#!/usr/bin/env python3
"""
Render a personalized Supabase Helm values file and pre-template manifests
using the local prole.cfg. Defaults are tailored for Prole's CNPG cluster
(knoe-db-rw Service) and Traefik ingress.
"""
from __future__ import annotations

import argparse
import base64
import configparser
import hashlib
import hmac
import json
import os
import secrets
import subprocess
import sys
import time
import urllib.parse
from pathlib import Path
from typing import Any, Dict

# Allow imports from the repo root
REPO_ROOT = Path(__file__).resolve().parents[2]
sys.path.insert(0, str(REPO_ROOT))

try:
    from knoe.config import _resolve_secret_value  # type: ignore
except Exception:  # pragma: no cover - fallback for minimal environments
    def _resolve_secret_value(value: str | None) -> str:
        return value or ""


def _read_cfg(path: Path) -> configparser.ConfigParser:
    parser = configparser.ConfigParser(interpolation=None)
    try:
        from knoe import prole_conf as prole_conf_mgr  # type: ignore

        files = [p for p in prole_conf_mgr.layered_cfg_files(path) if p.exists()]
        if files:
            parser.read([str(p) for p in files])
        else:
            parser.read(path)
    except Exception:
        parser.read(path)
    return parser


def _cfg_get(cfg: configparser.ConfigParser, section: str, key: str, default: str = "") -> str:
    try:
        raw = cfg.get(section, key, fallback=default)
    except Exception:
        return default
    return _resolve_secret_value((raw or "").strip())


def _first(*values: str, default: str = "") -> str:
    for v in values:
        if v:
            return v
    return default


def _is_placeholder(value: str) -> bool:
    v = (value or "").strip()
    return v.startswith("${") and v.endswith("}")


def _discover_k8s_service_namespace(service_name: str) -> str:
    try:
        raw = subprocess.check_output(["kubectl", "get", "svc", "-A", "-o", "json"], text=True)
        data = json.loads(raw)
        for item in data.get("items", []) or []:
            md = item.get("metadata", {}) or {}
            if md.get("name") == service_name and md.get("namespace"):
                return str(md.get("namespace"))
    except Exception:
        return ""
    return ""


def _ensure_dir(path: Path) -> Path:
    path.mkdir(parents=True, exist_ok=True)
    return path


def _load_or_create_secret(path: Path, length: int = 32) -> str:
    if path.exists():
        return path.read_text().strip()
    val = secrets.token_hex(length)
    path.write_text(val)
    return val


def _b64url(data: bytes) -> str:
    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("utf-8")


def _jwt(payload: Dict[str, Any], secret: str) -> str:
    header = {"alg": "HS256", "typ": "JWT"}
    head = _b64url(json.dumps(header, separators=(",", ":")).encode())
    body = _b64url(json.dumps(payload, separators=(",", ":")).encode())
    signing_input = f"{head}.{body}".encode()
    sig = hmac.new(secret.encode(), signing_input, hashlib.sha256).digest()
    return f"{head}.{body}.{_b64url(sig)}"


def _build_overlay(cfg: configparser.ConfigParser, args: argparse.Namespace) -> tuple[dict, dict]:
    db_service = os.environ.get("KNOE_DB_SERVICE", "knoe-db-rw")

    db_ns = _first(
        os.environ.get("KNOE_DB_NAMESPACE", ""),
        os.environ.get("DATABASE_NAMESPACE", ""),
        _cfg_get(cfg, "Global", "DATABASE_NAMESPACE"),
        _cfg_get(cfg, "Global", "NAMESPACE"),
        os.environ.get("NAMESPACE", ""),
        default="",
    )
    if _is_placeholder(db_ns):
        db_ns = ""
    if not db_ns:
        db_ns = _discover_k8s_service_namespace(db_service) or ""
    if not db_ns:
        db_ns = "default"

    supabase_ns = _first(
        _cfg_get(cfg, "Supabase", "NAMESPACE"),
        os.environ.get("SUPABASE_NAMESPACE", ""),
        "supabase",
    )
    db_host = f"{db_service}.{db_ns}.svc.cluster.local"
    db_port = _first(
        _cfg_get(cfg, "Global", "DB_HOST_PORT"),
        _cfg_get(cfg, "Inputs", "init_password.db_host_port"),
        "5432",
    )
    db_name = _first(
        _cfg_get(cfg, "Database Creation", "DB_NAME"),
        _cfg_get(cfg, "Global", "DB_NAME"),
        "postgres",
    )
    db_password = _first(
        os.environ.get("DB_PASSWORD", ""),  # live secret override takes highest priority
        _cfg_get(cfg, "Inputs", "init_password.db_password"),
        _cfg_get(cfg, "Global", "DB_PASSWORD"),
    )
    if not db_password:
        raise SystemExit("Database password is required (init_password.db_password or DB_PASSWORD).")

    gen_dir = _ensure_dir(Path(args.output_dir))
    secrets_dir = _ensure_dir(gen_dir / "secrets")

    jwt_secret = _first(os.environ.get("SUPABASE_JWT_SECRET", "")) or _load_or_create_secret(
        secrets_dir / "jwt.secret", length=32
    )
    now = int(time.time())
    exp = now + 10 * 365 * 24 * 3600
    anon_payload = {"role": "anon", "iss": "prole-supabase", "iat": now, "exp": exp}
    service_payload = {"role": "service_role", "iss": "prole-supabase", "iat": now, "exp": exp}
    anon_key = _jwt(anon_payload, jwt_secret)
    service_key = _jwt(service_payload, jwt_secret)

    supabase_hostname = _first(
        _cfg_get(cfg, "User", "supabase_hostname"),
        _cfg_get(cfg, "Global", "supabase_hostname"),
        _cfg_get(cfg, "User", "SUPABASE_HOSTNAME"),
        _cfg_get(cfg, "Global", "SUPABASE_HOSTNAME"),
        os.environ.get("SUPABASE_HOSTNAME", ""),
        os.environ.get("SUPABASE_HOST", ""),
        default="db.prole.org",
    ).strip()

    if _is_placeholder(supabase_hostname):
        supabase_hostname = ""
    if not supabase_hostname:
        supabase_hostname = "db.prole.org"

    # Canonical public URL for Supabase (used for auth callbacks + Studio links).
    public_url = ""
    ingress_host = supabase_hostname
    if "://" in supabase_hostname:
        parsed = urllib.parse.urlparse(supabase_hostname)
        ingress_host = (parsed.hostname or "").strip() or ingress_host
        scheme = (parsed.scheme or "https").strip()
        if parsed.netloc:
            public_url = f"{scheme}://{parsed.netloc}"
        else:
            public_url = f"{scheme}://{ingress_host}"
    else:
        public_url = f"https://{ingress_host}"

    # Additional origins/redirect URLs allowed by GoTrue (comma-separated hostnames or URLs).
    # Needed when a service at a different hostname (e.g. svc.prole.org) uses Supabase auth.
    _extra_redirect_raw = _first(
        os.environ.get("SUPABASE_ADDITIONAL_REDIRECT_URLS", ""),
        _cfg_get(cfg, "Global", "SUPABASE_ADDITIONAL_REDIRECT_URLS"),
        _cfg_get(cfg, "Supabase", "ADDITIONAL_REDIRECT_URLS"),
        default="",
    ).strip()
    _extra_redirect_urls: list[str] = []
    for _entry in _extra_redirect_raw.split(","):
        _entry = _entry.strip()
        if not _entry or _is_placeholder(_entry):
            continue
        if "://" not in _entry:
            _entry = f"https://{_entry}"
        if not _entry.endswith("/**"):
            _entry = _entry.rstrip("/") + "/**"
        _extra_redirect_urls.append(_entry)
    # Always include the primary public URL itself; only set if extra origins exist
    _gotrue_uri_allow_list = ",".join([public_url + "/**"] + _extra_redirect_urls) if _extra_redirect_urls else ""

    # Placement: pin Supabase pods to the configured primary node (default: pi.prole.org)
    mode = _first(
        os.environ.get("PROLE_MODE", ""),
        _cfg_get(cfg, "Global", "DEPLOYMENT_MODE"),
        _cfg_get(cfg, "globals", "prole.mode"),
        default="",
    ).strip().lower()
    supabase_primary_node = _first(
        os.environ.get("SUPABASE_PRIMARY_NODE", ""),
        _cfg_get(cfg, "Global", "SUPABASE_PRIMARY_NODE"),
        _cfg_get(cfg, "Supabase", "PRIMARY_NODE"),
        default="pi.prole.org",
    ).strip()
    if _is_placeholder(supabase_primary_node):
        supabase_primary_node = ""
    supabase_node_selector = (
        {"kubernetes.io/hostname": supabase_primary_node} if supabase_primary_node else {}
    )
    supabase_storage_class = _first(
        os.environ.get("SUPABASE_STORAGE_CLASS", ""),
        _cfg_get(cfg, "Global", "SUPABASE_STORAGE_CLASS"),
        _cfg_get(cfg, "Supabase", "STORAGE_CLASS"),
        default="merlin-local-iscsi-d002",
    ).strip()
    if _is_placeholder(supabase_storage_class):
        supabase_storage_class = "merlin-local-iscsi-d002"

    overlay: dict[str, Any] = {
        "nameOverride": "supabase",
        "fullnameOverride": "supabase",
        "deployment": {
            "db": {"enabled": False},
            "functions": {"enabled": False},
            "vector": {"enabled": False},
        },
        "externalDatabase": {
            "enabled": True,
            "host": db_host,
            "port": int(str(db_port)),
            "database": db_name,
            "ssl": "disable",
            "createAliasService": True,
            "aliasServiceName": "db",
        },
        "environment": {
            "auth": {
                "DB_HOST": db_host,
                "DB_PORT": str(db_port),
                "DB_SSL": "disable",
                "API_EXTERNAL_URL": public_url,
                "GOTRUE_SITE_URL": public_url,
                **( {"GOTRUE_URI_ALLOW_LIST": _gotrue_uri_allow_list} if _gotrue_uri_allow_list else {} ),
            },
            "analytics": {"DB_HOST": db_host, "DB_PORT": str(db_port)},
            "meta": {"DB_HOST": db_host, "DB_PORT": str(db_port)},
            "studio": {"SUPABASE_PUBLIC_URL": public_url},
        },
        "secret": {
            "db": {"password": db_password, "database": db_name},
            "jwt": {"secret": jwt_secret, "anonKey": anon_key, "serviceKey": service_key},
        },
        "ingress": {
            "enabled": True,
            "className": "traefik",
            "hosts": [
                {"host": ingress_host, "paths": [{"path": "/", "pathType": "Prefix"}]}
            ],
        },
    }

    if supabase_storage_class:
        # Validate: must be a synology/merlin mount — refuse pi/local SD card classes
        if not any(supabase_storage_class.startswith(p) for p in
                   ("synology", "merlin-local-iscsi", "myrddin-local-iscsi")):
            raise SystemExit(
                f"SUPABASE_STORAGE_CLASS '{supabase_storage_class}' is not a synology mount. "
                "Supabase must run on iSCSI/NFS storage (merlin-local-iscsi-d002 or synology-iscsi). "
                "Refusing deploy to prevent SD-card crash."
            )
        # Write to persistence.*.storageClassName — the path the Helm chart actually uses
        persistence = overlay.setdefault("persistence", {})
        for pvc_key in ("functions", "imgproxy", "snippets", "storage", "deno", "minio"):
            persistence.setdefault(pvc_key, {})["storageClassName"] = supabase_storage_class

    if mode == "k3s" and supabase_node_selector:
        deployment = overlay.setdefault("deployment", {})
        for component in (
            "analytics",
            "auth",
            "db",
            "functions",
            "imgproxy",
            "kong",
            "meta",
            "minio",
            "realtime",
            "rest",
            "storage",
            "studio",
            "vector",
        ):
            component_cfg = deployment.setdefault(component, {})
            component_cfg.setdefault("nodeSelector", {})
            component_cfg["nodeSelector"].update(supabase_node_selector)

    meta = {
        "supabase_namespace": supabase_ns,
        "db_namespace": db_ns,
        "db_host": db_host,
    }
    return overlay, meta


def render(args: argparse.Namespace) -> None:
    cfg_path = Path(args.config)
    if cfg_path.is_dir():
        cfg_path = cfg_path / "prole.cfg"
    if not cfg_path.exists():
        raise SystemExit(f"Config not found: {cfg_path}")

    cfg = _read_cfg(cfg_path)
    overlay, meta = _build_overlay(cfg, args)

    gen_dir = _ensure_dir(Path(args.output_dir))
    values_path = gen_dir / "values.generated.json"
    values_path.write_text(json.dumps(overlay, indent=2))

    # Write Namespace manifest for Supabase
    k8s_dir = _ensure_dir(Path(args.manifests_dir))
    namespace_manifest = {
        "apiVersion": "v1",
        "kind": "Namespace",
        "metadata": {"name": meta["supabase_namespace"]},
    }
    (k8s_dir / "namespace.yaml").write_text(json.dumps(namespace_manifest))

    # Render chart to a single manifest file (Helm accepts JSON values)
    rendered_path = k8s_dir / "supabase-helm.yaml"
    cmd = [
        "helm",
        "template",
        "prole-supabase",
        str(REPO_ROOT / "supabase" / "helm" / "prole-supabase"),
        "-n",
        meta["supabase_namespace"],
        "-f",
        str(values_path),
    ]
    proc = subprocess.run(cmd, capture_output=True, text=True)
    if proc.returncode != 0:
        sys.stderr.write(proc.stderr)
        raise SystemExit(f"Helm template failed (code {proc.returncode})")
    rendered_path.write_text(proc.stdout)

    summary = {
        "values": str(values_path),
        "manifests": str(rendered_path),
        "db_host": meta["db_host"],
        "supabase_namespace": meta["supabase_namespace"],
    }
    (gen_dir / "manifest-summary.json").write_text(json.dumps(summary, indent=2))


if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="Render Supabase Helm chart from prole.cfg")
    parser.add_argument(
        "--config",
        "-c",
        default=os.environ.get("PROLE_CONF", str(REPO_ROOT / "conf")),
        help="Path to prole.cfg or its directory",
    )
    parser.add_argument(
        "--output-dir",
        default=str(REPO_ROOT / "supabase" / "helm" / "generated"),
        help="Directory to write generated values and metadata",
    )
    parser.add_argument(
        "--manifests-dir",
        default=str(REPO_ROOT / "supabase" / "k8s"),
        help="Directory to write rendered Kubernetes manifests",
    )
    args = parser.parse_args()
    render(args)