use bytes::Bytes;
use russh::ChannelId;
use russh::server::Session;

use gitauth::ResolvedRepo;
use repo::actor::{ActorContext, RepoAccess};

use crate::error::SshError;
use crate::git_service::{GitService, parse_git_command, parse_repo_path, sanitize_for_log};
use crate::handler::GitSshHandler;
use crate::handler::git_op::GitOperation;

impl GitSshHandler {
    pub async fn exec_request_impl(
        &mut self,
        channel: ChannelId,
        data: &[u8],
        session: &mut Session,
    ) -> Result<(), russh::Error> {
        let mut service_label: &'static str = "unknown";
        let result: Result<(), russh::Error> = async {
            let cmd = std::str::from_utf8(data)
                .map_err(|_| invalid_command_error("Invalid command encoding", session, channel))?;
            let cmd = cmd.trim();
            tracing::info!(
                "ssh exec from {:?}: {}",
                self.client_addr,
                sanitize_for_log(cmd)
            );

            let Some((service, raw_path)) = parse_git_command(cmd) else {
                return Err(invalid_command_error(
                    "Invalid git command",
                    session,
                    channel,
                ));
            };
            let Some((space, repo)) = parse_repo_path(raw_path) else {
                return Err(invalid_command_error(
                    "Invalid repository path",
                    session,
                    channel,
                ));
            };
            service_label = service.as_subcommand();

            let actor = match &self.operator {
                Some(u) => ActorContext::for_user(u.uid),
                None => ActorContext::anonymous(),
            };
            let required = if service.is_write() {
                RepoAccess::Write
            } else {
                RepoAccess::Read
            };
            let resolved: ResolvedRepo = match self
                .service
                .auth
                .authorize(space, repo, &actor, required)
                .await
            {
                Ok(r) => r,
                Err(e) => {
                    let msg = auth_error_message(&e);
                    tracing::warn!("ssh {service:?} {space}/{repo} denied: {msg}");
                    return Err(invalid_command_error(msg.as_str(), session, channel));
                }
            };

            let bare = self.service.bare_path(&resolved);
            if !bare.is_dir() {
                let msg = format!("fatal: repository '{space}/{repo}' does not exist");
                return Err(invalid_command_error(msg.as_str(), session, channel));
            }

            let adv = run_advertise(&bare, service).await.unwrap_or_default();
            if !adv.is_empty() {
                let _ = session.data(channel, Bytes::from(adv));
            }
            let _ = session.channel_success(channel);
            let _ = session.flush();

            let op = match service {
                GitService::UploadPack => GitOperation::UploadPack { bare: bare.clone() },
                _ => GitOperation::ReceivePack { bare: bare.clone() },
            };
            let state = self.channels.entry(channel).or_default();
            state.git_op = Some(op);
            state.repo_id = Some(resolved.repo.id);
            state.channel_id = Some(resolved.channel.id);
            state.actor_id = actor.user_id;

            Ok(())
        }
        .await;
        crate::metrics::record_exec(service_label, result.is_ok());
        result
    }
}

fn invalid_command_error(msg: &str, session: &mut Session, channel: ChannelId) -> russh::Error {
    let _ = session.channel_failure(channel);
    let _ = session.exit_status_request(channel, 1);
    let _ = session.close(channel);
    let _ = session.flush();
    russh::Error::IO(std::io::Error::new(
        std::io::ErrorKind::InvalidData,
        msg.to_string(),
    ))
}

fn auth_error_message(e: &gitauth::GitAuthError) -> String {
    match e {
        gitauth::GitAuthError::BadRequest(m)
        | gitauth::GitAuthError::Unauthorized(m)
        | gitauth::GitAuthError::Forbidden(m)
        | gitauth::GitAuthError::NotFound(m)
        | gitauth::GitAuthError::Conflict(m) => m.clone(),
        _ => "authentication or authorization failed".to_string(),
    }
}

async fn run_advertise(
    bare: &std::path::PathBuf,
    service: GitService,
) -> Result<Vec<u8>, SshError> {
    let mut cmd = tokio::process::Command::new("git");
    cmd.current_dir(bare)
        .arg(service.as_subcommand())
        .arg("--advertise-refs")
        .env("GIT_DIR", bare)
        .env("GIT_TERMINAL_PROMPT", "0")
        .stdout(std::process::Stdio::piped())
        .stderr(std::process::Stdio::piped());
    let mut child = cmd.spawn().map_err(SshError::Io)?;
    let stderr_task = if let Some(stderr) = child.stderr.take() {
        Some(tokio::spawn(async move {
            use tokio::io::AsyncReadExt;
            let mut s = stderr;
            let mut buf = Vec::new();
            let _ = s.read_to_end(&mut buf).await;
            buf
        }))
    } else {
        None
    };
    let mut stdout = child
        .stdout
        .take()
        .ok_or_else(|| SshError::Internal("git stdout missing".to_string()))?;
    let mut out = Vec::new();
    use tokio::io::AsyncReadExt;
    stdout.read_to_end(&mut out).await.map_err(SshError::Io)?;
    let status = child.wait().await.map_err(SshError::Io)?;
    let stderr_bytes = match stderr_task {
        Some(t) => t.await.unwrap_or_default(),
        None => Vec::new(),
    };
    if !status.success() {
        return Err(SshError::Internal(format!(
            "git {} --advertise-refs failed: {}",
            service.as_subcommand(),
            String::from_utf8_lossy(&stderr_bytes)
        )));
    }
    Ok(out)
}

// Suppress unused import warnings while keeping the door open for future expansion.
#[allow(dead_code)]
fn _keep_module_in_scope() {}