#!/usr/bin/env python3
"""
Render a personalized Supabase Helm values file and pre-template manifests
using the local prole.cfg. Defaults are tailored for Prole's CNPG cluster
(knoe-db-rw Service) and Traefik ingress.
"""
from __future__ import annotations

import argparse
import base64
import configparser
import hashlib
import hmac
import json
import os
import secrets
import subprocess
import sys
import time
import urllib.parse
from pathlib import Path
from typing import Any, Dict

# Allow imports from the repo root
REPO_ROOT = Path(__file__).resolve().parents[2]
sys.path.insert(0, str(REPO_ROOT))

try:
    from knoe.config import _resolve_secret_value  # type: ignore
except Exception:  # pragma: no cover - fallback for minimal environments
    def _resolve_secret_value(value: str | None) -> str:
        return value or ""


def _read_cfg(path: Path) -> configparser.ConfigParser:
    parser = configparser.ConfigParser(interpolation=None)
    try:
        from knoe import prole_conf as prole_conf_mgr  # type: ignore

        files = [p for p in prole_conf_mgr.layered_cfg_files(path) if p.exists()]
        if files:
            parser.read([str(p) for p in files])
        else:
            parser.read(path)
    except Exception:
        parser.read(path)
    return parser


def _cfg_get(cfg: configparser.ConfigParser, section: str, key: str, default: str = "") -> str:
    try:
        raw = cfg.get(section, key, fallback=default)
    except Exception:
        return default
    return _resolve_secret_value((raw or "").strip())


def _first(*values: str, default: str = "") -> str:
    for v in values:
        if v:
            return v
    return default


def _is_placeholder(value: str) -> bool:
    v = (value or "").strip()
    return v.startswith("${") and v.endswith("}")


def _as_bool(value: str | bool | None, default: bool = False) -> bool:
    if isinstance(value, bool):
        return value
    if value is None:
        return default
    normalized = str(value).strip().lower()
    if not normalized:
        return default
    if normalized in {"1", "true", "yes", "on", "y"}:
        return True
    if normalized in {"0", "false", "no", "off", "n"}:
        return False
    return default


def _parse_hosts(raw_hosts: str, fallback: str = "db.prole.org") -> list[str]:
    entries: list[str] = []
    seen: set[str] = set()
    for entry in (raw_hosts or "").split(","):
        token = (entry or "").strip()
        if not token or _is_placeholder(token):
            continue

        if "://" in token:
            parsed = urllib.parse.urlparse(token)
            host = (parsed.hostname or "").strip()
        else:
            host = token

        if not host or host in seen:
            continue
        seen.add(host)
        entries.append(host)

    if entries:
        return entries
    return [fallback]


def _discover_k8s_service_namespace(service_name: str) -> str:
    try:
        raw = subprocess.check_output(["kubectl", "get", "svc", "-A", "-o", "json"], text=True)
        data = json.loads(raw)
        for item in data.get("items", []) or []:
            md = item.get("metadata", {}) or {}
            if md.get("name") == service_name and md.get("namespace"):
                return str(md.get("namespace"))
    except Exception:
        return ""
    return ""


def _ensure_dir(path: Path) -> Path:
    path.mkdir(parents=True, exist_ok=True)
    return path


def _load_or_create_secret(path: Path, length: int = 32) -> str:
    if path.exists():
        return path.read_text().strip()
    val = secrets.token_hex(length)
    path.write_text(val)
    return val


def _b64url(data: bytes) -> str:
    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("utf-8")


def _jwt(payload: Dict[str, Any], secret: str) -> str:
    header = {"alg": "HS256", "typ": "JWT"}
    head = _b64url(json.dumps(header, separators=(",", ":")).encode())
    body = _b64url(json.dumps(payload, separators=(",", ":")).encode())
    signing_input = f"{head}.{body}".encode()
    sig = hmac.new(secret.encode(), signing_input, hashlib.sha256).digest()
    return f"{head}.{body}.{_b64url(sig)}"


def _build_overlay(cfg: configparser.ConfigParser, args: argparse.Namespace) -> tuple[dict, dict]:
    db_service = os.environ.get("KNOE_DB_SERVICE", "knoe-db-rw")

    db_ns = _first(
        os.environ.get("KNOE_DB_NAMESPACE", ""),
        os.environ.get("DATABASE_NAMESPACE", ""),
        _cfg_get(cfg, "Global", "DATABASE_NAMESPACE"),
        _cfg_get(cfg, "Global", "NAMESPACE"),
        os.environ.get("NAMESPACE", ""),
        default="",
    )
    if _is_placeholder(db_ns):
        db_ns = ""
    if not db_ns:
        db_ns = _discover_k8s_service_namespace(db_service) or ""
    if not db_ns:
        db_ns = "default"

    supabase_ns = _first(
        _cfg_get(cfg, "Supabase", "NAMESPACE"),
        os.environ.get("SUPABASE_NAMESPACE", ""),
        "supabase",
    )
    db_host = f"{db_service}.{db_ns}.svc.cluster.local"
    db_port = _first(
        _cfg_get(cfg, "Global", "DB_HOST_PORT"),
        _cfg_get(cfg, "Inputs", "init_password.db_host_port"),
        "5432",
    )
    db_name = _first(
        _cfg_get(cfg, "Database Creation", "DB_NAME"),
        _cfg_get(cfg, "Global", "DB_NAME"),
        "postgres",
    )
    db_password = _first(
        os.environ.get("DB_PASSWORD", ""),  # live secret override takes highest priority
        _cfg_get(cfg, "Inputs", "init_password.db_password"),
        _cfg_get(cfg, "Global", "DB_PASSWORD"),
    )
    if not db_password:
        raise SystemExit("Database password is required (init_password.db_password or DB_PASSWORD).")

    gen_dir = _ensure_dir(Path(args.output_dir))
    secrets_dir = _ensure_dir(gen_dir / "secrets")

    jwt_secret = _first(os.environ.get("SUPABASE_JWT_SECRET", "")) or _load_or_create_secret(
        secrets_dir / "jwt.secret", length=32
    )
    now = int(time.time())
    exp = now + 10 * 365 * 24 * 3600
    anon_payload = {"role": "anon", "iss": "prole-supabase", "iat": now, "exp": exp}
    service_payload = {"role": "service_role", "iss": "prole-supabase", "iat": now, "exp": exp}
    anon_key = _jwt(anon_payload, jwt_secret)
    service_key = _jwt(service_payload, jwt_secret)

    supabase_hostname_raw = _first(
        os.environ.get("SUPABASE_STUDIO_URL", ""),
        _cfg_get(cfg, "Inputs", "init_cluster.supabase_studio_url"),
        _cfg_get(cfg, "User", "supabase_hostname"),
        _cfg_get(cfg, "Global", "supabase_hostname"),
        _cfg_get(cfg, "User", "SUPABASE_HOSTNAME"),
        _cfg_get(cfg, "Global", "SUPABASE_HOSTNAME"),
        os.environ.get("SUPABASE_HOSTNAME", ""),
        os.environ.get("SUPABASE_HOST", ""),
        default="db.prole.org",
    ).strip()

    if _is_placeholder(supabase_hostname_raw):
        supabase_hostname_raw = ""
    if not supabase_hostname_raw:
        supabase_hostname_raw = "db.prole.org"

    studio_enabled = _as_bool(
        _first(
            os.environ.get("SUPABASE_STUDIO_ENABLED", ""),
            _cfg_get(cfg, "Inputs", "init_cluster.supabase_studio_enabled"),
            _cfg_get(cfg, "Global", "SUPABASE_STUDIO_ENABLED"),
            default="true",
        ),
        default=True,
    )
    auth_enabled = _as_bool(
        _first(
            os.environ.get("SUPABASE_AUTH_ENABLED", ""),
            _cfg_get(cfg, "Inputs", "init_cluster.supabase_auth_enabled"),
            _cfg_get(cfg, "Global", "SUPABASE_AUTH_ENABLED"),
            default="true",
        ),
        default=True,
    )
    realtime_enabled = _as_bool(
        _first(
            os.environ.get("SUPABASE_REALTIME_ENABLED", ""),
            _cfg_get(cfg, "Inputs", "init_cluster.supabase_realtime_enabled"),
            _cfg_get(cfg, "Global", "SUPABASE_REALTIME_ENABLED"),
            default="true",
        ),
        default=True,
    )
    meta_enabled = _as_bool(
        _first(
            os.environ.get("SUPABASE_META_ENABLED", ""),
            _cfg_get(cfg, "Inputs", "init_cluster.supabase_meta_enabled"),
            _cfg_get(cfg, "Global", "SUPABASE_META_ENABLED"),
            default="true",
        ),
        default=True,
    )
    analytics_enabled = _as_bool(
        _first(
            os.environ.get("SUPABASE_ANALYTICS_ENABLED", ""),
            _cfg_get(cfg, "Inputs", "init_cluster.supabase_analytics_enabled"),
            _cfg_get(cfg, "Global", "SUPABASE_ANALYTICS_ENABLED"),
            default="true",
        ),
        default=True,
    )

    raw_host_entries: list[str] = []
    for entry in supabase_hostname_raw.split(","):
        token = (entry or "").strip()
        if token and not _is_placeholder(token):
            raw_host_entries.append(token)
    if not raw_host_entries:
        raw_host_entries = ["db.prole.org"]

    host_entries = _parse_hosts(",".join(raw_host_entries), fallback="db.prole.org")
    ingress_host = host_entries[0]

    # Canonical public URL for Supabase (used for auth callbacks + Studio links).
    public_url = ""
    primary_raw_host = (raw_host_entries[0] or "").strip()
    if "://" in primary_raw_host:
        parsed = urllib.parse.urlparse(primary_raw_host)
        ingress_host = (parsed.hostname or "").strip() or ingress_host
        scheme = (parsed.scheme or "https").strip()
        if parsed.netloc:
            public_url = f"{scheme}://{parsed.netloc}"
        else:
            public_url = f"{scheme}://{ingress_host}"
    else:
        public_url = f"https://{ingress_host}"

    # Additional origins/redirect URLs allowed by GoTrue (comma-separated hostnames or URLs).
    # Needed when a service at a different hostname (e.g. svc.prole.org) uses Supabase auth.
    _extra_redirect_raw = _first(
        os.environ.get("SUPABASE_ADDITIONAL_REDIRECT_URLS", ""),
        _cfg_get(cfg, "Global", "SUPABASE_ADDITIONAL_REDIRECT_URLS"),
        _cfg_get(cfg, "Supabase", "ADDITIONAL_REDIRECT_URLS"),
        default="",
    ).strip()
    _extra_redirect_urls: list[str] = []
    for _entry in _extra_redirect_raw.split(","):
        _entry = _entry.strip()
        if not _entry or _is_placeholder(_entry):
            continue
        if "://" not in _entry:
            _entry = f"https://{_entry}"
        if not _entry.endswith("/**"):
            _entry = _entry.rstrip("/") + "/**"
        _extra_redirect_urls.append(_entry)
    # Always include the primary public URL itself; only set if extra origins exist
    _gotrue_uri_allow_list = ",".join([public_url + "/**"] + _extra_redirect_urls) if _extra_redirect_urls else ""

    # Placement: pin Supabase pods to the configured primary node (default: pi.prole.org)
    mode = _first(
        os.environ.get("PROLE_MODE", ""),
        _cfg_get(cfg, "Global", "DEPLOYMENT_MODE"),
        _cfg_get(cfg, "globals", "prole.mode"),
        default="",
    ).strip().lower()
    supabase_primary_node = _first(
        os.environ.get("SUPABASE_PRIMARY_NODE", ""),
        os.environ.get("SUPABASE_NODE_SELECTOR", ""),
        os.environ.get("SUPABASE_PV_NODE", ""),
        _cfg_get(cfg, "Global", "SUPABASE_PRIMARY_NODE"),
        _cfg_get(cfg, "Global", "SUPABASE_NODE_SELECTOR"),
        _cfg_get(cfg, "Global", "SUPABASE_PV_NODE"),
        _cfg_get(cfg, "Supabase", "PRIMARY_NODE"),
        default="gandalf.prole.org",
    ).strip()
    if _is_placeholder(supabase_primary_node):
        supabase_primary_node = ""
    supabase_node_selector = (
        {"kubernetes.io/hostname": supabase_primary_node} if supabase_primary_node else {}
    )
    supabase_storage_class = _first(
        os.environ.get("SUPABASE_STORAGE_CLASS", ""),
        _cfg_get(cfg, "Global", "SUPABASE_STORAGE_CLASS"),
        _cfg_get(cfg, "Supabase", "STORAGE_CLASS"),
        default="synology-iscsi",
    ).strip()
    if _is_placeholder(supabase_storage_class):
        supabase_storage_class = "merlin-local-iscsi-d002"

    overlay: dict[str, Any] = {
        "nameOverride": "supabase",
        "fullnameOverride": "supabase",
        "deployment": {
            "db": {"enabled": False},
            "functions": {"enabled": True},
            "vector": {"enabled": True},
            "kong": {"enabled": True},
            "storage": {"enabled": True},
            "minio": {"enabled": True},
            "imgproxy": {"enabled": True},
            # Explicit fullnameOverride per component strips the chart name
            # from pod names (avoids 'supabase-prole-supabase-<component>').
            "analytics": {"enabled": analytics_enabled, "fullnameOverride": "supabase-analytics"},
            "auth": {"enabled": auth_enabled, "fullnameOverride": "supabase-auth"},
            "meta": {"enabled": meta_enabled, "fullnameOverride": "supabase-meta"},
            "realtime": {"enabled": realtime_enabled, "fullnameOverride": "supabase-realtime"},
            "rest": {"enabled": True, "fullnameOverride": "supabase-rest"},
            "studio": {"enabled": studio_enabled, "fullnameOverride": "supabase-studio"},
        },
        "externalDatabase": {
            "enabled": True,
            "host": db_host,
            "port": int(str(db_port)),
            "database": db_name,
            "ssl": "disable",
            "createAliasService": True,
            "aliasServiceName": "db",
        },
        "environment": {
            "auth": {
                "DB_HOST": db_host,
                "DB_PORT": str(db_port),
                "DB_SSL": "disable",
                "API_EXTERNAL_URL": public_url,
                "GOTRUE_SITE_URL": public_url,
                **( {"GOTRUE_URI_ALLOW_LIST": _gotrue_uri_allow_list} if _gotrue_uri_allow_list else {} ),
            },
            "analytics": {"DB_HOST": db_host, "DB_PORT": str(db_port)},
            "meta": {"DB_HOST": db_host, "DB_PORT": str(db_port)},
            "studio": {"SUPABASE_PUBLIC_URL": public_url},
        },
        "secret": {
            "db": {"password": db_password, "database": db_name},
            "jwt": {"secret": jwt_secret, "anonKey": anon_key, "serviceKey": service_key},
        },
        "ingress": {
            "enabled": True,
            "className": "traefik",
            "hosts": [{"host": host, "paths": [{"path": "/", "pathType": "Prefix"}]} for host in host_entries],
        },
        "studioIngress": {
            "enabled": True,
            "className": "traefik",
            "hosts": [{"host": host, "paths": [{"path": "/", "pathType": "Prefix"}]} for host in host_entries],
        },
    }

    if supabase_storage_class:
        # Validate: must be a synology/merlin mount — refuse pi/local SD card classes
        if not any(supabase_storage_class.startswith(p) for p in
                   ("synology", "merlin-local-iscsi", "myrddin-local-iscsi")):
            raise SystemExit(
                f"SUPABASE_STORAGE_CLASS '{supabase_storage_class}' is not a synology mount. "
                "Supabase must run on iSCSI/NFS storage (merlin-local-iscsi-d002 or synology-iscsi). "
                "Refusing deploy to prevent SD-card crash."
            )
        # Write to persistence.*.storageClassName — the path the Helm chart actually uses
        persistence = overlay.setdefault("persistence", {})
        for pvc_key in ("functions", "snippets", "deno", "imgproxy", "minio", "storage"):
            persistence.setdefault(pvc_key, {})["storageClassName"] = supabase_storage_class

    if mode == "k3s" and supabase_node_selector:
        deployment = overlay.setdefault("deployment", {})
        for component in (
            "analytics",
            "auth",
            "functions",
            "imgproxy",
            "kong",
            "meta",
            "minio",
            "realtime",
            "rest",
            "storage",
            "studio",
            "vector",
        ):
            component_cfg = deployment.setdefault(component, {})
            component_cfg.setdefault("nodeSelector", {})
            component_cfg["nodeSelector"].update(supabase_node_selector)

    meta = {
        "supabase_namespace": supabase_ns,
        "db_namespace": db_ns,
        "db_host": db_host,
    }
    return overlay, meta


def render(args: argparse.Namespace) -> None:
    cfg_path = Path(args.config)
    if cfg_path.is_dir():
        cfg_path = cfg_path / "prole.cfg"
    if not cfg_path.exists():
        raise SystemExit(f"Config not found: {cfg_path}")

    cfg = _read_cfg(cfg_path)
    overlay, meta = _build_overlay(cfg, args)

    gen_dir = _ensure_dir(Path(args.output_dir))
    values_path = gen_dir / "values.generated.json"
    values_path.write_text(json.dumps(overlay, indent=2))

    # Write Namespace manifest for Supabase
    k8s_dir = _ensure_dir(Path(args.manifests_dir))
    namespace_manifest = {
        "apiVersion": "v1",
        "kind": "Namespace",
        "metadata": {"name": meta["supabase_namespace"]},
    }
    (k8s_dir / "namespace.yaml").write_text(json.dumps(namespace_manifest))

    # Render chart to a single manifest file (Helm accepts JSON values)
    rendered_path = k8s_dir / "supabase-helm.yaml"
    cmd = [
        "helm",
        "template",
        "prole-supabase",
        str(REPO_ROOT / "supabase" / "helm" / "prole-supabase"),
        "-n",
        meta["supabase_namespace"],
        "-f",
        str(values_path),
    ]
    proc = subprocess.run(cmd, capture_output=True, text=True)
    if proc.returncode != 0:
        sys.stderr.write(proc.stderr)
        raise SystemExit(f"Helm template failed (code {proc.returncode})")
    rendered_path.write_text(proc.stdout)

    summary = {
        "values": str(values_path),
        "manifests": str(rendered_path),
        "db_host": meta["db_host"],
        "supabase_namespace": meta["supabase_namespace"],
    }
    (gen_dir / "manifest-summary.json").write_text(json.dumps(summary, indent=2))


if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="Render Supabase Helm chart from prole.cfg")
    parser.add_argument(
        "--config",
        "-c",
        default=os.environ.get("PROLE_CONF", str(REPO_ROOT / "conf")),
        help="Path to prole.cfg or its directory",
    )
    parser.add_argument(
        "--output-dir",
        default=str(REPO_ROOT / "supabase" / "helm" / "generated"),
        help="Directory to write generated values and metadata",
    )
    parser.add_argument(
        "--manifests-dir",
        default=str(REPO_ROOT / "supabase" / "k8s"),
        help="Directory to write rendered Kubernetes manifests",
    )
    args = parser.parse_args()
    render(args)