package k8scliv1

import (
	"context"
	"fmt"

	gkev1beta2 "github.com/crossplane-contrib/provider-gcp/apis/container/v1beta2"
	"k8s.io/client-go/rest"
	"k8s.io/client-go/tools/clientcmd"
	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
	"sigs.k8s.io/controller-runtime/pkg/client"
)

const (
	gkeExecConfigAPIVersion = "client.authentication.k8s.io/v1beta1"
)

type gkeTenantClientManager struct {
	cli    client.Client
	option client.Options
}

func NewGKEClientManager(cli client.Client, opt client.Options) ClientManager {
	return &gkeTenantClientManager{
		cli:    cli,
		option: opt,
	}
}

func (t *gkeTenantClientManager) GetClient(ctx context.Context, cluster client.ObjectKey) (client.Client, error) {
	restCfg, err := t.GetConfig(ctx, cluster)
	if err != nil {
		return nil, err
	}
	cli, err := client.New(restCfg, t.option)
	if err != nil {
		return nil, err
	}
	return cli, nil
}

func (t *gkeTenantClientManager) GetConfig(ctx context.Context, gkeKey client.ObjectKey) (*rest.Config, error) {
	gke := &gkev1beta2.Cluster{}
	err := t.cli.Get(ctx, gkeKey, gke)
	if err != nil {
		return nil, err
	}
	cfg := clientcmdapi.NewConfig()

	cfgctx := clientcmdapi.NewContext()
	cfgctx.Cluster = gke.Name
	cfgctx.AuthInfo = gke.Name

	cluster := clientcmdapi.NewCluster()
	// TODO: get ca data from gcp
	cluster.InsecureSkipTLSVerify = true
	// cluster.CertificateAuthorityData = []byte(gke.Status.AtProvider.CertificateAuthorityData)
	cluster.Server = fmt.Sprintf("https://%s", gke.Status.AtProvider.Endpoint)

	auth := clientcmdapi.NewAuthInfo()
	auth.Exec = &clientcmdapi.ExecConfig{
		APIVersion:      gkeExecConfigAPIVersion,
		InteractiveMode: clientcmdapi.NeverExecInteractiveMode,
		Command:         "gke-gcloud-auth-plugin",
		Args:            []string{"--use_application_default_credentials"},
	}

	cfg.Contexts[gke.Name] = cfgctx
	cfg.Clusters[gke.Name] = cluster
	cfg.AuthInfos[gke.Name] = auth
	cfg.CurrentContext = gke.Name

	return clientcmd.NewDefaultClientConfig(*cfg, nil).ClientConfig()
}