package frp

import (
	"context"
	"fmt"
	"strings"

	"github.com/fonu/fonu/internal/frp/agentbin"
)

// AgentInstaller 负责把内嵌的 fonu-agent 通过 SSH 装到 VPS 上，并收集安装结果。
type AgentInstaller struct {
	SSH SSHInstaller
}

// Probe 返回 VPS 环境摘要：架构、nginx 是否安装、agent 是否已装、systemd 可用性。
func (i AgentInstaller) Probe(ctx context.Context) (map[string]any, error) {
	client, err := i.SSH.client(ctx)
	if err != nil {
		return nil, fmt.Errorf("SSH 连接失败: %w", err)
	}
	defer client.Close()
	out := func(cmd string) string {
		v, _ := runSSHSession(client, cmd)
		return strings.TrimSpace(v)
	}
	arch := out("uname -m")
	return map[string]any{
		"arch":          arch,
		"nginx_conf":    out(`conf=$(nginx -V 2>&1 | grep -o '\-\-conf-path=[^ ]*' | head -1 | cut -d= -f2-); [ -z "$conf" ] && conf=/etc/nginx/nginx.conf; grep '^[[:space:]]*include' "$conf" 2>/dev/null | grep -m1 -E 'conf\.d|sites-enabled|vhost/nginx' || ls -d /etc/nginx/conf.d 2>/dev/null`),
		"agent_exist":   out("test -x /usr/local/bin/fonu-agent && echo yes || echo no") == "yes",
		"agent_running": out("systemctl is-active fonu-agent 2>/dev/null || true"),
		"agent_version": out("/usr/local/bin/fonu-agent -version 2>/dev/null || echo 未知"),
		// Token 只回「是否已配置 + 末 4 位」：明文不经过 HTTP 返回前端（库里同一字段也是掩码）
		"agent_token_configured": out("test -s /etc/fonu-agent/agent.env && grep -q '^FONU_AGENT_TOKEN=' /etc/fonu-agent/agent.env && echo yes || echo no") == "yes",
		"agent_token_hint":       out("sed -n 's/^FONU_AGENT_TOKEN=//p' /etc/fonu-agent/agent.env 2>/dev/null | tr -d '\\n' | tail -c 4"),
		"frps_alive":             out("systemctl is-active frps 2>/dev/null; pgrep -x frps >/dev/null && echo active || true"),
		"frps_version":           out("/usr/local/bin/frps --version 2>/dev/null || echo 未安装"),
		"frps_config":            out("test -f /etc/frp/frps.toml && echo /etc/frp/frps.toml || echo 配置文件不存在"),
		"frps_unit":              out("systemctl status frps --no-pager 2>/dev/null | head -3 || echo 无 systemd 单位"),
		"frps_log":               out("journalctl -u frps -n 5 --no-pager 2>/dev/null || true"),
		"port7000":               out("ss -tlnp 2>/dev/null | grep ':7000 ' | head -1"),
		"port80":                 out("ss -tlnp 2>/dev/null | grep ':80 ' | head -1"),
		"port443":                out("ss -tlnp 2>/dev/null | grep ':443 ' | head -1"),
	}, nil
}

// Install 上传内嵌二进制并执行安装脚本；重复执行等于覆盖升级。返回 agent Token。
func (i AgentInstaller) Install(ctx context.Context) (string, error) {
	arch, err := i.SSH.Run(ctx, "uname -m")
	if err != nil {
		return "", fmt.Errorf("探测架构失败: %w", err)
	}
	binary, ok := agentbin.BinaryForArch(strings.TrimSpace(arch))
	if !ok {
		return "", fmt.Errorf("不支持的 VPS 架构: %s", strings.TrimSpace(arch))
	}
	// 开发环境（go run / 非 Docker 构建）里内嵌的是占位文件；提前报错而不是让 VPS 上 systemd 反复 Exec format error
	if !isELFBinary(binary) {
		return "", fmt.Errorf("内嵌 agent 二进制无效（开发构建占位文件）。请用 Docker 构建或先执行构建脚本生成真实 agent：go build -o internal/frp/agentbin/fonu-agent-linux-amd64 ./cmd/fonu-agent（GOOS=linux GOARCH=amd64）")
	}
	script, err := agentInstallScript()
	if err != nil {
		return "", err
	}
	output, err := i.SSH.Install(ctx, binary, script)
	if err != nil {
		return "", err
	}
	token := extractToken(output)
	if token == "" {
		return "", fmt.Errorf("安装完成但未取回 Token: %s", strings.TrimSpace(output))
	}
	return token, nil
}

// Uninstall 停止并移除 agent 服务；--keep-data 保留路由与证书。
func (i AgentInstaller) Uninstall(ctx context.Context, keepData bool) (string, error) {
	command := "/usr/local/bin/fonu-agent-uninstall"
	if keepData {
		command += " --keep-data"
	}
	out, err := i.SSH.Run(ctx, fmt.Sprintf("if [ -x %s ]; then %s; else echo 'agent 未安装'; fi", "'"+command+"'", command))
	return strings.TrimSpace(out), err
}

// RestorePreviousConfig 在安全迁移验证失败时恢复安装前的 agent.env，并重启旧监听配置。
func (i AgentInstaller) RestorePreviousConfig(ctx context.Context) error {
	command := `if [ -f /etc/fonu-agent/agent.env.previous ]; then cp /etc/fonu-agent/agent.env.previous /etc/fonu-agent/agent.env && chmod 600 /etc/fonu-agent/agent.env && systemctl restart fonu-agent; fi`
	_, err := i.SSH.Run(ctx, command)
	return err
}

// Diagnose agent 失联时走 SSH 急救：进程、端口、服务日志尾部。
func (i AgentInstaller) Diagnose(ctx context.Context) (string, error) {
	return i.SSH.Run(ctx, "systemctl status fonu-agent --no-pager -l 2>/dev/null | head -20; echo '---'; journalctl -u fonu-agent -n 15 --no-pager 2>/dev/null; echo '---'; ss -tlnp 2>/dev/null | grep ':7700 ' || echo '7700 not listening'")
}

func extractToken(output string) string {
	for _, line := range strings.Split(output, "\n") {
		if token, found := strings.CutPrefix(strings.TrimSpace(line), "Token: "); found {
			return strings.TrimSpace(token)
		}
	}
	return ""
}

func agentInstallScript() ([]byte, error) {
	// 与 scripts/agent-install.sh 同一份逻辑内嵌：支持传入二进制路径参数，卸载子命令。
	return []byte(`#!/usr/bin/env bash
set -eu
if [ "$(id -u)" -ne 0 ]; then echo "请使用 root 或 sudo 运行" >&2; exit 1; fi
AGENT_BINARY=${1:-/tmp/fonu-agent}
PREFIX=/usr/local/bin/fonu-agent
CONF_DIR=/etc/fonu-agent
CONF_FILE="$CONF_DIR/agent.env"
UNIT=/etc/systemd/system/fonu-agent.service

if [ "${1:-}" = "--uninstall" ]; then
  systemctl stop fonu-agent 2>/dev/null || true
  systemctl disable fonu-agent 2>/dev/null || true
  rm -f "$UNIT" "$PREFIX" /usr/local/bin/fonu-agent-uninstall
  systemctl daemon-reload
  if [ "${2:-}" != "--keep-data" ]; then rm -rf /var/lib/fonu-agent; fi
  echo "fonu-agent 已卸载"
  exit 0
fi

mkdir -p "$CONF_DIR" /var/lib/fonu-agent/certs
# 先停服务，再原子替换；安装后必须确认目标存在、可执行且能输出版本
systemctl stop fonu-agent 2>/dev/null || true
TMP_PREFIX="${PREFIX}.new"
install -m 0755 "$AGENT_BINARY" "$TMP_PREFIX"
if [ ! -x "$TMP_PREFIX" ]; then
  echo "agent 二进制安装失败：$TMP_PREFIX 不存在或不可执行" >&2
  exit 1
fi
AGENT_VERSION=$($TMP_PREFIX -version 2>/dev/null) || {
  echo "agent 二进制无法执行：$TMP_PREFIX" >&2
  rm -f "$TMP_PREFIX"
  exit 1
}
mv -f "$TMP_PREFIX" "$PREFIX"
if [ ! -x "$PREFIX" ]; then
  echo "agent 原子替换失败：$PREFIX 不存在或不可执行" >&2
  exit 1
fi
printf 'agent version: %s\n' "$AGENT_VERSION"
if [ ! -f "$CONF_FILE" ]; then
  umask 077
  # 用 /dev/urandom 生成 64 位 hex token，不依赖 openssl（缺失时会静默写入空 token，导致 Fonu 无法认证 agent）
  printf 'FONU_AGENT_TOKEN=%s\n' "$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')" > "$CONF_FILE"
fi
cp "$CONF_FILE" "$CONF_FILE.previous" 2>/dev/null || true
touch "$CONF_FILE"
sed -i '/^FONU_AGENT_LISTEN=/d; /^FONU_AGENT_ALLOW_REMOTE=/d' "$CONF_FILE"
printf 'FONU_AGENT_LISTEN=127.0.0.1:7700\nFONU_AGENT_ALLOW_REMOTE=0\n' >> "$CONF_FILE"
cat > "$UNIT" <<'UNIT'
[Unit]
Description=Fonu FRPS management agent
After=network-online.target nginx.service
Wants=network-online.target

[Service]
Type=simple
EnvironmentFile=/etc/fonu-agent/agent.env
ExecStart=/usr/local/bin/fonu-agent
Restart=on-failure
RestartSec=3

[Install]
WantedBy=multi-user.target
UNIT
systemctl daemon-reload
systemctl restart fonu-agent
systemctl enable fonu-agent
cp "$0" /usr/local/bin/fonu-agent-uninstall
echo "fonu-agent installed"
echo "Token: $(sed -n 's/^FONU_AGENT_TOKEN=//p' "$CONF_FILE")"
`), nil
}

// isELFBinary 判断内容是否为 Linux ELF 可执行（魔数 0x7F 'ELF'），用于拦截开发构建的占位文件。
func isELFBinary(data []byte) bool {
	return len(data) > 4 && data[0] == 0x7F && data[1] == 'E' && data[2] == 'L' && data[3] == 'F'
}