use std::collections::BTreeSet;

use std::net::{Ipv4Addr, Ipv6Addr};

use std::str::FromStr;

use crate::dns::RecordType;

use lyquor_primitives::NodeID;

const ACME_CHALLENGE_PREFIX: &str = "_acme-challenge.";

const MAX_DOMAIN_LEN: usize = 253;

const MAX_LABEL_LEN: usize = 63;

#[derive(Debug, thiserror::Error)]

pub enum RequestError {

    #[error("invalid argument: {0}")]

    InvalidArgument(String),

    #[error("permission denied: {0}")]

    PermissionDenied(String),

}

pub fn normalize_fqdn(input: &str) -> Result<String, RequestError> {

    let trimmed = input.trim();

    if trimmed.is_empty() {

        return Err(RequestError::InvalidArgument("fqdn is required".into()));

    }

    let lower = trimmed.to_ascii_lowercase();

    let normalized = lower.trim_end_matches('.');

    if normalized.is_empty() {

        return Err(RequestError::InvalidArgument(

            "fqdn is empty after normalization".into(),

        ));

    }

    if normalized.len() > MAX_DOMAIN_LEN {

        return Err(RequestError::InvalidArgument("fqdn exceeds maximum length".into()));

    }

    let labels: Vec<&str> = normalized.split('.').collect();

    validate_labels(&labels)
?0
;

    Ok(normalized.to_string())

}

pub fn normalize_cname_target(input: &str) -> Result<String, RequestError> {

    let normalized = normalize_fqdn(input)
?0
;

    Ok(normalized)

}

pub fn normalize_ttl(ttl: u32, default_ttl: u32) -> u32 {

    if ttl == 0 { 
default_ttl4
 } else { 
ttl6
 }

}

pub fn normalize_record_values(record_type: RecordType, values: Vec<String>) -> Result<Vec<String>, RequestError> {

    match record_type {

        RecordType::A => normalize_ipv4_values(values),

        RecordType::Aaaa => normalize_ipv6_values(values),

        RecordType::Txt => normalize_txt_values(values),

        RecordType::Cname => normalize_cname_values(values),

    }

}

pub fn validate_fqdn_for_record(

    fqdn: &str, record_type: RecordType, dns_suffix: &str, node_id: &NodeID,

) -> Result<(), RequestError> {

    match record_type {

        RecordType::Txt => {

            if !fqdn.starts_with(ACME_CHALLENGE_PREFIX) {

                return Err(RequestError::PermissionDenied(

                    "TXT records must target _acme-challenge names".into(),

                ));

            }

            let base = &fqdn[ACME_CHALLENGE_PREFIX.len()..];

            if base.is_empty() {

                return Err(RequestError::PermissionDenied(

                    "_acme-challenge base name is empty".into(),

                ));

            }

            ensure_allowed_suffix(base, dns_suffix)
?0
;

            ensure_node_owns_fqdn(base, dns_suffix, node_id)
?0
;

        }

        RecordType::A | RecordType::Aaaa | RecordType::Cname => {

            if fqdn.starts_with(ACME_CHALLENGE_PREFIX) {

                return Err(RequestError::PermissionDenied(

                    "non-TXT records may not target _acme-challenge names".into(),

                ));

            }

            ensure_allowed_suffix(fqdn, dns_suffix)
?1
;

            ensure_node_owns_fqdn(fqdn, dns_suffix, node_id)
?1
;

        }

    }

    Ok(())

}

fn normalize_ipv4_values(values: Vec<String>) -> Result<Vec<String>, RequestError> {

    let mut set = BTreeSet::new();

    for value in 
values6
 {

        let trimmed = value.trim();

        if trimmed.is_empty() {

            return Err(RequestError::InvalidArgument("A record value is empty".into()));

        }

        let 
addr7
 = Ipv4Addr::from_str(trimmed)

            .map_err(|_| RequestError::InvalidArgument(
format!1
("invalid IPv4 address: {trimmed}")))
?1
;

        set.insert(addr.to_string());

    }

    Ok(set.into_iter().collect())

}

fn normalize_ipv6_values(values: Vec<String>) -> Result<Vec<String>, RequestError> {

    let mut set = BTreeSet::new();

    for value in values {

        let trimmed = value.trim();

        if trimmed.is_empty() {

            return Err(RequestError::InvalidArgument("AAAA record value is empty".into()));

        }

        let 
addr2
 = Ipv6Addr::from_str(trimmed)

            .map_err(|_| RequestError::InvalidArgument(
format!1
("invalid IPv6 address: {trimmed}")))
?1
;

        set.insert(addr.to_string());

    }

    Ok(set.into_iter().collect())

}

fn normalize_txt_values(values: Vec<String>) -> Result<Vec<String>, RequestError> {

    let mut set = BTreeSet::new();

    for value in values {

        set.insert(value);

    }

    Ok(set.into_iter().collect())

}

fn normalize_cname_values(values: Vec<String>) -> Result<Vec<String>, RequestError> {

    if values.len() > 1 {

        return Err(RequestError::InvalidArgument(

            "CNAME must contain exactly one value".into(),

        ));

    }

    if values.is_empty() {

        return Ok(Vec::new());

    }

    let target = normalize_cname_target(&values[0])?;

    Ok(vec![target])

}

fn validate_labels(labels: &[&str]) -> Result<(), RequestError> {

    for label in 
labels13
 {

        if label.is_empty() {

            return Err(RequestError::InvalidArgument("fqdn has empty label".into()));

        }

        if label.len() > MAX_LABEL_LEN {

            return Err(RequestError::InvalidArgument(

                "fqdn label exceeds maximum length".into(),

            ));

        }

        if !label

            .chars()

            .
all57
(|c| c.is_ascii_lowercase() || 
c88
.
is_ascii_digit88
() || 
c == '-'16
 || 
c == '_'3
)

        {

            return Err(RequestError::InvalidArgument(format!(

                "fqdn label contains invalid character: {label}"

            )));

        }

    }

    Ok(())

}

fn ensure_allowed_suffix(fqdn: &str, dns_suffix: &str) -> Result<(), RequestError> {

    if !fqdn.ends_with(dns_suffix) {

        return Err(RequestError::PermissionDenied("fqdn is outside allowed suffix".into()));

    }

    let prefix = fqdn.strip_suffix(dns_suffix).unwrap_or("");

    let prefix = prefix.trim_end_matches('.');

    if prefix.is_empty() {

        return Err(RequestError::PermissionDenied(

            "fqdn must include node label within allowed suffix".into(),

        ));

    }

    Ok(())

}

fn ensure_node_owns_fqdn(fqdn: &str, dns_suffix: &str, node_id: &NodeID) -> Result<(), RequestError> {

    let prefix = fqdn.strip_suffix(dns_suffix).unwrap_or("").trim_end_matches('.');

    if prefix.is_empty() {

        return Err(RequestError::PermissionDenied(

            "fqdn must include node label within allowed suffix".into(),

        ));

    }

    // NodeID::as_dns_label is the canonical label used across lyquor-tls.

    let label = node_id.as_dns_label();

    let mut labels = prefix.split('.');

    let last = labels.next_back().unwrap_or("");

    if last != label {

        return Err(RequestError::PermissionDenied("fqdn is not owned by node".into()));

    }

    Ok(())

}