package config

import (
	"time"

	"golang.org/x/crypto/ssh"
)

type rawFile struct {
	Server       rawServer        `toml:"server"`
	Portdistrict *rawPortdistrict `toml:"portdistrict"`
	Config       rawConfigSource  `toml:"config"`
	Userbase     *rawUserbase     `toml:"userbase"`
	Invite       rawInvite        `toml:"invite"`
	Session      rawSession       `toml:"session"`
	Audit        rawAudit         `toml:"audit"`
	Google       *rawGoogle       `toml:"google"`
	LDAP         *rawLDAP         `toml:"ldap"`
	Client       []rawClient      `toml:"client"`
	App          []rawApp         `toml:"app"`
}

type rawServer struct {
	Socket        string `toml:"socket"`
	Listen        string `toml:"listen"`
	MetricsListen string `toml:"metrics_listen"`
	DomainIDP     string `toml:"domain_idp"`
	DomainAccount string `toml:"domain_account"`
	DomainAdmin   string `toml:"domain_admin"`
	AdminGroup    string `toml:"admin_group"`
	SiteName      string `toml:"site_name"`
}

type rawPortdistrict struct {
	Listen      string `toml:"listen"`
	PeerTable   string `toml:"peer_table"`
	TableMaxAge string `toml:"table_max_age"`
}

type rawConfigSource struct {
	Source string        `toml:"source"`
	Git    *rawConfigGit `toml:"git"`
}

type rawConfigGit struct {
	Remote         string `toml:"remote"`
	Branch         string `toml:"branch"`
	AllowedSigners string `toml:"allowed_signers"`
	KnownHosts     string `toml:"known_hosts"`
}

type rawUserbase struct {
	Repo                string `toml:"repo"`
	Mirror              string `toml:"mirror"`
	KnownHosts          string `toml:"known_hosts"`
	BreakGlassRecipient string `toml:"break_glass_recipient"`
	ExportSigningKeys   bool   `toml:"export_signing_keys"`
	RestoreOnFirstBoot  bool   `toml:"restore_on_first_boot"`
}

type rawInvite struct {
	TTL           string   `toml:"ttl"`
	DefaultGroups []string `toml:"default_groups"`
}

type rawSession struct {
	TTL string `toml:"ttl"`
}

type rawGoogle struct {
	ClientID  string `toml:"client_id"`
	AllowedHD string `toml:"allowed_hd"`
}

type rawLDAP struct {
	Listen       string `toml:"listen"`
	PrimaryGroup string `toml:"primary_group"`
	BaseDN       string `toml:"base_dn"`
	TLSCert      string `toml:"tls_cert"`
	TLSKey       string `toml:"tls_key"`
}

type rawClient struct {
	ID           string   `toml:"id"`
	RedirectURIs []string `toml:"redirect_uris"`
	Public       bool     `toml:"public"`
}

type rawApp struct {
	Domain     string   `toml:"domain"`
	SessionTTL string   `toml:"session_ttl"`
	Groups     []string `toml:"groups"`
}

const (
	defaultMetricsListen = "127.0.0.1:9464"
	defaultAdminGroup    = "admins"
	defaultPrimaryGroup  = "members"
	defaultInviteTTL     = 168 * time.Hour
	defaultSessionTTL    = 12 * time.Hour
	sourceFile           = "file"
	sourceGit            = "git"
)

var defaultInviteGroups = []string{"members"}

type Config struct {
	Server       Server
	Portdistrict *Portdistrict
	Source       string
	ConfigGit    *ConfigGit
	Userbase     *Userbase
	Invite       Invite
	Session      Session
	Audit        Audit
	Google       *Google
	LDAP         *LDAP
	PrimaryGroup string
	Clients      []Client
	Apps         []App
	Secrets      Secrets
}

type Server struct {
	Socket        string
	Listen        string
	MetricsListen string
	DomainIDP     string
	DomainAccount string
	DomainAdmin   string
	AdminGroup    string
	SiteName      string
}

type Portdistrict struct {
	Listen      string
	PeerTable   string
	TableMaxAge time.Duration
}

type ConfigGit struct {
	Remote         string
	Branch         string
	AllowedSigners string
	KnownHosts     string
	Signers        []ssh.PublicKey
	KnownHostsData []byte
}

type Userbase struct {
	Repo                string
	Mirror              string
	KnownHosts          string
	BreakGlassRecipient string
	ExportSigningKeys   bool
	RestoreOnFirstBoot  bool
}

type Invite struct {
	TTL           time.Duration
	DefaultGroups []string
}

type Session struct {
	TTL time.Duration
}

type Google struct {
	ClientID  string
	AllowedHD string
}

type LDAP struct {
	Listen  string
	BaseDN  string
	TLSCert string
	TLSKey  string
}

type Client struct {
	ID           string
	RedirectURIs []string
	Public       bool
}

type App struct {
	Domain     string
	SessionTTL time.Duration
	Groups     []string
}

func (c *Config) ReferencedGroups() []string {
	seen := map[string]bool{}
	var out []string
	add := func(g string) {
		if g != "" && !seen[g] {
			seen[g] = true
			out = append(out, g)
		}
	}
	add(c.Server.AdminGroup)
	add(c.PrimaryGroup)
	for _, g := range c.Invite.DefaultGroups {
		add(g)
	}
	for _, a := range c.Apps {
		for _, g := range a.Groups {
			add(g)
		}
	}
	return out
}

type Secret struct {
	p *string
}

type Secrets struct {
	SessionMasterKey   Secret
	GoogleClientSecret Secret
	ClientSecrets      map[string]Secret
	AgeIdentity        Secret
	UserbaseSigningKey Secret
	UserbaseDeployKey  Secret
	ConfigDeployKey    Secret
}

func (u *Userbase) SSH() bool {
	return usesSSH(u.Repo, u.Mirror)
}