import java.io.*;
import java.net.*;
import java.net.http.*;
import java.nio.file.*;
import java.nio.file.attribute.*;
import java.security.MessageDigest;
import java.time.Duration;
import java.util.*;

class Setup {
    static Path home() { return Path.of(System.getProperty("user.home")); }
    static String required(Map<String,String> env, String key) {
        String value = env.get(key);
        if (value == null || value.isBlank()) throw new IllegalArgumentException("Missing " + key);
        return value;
    }
    static String secret(Map<String,String> env, String key) throws IOException {
        Path path = Path.of(required(env,key));
        Set<PosixFilePermission> permissions = Files.getPosixFilePermissions(path);
        if (permissions.stream().anyMatch(p -> p.name().startsWith("GROUP_") || p.name().startsWith("OTHERS_")))
            throw new IllegalArgumentException(key + " must refer to an owner-only file (mode 600)");
        String token = Files.readString(path).strip();
        if (token.isEmpty()) throw new IllegalArgumentException(key + " is empty");
        return token;
    }
    static class ApiFailure extends IOException {
        final int status;
        ApiFailure(int status) { super("Gitea HTTP " + status); this.status = status; }
    }
    static Object api(String server, String token, String method, String path, Object body) throws Exception {
        Pipeline.check(token.matches("[a-zA-Z0-9_-]+"), "Invalid token format");
        HttpRequest request = HttpRequest.newBuilder(URI.create(server.replaceAll("/+$", "") + path))
                .timeout(Duration.ofSeconds(30)).header("Authorization", "token " + token)
                .header("Content-Type", "application/json")
                .method(method, body == null ? HttpRequest.BodyPublishers.noBody() : HttpRequest.BodyPublishers.ofString(Json.write(body)))
                .build();
        try (HttpClient client = HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(30)).build()) {
            var response = client.send(request, HttpResponse.BodyHandlers.ofString());
            if (response.statusCode() < 200 || response.statusCode() >= 300) throw new ApiFailure(response.statusCode());
            return response.body().isBlank() ? null : Json.parse(response.body());
        }
    }
    static void configureGitea(Map<String,String> env) throws Exception {
        String admin = secret(env,"GITEA_ADMIN_TOKEN_FILE"), registry = secret(env,"REGISTRY_TOKEN_FILE");
        String user = required(env,"REGISTRY_USER"), platform = required(env,"TARGET_PLATFORM");
        Pipeline.check(Set.of("linux/amd64","linux/arm64").contains(platform), "Set TARGET_PLATFORM from the verified Synology architecture");
        String server = "http://192.168.2.28:3000", base = "/api/v1/repos/wanjakrah/agiledancers";
        api(server,admin,"PATCH",base,Map.of("has_actions",true));
        api(server,admin,"PUT",base + "/actions/secrets/REGISTRY_USER",Map.of("data",user));
        api(server,admin,"PUT",base + "/actions/secrets/REGISTRY_TOKEN",Map.of("data",registry));
        String variable = base + "/actions/variables/TARGET_PLATFORM";
        boolean exists;
        try { api(server,admin,"GET",variable,null); exists = true; }
        catch (ApiFailure e) { if (e.status != 404) throw e; exists = false; }
        api(server,admin,exists ? "PUT" : "POST",variable,Map.of("value",platform));
        Map<String,Object> response = Json.object(api(server,admin,"POST",base + "/actions/runners/registration-token",null));
        Path directory = home().resolve(".config/agiledancers-runner");
        privateDirectory(directory);
        privateWrite(directory.resolve("registration-token"), Objects.toString(response.get("token")));
        System.out.println("Actions, registry secrets and platform configured; runner token saved outside Git.");
    }
    static void configureDocker(Path file) throws IOException {
        Map<String,Object> data = Files.exists(file) ? Json.object(Json.parse(Files.readString(file))) : new LinkedHashMap<>();
        Object entry = data.getOrDefault("insecure-registries", new ArrayList<>());
        if (!(entry instanceof List<?>)) throw new IllegalArgumentException("Existing insecure-registries must be an array; unchanged");
        List<Object> registries = new ArrayList<>((List<?>)entry);
        if (registries.contains("192.168.2.28:3000")) { System.out.println("Internal registry already configured; no change"); return; }
        registries.add("192.168.2.28:3000"); data.put("insecure-registries",registries);
        Path absolute = file.toAbsolutePath(), parent = absolute.getParent(); Files.createDirectories(parent);
        if (Files.exists(file)) {
            Path backup = file.resolveSibling(file.getFileName() + ".before-agiledancers");
            if (!Files.exists(backup)) Files.copy(file,backup,StandardCopyOption.COPY_ATTRIBUTES);
        }
        Path temp = Files.createTempFile(parent,"daemon-", ".json");
        try {
            Files.writeString(temp,Json.write(data) + "\n");
            if (Files.exists(file)) Files.setPosixFilePermissions(temp,Files.getPosixFilePermissions(file));
            Files.move(temp,absolute,StandardCopyOption.ATOMIC_MOVE,StandardCopyOption.REPLACE_EXISTING);
        } finally { Files.deleteIfExists(temp); }
        System.out.println("Internal registry added; restart/apply Docker Engine configuration to activate");
    }
    static void installRunner(Path root, Map<String,String> env, Commands commands, boolean prepareOnly) throws Exception {
        Pipeline.check(System.getProperty("os.name").equals("Linux") && Set.of("amd64","x86_64").contains(System.getProperty("os.arch")),
                "Installer targets the existing Linux x86_64 mini-PC");
        Path runnerDir = home().resolve(".local/share/agiledancers-runner"), configDir = home().resolve(".config/agiledancers-runner");
        Path bin = home().resolve(".local/bin"), units = home().resolve(".config/systemd/user");
        for (Path path : List.of(runnerDir,configDir,bin,units)) privateDirectory(path);
        for (String tool : List.of("node","java","mvn","docker","git","systemctl")) executable(env,tool);
        String javaHome = System.getProperty("java.home");
        String version = commands.execute(List.of("node","--version"),root,env,null,false).checked();
        String[] parts = version.replaceFirst("^v", "").split("\\.");
        int major = Integer.parseInt(parts[0]), minor = Integer.parseInt(parts[1]), patch = Integer.parseInt(parts[2]);
        Pipeline.check((major == 22 && (minor > 22 || minor == 22 && patch >= 3)) || (major == 24 && minor >= 15) || major >= 26,
                "Supported Node version required");
        Path runner = bin.resolve("act_runner");
        if (!Files.isExecutable(runner)) {
            URI uri = URI.create("https://dl.gitea.com/act_runner/0.2.13/act_runner-0.2.13-linux-amd64");
            byte[] bytes;
            try (HttpClient client = HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NORMAL).build()) {
                var response = client.send(HttpRequest.newBuilder(uri).timeout(Duration.ofMinutes(2)).build(),HttpResponse.BodyHandlers.ofByteArray());
                Pipeline.check(response.statusCode() == 200, "Runner download failed"); bytes = response.body();
            }
            String hash = HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(bytes));
            Pipeline.check(hash.equals("3acac8b506ac8cadc88a55155b5d6378f0fab0b8f62d1e0c0450f4ccd69733e2"),"Runner checksum mismatch");
            Files.write(runner,bytes); Files.setPosixFilePermissions(runner,PosixFilePermissions.fromString("rwxr-xr-x"));
        }
        String actual = commands.execute(List.of(runner.toString(),"--version"),root,env,null,false).checked();
        Pipeline.check(actual.contains("v0.2.13"), "Expected runner v0.2.13");
        privateWrite(runnerDir.resolve("config.yaml"),Files.readString(root.resolve("ci/runner/config.yaml")));
        Files.copy(root.resolve("ci/runner/agiledancers-runner.service"),units.resolve("agiledancers-runner.service"),StandardCopyOption.REPLACE_EXISTING);
        String dockerHost = env.get("DOCKER_HOST");
        if (dockerHost == null || dockerHost.isBlank()) dockerHost = commands.execute(List.of("docker","context","inspect","--format","{{.Endpoints.docker.Host}}"),root,env,null,false).checked();
        String path = javaHome + "/bin:" + executable(env,"node").getParent() + ":" + executable(env,"mvn").getParent() + ":/usr/local/bin:/usr/bin:/bin";
        privateWrite(configDir.resolve("environment"),"JAVA_HOME=" + quoted(javaHome) + "\nPATH=" + quoted(path) + "\nDOCKER_HOST=" + quoted(dockerHost) + "\n");
        commands.execute(List.of("systemctl","--user","daemon-reload"),root,env,null,true).checked();
        if (prepareOnly) { System.out.println("Runner installed; registration and startup still required."); return; }
        commands.execute(List.of("docker","info"),root,env,null,false).checked();
        if (!Files.exists(runnerDir.resolve(".runner"))) {
            Path tokenPath = Path.of(env.getOrDefault("RUNNER_REGISTRATION_TOKEN_FILE",configDir.resolve("registration-token").toString()));
            Map<String,String> tokenEnv = Map.of("RUNNER_TOKEN_FILE",tokenPath.toString());
            String token = secret(tokenEnv,"RUNNER_TOKEN_FILE");
            commands.execute(List.of(runner.toString(),"register","--no-interactive","--instance","http://192.168.2.28:3000",
                    "--name","agiledancers-mini-pc","--labels","agiledancers-mini-pc:host","--token",token),runnerDir,env,null,true).checked();
            Files.setPosixFilePermissions(runnerDir.resolve(".runner"),PosixFilePermissions.fromString("rw-------"));
        }
        commands.execute(List.of("systemctl","--user","enable","--now","agiledancers-runner.service"),root,env,null,true).checked();
        System.out.println("Runner registered and started; keep the mini-PC and Docker available.");
    }
    static Path executable(Map<String,String> env, String name) {
        for (String dir : env.getOrDefault("PATH", "").split(File.pathSeparator)) {
            Path path = Path.of(dir,name); if (Files.isRegularFile(path) && Files.isExecutable(path)) return path.toAbsolutePath();
        }
        throw new IllegalArgumentException("Missing executable: " + name);
    }
    static String quoted(String value) {
        Pipeline.check(!value.contains("\n") && !value.contains("\r"), "Invalid service environment value");
        return "\"" + value.replace("\\","\\\\").replace("\"","\\\"") + "\"";
    }
    static void privateDirectory(Path path) throws IOException {
        Files.createDirectories(path); Files.setPosixFilePermissions(path,PosixFilePermissions.fromString("rwx------"));
    }
    static void privateWrite(Path path, String text) throws IOException {
        if (!Files.exists(path)) Files.createFile(path,PosixFilePermissions.asFileAttribute(PosixFilePermissions.fromString("rw-------")));
        Files.setPosixFilePermissions(path,PosixFilePermissions.fromString("rw-------")); Files.writeString(path,text);
    }
}