defmodule BearCli.CLI do
  @moduledoc """
  `bear` 指令的命令列入口與指令分派。

  指令：`login`（PAT 模式）、`whoami`、`token`、`logout`、`status`。

  `BEAR_TOKEN` 環境變數（一次性／CI 用的 PAT）提供時，`whoami`／`token`／`status`
  優先使用該值，不讀寫本機憑證檔。
  """

  alias BearCli.{Api, Apps, Config, Credentials}

  @global_switches [
    issuer: :string,
    config: :string,
    json: :boolean,
    verbose: :boolean,
    help: :boolean,
    version: :boolean
  ]
  @global_aliases [v: :verbose, h: :help]

  @login_switches [token: :string, scope: :string, "client-id": :string]
  @token_switches [refresh: :boolean]

  # -- apps 指令群（docs/commands.md §3.6）--
  # 注意：OptionParser 會把選項名的連字號正規化為底線
  # （--client-id → :client_id），switch 定義需用底線 atom。
  @apps_verbs ~w(list show create update rotate-secret toggle)

  @apps_list_switches [
    visibility: :string,
    status: :string,
    page: :integer,
    per_page: :integer
  ]

  @apps_create_switches [
    client_id: :string,
    url: :string,
    title: :string,
    method: :string,
    visibility: :string,
    redirect_url: :keep,
    post_logout_redirect_uri: :keep,
    scope: :keep,
    sub: :string,
    jwk_id: :string,
    secret: :string
  ]

  @apps_update_switches [
    url: :string,
    title: :string,
    method: :string,
    visibility: :string,
    redirect_url: :keep,
    post_logout_redirect_uri: :keep,
    scope: :keep,
    sub: :string,
    jwk_id: :string
  ]

  @visibilities ~w(public internal)
  @statuses ~w(active inactive)
  @methods ~w(client_secret PKCE)

  # -- escript 入口 --

  @doc "escript 主函式。執行後以 `System.halt/1` 設定退出碼。"
  def main(argv) do
    start_apps()
    code = argv |> parse() |> dispatch()
    System.halt(code)
  end

  # Req 預設用 Finch 作為 HTTP adapter，escript 需自行啟動一個 pool。
  defp start_apps do
    _ = Application.ensure_all_started(:req)
    _ = Application.ensure_all_started(:finch)

    case Finch.start_link(name: BearCli.Finch) do
      {:ok, _} -> :ok
      {:error, _} -> :ok
    end

    :ok
  end

  # -- 解析 --

  @doc """
  解析 argv，回傳：

    - `{:version, opts}`
    - `{:help, opts}`
    - `{:ok, command, opts}`（opts 為 atom key 的 map）
    - `{:error, message, exit_code}`
  """
  def parse(argv) do
    argv = Enum.map(argv, &to_string/1)

    case OptionParser.parse_head(argv, strict: @global_switches, aliases: @global_aliases) do
      {global, rest, []} ->
        do_parse(global, rest)

      {_global, _rest, [{opt, _} | _]} ->
        {:error, "未知選項：#{opt}", 2}
    end
  end

  defp do_parse(global, rest) do
    cond do
      global[:version] ->
        {:version, %{}}

      global[:help] == true and rest == [] ->
        {:help, %{}}

      rest == [] ->
        {:help, %{}}

      true ->
        [command | args] = rest
        parse_command(command, args, global)
    end
  end

  defp parse_command("login", args, global) do
    with {:ok, opts} <- parse_opts(args, @global_switches ++ @login_switches) do
      {:ok, :login, merge_opts(global, opts)}
    end
  end

  defp parse_command("whoami", args, global) do
    with {:ok, opts} <- parse_opts(args, @global_switches) do
      {:ok, :whoami, merge_opts(global, opts)}
    end
  end

  defp parse_command("token", args, global) do
    with {:ok, opts} <- parse_opts(args, @global_switches ++ @token_switches) do
      {:ok, :token, merge_opts(global, opts)}
    end
  end

  defp parse_command("logout", args, global) do
    with {:ok, opts} <- parse_opts(args, @global_switches) do
      {:ok, :logout, merge_opts(global, opts)}
    end
  end

  defp parse_command("status", args, global) do
    with {:ok, opts} <- parse_opts(args, @global_switches) do
      {:ok, :status, merge_opts(global, opts)}
    end
  end

  defp parse_command("apps", args, global) do
    case args do
      [verb | rest] when verb in @apps_verbs ->
        switches = apps_switches(verb)

        case OptionParser.parse(rest, strict: @global_switches ++ switches) do
          {opts, positionals, []} ->
            validate_apps(verb, positionals, merge_opts(global, opts_to_map(opts)))

          {_opts, _extra, [{opt, _} | _]} ->
            {:error, "無法解析選項：#{opt}", 2}
        end

      [] ->
        {:error, "apps 缺少子指令（可用：#{Enum.join(@apps_verbs, " ")}）", 2}

      [unknown | _] ->
        {:error, "未知的 apps 子指令：#{unknown}（可用：#{Enum.join(@apps_verbs, " ")}）", 2}
    end
  end

  defp parse_command(unknown, _args, _global) do
    {:error, "未知指令：#{unknown}（可用 bear --help 查看說明）", 2}
  end

  defp parse_opts(args, switches) do
    case OptionParser.parse(args, strict: switches) do
      {opts, [], []} ->
        {:ok, opts}

      {_opts, extra, []} ->
        {:error, "不接受的參數：#{Enum.join(extra, " ")}", 2}

      {_opts, _extra, [{opt, _} | _]} ->
        {:error, "無法解析選項：#{opt}", 2}
    end
  end

  # -- apps 解析輔助 --

  defp apps_switches("list"), do: @apps_list_switches
  defp apps_switches("show"), do: []
  defp apps_switches("create"), do: @apps_create_switches
  defp apps_switches("update"), do: @apps_update_switches
  defp apps_switches("rotate-secret"), do: []
  defp apps_switches("toggle"), do: []

  # apps 子指令的本地用法驗證（§3.6：用法錯誤 → 退出碼 2）。
  defp validate_apps("list", [], opts) do
    cond do
      invalid_enum?(opts[:visibility], @visibilities, "--visibility") ->
        usage_error(opts[:visibility], "--visibility", @visibilities)

      invalid_enum?(opts[:status], @statuses, "--status") ->
        usage_error(opts[:status], "--status", @statuses)

      true ->
        {:ok, {Apps, :list}, opts}
    end
  end

  defp validate_apps("list", extra, _opts),
    do: {:error, "apps list 不接受位置參數：#{Enum.join(extra, " ")}", 2}

  defp validate_apps("show", [client_id], opts),
    do: {:ok, {Apps, :show}, Map.put(opts, :client_id_arg, client_id)}

  defp validate_apps("show", [], _opts), do: {:error, "apps show 缺少 <client-id>", 2}

  defp validate_apps("show", extra, _opts),
    do: {:error, "apps show 只接受一個 <client-id>（多餘：#{Enum.join(Enum.drop(extra, 1), " ")}）", 2}

  defp validate_apps("create", [], opts) do
    missing =
      [{"client-id", opts[:client_id]}, {"url", opts[:url]}, {"title", opts[:title]}]
      |> Enum.filter(fn {_name, v} -> blank?(v) end)
      |> Enum.map(&elem(&1, 0))

    cond do
      missing != [] ->
        {:error, "apps create 缺少必選參數：#{Enum.join(missing, "、")}", 2}

      invalid_enum?(opts[:method], @methods, "--method") ->
        usage_error(opts[:method], "--method", @methods)

      invalid_enum?(opts[:visibility], @visibilities, "--visibility") ->
        usage_error(opts[:visibility], "--visibility", @visibilities)

      opts[:method] == "PKCE" and blank?(opts[:jwk_id]) ->
        {:error, "method=PKCE 必須給 --jwk-id", 2}

      true ->
        {:ok, {Apps, :create}, opts}
    end
  end

  defp validate_apps("create", extra, _opts),
    do: {:error, "apps create 不接受位置參數：#{Enum.join(extra, " ")}", 2}

  defp validate_apps("update", [client_id], opts) do
    cond do
      invalid_enum?(opts[:method], @methods, "--method") ->
        usage_error(opts[:method], "--method", @methods)

      invalid_enum?(opts[:visibility], @visibilities, "--visibility") ->
        usage_error(opts[:visibility], "--visibility", @visibilities)

      opts[:method] == "PKCE" and blank?(opts[:jwk_id]) ->
        {:error, "method=PKCE 必須給 --jwk-id", 2}

      true ->
        {:ok, {Apps, :update}, Map.put(opts, :client_id_arg, client_id)}
    end
  end

  defp validate_apps("update", [], _opts), do: {:error, "apps update 缺少 <client-id>", 2}

  defp validate_apps("update", extra, _opts),
    do: {:error, "apps update 只接受一個 <client-id>（多餘：#{Enum.join(Enum.drop(extra, 1), " ")}）", 2}

  defp validate_apps("rotate-secret", [client_id], opts),
    do: {:ok, {Apps, :"rotate-secret"}, Map.put(opts, :client_id_arg, client_id)}

  defp validate_apps("rotate-secret", [], _opts),
    do: {:error, "apps rotate-secret 缺少 <client-id>", 2}

  defp validate_apps("rotate-secret", extra, _opts),
    do:
      {:error, "apps rotate-secret 只接受一個 <client-id>（多餘：#{Enum.join(Enum.drop(extra, 1), " ")}）",
       2}

  defp validate_apps("toggle", [client_id], opts),
    do: {:ok, {Apps, :toggle}, Map.put(opts, :client_id_arg, client_id)}

  defp validate_apps("toggle", [], _opts), do: {:error, "apps toggle 缺少 <client-id>", 2}

  defp validate_apps("toggle", extra, _opts),
    do: {:error, "apps toggle 只接受一個 <client-id>（多餘：#{Enum.join(Enum.drop(extra, 1), " ")}）", 2}

  defp invalid_enum?(nil, _allowed, _flag), do: false
  defp invalid_enum?(value, allowed, _flag), do: value not in allowed

  defp usage_error(value, flag, allowed) do
    {:error, "#{flag} 不接受的值：#{value}（可用：#{Enum.join(allowed, "、")}）", 2}
  end

  defp merge_opts(global, opts) do
    Map.merge(Map.new(global), Map.new(opts))
  end

  # keyword 轉 map：`:keep` 選項（@keep_keys）重複出現時收集為清單，其餘取最後值。
  @keep_keys ~w(redirect_url post_logout_redirect_uri scope)a

  defp opts_to_map(opts) do
    Enum.reduce(opts, %{}, fn
      {k, v}, acc when k in @keep_keys ->
        Map.update(acc, k, [v], fn existing -> existing ++ [v] end)

      {k, v}, acc ->
        Map.put(acc, k, v)
    end)
  end

  # -- 分派 --

  @doc """
  執行已解析的指令，回傳退出碼。`opts[:api]` 可注入假的 userinfo 函式供測試。
  """
  def dispatch(parsed, opts \\ []) do
    api = opts[:api] || (&Api.userinfo/2)

    case parsed do
      {:version, _} ->
        IO.puts(BearCli.version())
        0

      {:help, _} ->
        print_help()
        0

      {:error, message, code} ->
        IO.puts(:stderr, "錯誤：#{message}")
        code

      # apps 指令群（{:ok, {module, verb}, opts} 形狀；注入的 api 模組同時作為 apps_api）
      {:ok, {Apps, verb}, cmd_opts} when is_atom(verb) ->
        apps_api = cmd_opts[:apps_api] || opts[:apps_api] || Api
        Apps.run(verb, Map.put(cmd_opts, :apps_api, apps_api))

      {:ok, command, cmd_opts} ->
        cond do
          cmd_opts[:version] ->
            IO.puts(BearCli.version())
            0

          cmd_opts[:help] ->
            print_help()
            0

          true ->
            run(command, cmd_opts, api)
        end
    end
  end

  # -- 指令實作 --

  defp run(:login, opts, api) do
    case opts[:token] do
      nil ->
        IO.puts(:stderr, "Device Flow 登入尚未開放（伺服器端 P1 未實作）。")
        IO.puts(:stderr, "請改用個人存取權杖登入：bear login --token <PAT>")
        2

      "" ->
        fail(opts, "token 不可為空", 2)

      token ->
        token = if token == "-", do: read_token_from_stdin(), else: token
        do_login(opts, token, api)
    end
  end

  defp run(:whoami, opts, api) do
    case Config.env_token() do
      # BEAR_TOKEN 優先於憑證檔（不讀檔、不寫檔）。
      nil ->
        whoami_from_credentials(opts, api)

      token ->
        call_userinfo(resolve_issuer(opts), token, opts, api)
    end
  end

  defp run(:token, opts, _api) do
    cond do
      # BEAR_TOKEN 優先於憑證檔（一次性／CI 用，不寫入）。
      token = Config.env_token() ->
        IO.puts(token)
        0

      true ->
        token_from_credentials(opts)
    end
  end

  defp run(:logout, opts, _api) do
    case Credentials.delete() do
      :ok ->
        if opts[:json] do
          IO.puts(Jason.encode!(%{ok: true}))
        else
          IO.puts("已登出（本機憑證已清除）。")
          IO.puts("注意：PAT 本身仍在伺服器端有效，如需撤銷請至 Bear 網頁「個人存取權杖」頁面。")
        end

        0

      {:error, reason} ->
        fail(opts, "清除憑證失敗：#{inspect(reason)}", 1)
    end
  end

  defp run(:status, opts, _api) do
    env_token = Config.env_token()

    cond do
      env_token ->
        issuer = resolve_issuer(opts)

        if opts[:json] do
          IO.puts(
            Jason.encode!(%{
              ok: true,
              logged_in: true,
              mode: "env_token",
              issuer: issuer
            })
          )
        else
          IO.puts("已登入（BEAR_TOKEN 環境變數）")
          IO.puts("模式：個人存取權杖（環境變數，不寫入憑證檔）")
          IO.puts("issuer：#{issuer}")
        end

        0

      true ->
        status_from_credentials(opts)
    end
  end

  # -- 指令實作輔助 --

  defp whoami_from_credentials(opts, api) do
    case Credentials.load() do
      {:ok, creds} ->
        token = creds["access_token"]

        if blank?(token) do
          fail(opts, "憑證檔缺少 access_token，請重新 bear login", 7)
        else
          call_userinfo(resolve_issuer(opts, creds["issuer"]), token, opts, api)
        end

      :error ->
        fail(opts, "未登入（請先執行 bear login）", 3)
    end
  end

  defp call_userinfo(issuer, token, opts, api) do
    if opts[:verbose], do: IO.puts(:stderr, "issuer: #{issuer}")

    case api.(issuer, token) do
      {:ok, claims} ->
        if opts[:json] do
          IO.puts(Jason.encode!(%{ok: true, claims: claims}))
        else
          print_claims(claims)
        end

        0

      {:error, :unauthorized, desc} ->
        fail(opts, "token 無效或已過期（#{desc}），請重新 bear login", 3)

      {:error, :network, reason} ->
        fail(opts, "無法連線到 #{issuer}：#{reason}", 6)

      {:error, :server_error, status} ->
        fail(opts, "伺服器回應 #{status}", 6)
    end
  end

  defp token_from_credentials(opts) do
    case Credentials.load() do
      {:ok, creds} ->
        if opts[:refresh] do
          # 規格 §3.3：PAT 模式下 --refresh 為無效選項，報用法錯誤。
          fail_token("PAT 模式無 refresh token，--refresh 為無效選項", 2)
        else
          case creds["access_token"] do
            token when is_binary(token) and token != "" ->
              # token 指令只輸出 token 本體（單行、無前綴），供 pipe 使用。
              IO.puts(token)
              0

            _ ->
              fail_token("憑證檔缺少 access_token，請重新 bear login", 7)
          end
        end

      :error ->
        fail_token("未登入（請先執行 bear login）", 3)
    end
  end

  defp status_from_credentials(opts) do
    case Credentials.load() do
      {:ok, creds} ->
        if opts[:json] do
          IO.puts(
            Jason.encode!(%{
              ok: true,
              logged_in: true,
              email: creds["email"],
              issuer: creds["issuer"],
              mode: "pat"
            })
          )
        else
          IO.puts("已登入：#{creds["email"] || "(未知)"}")
          IO.puts("模式：個人存取權杖（PAT）")
          IO.puts("issuer：#{creds["issuer"]}")
        end

        0

      :error ->
        if opts[:json] do
          IO.puts(Jason.encode!(%{ok: false, logged_in: false, error: "未登入", code: 3}))
        else
          IO.puts("未登入")
        end

        3
    end
  end

  # -- 指令實作輔助 --

  defp do_login(opts, token, api) do
    issuer = resolve_issuer(opts)

    if opts[:verbose], do: IO.puts(:stderr, "issuer: #{issuer}")

    case api.(issuer, token) do
      {:ok, claims} ->
        email = claims["email"]
        creds = %{"issuer" => issuer, "access_token" => token, "email" => email}

        case Credentials.save(creds) do
          :ok ->
            if opts[:json] do
              IO.puts(Jason.encode!(%{ok: true, email: email}))
            else
              IO.puts("已登入：#{email || "(無 email claim)"}")
            end

            0

          {:error, reason} ->
            fail(opts, "憑證檔寫入失敗：#{inspect(reason)}", 1)
        end

      {:error, :unauthorized, desc} ->
        # 規格 §3.1：PAT 無效或已撤銷 → 退出碼 3。
        fail(opts, "PAT 無效或已撤銷（#{desc}），不寫入任何資料", 3)

      {:error, :network, reason} ->
        fail(opts, "無法連線到 #{issuer}：#{reason}", 6)

      {:error, :server_error, status} ->
        fail(opts, "伺服器回應 #{status}", 6)
    end
  end

  # -- 輔助 --

  # 優先取 --issuer flag；否則取憑證內記錄的 issuer；最後才回落 config/env/預設。
  defp resolve_issuer(opts, stored_issuer \\ nil) do
    opts[:issuer] || stored_issuer || Config.resolve_issuer(nil, opts[:config])
  end

  defp read_token_from_stdin do
    IO.read(:stdio, :line) |> to_string() |> String.trim()
  end

  defp fail(opts, message, code) do
    if opts[:json] do
      IO.puts(Jason.encode!(%{ok: false, error: message, code: code}))
    else
      IO.puts(:stderr, "錯誤：#{message}")
    end

    code
  end

  # token 指令的錯誤一律走 stderr，避免污染 stdout（pipe 的對象）。
  defp fail_token(message, code) do
    IO.puts(:stderr, "錯誤：#{message}")
    code
  end

  @preferred_claims ~w(sub email name preferred_username nickname picture)

  defp print_claims(claims) do
    preferred =
      Enum.filter(@preferred_claims, &Map.has_key?(claims, &1))

    rest =
      claims
      |> Map.drop(@preferred_claims)
      |> Enum.sort_by(fn {k, _} -> to_string(k) end)

    Enum.each(preferred, fn k ->
      IO.puts("#{String.pad_trailing(k, 20)}: #{format_value(claims[k])}")
    end)

    Enum.each(rest, fn {k, v} ->
      IO.puts("#{String.pad_trailing(to_string(k), 20)}: #{format_value(v)}")
    end)
  end

  defp format_value(v) when is_binary(v), do: v
  defp format_value(v) when is_number(v), do: to_string(v)
  defp format_value(v) when is_boolean(v), do: to_string(v)
  defp format_value(v) when is_nil(v), do: ""
  defp format_value(v), do: Jason.encode!(v)

  defp blank?(nil), do: true
  defp blank?(""), do: true
  defp blank?(_), do: false

  defp print_help do
    IO.puts("""
    Bear CLI — Bear SSO 終端機客戶端

    用法：bear <指令> [選項]

    指令：
      login --token <PAT>   以個人存取權杖登入（PAT 模式；Device Flow 尚未開放）
      whoami                顯示目前登入身分
      token [--refresh]     印出 access token（PAT 模式下 --refresh 為用法錯誤）
      logout                登出（清除本機憑證）
      status                顯示登入狀態
      apps <動詞>            App 管理（admin；bear apps --help 查看）

    apps 指令群（需 admin 權限的 PAT）：
      apps list [--visibility public|internal] [--status active|inactive]
                [--page N] [--per-page N]
      apps show <client-id>
      apps create --client-id ID --url URL --title TITLE
                  [--method client_secret|PKCE] [--visibility public|internal]
                  [--redirect-url URL]... [--post-logout-redirect-uri URI]...
                  [--scope SCOPE]... [--sub FIELD] [--jwk-id ID] [--secret SECRET]
      apps update <client-id> [同 create 的選項；只更新有給的欄位]
      apps rotate-secret <client-id>
      apps toggle <client-id>

    全域選項：
      --issuer URL          Bear（OIDC Provider）位址（預設 https://alterminal.com）
      --config PATH         設定檔路徑（預設 ~/.config/bear/config.json）
      --json                機器可讀輸出（JSON）
      -v, --verbose         顯示詳細日誌
      -h, --help            顯示說明
      --version             顯示版本

    環境變數：
      BEAR_TOKEN            一次性／CI 用的 PAT；提供後 whoami/token/status 優先
                            使用，不寫入憑證檔
    """)
  end
end