package dedicatedapi

import (
	"context"
	"fmt"
	"os"
	"path/filepath"
	"strings"

	"github.com/tidbcloud/controlplane9/internal/host"
)

// PersistRemoteAdminKubeconfig makes the loopback-bound Dedicated admin
// identity available on a remote host. The same 127.0.0.1 endpoint is valid
// there because k3d publishes the Dedicated NodePort on the remote host's
// loopback interface. Re-running this operation safely repairs older sessions
// that completed host_ready before this metadata was persisted.
func PersistRemoteAdminKubeconfig(ctx context.Context, selected *host.Session) error {
	if selected == nil || selected.Remote == nil || selected.DedicatedAPI == nil {
		return fmt.Errorf("persist remote Dedicated admin kubeconfig: prepared remote session is required")
	}
	remoteStateDir := strings.TrimSpace(selected.Remote.RemoteStateDir)
	if remoteStateDir == "" || !filepath.IsAbs(remoteStateDir) {
		return fmt.Errorf("persist remote Dedicated admin kubeconfig: absolute remote state directory is required")
	}
	adminPath := strings.TrimSpace(selected.DedicatedAPI.AdminKubeconfigPath)
	if adminPath == "" {
		return fmt.Errorf("persist remote Dedicated admin kubeconfig: local admin kubeconfig path is required")
	}
	adminKubeconfig, err := os.ReadFile(adminPath)
	if err != nil {
		return fmt.Errorf("read Dedicated API admin kubeconfig for remote host: %w", err)
	}
	remoteAdminPath := filepath.Join(remoteStateDir, StateDirName, "admin.kubeconfig")
	remoteDir := filepath.Dir(remoteAdminPath)
	script := fmt.Sprintf(`set -eu
umask 077
mkdir -p -- %s
temporary=$(mktemp %s)
trap 'rm -f -- "$temporary"' EXIT
cat > "$temporary"
chmod 600 "$temporary"
mv -- "$temporary" %s
trap - EXIT
`, host.ShellEscape(remoteDir), host.ShellEscape(filepath.Join(remoteDir, ".admin.kubeconfig.XXXXXX")), host.ShellEscape(remoteAdminPath))
	if _, err := host.RunSSH(ctx, selected, adminKubeconfig, "sh", "-lc", script); err != nil {
		return fmt.Errorf("persist Dedicated API admin kubeconfig on remote host: %w", err)
	}
	selected.DedicatedAPI.RemoteAdminKubeconfigPath = remoteAdminPath
	if err := host.Save(selected.StateDir, selected); err != nil {
		return fmt.Errorf("persist remote Dedicated admin kubeconfig metadata: %w", err)
	}
	return nil
}