package cmek

import (
	"context"
	"errors"
	"strconv"

	"github.com/aws/aws-sdk-go-v2/aws/arn"
	"github.com/samber/lo"
	regionaldedicatedv1 "github.com/tidbcloud/infra-provider/api/tidbcloud/regional-server/v1"
	"github.com/tidbcloud/tiinf/monitor/tilog"
	"go.uber.org/zap"

	globalcommonv1 "github.com/tidbcloud/tidb-management-service/api/spec/global/common/v1"
	globaldedicatedv1 "github.com/tidbcloud/tidb-management-service/api/spec/global/dedicated/v1"
	"github.com/tidbcloud/tidb-management-service/dedicated-global-service/domain/entity"
	"github.com/tidbcloud/tidb-management-service/dedicated-global-service/domain/repository/cmek"
	"github.com/tidbcloud/tidb-management-service/utilities/bizerr"
	"github.com/tidbcloud/tidb-management-service/utilities/featuregate"
)

func (s *customerManagedEncryptionKeyServiceImpl) Create(
	ctx context.Context,
	req *globaldedicatedv1.CreateCustomerManagedEncryptionKeyRequest,
) (*entity.CustomerManagedEncryptionKey, bizerr.BizError) {
	ctx, span := Tracer.Start(ctx, "Domain.CreateCmek")
	defer span.End()

	if req.CustomerManagedEncryptionKey == nil {
		return nil, bizerr.New(bizerr.ErrCodeParams, "cmek is invalid")
	}

	// convert request to entity
	cmekEntity := req.CustomerManagedEncryptionKey

	// check project
	// check cmek enable
	project, berr := s.accountCli.GetProject(ctx, cmekEntity.ProjectId)
	if berr != nil {
		return nil, berr
	}

	// if cmek not enabled, return empty
	if !project.AwsCmekEnabled ||
		!s.featGateCli.CheckFeatureEnabled(
			featuregate.AwsCmek,
			cmekEntity.OrganizationId,
			cmekEntity.ProjectId,
			cmekEntity.GetCloudProviderId().String(),
			cmekEntity.RegionId.String(),
		) {
		return nil, bizerr.New(bizerr.ErrCodeParams, "aws cmek is not enabled for this project")
	}

	// append app registration umi to cmekEntity
	if cmekEntity.CloudProviderId == globalcommonv1.CloudProvider_AZURE {
		regionEntity, err := s.regionRepo.SelectRegionById(ctx, cmekEntity.RegionId, cmekEntity.OrganizationId)
		if err != nil {
			return nil, bizerr.New(bizerr.ErrCodeDB, "failed to find region")
		}
		account, err := s.regionServerCli.GetAccount(
			ctx,
			regionEntity,
			&regionaldedicatedv1.GetAccountRequest{ProjectId: strconv.FormatUint(cmekEntity.ProjectId, 10)},
		)

		// not found, need to assign account
		if err != nil {
			if err.ErrCode() != bizerr.ErrCodeRecordNotFound {
				return nil, err
			}
			account, err = s.regionServerCli.AssignAccount(
				ctx,
				regionEntity,
				&regionaldedicatedv1.AssignAccountRequest{
					ProjectId:   strconv.FormatUint(cmekEntity.ProjectId, 10),
					CmekEnabled: true,
				},
			)
			if err != nil {
				return nil, err
			}
		}

		// double check account not nil
		if account == nil {
			return nil, bizerr.New(bizerr.ErrCodeUnknown, "failed to get iam principal")
		}

		cmekEntity.GetAzureKeyVault().AzureAppRegistration.AppRegistrationUmi = account.GetAzureAppRegistration().GetAppRegistrationUmi()
	}

	err := s.transaction.Transaction(ctx, func(ctx context.Context) error {
		// check if cmek of this region already exists
		cmeks, err := s.cmekRepo.Query(ctx, &cmek.Filter{
			CloudProviderNames: []entity.CloudProviderName{cmekEntity.CloudProviderId},
			RegionNames:        []entity.RegionName{cmekEntity.RegionId},
			OrganizationIds:    []uint64{cmekEntity.OrganizationId},
			ProjectIds:         []uint64{cmekEntity.ProjectId},
		})
		if err != nil {
			return err
		}

		if len(cmeks) > 0 {
			exists := lo.ContainsBy[*entity.CustomerManagedEncryptionKey](
				cmeks,
				func(item *entity.CustomerManagedEncryptionKey) bool {
					return item.RegionId == cmekEntity.RegionId && item.ProjectId == cmekEntity.ProjectId
				},
			)

			if exists {
				return bizerr.New(bizerr.ErrCodeRecordExist,
					"project %d in region %s cmek already exists",
					cmekEntity.ProjectId,
					cmekEntity.RegionId.String(),
				)
			}
		}

		// gen cmek id
		cmekEntity.Id = s.idGeneratorAdapter.MustNew()

		// check provider and region is valid
		err = s.checkCloudProviderAndRegion(
			ctx,
			cmekEntity.CloudProviderId,
			cmekEntity.RegionId,
			cmekEntity.OrganizationId,
		)
		if err != nil {
			return err
		}

		// check if cmek is valid
		err = s.checkCmekResource(ctx, cmekEntity)
		if err != nil {
			return err
		}

		if req.ValidateOnly {
			return nil
		}

		err = s.cmekRepo.Save(ctx, cmekEntity)
		if err != nil {
			return err
		}
		return nil
	})
	if err != nil {
		var e *bizerr.BizErr
		if errors.As(err, &e) && bizerr.IsRequestErr(e.ErrCode()) {
			return nil, e
		}

		// FIXME It's not a correct error code for checkCmekResource fail
		return nil, bizerr.New(bizerr.ErrCodeDB, "%s", err.Error())
	}

	return cmekEntity, nil
}

func (s *customerManagedEncryptionKeyServiceImpl) checkCmekResource(
	ctx context.Context,
	cmekEntity *entity.CustomerManagedEncryptionKey,
) bizerr.BizError {
	// check if kms arn is valid
	switch cmekEntity.CloudProviderId {
	case globalcommonv1.CloudProvider_AWS:
		parsedArn, err := arn.Parse(cmekEntity.GetAwsKeyArn())
		if err != nil {
			return bizerr.New(
				bizerr.ErrCodeParams,
				"failed to parse kms arn: %s, arn: %s",
				err.Error(),
				cmekEntity.GetAwsKeyArn(),
			)
		}
		if parsedArn.Service != "kms" {
			return bizerr.New(bizerr.ErrCodeParams, "provided kms arn is not for KMS service")
		}
	case globalcommonv1.CloudProvider_AZURE:
		suffixEntity, err := s.cmekRepo.GetProjectCmekKeySuffix(ctx, cmekEntity.ProjectId)
		if err != nil {
			return bizerr.New(bizerr.ErrCodeDB, "failed to get or create cmek suffix")
		}
		valid, err := verifyCmekKeySuffix(cmekEntity.ProjectId, cmekEntity.GetAzureKeyVault().KeyVaultKey, suffixEntity)
		if err != nil {
			return bizerr.New(
				bizerr.ErrCodeParams,
				"failed to verify azure cmek key suffix: %s, key: %s",
				err.Error(),
				cmekEntity.GetAzureKeyVault().KeyVaultKey,
			)
		}
		if !valid {
			return bizerr.New(bizerr.ErrCodeParams, "azure cmek key suffix is not valid")
		}

		regionEntity, err := s.regionRepo.SelectRegionById(ctx, cmekEntity.RegionId, cmekEntity.OrganizationId)
		if err != nil {
			tilog.Error(
				ctx,
				"failed to find region",
				zap.Error(err),
				zap.String("region_id", cmekEntity.RegionId.String()),
			)
			return err
		}
		resp, err := s.regionServerCli.ValidateSecurityConfiguration(
			ctx,
			regionEntity,
			&regionaldedicatedv1.ValidateSecurityConfigurationRequest{
				Provider: globalcommonv1.CloudProvider_Name_name[int32(cmekEntity.CloudProviderId)],
				SecurityConfigurations: &regionaldedicatedv1.Cluster_SecurityConfigurations{
					Cmek: &regionaldedicatedv1.Cluster_SecurityConfigurations_AzureCmek{
						AzureCmek: &regionaldedicatedv1.Cluster_AzureCmek{
							ApplicationId: cmekEntity.GetAzureKeyVault().
								GetAzureAppRegistration().
								GetAppRegistrationId(),
							ManagedIdentityResourceId: cmekEntity.GetAzureKeyVault().
								GetAzureAppRegistration().
								GetAppRegistrationUmi(),
							KeyName:      cmekEntity.GetAzureKeyVault().GetKeyVaultKey(),
							KeyVaultName: cmekEntity.GetAzureKeyVault().GetKeyVaultName(),
						},
					},
				},
			},
		)
		if err != nil {
			return bizerr.New(bizerr.GeneralInternalErrorCode, "failed to validate security configuration")
		}

		if !resp.IsValid {
			return bizerr.New(bizerr.ErrCodeParams, "azure cmek key is not valid: %s", resp.Message)
		}
	default:
		return bizerr.New(bizerr.ErrCodeParams, "not support cloud provider %s", cmekEntity.CloudProviderId)
	}

	return nil
}

func (s *customerManagedEncryptionKeyServiceImpl) checkCloudProviderAndRegion(
	ctx context.Context,
	cloudProviderId globalcommonv1.CloudProvider_Name,
	regionId globalcommonv1.Region_Name,
	orgId uint64,
) bizerr.BizError {
	region, err := s.regionRepo.SelectRegionById(ctx, regionId, orgId)
	if err != nil {
		return err
	}

	cloudProvider, err := s.regionRepo.GetCloudProviderById(ctx, cloudProviderId, orgId)
	if err != nil {
		return err
	}

	switch cloudProviderId {
	case globalcommonv1.CloudProvider_AWS, globalcommonv1.CloudProvider_AZURE:
		// do nothing
	default:
		return bizerr.New(bizerr.ErrCodeParams, "not support cloud provider %s", cloudProviderId)
	}

	if region.CloudProviderId != cloudProviderId {
		return bizerr.New(bizerr.ErrCodeParams, "region %s not belong to cloud provider %s", regionId, cloudProviderId)
	}

	if cloudProvider.State != globalcommonv1.CloudProvider_ACTIVE {
		return bizerr.New(bizerr.ErrCodeParams, "inactive cloud provider %s", cloudProvider.Id)
	}

	if region.State != globalcommonv1.Region_ACTIVE {
		return bizerr.New(bizerr.ErrCodeParams, "inactive region %s in %s cloud provider", region.Id, cloudProvider.Id)
	}

	if region.CloudProviderId != cloudProviderId {
		return bizerr.New(bizerr.ErrCodeParams, "region %s is not in cloud provider %s", region.Id, cloudProvider.Id)
	}

	return nil
}