package alerts

import (
	"context"
	"encoding/json"
	"errors"
	"regexp"
	"strings"
	"time"

	"data-terminal-cloud/internal/audit"
	"data-terminal-cloud/internal/idempotency"
	"data-terminal-cloud/internal/identity"

	"github.com/google/uuid"
	"github.com/jackc/pgx/v5"
	"github.com/jackc/pgx/v5/pgxpool"
)

var (
	ErrInvalid         = errors.New("alert input is invalid")
	ErrAccessDenied    = errors.New("alert operations access denied")
	ErrNotFound        = errors.New("alert resource not found")
	ErrStateConflict   = errors.New("alert state conflict")
	ErrVersionConflict = errors.New("alert version conflict")
)

type RoutingInput struct {
	Category                string `json:"category"`
	Severity                string `json:"severity"`
	ReceiverGroup           string `json:"receiver_group"`
	ResponseMinutes         int    `json:"response_minutes"`
	EscalationAfterMinutes  int    `json:"escalation_after_minutes"`
	EscalationReceiverGroup string `json:"escalation_receiver_group"`
	RunbookRef              string `json:"runbook_ref"`
	ChangeSummary           string `json:"change_summary"`
}

type RoutingPolicy struct {
	ID                      string     `json:"id"`
	TenantID                string     `json:"tenant_id"`
	Category                string     `json:"category"`
	Severity                string     `json:"severity"`
	VersionNo               int        `json:"version_no"`
	Status                  string     `json:"status"`
	ReceiverGroup           string     `json:"receiver_group"`
	ResponseMinutes         int        `json:"response_minutes"`
	EscalationAfterMinutes  int        `json:"escalation_after_minutes"`
	EscalationReceiverGroup string     `json:"escalation_receiver_group"`
	RunbookRef              string     `json:"runbook_ref"`
	ChangeSummary           string     `json:"change_summary"`
	CreatedBy               string     `json:"created_by"`
	RetiredAt               *time.Time `json:"retired_at,omitempty"`
	RowVersion              int64      `json:"row_version"`
	CreatedAt               time.Time  `json:"created_at"`
	UpdatedAt               time.Time  `json:"updated_at"`
}

type SilenceInput struct {
	RuleCode         string         `json:"rule_code,omitempty"`
	Category         string         `json:"category,omitempty"`
	ResourceType     string         `json:"resource_type,omitempty"`
	ResourcePublicID string         `json:"resource_id,omitempty"`
	Matcher          map[string]any `json:"matcher"`
	Reason           string         `json:"reason"`
	StartsAt         time.Time      `json:"starts_at"`
	EndsAt           time.Time      `json:"ends_at"`
}

type Silence struct {
	ID               string         `json:"id"`
	RuleCode         *string        `json:"rule_code,omitempty"`
	Category         *string        `json:"category,omitempty"`
	ResourceType     *string        `json:"resource_type,omitempty"`
	ResourcePublicID *string        `json:"resource_id,omitempty"`
	Matcher          map[string]any `json:"matcher"`
	Reason           string         `json:"reason"`
	StartsAt         time.Time      `json:"starts_at"`
	EndsAt           time.Time      `json:"ends_at"`
	CreatedBy        string         `json:"created_by"`
	RevokedAt        *time.Time     `json:"revoked_at,omitempty"`
	RowVersion       int64          `json:"row_version"`
	CreatedAt        time.Time      `json:"created_at"`
}

type Action struct {
	ID         string    `json:"id"`
	ActionType string    `json:"action_type"`
	FromStatus *string   `json:"from_status,omitempty"`
	ToStatus   *string   `json:"to_status,omitempty"`
	ActorType  string    `json:"actor_type"`
	ActorUser  *string   `json:"actor_user_id,omitempty"`
	Note       string    `json:"note"`
	CreatedAt  time.Time `json:"created_at"`
}

type Incident struct {
	ID                   string     `json:"id"`
	RuleCode             string     `json:"rule_code"`
	Category             string     `json:"category"`
	Severity             string     `json:"severity"`
	Status               string     `json:"status"`
	Fingerprint          string     `json:"fingerprint"`
	Title                string     `json:"title"`
	Summary              string     `json:"summary"`
	ResourceType         *string    `json:"resource_type,omitempty"`
	ResourcePublicID     *string    `json:"resource_id,omitempty"`
	CorrelationRequestID *string    `json:"request_id,omitempty"`
	ReceiverGroup        *string    `json:"receiver_group,omitempty"`
	RunbookRef           *string    `json:"runbook_ref,omitempty"`
	CurrentOwner         *string    `json:"current_owner,omitempty"`
	FirstDetectedAt      time.Time  `json:"first_detected_at"`
	LastDetectedAt       time.Time  `json:"last_detected_at"`
	OccurrenceCount      int64      `json:"occurrence_count"`
	AcknowledgedAt       *time.Time `json:"acknowledged_at,omitempty"`
	MitigatedAt          *time.Time `json:"mitigated_at,omitempty"`
	ResolvedAt           *time.Time `json:"resolved_at,omitempty"`
	SilencedUntil        *time.Time `json:"silenced_until,omitempty"`
	EscalatedAt          *time.Time `json:"escalated_at,omitempty"`
	RowVersion           int64      `json:"row_version"`
	Actions              []Action   `json:"actions"`
}

type actor struct{ tenantID, tenantPublicID, userID, userPublicID, role string }

type Service struct {
	pool  *pgxpool.Pool
	audit *audit.Repository
	idem  *idempotency.Executor
}

func NewService(pool *pgxpool.Pool, auditRepository *audit.Repository) (*Service, error) {
	if pool == nil || auditRepository == nil {
		return nil, errors.New("alert service dependencies are required")
	}
	return &Service{pool: pool, audit: auditRepository, idem: idempotency.NewExecutor(pool)}, nil
}

func (s *Service) CreateRoutingPolicy(ctx context.Context, principal identity.Principal, tenantPublicID, key, requestID string, input RoutingInput) (RoutingPolicy, bool, error) {
	normalizeRouting(&input)
	if !validRoutingInput(input) {
		return RoutingPolicy{}, false, ErrInvalid
	}
	a, err := s.resolveActor(ctx, principal, tenantPublicID, "ops_approver", "ops_admin")
	if err != nil {
		return RoutingPolicy{}, false, err
	}
	body, _ := json.Marshal(input)
	result, err := s.idem.Execute(ctx, idempotency.Request{TenantID: &a.tenantID, ActorKey: "ops:" + a.userPublicID, Scope: "POST /api/v1/ops/alert-routing-policies", Key: key, RequestHash: idempotency.Hash(body), ExpiresAfter: 24 * time.Hour}, func(op context.Context, tx pgx.Tx) (idempotency.Result, error) {
		if _, e := tx.Exec(op, `SELECT pg_advisory_xact_lock(hashtextextended($1,0))`, a.tenantID+":"+input.Category+":"+input.Severity); e != nil {
			return idempotency.Result{}, e
		}
		var version int
		if e := tx.QueryRow(op, `SELECT COALESCE(MAX(version_no),0)+1 FROM alert_routing_policy WHERE tenant_id=$1::uuid AND category=$2 AND severity=$3`, a.tenantID, input.Category, input.Severity).Scan(&version); e != nil {
			return idempotency.Result{}, e
		}
		if _, e := tx.Exec(op, `UPDATE alert_routing_policy SET status='RETIRED',retired_at=now(),row_version=row_version+1,updated_at=now() WHERE tenant_id=$1::uuid AND category=$2 AND severity=$3 AND status='ACTIVE'`, a.tenantID, input.Category, input.Severity); e != nil {
			return idempotency.Result{}, e
		}
		publicID := uuid.NewString()
		var internalID string
		if e := tx.QueryRow(op, `INSERT INTO alert_routing_policy(public_id,tenant_id,category,severity,version_no,receiver_group,response_minutes,escalation_after_minutes,escalation_receiver_group,runbook_ref,change_summary,created_by) VALUES($1::uuid,$2::uuid,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12::uuid) RETURNING id::text`, publicID, a.tenantID, input.Category, input.Severity, version, input.ReceiverGroup, input.ResponseMinutes, input.EscalationAfterMinutes, input.EscalationReceiverGroup, input.RunbookRef, input.ChangeSummary, a.userID).Scan(&internalID); e != nil {
			return idempotency.Result{}, e
		}
		if e := s.audit.Record(op, tx, audit.Event{TenantID: &a.tenantID, ActorType: "user", ActorPublicID: &a.userPublicID, Action: "alert.routing.activate", ResourceType: "alert_routing_policy", ResourceID: &internalID, RequestID: requestID, Purpose: input.ChangeSummary, Result: "success", Detail: map[string]any{"category": input.Category, "severity": input.Severity, "version_no": version}}); e != nil {
			return idempotency.Result{}, e
		}
		item, e := getRoutingTx(op, tx, a.tenantID, publicID)
		if e != nil {
			return idempotency.Result{}, e
		}
		encoded, _ := json.Marshal(item)
		return idempotency.Result{StatusCode: 201, Body: encoded, ResourceID: &internalID}, nil
	})
	if err != nil {
		return RoutingPolicy{}, false, err
	}
	var item RoutingPolicy
	if err = json.Unmarshal(result.Body, &item); err != nil {
		return RoutingPolicy{}, false, err
	}
	return item, !result.Replayed, nil
}

func (s *Service) ListRoutingPolicies(ctx context.Context, principal identity.Principal, tenantPublicID string) ([]RoutingPolicy, error) {
	a, e := s.resolveActor(ctx, principal, tenantPublicID, "ops_viewer", "ops_operator", "ops_approver", "ops_admin")
	if e != nil {
		return nil, e
	}
	rows, e := s.pool.Query(ctx, routingSelect+` WHERE arp.tenant_id=$1::uuid ORDER BY CASE arp.status WHEN 'ACTIVE' THEN 1 ELSE 2 END,arp.category,arp.severity,arp.version_no DESC`, a.tenantID)
	if e != nil {
		return nil, e
	}
	defer rows.Close()
	items := []RoutingPolicy{}
	for rows.Next() {
		item, se := scanRouting(rows)
		if se != nil {
			return nil, se
		}
		items = append(items, item)
	}
	return items, rows.Err()
}

func (s *Service) ListIncidents(ctx context.Context, principal identity.Principal, tenantPublicID, status string) ([]Incident, error) {
	a, e := s.resolveActor(ctx, principal, tenantPublicID, "ops_viewer", "ops_operator", "ops_approver", "ops_admin")
	if e != nil {
		return nil, e
	}
	status = strings.ToUpper(strings.TrimSpace(status))
	if status != "" && !validStatus(status) {
		return nil, ErrInvalid
	}
	rows, e := s.pool.Query(ctx, incidentSelect+` WHERE ai.tenant_id=$1::uuid AND (NULLIF($2,'') IS NULL OR ai.status=$2) ORDER BY CASE ai.severity WHEN 'CRITICAL' THEN 1 WHEN 'HIGH' THEN 2 WHEN 'MEDIUM' THEN 3 ELSE 4 END,ai.last_detected_at DESC LIMIT 1000`, a.tenantID, status)
	if e != nil {
		return nil, e
	}
	defer rows.Close()
	items := []Incident{}
	for rows.Next() {
		item, se := scanIncident(rows)
		if se != nil {
			return nil, se
		}
		items = append(items, item)
	}
	return items, rows.Err()
}

func (s *Service) GetIncident(ctx context.Context, principal identity.Principal, tenantPublicID, publicID string) (Incident, error) {
	a, e := s.resolveActor(ctx, principal, tenantPublicID, "ops_viewer", "ops_operator", "ops_approver", "ops_admin")
	if e != nil {
		return Incident{}, e
	}
	if !validUUID(publicID) {
		return Incident{}, ErrInvalid
	}
	tx, e := s.pool.BeginTx(ctx, pgx.TxOptions{AccessMode: pgx.ReadOnly})
	if e != nil {
		return Incident{}, e
	}
	defer tx.Rollback(context.Background())
	item, e := getIncidentTx(ctx, tx, a.tenantID, publicID)
	if errors.Is(e, pgx.ErrNoRows) {
		return Incident{}, ErrNotFound
	}
	if e == nil {
		e = tx.Commit(ctx)
	}
	return item, e
}

func (s *Service) CreateSilence(ctx context.Context, principal identity.Principal, tenantPublicID, key, requestID string, input SilenceInput) (Silence, bool, error) {
	normalizeSilence(&input)
	if !validSilenceInput(input, time.Now().UTC()) {
		return Silence{}, false, ErrInvalid
	}
	a, e := s.resolveActor(ctx, principal, tenantPublicID, "ops_operator", "ops_approver", "ops_admin")
	if e != nil {
		return Silence{}, false, e
	}
	encoded, _ := json.Marshal(input)
	result, e := s.idem.Execute(ctx, idempotency.Request{TenantID: &a.tenantID, ActorKey: "ops:" + a.userPublicID, Scope: "POST /api/v1/ops/alert-silences", Key: key, RequestHash: idempotency.Hash(encoded), ExpiresAfter: 24 * time.Hour}, func(op context.Context, tx pgx.Tx) (idempotency.Result, error) {
		matcher, _ := json.Marshal(input.Matcher)
		publicID := uuid.NewString()
		var internalID string
		e := tx.QueryRow(op, `INSERT INTO alert_silence(public_id,tenant_id,rule_code,category,resource_type,resource_public_id,matcher,reason,starts_at,ends_at,created_by) VALUES($1::uuid,$2::uuid,NULLIF($3,''),NULLIF($4,''),NULLIF($5,''),$6::uuid,$7::jsonb,$8,$9,$10,$11::uuid) RETURNING id::text`, publicID, a.tenantID, input.RuleCode, input.Category, input.ResourceType, nullStringUUID(input.ResourcePublicID), matcher, input.Reason, input.StartsAt.UTC(), input.EndsAt.UTC(), a.userID).Scan(&internalID)
		if e != nil {
			return idempotency.Result{}, e
		}
		if e = s.audit.Record(op, tx, audit.Event{TenantID: &a.tenantID, ActorType: "user", ActorPublicID: &a.userPublicID, Action: "alert.silence.create", ResourceType: "alert_silence", ResourceID: &internalID, RequestID: requestID, Purpose: input.Reason, Result: "success"}); e != nil {
			return idempotency.Result{}, e
		}
		item, e := getSilenceTx(op, tx, a.tenantID, publicID)
		if e != nil {
			return idempotency.Result{}, e
		}
		body, _ := json.Marshal(item)
		return idempotency.Result{StatusCode: 201, Body: body, ResourceID: &internalID}, nil
	})
	if e != nil {
		return Silence{}, false, e
	}
	var item Silence
	if e = json.Unmarshal(result.Body, &item); e != nil {
		return Silence{}, false, e
	}
	return item, !result.Replayed, nil
}

func (s *Service) ListSilences(ctx context.Context, principal identity.Principal, tenantPublicID string) ([]Silence, error) {
	a, e := s.resolveActor(ctx, principal, tenantPublicID, "ops_viewer", "ops_operator", "ops_approver", "ops_admin")
	if e != nil {
		return nil, e
	}
	rows, e := s.pool.Query(ctx, silenceSelect+` WHERE als.tenant_id=$1::uuid ORDER BY CASE WHEN revoked_at IS NULL AND ends_at>now() THEN 1 ELSE 2 END,ends_at DESC LIMIT 1000`, a.tenantID)
	if e != nil {
		return nil, e
	}
	defer rows.Close()
	items := []Silence{}
	for rows.Next() {
		item, se := scanSilence(rows)
		if se != nil {
			return nil, se
		}
		items = append(items, item)
	}
	return items, rows.Err()
}

func (s *Service) RevokeSilence(ctx context.Context, principal identity.Principal, tenantPublicID, publicID, requestID, reason string, expected int64) (Silence, error) {
	reason = strings.TrimSpace(reason)
	if reason == "" || len([]rune(reason)) > 500 {
		return Silence{}, ErrInvalid
	}
	a, e := s.resolveActor(ctx, principal, tenantPublicID, "ops_operator", "ops_approver", "ops_admin")
	if e != nil {
		return Silence{}, e
	}
	tx, e := s.pool.BeginTx(ctx, pgx.TxOptions{})
	if e != nil {
		return Silence{}, e
	}
	defer tx.Rollback(context.Background())
	var id string
	var version int64
	var revoked *time.Time
	e = tx.QueryRow(ctx, `SELECT id::text,row_version,revoked_at FROM alert_silence WHERE tenant_id=$1::uuid AND public_id=$2::uuid FOR UPDATE`, a.tenantID, publicID).Scan(&id, &version, &revoked)
	if errors.Is(e, pgx.ErrNoRows) {
		return Silence{}, ErrNotFound
	}
	if e != nil {
		return Silence{}, e
	}
	if version != expected {
		return Silence{}, ErrVersionConflict
	}
	if revoked != nil {
		return Silence{}, ErrStateConflict
	}
	_, e = tx.Exec(ctx, `UPDATE alert_silence SET revoked_by=$2::uuid,revoked_at=now(),row_version=row_version+1,updated_at=now() WHERE id=$1::uuid`, id, a.userID)
	if e != nil {
		return Silence{}, e
	}
	if e = s.audit.Record(ctx, tx, audit.Event{TenantID: &a.tenantID, ActorType: "user", ActorPublicID: &a.userPublicID, Action: "alert.silence.revoke", ResourceType: "alert_silence", ResourceID: &id, RequestID: requestID, Purpose: reason, Result: "success"}); e != nil {
		return Silence{}, e
	}
	item, e := getSilenceTx(ctx, tx, a.tenantID, publicID)
	if e == nil {
		e = tx.Commit(ctx)
	}
	return item, e
}

func (s *Service) TransitionIncident(ctx context.Context, principal identity.Principal, tenantPublicID, publicID, requestID, action, note string, expected int64) (Incident, error) {
	action = strings.ToUpper(strings.TrimSpace(action))
	note = strings.TrimSpace(note)
	if note == "" || len([]rune(note)) > 1000 {
		return Incident{}, ErrInvalid
	}
	targets := map[string]string{"ACKNOWLEDGE": "ACKNOWLEDGED", "MITIGATE": "MITIGATED", "RESOLVE": "RESOLVED"}
	target, ok := targets[action]
	if !ok {
		return Incident{}, ErrInvalid
	}
	a, e := s.resolveActor(ctx, principal, tenantPublicID, "ops_operator", "ops_approver", "ops_admin")
	if e != nil {
		return Incident{}, e
	}
	tx, e := s.pool.BeginTx(ctx, pgx.TxOptions{})
	if e != nil {
		return Incident{}, e
	}
	defer tx.Rollback(context.Background())
	var id, status string
	var version int64
	e = tx.QueryRow(ctx, `SELECT id::text,status,row_version FROM alert_incident WHERE tenant_id=$1::uuid AND public_id=$2::uuid FOR UPDATE`, a.tenantID, publicID).Scan(&id, &status, &version)
	if errors.Is(e, pgx.ErrNoRows) {
		return Incident{}, ErrNotFound
	}
	if e != nil {
		return Incident{}, e
	}
	if version != expected {
		return Incident{}, ErrVersionConflict
	}
	if status == "RESOLVED" || status == target {
		return Incident{}, ErrStateConflict
	}
	now := time.Now().UTC()
	_, e = tx.Exec(ctx, `UPDATE alert_incident SET status=$2::varchar,current_owner_id=COALESCE(current_owner_id,$3::uuid),acknowledged_at=CASE WHEN $2::varchar='ACKNOWLEDGED' THEN $4::timestamptz ELSE acknowledged_at END,mitigated_at=CASE WHEN $2::varchar='MITIGATED' THEN $4::timestamptz ELSE mitigated_at END,resolved_at=CASE WHEN $2::varchar='RESOLVED' THEN $4::timestamptz ELSE resolved_at END,row_version=row_version+1,updated_at=$4::timestamptz WHERE id=$1::uuid`, id, target, a.userID, now)
	if e != nil {
		return Incident{}, e
	}
	_, e = tx.Exec(ctx, `INSERT INTO alert_action(tenant_id,incident_id,action_type,from_status,to_status,actor_type,actor_user_id,note) VALUES($1::uuid,$2::uuid,$3,$4,$5,'user',$6::uuid,$7)`, a.tenantID, id, target, status, target, a.userID, note)
	if e != nil {
		return Incident{}, e
	}
	if e = s.audit.Record(ctx, tx, audit.Event{TenantID: &a.tenantID, ActorType: "user", ActorPublicID: &a.userPublicID, Action: "alert.incident." + strings.ToLower(action), ResourceType: "alert_incident", ResourceID: &id, RequestID: requestID, Purpose: note, Result: "success"}); e != nil {
		return Incident{}, e
	}
	item, e := getIncidentTx(ctx, tx, a.tenantID, publicID)
	if e == nil {
		e = tx.Commit(ctx)
	}
	return item, e
}

func (s *Service) resolveActor(ctx context.Context, principal identity.Principal, tenantPublicID string, roles ...string) (actor, error) {
	if _, e := uuid.Parse(tenantPublicID); e != nil {
		return actor{}, ErrInvalid
	}
	var a actor
	e := s.pool.QueryRow(ctx, `SELECT t.id::text,t.public_id::text,ua.id::text,ua.public_id::text,ua.platform_role FROM user_account ua JOIN tenant t ON t.id=ua.tenant_id AND t.status='active' WHERE t.public_id=$1::uuid AND ua.oidc_issuer=$2 AND ua.oidc_subject=$3 AND ua.status='active' AND ua.account_kind='operator'`, tenantPublicID, principal.Issuer, principal.Subject).Scan(&a.tenantID, &a.tenantPublicID, &a.userID, &a.userPublicID, &a.role)
	if errors.Is(e, pgx.ErrNoRows) {
		return actor{}, ErrAccessDenied
	}
	if e != nil {
		return actor{}, e
	}
	for _, role := range roles {
		if a.role == role {
			return a, nil
		}
	}
	return actor{}, ErrAccessDenied
}

func normalizeRouting(i *RoutingInput) {
	i.Category = strings.ToUpper(strings.TrimSpace(i.Category))
	i.Severity = strings.ToUpper(strings.TrimSpace(i.Severity))
	i.ReceiverGroup = strings.TrimSpace(i.ReceiverGroup)
	i.EscalationReceiverGroup = strings.TrimSpace(i.EscalationReceiverGroup)
	i.RunbookRef = strings.TrimSpace(i.RunbookRef)
	i.ChangeSummary = strings.TrimSpace(i.ChangeSummary)
}
func validRoutingInput(i RoutingInput) bool {
	return validCategory(i.Category) && validSeverity(i.Severity) && i.ReceiverGroup != "" && len([]rune(i.ReceiverGroup)) <= 120 && i.ResponseMinutes >= 1 && i.ResponseMinutes <= 10080 && i.EscalationAfterMinutes >= i.ResponseMinutes && i.EscalationAfterMinutes <= 10080 && i.EscalationReceiverGroup != "" && len([]rune(i.EscalationReceiverGroup)) <= 120 && i.RunbookRef != "" && len([]rune(i.RunbookRef)) <= 300 && i.ChangeSummary != "" && len([]rune(i.ChangeSummary)) <= 500
}
func normalizeSilence(i *SilenceInput) {
	i.RuleCode = strings.ToUpper(strings.TrimSpace(i.RuleCode))
	i.Category = strings.ToUpper(strings.TrimSpace(i.Category))
	i.ResourceType = strings.TrimSpace(i.ResourceType)
	i.ResourcePublicID = strings.TrimSpace(i.ResourcePublicID)
	i.Reason = strings.TrimSpace(i.Reason)
}
func validSilenceInput(i SilenceInput, now time.Time) bool {
	return !(i.RuleCode == "" && i.Category == "" && i.ResourcePublicID == "") && (i.RuleCode == "" || rulePattern.MatchString(i.RuleCode)) && (i.Category == "" || validCategory(i.Category)) && (i.ResourcePublicID == "" || validUUID(i.ResourcePublicID)) && i.Reason != "" && len([]rune(i.Reason)) <= 500 && !i.StartsAt.IsZero() && i.EndsAt.After(i.StartsAt) && i.EndsAt.Sub(i.StartsAt) <= 30*24*time.Hour && !i.EndsAt.Before(now)
}
func validCategory(v string) bool {
	return v == "BUSINESS" || v == "TECHNICAL" || v == "SECURITY" || v == "COST"
}
func validSeverity(v string) bool {
	return v == "CRITICAL" || v == "HIGH" || v == "MEDIUM" || v == "LOW"
}
func validStatus(v string) bool {
	return v == "OPEN" || v == "ACKNOWLEDGED" || v == "MITIGATED" || v == "RESOLVED" || v == "SILENCED"
}
func validUUID(v string) bool { _, e := uuid.Parse(v); return e == nil }
func nullStringUUID(v string) any {
	if strings.TrimSpace(v) == "" {
		return nil
	}
	return v
}

var rulePattern = regexp.MustCompile(`^[A-Z][A-Z0-9_]{2,99}$`)

type scanner interface{ Scan(...any) error }

const routingSelect = `SELECT arp.public_id::text,t.public_id::text,arp.category,arp.severity,arp.version_no,arp.status,arp.receiver_group,arp.response_minutes,arp.escalation_after_minutes,arp.escalation_receiver_group,arp.runbook_ref,arp.change_summary,ua.public_id::text,arp.retired_at,arp.row_version,arp.created_at,arp.updated_at FROM alert_routing_policy arp JOIN tenant t ON t.id=arp.tenant_id JOIN user_account ua ON ua.id=arp.created_by`

func scanRouting(r scanner) (RoutingPolicy, error) {
	var i RoutingPolicy
	e := r.Scan(&i.ID, &i.TenantID, &i.Category, &i.Severity, &i.VersionNo, &i.Status, &i.ReceiverGroup, &i.ResponseMinutes, &i.EscalationAfterMinutes, &i.EscalationReceiverGroup, &i.RunbookRef, &i.ChangeSummary, &i.CreatedBy, &i.RetiredAt, &i.RowVersion, &i.CreatedAt, &i.UpdatedAt)
	return i, e
}
func getRoutingTx(ctx context.Context, tx pgx.Tx, tenantID, publicID string) (RoutingPolicy, error) {
	return scanRouting(tx.QueryRow(ctx, routingSelect+` WHERE arp.tenant_id=$1::uuid AND arp.public_id=$2::uuid`, tenantID, publicID))
}

const incidentSelect = `SELECT ai.public_id::text,ai.rule_code,ai.category,ai.severity,ai.status,ai.fingerprint,ai.title,ai.summary,ai.resource_type,ai.resource_public_id::text,ai.correlation_request_id,arp.receiver_group,arp.runbook_ref,owner.public_id::text,ai.first_detected_at,ai.last_detected_at,ai.occurrence_count,ai.acknowledged_at,ai.mitigated_at,ai.resolved_at,ai.silenced_until,ai.escalated_at,ai.row_version FROM alert_incident ai LEFT JOIN alert_routing_policy arp ON arp.id=ai.routing_policy_id LEFT JOIN user_account owner ON owner.id=ai.current_owner_id`

func scanIncident(r scanner) (Incident, error) {
	var i Incident
	e := r.Scan(&i.ID, &i.RuleCode, &i.Category, &i.Severity, &i.Status, &i.Fingerprint, &i.Title, &i.Summary, &i.ResourceType, &i.ResourcePublicID, &i.CorrelationRequestID, &i.ReceiverGroup, &i.RunbookRef, &i.CurrentOwner, &i.FirstDetectedAt, &i.LastDetectedAt, &i.OccurrenceCount, &i.AcknowledgedAt, &i.MitigatedAt, &i.ResolvedAt, &i.SilencedUntil, &i.EscalatedAt, &i.RowVersion)
	i.Actions = []Action{}
	return i, e
}
func getIncidentTx(ctx context.Context, tx pgx.Tx, tenantID, publicID string) (Incident, error) {
	i, e := scanIncident(tx.QueryRow(ctx, incidentSelect+` WHERE ai.tenant_id=$1::uuid AND ai.public_id=$2::uuid`, tenantID, publicID))
	if e != nil {
		return i, e
	}
	rows, e := tx.Query(ctx, `SELECT aa.public_id::text,aa.action_type,aa.from_status,aa.to_status,aa.actor_type,ua.public_id::text,aa.note,aa.created_at FROM alert_action aa LEFT JOIN user_account ua ON ua.id=aa.actor_user_id WHERE aa.incident_id=(SELECT id FROM alert_incident WHERE tenant_id=$1::uuid AND public_id=$2::uuid) ORDER BY aa.created_at,aa.id`, tenantID, publicID)
	if e != nil {
		return i, e
	}
	defer rows.Close()
	for rows.Next() {
		var a Action
		if e = rows.Scan(&a.ID, &a.ActionType, &a.FromStatus, &a.ToStatus, &a.ActorType, &a.ActorUser, &a.Note, &a.CreatedAt); e != nil {
			return i, e
		}
		i.Actions = append(i.Actions, a)
	}
	return i, rows.Err()
}

const silenceSelect = `SELECT als.public_id::text,als.rule_code,als.category,als.resource_type,als.resource_public_id::text,als.matcher,als.reason,als.starts_at,als.ends_at,ua.public_id::text,als.revoked_at,als.row_version,als.created_at FROM alert_silence als JOIN user_account ua ON ua.id=als.created_by`

func scanSilence(r scanner) (Silence, error) {
	var i Silence
	var raw []byte
	e := r.Scan(&i.ID, &i.RuleCode, &i.Category, &i.ResourceType, &i.ResourcePublicID, &raw, &i.Reason, &i.StartsAt, &i.EndsAt, &i.CreatedBy, &i.RevokedAt, &i.RowVersion, &i.CreatedAt)
	if e == nil {
		e = json.Unmarshal(raw, &i.Matcher)
	}
	if i.Matcher == nil {
		i.Matcher = map[string]any{}
	}
	return i, e
}
func getSilenceTx(ctx context.Context, tx pgx.Tx, tenantID, publicID string) (Silence, error) {
	return scanSilence(tx.QueryRow(ctx, silenceSelect+` WHERE als.tenant_id=$1::uuid AND als.public_id=$2::uuid`, tenantID, publicID))
}