package infrastructureconformance

import (
	"bytes"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"regexp"
	"slices"
	"strings"
	"time"
)

const (
	CaptureSchema = "production-infrastructure-capture-v1"
	ReportSchema  = "production-infrastructure-conformance-report-v1"
)

var digestPattern = regexp.MustCompile(`^sha256:[0-9a-f]{64}$`)

var RequiredComponents = []string{"DOMAIN_TLS", "OIDC", "POSTGRES", "REDIS", "OBJECT_STORE", "NETWORK_ISOLATION", "MONITORING"}

var requiredControls = map[string][]string{
	"DOMAIN_TLS":        {"DNS_RESOLVED", "TLS_VALID", "CERTIFICATE_MONITORED"},
	"OIDC":              {"JWKS_AVAILABLE", "TLS_VALID", "TENANT_MAPPING_VERIFIED"},
	"POSTGRES":          {"PRIVATE_NETWORK", "TLS_VALID", "HIGH_AVAILABILITY", "BACKUP_CONFIGURED", "MONITORED"},
	"REDIS":             {"PRIVATE_NETWORK", "TLS_VALID", "HIGH_AVAILABILITY", "REBUILD_VERIFIED", "MONITORED"},
	"OBJECT_STORE":      {"PRIVATE_ACCESS", "TLS_VALID", "VERSIONING_OR_RETENTION", "MONITORED"},
	"NETWORK_ISOLATION": {"INGRESS_RESTRICTED", "EGRESS_RESTRICTED", "NAMESPACE_ISOLATED"},
	"MONITORING":        {"METRICS_SCRAPED", "ALERT_RULES_LOADED", "EXTERNAL_RECEIVER_ROUTED"},
}

type Capture struct {
	SchemaVersion    string              `json:"schema_version"`
	EvidenceSource   string              `json:"evidence_source"`
	CandidateVersion string              `json:"candidate_version"`
	BuildDigest      string              `json:"build_digest"`
	Environment      string              `json:"environment"`
	RegionRef        string              `json:"region_ref"`
	ClusterRef       string              `json:"cluster_ref"`
	ChangeTicketRef  string              `json:"change_ticket_ref"`
	AttestedByRef    string              `json:"attested_by_ref"`
	AttestedAt       time.Time           `json:"attested_at"`
	CollectedAt      time.Time           `json:"collected_at"`
	Components       []ComponentEvidence `json:"components"`
}

type ComponentEvidence struct {
	ComponentType    string    `json:"component_type"`
	ResourceRef      string    `json:"resource_ref"`
	Status           string    `json:"status"`
	ObservedAt       time.Time `json:"observed_at"`
	VerifiedControls []string  `json:"verified_controls"`
	ProbeRef         string    `json:"probe_ref"`
	ConfigurationRef string    `json:"configuration_ref"`
	AuditRef         string    `json:"audit_ref"`
}

type Check struct {
	Code   string `json:"code"`
	Status string `json:"status"`
	Detail string `json:"detail"`
}

type Report struct {
	SchemaVersion              string            `json:"schema_version"`
	Result                     string            `json:"result"`
	GeneratedAt                time.Time         `json:"generated_at"`
	CandidateVersion           string            `json:"candidate_version"`
	BuildDigest                string            `json:"build_digest"`
	EvidenceScope              string            `json:"evidence_scope"`
	ExternalValidationRequired bool              `json:"external_validation_required"`
	Environment                string            `json:"environment"`
	RegionRef                  string            `json:"region_ref"`
	ClusterRef                 string            `json:"cluster_ref"`
	ComponentCount             int               `json:"component_count"`
	VerifiedComponents         []string          `json:"verified_components"`
	ControlCounts              map[string]int    `json:"control_counts"`
	InputSHA256                map[string]string `json:"input_sha256"`
	Checks                     []Check           `json:"checks"`
	Disclaimer                 string            `json:"disclaimer"`
}

func ParseCapture(content []byte) (Capture, error) {
	var capture Capture
	if err := decodeStrict(content, &capture); err != nil {
		return Capture{}, fmt.Errorf("decode production infrastructure capture: %w", err)
	}
	return capture, nil
}

func ParseReport(content []byte) (Report, error) {
	var report Report
	if err := decodeStrict(content, &report); err != nil {
		return Report{}, fmt.Errorf("decode production infrastructure report: %w", err)
	}
	return report, nil
}

func Evaluate(capture Capture, candidateVersion, buildDigest string, generatedAt time.Time) Report {
	candidateVersion = strings.TrimSpace(candidateVersion)
	buildDigest = strings.ToLower(strings.TrimSpace(buildDigest))
	report := Report{
		SchemaVersion: ReportSchema, Result: "PASS", GeneratedAt: generatedAt.UTC(), CandidateVersion: candidateVersion, BuildDigest: buildDigest,
		EvidenceScope: "LOCAL_INFRASTRUCTURE", ExternalValidationRequired: true, Environment: capture.Environment, RegionRef: capture.RegionRef, ClusterRef: capture.ClusterRef,
		ComponentCount: len(capture.Components), VerifiedComponents: []string{}, ControlCounts: map[string]int{}, InputSHA256: map[string]string{}, Checks: []Check{},
		Disclaimer: "基础设施一致性报告只证明所提供候选、资源引用、探针、配置、控制项和审计相互一致；本地组件不替代生产网络、托管服务和发布审批。",
	}
	if capture.EvidenceSource == "PRODUCTION" {
		report.EvidenceScope = "PRODUCTION_INFRASTRUCTURE"
	}
	add := func(code string, ok bool, detail string) {
		status := "PASS"
		if !ok {
			status, report.Result = "FAIL", "FAIL"
		}
		report.Checks = append(report.Checks, Check{Code: code, Status: status, Detail: detail})
	}
	add("CAPTURE_SCHEMA", capture.SchemaVersion == CaptureSchema, "基础设施证据必须使用"+CaptureSchema)
	add("EVIDENCE_SOURCE", capture.EvidenceSource == "LOCAL" || capture.EvidenceSource == "PRODUCTION", "证据来源必须明确为LOCAL或PRODUCTION")
	add("CANDIDATE_IDENTITY", candidateVersion != "" && digestPattern.MatchString(buildDigest), "候选版本和sha256构建摘要必须完整")
	add("CAPTURE_CANDIDATE_BINDING", capture.CandidateVersion == candidateVersion && strings.ToLower(capture.BuildDigest) == buildDigest, "基础设施采集必须绑定同一候选版本和构建摘要")
	real := capture.EvidenceSource == "PRODUCTION"
	environmentOK := capture.AttestedByRef != "" && !capture.AttestedAt.IsZero() && !capture.CollectedAt.IsZero() && !capture.AttestedAt.After(capture.CollectedAt)
	if real {
		environmentOK = environmentOK && (capture.Environment == "STAGING" || capture.Environment == "PRODUCTION") && capture.RegionRef != "" && capture.ClusterRef != "" && capture.ChangeTicketRef != ""
	} else {
		environmentOK = environmentOK && capture.Environment == "LOCAL"
	}
	add("ENVIRONMENT_IDENTITY", environmentOK, "生产证据必须绑定环境、区域、集群、变更工单和复核人")

	componentsOK, controlsOK, refsOK, timeOK := len(capture.Components) > 0, true, true, true
	seen := map[string]bool{}
	for _, component := range capture.Components {
		if !slices.Contains(RequiredComponents, component.ComponentType) || seen[component.ComponentType] || component.ResourceRef == "" || component.Status != "VERIFIED" {
			componentsOK = false
		}
		seen[component.ComponentType] = true
		report.ControlCounts[component.ComponentType] = len(component.VerifiedControls)
		timeOK = timeOK && !component.ObservedAt.IsZero() && !component.ObservedAt.After(capture.CollectedAt)
		refsOK = refsOK && component.ProbeRef != "" && component.ConfigurationRef != "" && component.AuditRef != ""
		if real {
			for _, control := range requiredControls[component.ComponentType] {
				controlsOK = controlsOK && slices.Contains(component.VerifiedControls, control)
			}
		}
	}
	for component := range seen {
		report.VerifiedComponents = append(report.VerifiedComponents, component)
	}
	slices.Sort(report.VerifiedComponents)
	if real {
		for _, component := range RequiredComponents {
			componentsOK = componentsOK && seen[component]
		}
	}
	add("COMPONENT_COVERAGE", componentsOK, "生产基础设施必须覆盖域名TLS、OIDC、PostgreSQL、Redis、对象存储、网络隔离和监控")
	add("PRODUCTION_CONTROLS", controlsOK, "每类生产组件必须包含其TLS、私网、高可用、备份、隔离或监控控制项")
	add("OBSERVATION_TIMELINE", timeOK, "所有组件观测时间必须有效且不晚于采集时间")
	add("EVIDENCE_REFERENCES", refsOK, "每个组件必须保存探针、配置和审计引用")
	if real && environmentOK && componentsOK && controlsOK && timeOK && refsOK && report.Result == "PASS" {
		report.ExternalValidationRequired = false
	}
	return report
}

func RequiredControls(component string) []string { return slices.Clone(requiredControls[component]) }

func SHA256(content []byte) string {
	digest := sha256.Sum256(content)
	return hex.EncodeToString(digest[:])
}

func decodeStrict(content []byte, target any) error {
	decoder := json.NewDecoder(bytes.NewReader(content))
	decoder.DisallowUnknownFields()
	if err := decoder.Decode(target); err != nil {
		return err
	}
	var trailing any
	if err := decoder.Decode(&trailing); !errors.Is(err, io.EOF) {
		return errors.New("trailing JSON data")
	}
	return nil
}