config(config)

    # Build config to save (for bootstrap or explicit --save)
    cli_config = Config(
        rp_id=args.rp_id,
        rp_name=args.rp_name,
        origins=args.origins,
        auth_host=args.auth_host,
        listen=args.listen,
    )

    run_kwargs: dict = {
        "log_level": "warning",  # Suppress startup messages; we use custom logging
        "access_log": False,  # We use custom AccessLogMiddleware instead
    }

    if DEVMODE:
        # Security: dev mode must run on localhost:4402 to prevent
        # accidental public exposure of the Vite dev server
        if host != "localhost" or port != 4402:
            raise SystemExit(f"Dev mode requires localhost:4402, got {host}:{port}")
        run_kwargs["reload"] = True
        run_kwargs["reload_dirs"] = ["paskia"]

    async def async_main():
        await _globals.init(
            rp_id=config.rp_id,
            rp_name=config.rp_name,
            origins=config.origins,
            bootstrap=False,
        )
        # Pass config to bootstrap - it will be saved within the bootstrap transaction
        await bootstrap_if_needed(config=cli_config)
        # Also save config if --save was explicitly used (even without bootstrap)
        if args.save:
            await set_config(cli_config)
        await flush()

        if len(endpoints) > 1:
            async with asyncio.TaskGroup() as tg:
                for ep in endpoints:
                    tg.create_task(
                        Server(
                            UvicornConfig(app="paskia.fastapi:app", **run_kwargs, **ep)
                        ).serve()
                    )
        elif DEVMODE:
            # Use uvicorn.run for proper reload support (it handles subprocess spawning)
            ep = endpoints[0]
            uvicorn_run("paskia.fastapi:app", **run_kwargs, **ep)
        else:
            server = Server(
                UvicornConfig(app="paskia.fastapi:app", **run_kwargs, **endpoints[0])
            )
            await server.serve()

    try:
        asyncio.run(async_main())
    except KeyboardInterrupt:
        pass


if __name__ == "__main__":
    main()