//! Certificate list, flat or as an issuer tree.
use std::collections::HashMap;

use serde_json::json;

use sycamore::prelude::*;
use wasm_bindgen::JsCast;
use wasm_bindgen_futures::spawn_local;

use crate::api;
use crate::components::nav::{app_nav, spinner, whoami};
use crate::components::ui::{page_header, toast_error};
use crate::dom;
use crate::model::{fmt_date, fmt_fp, status_badge, CertificateSummary, Me};

pub fn CertificatesPage(vault_id: String) -> View {
    let id: &'static str = Box::leak(vault_id.clone().into_boxed_str());
    let me = create_signal(None::<Me>);
    let certificates = create_signal(Vec::<CertificateSummary>::new());
    let error = create_signal(None::<String>);
    let loading = create_signal(true);
    let filter = create_signal(String::new());
    let plain = create_signal(false);
    let selected = create_signal(Vec::<String>::new());
    let bulk_reason = create_signal("unspecified".to_string());
    let bulk_invalidity = create_signal(String::new());
    let bulk_busy = create_signal(false);
    let info = create_signal(None::<String>);

    spawn_local(async move {
        match api::me().await {
            Ok(user) => {
                if me.is_alive() {
                    me.set(Some(user));
                }
                match api::certificates(id).await {
                    Ok(page) => {
                        if certificates.is_alive() {
                            certificates.set(page.results);
                        }
                    }
                    Err(message) if message != api::LOGIN_REQUIRED => {
                        if error.is_alive() {
                            error.set(Some(message));
                        }
                    }
                    _ => {}
                }
            }
            Err(message) if message == api::LOGIN_REQUIRED => {}
            Err(message) => {
                if error.is_alive() {
                    error.set(Some(message));
                }
            }
        }
        if loading.is_alive() {
            loading.set(false);
        }
    });

    let refresh = move || {
        spawn_local(async move {
            if let Ok(page) = api::certificates(id).await {
                if certificates.is_alive() {
                    certificates.set(page.results);
                }
            }
        });
    };

    let toggle = move |event: web_sys::Event| {
        if let Some(target) = event
            .target()
            .and_then(|t| t.dyn_into::<web_sys::HtmlInputElement>().ok())
        {
            if let Some(cert_id) = target.get_attribute("data-cert-id") {
                let mut current = selected.get_clone();
                if target.checked() {
                    if !current.contains(&cert_id) {
                        current.push(cert_id);
                    }
                } else {
                    current.retain(|value| value != &cert_id);
                }
                selected.set(current);
            }
        }
    };
    let select_all = move |_| {
        let all = certificates
            .get_clone()
            .into_iter()
            .filter(|cert| cert.issuer_id.is_some())
            .map(|cert| cert.id)
            .collect::<Vec<_>>();
        selected.set(all);
    };
    let clear_selection = move |_| selected.set(Vec::new());
    let bulk_revoke = move |_| {
        let ids = selected.get_clone();
        if ids.is_empty() {
            error.set(Some("select at least one certificate".to_string()));
            return;
        }
        if !dom::confirm(&format!("Revoke {} selected certificate(s)?", ids.len())) {
            return;
        }
        let payload = json!({
            "certificate_ids": ids,
            "reason": bulk_reason.get_clone(),
            "invalidity_date": if bulk_invalidity.get_clone().is_empty() {
                serde_json::Value::Null
            } else {
                json!(bulk_invalidity.get_clone())
            },
        });
        bulk_busy.set(true);
        spawn_local(async move {
            match api::bulk_revoke_certificates(id, &payload).await {
                Ok(value) => {
                    let revoked = value
                        .get("revoked")
                        .and_then(|v| v.as_array())
                        .map(|v| v.len())
                        .unwrap_or(0);
                    let skipped = value
                        .get("skipped")
                        .and_then(|v| v.as_array())
                        .map(|v| v.len())
                        .unwrap_or(0);
                    let errors = value
                        .get("errors")
                        .and_then(|v| v.as_array())
                        .map(|v| v.len())
                        .unwrap_or(0);
                    info.set(Some(format!(
                        "Revoked {revoked} certificate(s); {skipped} already revoked; {errors} error(s)."
                    )));
                    selected.set(Vec::new());
                    bulk_invalidity.set(String::new());
                    refresh();
                }
                Err(message) if message == api::LOGIN_REQUIRED => {}
                Err(message) => error.set(Some(message)),
            }
            if bulk_busy.is_alive() {
                bulk_busy.set(false);
            }
        });
    };

    let content = move || {
        if loading.get() {
            return spinner();
        }
        let rows = certificates.get_clone();
        let query = filter.get_clone().to_lowercase();
        let visible: Vec<CertificateSummary> = rows
            .into_iter()
            .filter(|cert| {
                query.is_empty()
                    || cert.name.to_lowercase().contains(&query)
                    || cert.subject.to_lowercase().contains(&query)
                    || cert.issuer_name.to_lowercase().contains(&query)
                    || cert.serial_hex.to_lowercase().contains(&query)
                    || cert.fingerprint_sha256.to_lowercase().contains(&query)
            })
            .collect();
        let chosen = selected.get_clone();
        let html = if plain.get() {
            flat_html(&visible, id, &chosen)
        } else {
            tree_html(&visible, id, &chosen)
        };
        view! {
            (page_header(
                "Certificates",
                "The tree follows issuer links; use the plain view for a flat table.",
                view! {
                    a(class="btn btn-primary", href=format!("/vaults/{id}/certificates/new")) { "New certificate" }
                    a(class="btn btn-outline-light", href=format!("/vaults/{id}/import")) { "Import" }
                    button(class="btn btn-outline-light", on:click=move |_| plain.set(!plain.get())) {
                        (if plain.get() { "Tree view" } else { "Plain view" })
                    }
                },
            ))
            div(class="card mb-3") {
                div(class="card-body py-2") {
                    input(class="form-control", placeholder="Filter by name, subject, issuer, serial or fingerprint…",
                          aria-label="Filter certificates", bind:value=filter)
                }
            }
            div(class="card mb-3") {
                div(class="card-body") {
                    div(class="d-flex flex-wrap gap-2 align-items-end") {
                        div(class="me-auto") {
                            div(class="small text-secondary", aria-live="polite") { (format!("{} selected", selected.get_clone().len())) }
                            div(class="d-flex gap-2 mt-1") {
                                button(class="btn btn-sm btn-outline-light", on:click=select_all) { "Select all revocable" }
                                button(class="btn btn-sm btn-outline-light", on:click=clear_selection) { "Clear" }
                            }
                        }
                        div() {
                            label(class="form-label small mb-1") { "Reason" }
                            select(class="form-select form-select-sm", bind:value=bulk_reason) { (reason_options()) }
                        }
                        div() {
                            label(class="form-label small mb-1") { "Invalid since (optional)" }
                            input(class="form-control form-control-sm", r#type="datetime-local", bind:value=bulk_invalidity)
                        }
                        button(class="btn btn-warning", disabled=bulk_busy.get() || selected.get_clone().is_empty(), on:click=bulk_revoke) {
                            (if bulk_busy.get() { "Revoking…" } else { "Revoke selected" })
                        }
                    }
                }
            }
            div(class="card", on:change=toggle, dangerously_set_inner_html=html) {}
        }
    };

    let nav = move || match me.get_clone() {
        Some(user) => whoami(&user),
        None => view! {},
    };

    view! {
        (app_nav("/", Some(id), nav))
        main(class="container page-shell py-4") {
            (toast_error(error))
            (crate::components::toast::toast(info, true))
            (content)
        }
    }
}

fn certificate_href(vault_id: &str, cert_id: &str) -> String {
    format!("/vaults/{}/certificates/{}", escape(vault_id), escape(cert_id))
}

fn flat_html(rows: &[CertificateSummary], vault_id: &str, selected: &[String]) -> String {
    if rows.is_empty() {
        return "<p class=\"empty-state\">No certificates match.</p>".to_string();
    }
    let mut body = String::new();
    for cert in rows {
        let (badge_class, badge_label) = status_badge(cert);
        body.push_str(&format!(
            "<tr><td>{}</td><td><a href=\"{}\">{}</a><div class=\"item-sub\">{}</div></td><td>{}</td><td>{}</td><td class=\"fingerprint\">{}</td><td>{}</td><td><span class=\"badge {}\">{}</span>{}</td><td class=\"fingerprint\">{}</td></tr>",
            checkbox(cert, selected),
            certificate_href(vault_id, &cert.id),
            escape(&cert.name),
            escape(&cert.subject),
            escape(&cert.issuer_name),
            if cert.is_ca { "CA" } else { "end entity" },
            escape(&cert.serial_hex),
            if cert.no_expiration { "No expiration".to_string() } else { fmt_date(&cert.not_after) },
            badge_class,
            badge_label,
            if cert.has_private_key { " <span class=\"badge badge-soft\">key</span>" } else { "" },
            fmt_fp(&cert.fingerprint_sha256),
        ));
    }
    format!(
        "<div class=\"table-responsive\"><table class=\"table table-hover align-middle mb-0\"><thead><tr><th scope=\"col\"><span class=\"visually-hidden\">Select</span></th><th scope=\"col\">Name</th><th scope=\"col\">Issuer</th><th scope=\"col\">Type</th><th scope=\"col\">Serial</th><th scope=\"col\">Expires</th><th scope=\"col\">Status</th><th scope=\"col\">SHA-256</th></tr></thead><tbody>{body}</tbody></table></div>"
    )
}

fn tree_html(rows: &[CertificateSummary], vault_id: &str, selected: &[String]) -> String {
    if rows.is_empty() {
        return "<p class=\"empty-state\">No certificates match.</p>".to_string();
    }
    let mut children: HashMap<String, Vec<CertificateSummary>> = HashMap::new();
    let mut roots: Vec<CertificateSummary> = Vec::new();
    let ids: Vec<String> = rows.iter().map(|cert| cert.id.clone()).collect();
    for cert in rows {
        match &cert.issuer_id {
            Some(issuer) if ids.contains(issuer) && issuer != &cert.id => {
                children
                    .entry(issuer.clone())
                    .or_default()
                    .push(cert.clone());
            }
            _ => roots.push(cert.clone()),
        }
    }
    roots.sort_by(|a, b| a.name.to_lowercase().cmp(&b.name.to_lowercase()));
    let mut html = String::from("<div class=\"card-body\"><ul class=\"cert-tree\">");
    for root in &roots {
        html.push_str(&node_html(root, &children, vault_id, selected));
    }
    html.push_str("</ul></div>");
    html
}

fn node_html(
    cert: &CertificateSummary,
    children: &HashMap<String, Vec<CertificateSummary>>,
    vault_id: &str,
    selected: &[String],
) -> String {
    let (badge_class, badge_label) = status_badge(cert);
    let sub = if cert.subject == cert.issuer_name {
        "self-signed".to_string()
    } else {
        format!("issuer: {}", cert.issuer_name)
    };
    let mut row = format!(
        "<div class=\"cert-row\">{}<a class=\"item-name\" href=\"{}\">{}</a>{} <span class=\"badge {}\">{}</span><span class=\"item-sub\">{}</span><span class=\"item-sub\">expires {}</span><span class=\"item-sub fingerprint\">{}</span></div>",
        checkbox(cert, selected),
        certificate_href(vault_id, &cert.id),
        escape(&cert.name),
        if cert.is_ca { " <span class=\"badge badge-ca\">CA</span>" } else { "" },
        badge_class,
        badge_label,
        escape(&sub),
        if cert.no_expiration { "No expiration".to_string() } else { fmt_date(&cert.not_after) },
        fmt_fp(&cert.fingerprint_sha256),
    );
    let kids = children.get(&cert.id);
    if let Some(kids) = kids {
        if !kids.is_empty() {
            row = format!(
                "<li><details class=\"cert-node\" open><summary>{row}</summary><ul class=\"cert-tree\">{}</ul></details></li>",
                kids.iter().map(|child| node_html(child, children, vault_id, selected)).collect::<String>()
            );
        } else {
            row = format!("<li>{row}</li>");
        }
    } else {
        row = format!("<li>{row}</li>");
    }
    row
}

fn checkbox(cert: &CertificateSummary, selected: &[String]) -> String {
    if cert.issuer_id.is_none() {
        return "<input class=\"form-check-input\" type=\"checkbox\" disabled aria-label=\"Self-signed certificates cannot be revoked\" title=\"Self-signed certificates cannot be revoked\">".to_string();
    }
    let checked = if selected.contains(&cert.id) {
        " checked"
    } else {
        ""
    };
    format!(
        "<input class=\"form-check-input\" type=\"checkbox\" data-cert-id=\"{}\" aria-label=\"Select {} for revocation\"{}>",
        escape(&cert.id),
        escape(&cert.name),
        checked
    )
}

fn reason_options() -> Vec<View> {
    [
        "unspecified",
        "keyCompromise",
        "CACompromise",
        "affiliationChanged",
        "superseded",
        "cessationOfOperation",
        "certificateHold",
        "privilegeWithdrawn",
    ]
    .iter()
    .map(|reason| view! { option(value=*reason) { (*reason) } })
    .collect::<Vec<View>>()
}

fn escape(value: &str) -> String {
    value
        .replace('&', "&amp;")
        .replace('<', "&lt;")
        .replace('>', "&gt;")
        .replace('"', "&quot;")
}

#[cfg(test)]
mod tests {
    use super::*;

    fn cert(id: &str, name: &str) -> CertificateSummary {
        CertificateSummary {
            id: id.to_string(),
            name: name.to_string(),
            ..CertificateSummary::default()
        }
    }

    #[test]
    fn certificate_links_point_at_the_detail_route() {
        let cert = cert("cert-1", "Leaf");

        let flat = flat_html(std::slice::from_ref(&cert), "vault-1", &[]);
        assert!(flat.contains("href=\"/vaults/vault-1/certificates/cert-1\""));
        assert!(!flat.contains("href=\"/vaults/vault-1/cert-1\""));

        let tree = tree_html(std::slice::from_ref(&cert), "vault-1", &[]);
        assert!(tree.contains("href=\"/vaults/vault-1/certificates/cert-1\""));
        assert!(!tree.contains("href=\"/vaults/vault-1/cert-1\""));
    }
}