package cli

import (
	"context"
	"fmt"
	"os"

	"github.com/urfave/cli/v3"

	"git.morlana.online/f.weber/vault-tui/internal/auth"
)

func loginCommand() *cli.Command {
	return &cli.Command{
		Name:      "login",
		Usage:     "authenticate to Vault and save the resulting token",
		ArgsUsage: "[key=value ...]",
		Flags: []cli.Flag{
			&cli.StringFlag{Name: "method", Usage: "auth method name (default: profile's auth.method)"},
			&cli.StringFlag{Name: "mount", Usage: "auth mount path (default: profile's auth.mount, or the method's default)"},
			&cli.BoolFlag{Name: "no-store", Usage: "print the token instead of saving it"},
		},
		Action: func(ctx context.Context, cmd *cli.Command) error {
			a, err := appFrom(ctx)
			if err != nil {
				return err
			}
			m, err := a.Method(cmd.String("method"))
			if err != nil {
				return err
			}
			mount := cmd.String("mount")
			if mount == "" {
				mount = a.Settings.Auth.Mount
			}
			if mount == "" {
				mount = m.DefaultMount()
			}

			cliArgs, err := parseKVArgs(cmd.Args().Slice())
			if err != nil {
				return err
			}
			creds := auth.Prefill(m, auth.PrefillSource{
				CLIArgs:    cliArgs,
				ConfigArgs: a.Settings.Auth.Params,
			})

			if missing := auth.Missing(m, creds); len(missing) > 0 {
				if !IsInteractive() {
					names := make([]string, 0, len(missing))
					for _, f := range missing {
						names = append(names, f.Name)
					}
					return fmt.Errorf("missing required credentials for method %q: %v (set via VAULT_TUI_AUTH_<NAME>, a method-specific env var, key=value args, or run interactively)", m.Name(), names)
				}
				if err := promptMissing(m, creds); err != nil {
					return err
				}
			}
			if err := auth.Validate(m, creds); err != nil {
				return err
			}

			events := make(chan auth.Event, 16)
			go drainEvents(events)
			req := auth.Request{Mount: mount, Namespace: a.Settings.Namespace, Creds: creds, Events: events}

			sec, err := m.Login(ctx, a.Client, req)
			close(events)
			if err != nil {
				return fmt.Errorf("login failed: %w", err)
			}
			result, err := auth.NewResult(sec, a.Settings.Namespace)
			if err != nil {
				return err
			}

			if cmd.Bool("no-store") {
				fmt.Println(result.Token)
				return nil
			}
			if err := a.Store.Store(ctx, result.Token); err != nil {
				return fmt.Errorf("saving token to %s: %w", a.Store.Location(), err)
			}
			fmt.Fprintf(os.Stderr, "Success! Token saved via %s (%s).\n", a.Store.Kind(), a.Store.Location())
			if result.TTL > 0 {
				fmt.Fprintf(os.Stderr, "token ttl: %s  policies: %v\n", result.TTL, result.Policies)
			}
			return nil
		},
	}
}

// drainEvents prints login progress (the OIDC URL, Okta push prompts, ...)
// to stderr as it arrives. Used by every headless command that can trigger
// a multi-step login; the TUI instead pumps these into its own model (see
// internal/ui/app — not yet wired here).
func drainEvents(events <-chan auth.Event) {
	for e := range events {
		switch e.Kind {
		case auth.EventOpenURL:
			fmt.Fprintf(os.Stderr, "\nOpen this URL to continue:\n\n  %s\n\n", e.URL)
		case auth.EventWarning:
			fmt.Fprintf(os.Stderr, "warning: %s\n", e.Message)
		default:
			fmt.Fprintf(os.Stderr, "%s\n", e.Message)
		}
	}
}