package aks

import (
	"fmt"
	"strings"

	"github.com/tidbcloud/infra-provider/regional-server/api/v1alpha1"
	"github.com/tidbcloud/infra-provider/regional-server/pkg/controllers"
	taskcontext "github.com/tidbcloud/infra-provider/regional-server/pkg/controllers/appbox/task"
)

const userAssignedIdentityResourceIDFormat = "/subscriptions/%s/resourceGroups/%s/providers/Microsoft.ManagedIdentity/userAssignedIdentities/%s"

func aksControlPlaneManagedIdentityName(appBox *v1alpha1.APPBox) string {
	return fmt.Sprintf("%s-cp-mi", aksClusterName(appBox))
}

func aksControlPlaneManagedIdentityResourceID(c *taskcontext.Context) (string, error) {
	if c.VPC == nil || c.VPC.Spec.AccountRef == nil {
		return "", fmt.Errorf("azure account reference is required for AKS managed identity")
	}

	subscriptionID := strings.TrimSpace(c.VPC.Spec.AccountRef.AccountID)
	if subscriptionID == "" {
		return "", fmt.Errorf("azure subscription id is required for AKS managed identity")
	}

	return buildUserAssignedIdentityResourceID(
		subscriptionID,
		controllers.GetResourceGroupName(c.VPC, c.Config.ResourceNamePrefix),
		aksControlPlaneManagedIdentityName(c.APPBox),
	), nil
}

func getOIDCIssuerURLWithoutScheme(oidcurl string) string {
	return strings.TrimPrefix(oidcurl, "https://")
}

func getBYOCManagedIdentityResourceIDs(c *taskcontext.Context) (string, string, bool, error) {
	if c == nil || !c.IsBYOC() {
		return "", "", false, nil
	}

	managedIdentityConfig, enabled, err := c.Config.BYOC.AKSManagedIdentityConfig()
	if err != nil {
		return "", "", false, err
	}
	if !enabled {
		return "", "", false, nil
	}
	if c.VPC == nil || c.VPC.Spec.AccountRef == nil {
		return "", "", false, fmt.Errorf("azure account reference is required for BYOC managed identities")
	}

	subscriptionID := strings.TrimSpace(c.VPC.Spec.AccountRef.AccountID)
	if subscriptionID == "" {
		return "", "", false, fmt.Errorf("azure subscription id is required for BYOC managed identities")
	}

	return buildUserAssignedIdentityResourceID(
			subscriptionID,
			managedIdentityConfig.ManagedIdentityResourceGroup,
			managedIdentityConfig.ControlPlaneIdentityName,
		),
		buildUserAssignedIdentityResourceID(
			subscriptionID,
			managedIdentityConfig.ManagedIdentityResourceGroup,
			managedIdentityConfig.KubeletIdentityName,
		),
		true,
		nil
}

func buildUserAssignedIdentityResourceID(subscriptionID, resourceGroupName, identityName string) string {
	return fmt.Sprintf(userAssignedIdentityResourceIDFormat, subscriptionID, resourceGroupName, identityName)
}

func shouldBypassPCAIssuerTask(c *taskcontext.Context) bool {
	return c != nil && c.IsBYOC()
}