package gudusoft.gsqlparser.demos.sqlguard;

import com.sun.net.httpserver.HttpExchange;
import com.sun.net.httpserver.HttpHandler;
import com.sun.net.httpserver.HttpServer;

import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.URL;
import java.nio.charset.StandardCharsets;
import java.util.concurrent.ArrayBlockingQueue;
import java.util.concurrent.ThreadPoolExecutor;
import java.util.concurrent.TimeUnit;

public class SqlGuardHttpServer {
    public static final int MAX_BODY_BYTES = 1572864;
    private final String host;
    private final int port;
    private final SqlGuardService service;
    private HttpServer server;

    public SqlGuardHttpServer(String host, int port, SqlGuardService service) {
        this.host = host == null ? "127.0.0.1" : host;
        this.port = port;
        this.service = service;
    }

    public void start() throws IOException {
        InetAddress bindAddress = InetAddress.getByName(host);
        if (!bindAddress.isLoopbackAddress()) {
            throw new IOException("SQL Guard worker refuses non-loopback bind address: " + host);
        }
        server = HttpServer.create(new InetSocketAddress(bindAddress, port), 16);
        server.createContext("/healthz", new Health());
        server.createContext("/check", new Check());
        server.setExecutor(new ThreadPoolExecutor(
                4, 4, 0L, TimeUnit.MILLISECONDS, new ArrayBlockingQueue<Runnable>(32)));
        server.start();
    }

    public void stop(int delay) {
        if (server != null) server.stop(delay);
    }

    public InetSocketAddress address() {
        return server.getAddress();
    }

    class Health implements HttpHandler {
        public void handle(HttpExchange x) throws IOException {
            if (!"GET".equals(x.getRequestMethod())) {
                send(x, 405, "{\"ok\":false}");
                return;
            }
            send(x, 200, "{\"ok\":true,\"service\":\"sql-guard-worker\"}");
        }
    }

    class Check implements HttpHandler {
        public void handle(HttpExchange x) throws IOException {
            if (!"POST".equals(x.getRequestMethod())) {
                send(x, 405, "{\"ok\":false}");
                return;
            }
            String body;
            try {
                body = readLimited(x.getRequestBody(), MAX_BODY_BYTES);
            } catch (IOException e) {
                send(x, 413, SqlGuardResponse.error(null, "REQUEST_TOO_LARGE", "Request body too large.").toJson());
                return;
            }
            SqlGuardResponse r;
            try {
                r = service.check(SqlGuardRequest.fromJson(body));
            } catch (Exception e) {
                r = SqlGuardResponse.error(null, "INVALID_REQUEST", "Invalid JSON request.");
            }
            send(x, r.ok ? 200 : 400, r.toJson());
        }
    }

    /**
     * Reads at most {@code max} bytes from {@code in}, refusing input that exceeds the limit before it is buffered.
     *
     * <p>PUBLIC ON PURPOSE: every shipped jar is ProGuard-obfuscated under a
     * compatibility-first policy that preserves public and protected members
     * and renames everything else. A package-private method is therefore
     * unreachable from the released jar, which is what the test suite runs
     * against in the nightly obfuscated-jar gate. Keeping this public is what
     * lets that gate execute the real shipped bytes.</p>
     *
     * @since 4.2.6
     */
    public static String readLimited(InputStream in, int max) throws IOException {
        ByteArrayOutputStream out = new ByteArrayOutputStream();
        byte[] buf = new byte[8192];
        int total = 0;
        int n;
        while ((n = in.read(buf)) != -1) {
            if (total + n > max) {
                throw new IOException("too large");
            }
            total += n;
            out.write(buf, 0, n);
        }
        return new String(out.toByteArray(), StandardCharsets.UTF_8);
    }

    static void send(HttpExchange x, int status, String body) throws IOException {
        byte[] b = body.getBytes(StandardCharsets.UTF_8);
        x.getResponseHeaders().set("Content-Type", "application/json; charset=utf-8");
        x.sendResponseHeaders(status, b.length);
        OutputStream os = x.getResponseBody();
        try {
            os.write(b);
        } finally {
            os.close();
        }
    }

    public static String httpGet(String url) throws IOException {
        HttpURLConnection c = (HttpURLConnection) new URL(url).openConnection();
        c.setRequestMethod("GET");
        return readAll(c);
    }

    public static String httpPost(String url, String body) throws IOException {
        HttpURLConnection c = (HttpURLConnection) new URL(url).openConnection();
        c.setRequestMethod("POST");
        c.setDoOutput(true);
        c.setRequestProperty("Content-Type", "application/json");
        OutputStream os = c.getOutputStream();
        try {
            os.write(body.getBytes(StandardCharsets.UTF_8));
        } finally {
            os.close();
        }
        return readAll(c);
    }

    private static String readAll(HttpURLConnection c) throws IOException {
        InputStream in = c.getResponseCode() >= 400 ? c.getErrorStream() : c.getInputStream();
        if (in == null) {
            return "";
        }
        try {
            ByteArrayOutputStream out = new ByteArrayOutputStream();
            byte[] buf = new byte[4096];
            int n;
            while ((n = in.read(buf)) != -1) out.write(buf, 0, n);
            return new String(out.toByteArray(), StandardCharsets.UTF_8);
        } finally {
            in.close();
        }
    }
}