//! Ladle - A CLI tool for Lyquor node operators

//!

//! Ladle provides a set of utilities for node operators to manage and interact with

//! Lyquor nodes. It simplifies common operations such as key generation and management.

use std::{path::PathBuf, str::FromStr};

use anyhow::{Context as _, Result};

use barstrainer_client::{SigningIdentity, connect, fqdn_for_node, normalize_subdomain};

use clap::{ArgGroup, Command, arg, command};

use lyquor_config::{NetworkType, validate_domain_name};

use lyquor_tls::TlsConfig;

#[tokio::main]

async fn main() -> Result<()> {

    let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();

    let subscriber = tracing_subscriber::FmtSubscriber::builder()

        .with_env_filter(

            tracing_subscriber::EnvFilter::try_from_default_env()

                .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),

        )

        .finish();

    tracing::subscriber::set_global_default(subscriber)
?0
;

    // Parse command line arguments

    let matches = command!("ladle")

        .version(lyquor_cli::build_version!())

        .about("CLI tool for Lyquor node operators")

        .subcommand_required(true)

        .subcommand(

            Command::new("certificates")

                .about("Certificate management operations")

                .subcommand_required(true)

                .subcommand(

                    Command::new("generate")

                        .about("Generate a new key pair and certificates")

                        .arg(

                            arg!(-o --output <DIR> "Output directory for the generated key and certificates")

                                .default_value("."),

                        )

                        .arg(

                            arg!(-s --seed <SEED> "Seed used to derive the root key")

                                .required(false)

                                .default_value("000102030405060708090a0b0c0d0e0f")

                                .value_parser(parse_seed),

                        )

                        .arg(

                            arg!(-n --network <NETWORK> "Select the network to generate certificates for. (Available: devnet/testnet/mainnet)")

                                .required(false)

                                .default_value("devnet")

                                .value_parser(NetworkType::from_str),

                        ),

                ),

        )

        .subcommand(

            Command::new("dns")

                .about("Interact with the barstrainer DNS control plane")

                .subcommand_required(true)

                .subcommand(

                    Command::new("upsert")

                        .about("Upsert a DNS record via barstrainer")

                        .arg(arg!(--addr <ADDR> "Barstrainer gRPC address (host:port or http(s)://...)").required(true))

                        .arg(

                            arg!(--"dns-suffix" <SUFFIX> "DNS suffix namespace bound to the authorization (canonical hostname suffix, no leading/trailing '.')")

                                .required(true),

                        )

                        .arg(arg!(--subdomain <NAME> "Optional subdomain prefix (e.g. api or _acme-challenge.api)").required(false))

                        .arg(arg!(--a <IPV4> "A record value (IPv4 address)"))

                        .arg(arg!(--txt <TXT> "TXT record value (unescaped)"))

                        .arg(

                            arg!(--ttl <TTL> "TTL in seconds (0 uses server default)")

                                .required(false)

                                .default_value("0")

                                .value_parser(clap::value_parser!(u32)),

                        )

                        .arg(

                            arg!(--cert <PATH> "Path to node certificate chain PEM")

                                .required(false)

                                .default_value("node_cert_chain.pem"),

                        )

                        .arg(

                            arg!(--key <PATH> "Path to node private key PEM")

                                .required(false)

                                .default_value("node_key.pem"),

                        )

                        .group(ArgGroup::new("record").required(true).args(["a", "txt"])),

                ),

        )

        .get_matches();

    // Execute the appropriate subcommand

    match matches.subcommand() {

        Some((
"certificates"2
, 
sub_matches2
)) => match 
sub_matches.subcommand()2
 {

            Some((
"generate"2
, 
gen_matches2
)) => {

                let 
output_dir2
 = 
gen_matches2
.
get_one2
::<String>(
"output"2
).
unwrap2
();

                let 
seed2
 = 
*2
gen_matches2
.
get_one2
::<[u8; 32]>("seed").unwrap();

                let 
network2
 = 
*2
gen_matches2
.
get_one2
::<NetworkType>("network").unwrap();

                
generate_certificates2
(
output_dir2
, 
&seed2
, 
network2
)

            }

            _ => 
unreachable!0
("Exhausted list of subcommands and subcommand_required prevents `None`"),

        },

        Some((
"dns"0
, 
sub_matches0
)) => match 
sub_matches.subcommand()0
 {

            Some((
"upsert"0
, 
upsert_matches0
)) => 
dns_upsert0
(upsert_matches).await,

            _ => 
unreachable!0
("Exhausted list of subcommands and subcommand_required prevents `None`"),

        },

        _ => 
unreachable!6
("Exhausted list of subcommands and subcommand_required prevents `None`"),

    }

}

fn generate_certificates(output_dir: &str, seed: &[u8; 32], network: NetworkType) -> Result<()> {

    tracing::info!("Generating key pair in directory: {} with seed: {:?}", output_dir, seed);

    let (node_id, node_ca, issuer) =

        lyquor_tls::generator::generate_node_ca_cert(seed, network.default_network_domain())
?0
;

    let cert_dir = PathBuf::from(output_dir);

    let node_cert_key = lyquor_tls::generator::generate_node_cert(&node_id, &issuer, network.default_network_domain())
?0
;

    let key_path = cert_dir.join("node_key.pem");

    let cert_path = cert_dir.join("node_cert_chain.pem");

    std::fs::write(&key_path, node_cert_key.signing_key.serialize_pem())
?0
;

    std::fs::write(&cert_path, format!("{}{}", node_cert_key.cert.pem(), node_ca.pem()))
?0
;

    Ok(())

}

fn parse_seed(input: &str) -> Result<[u8; 32], String> {

    let raw = input.strip_prefix("0x").unwrap_or(input);

    let normalized;

    let raw = if raw.len().is_multiple_of(2) {

        raw

    } else {

        normalized = format!("0{raw}");

        normalized.as_str()

    };

    let 
seed3
 = const_hex::decode(raw).map_err(|err| 
format!1
("Invalid hex: {err}"))
?1
;

    if seed.len() > 32 {

        return Err(format!(

            "Invalid seed length: expected at most 32 bytes, got {}",

            seed.len()

        ));

    }

    let mut padded_seed = [0u8; 32];

    padded_seed[..seed.len()].copy_from_slice(&seed);

    Ok(padded_seed)

}

async fn dns_upsert(matches: &clap::ArgMatches) -> Result<()> {

    let addr = matches.get_one::<String>("addr").unwrap();

    let dns_suffix_raw = matches.get_one::<String>("dns-suffix").unwrap();

    let subdomain_raw = matches.get_one::<String>("subdomain").map(String::as_str);

    let ttl = *matches.get_one::<u32>("ttl").unwrap();

    let cert_path = matches.get_one::<String>("cert").unwrap();

    let key_path = matches.get_one::<String>("key").unwrap();

    let (record_data, record_kind) = if let Some(value) = matches.get_one::<String>("a") {

        (barstrainer_client::proto::record::Data::A(value.clone()), "A")

    } else if let Some(value) = matches.get_one::<String>("txt") {

        (barstrainer_client::proto::record::Data::Txt(value.clone()), "TXT")

    } else {

        unreachable!("clap ArgGroup ensures one of --a/--txt is present");

    };

    let tls_config = TlsConfig::from_pem_files(cert_path, key_path).with_context(|| "failed to load TLS keypair")?;

    let identity = SigningIdentity::from_tls_config(&tls_config)

        .with_context(|| "failed to build barstrainer signing identity")?;

    let dns_suffix = validate_domain_name(dns_suffix_raw)?;

    let subdomain = normalize_subdomain(subdomain_raw)?;

    let fqdn = fqdn_for_node(identity.node_id(), &dns_suffix, subdomain.as_deref());

    tracing::debug!(

        addr = %addr,

        node_id = %identity.node_id(),

        dns_suffix = %dns_suffix,

        subdomain = %subdomain.as_deref().unwrap_or(""),

        fqdn = %fqdn,

        record_kind,

        ttl,

        "ladle dns upsert request prepared"

    );

    let record = barstrainer_client::proto::Record {

        fqdn: fqdn.clone(),

        data: Some(record_data),

        ttl,

    };

    let request = identity.build_upsert_request(&dns_suffix, vec![record])?;

    tracing::debug!(signature_len = request.signature.len(), "ladle dns request built");

    tracing::debug!(addr = %addr, "ladle dns connecting to barstrainer");

    let mut client = connect(addr)?;

    client.upsert_record(request).await?;

    println!("Upsert accepted for {}", fqdn);

    Ok(())

}