package grpcserver

import (
	"context"
	"errors"

	"google.golang.org/grpc/codes"
	"google.golang.org/grpc/status"

	pb "git.wntrmute.dev/mc/metacrypt/gen/metacrypt/v2"
	"git.wntrmute.dev/mc/metacrypt/internal/barrier"
	"git.wntrmute.dev/mc/metacrypt/internal/seal"
)

type barrierServer struct {
	pb.UnimplementedBarrierServiceServer
	s *GRPCServer
}

func (bs *barrierServer) ListKeys(ctx context.Context, _ *pb.ListKeysRequest) (*pb.ListKeysResponse, error) {
	keys, err := bs.s.sealMgr.Barrier().ListKeys(ctx)
	if err != nil {
		bs.s.logger.Error("grpc: list barrier keys", "error", err)
		return nil, status.Error(codes.Internal, "failed to list keys")
	}

	resp := &pb.ListKeysResponse{}
	for _, k := range keys {
		resp.Keys = append(resp.Keys, &pb.BarrierKeyInfo{
			KeyId:     k.KeyID,
			Version:   int32(k.Version),
			CreatedAt: k.CreatedAt,
			RotatedAt: k.RotatedAt,
		})
	}
	return resp, nil
}

func (bs *barrierServer) RotateMEK(ctx context.Context, req *pb.RotateMEKRequest) (*pb.RotateMEKResponse, error) {
	if req.Password == "" {
		return nil, status.Error(codes.InvalidArgument, "password is required")
	}

	if err := bs.s.sealMgr.RotateMEK(ctx, []byte(req.Password)); err != nil {
		if errors.Is(err, seal.ErrInvalidPassword) {
			return nil, status.Error(codes.Unauthenticated, "invalid password")
		}
		if errors.Is(err, seal.ErrSealed) {
			return nil, status.Error(codes.FailedPrecondition, "sealed")
		}
		bs.s.logger.Error("grpc: rotate MEK", "error", err)
		return nil, status.Error(codes.Internal, "rotation failed")
	}

	bs.s.logger.Info("audit: MEK rotated")
	return &pb.RotateMEKResponse{Ok: true}, nil
}

func (bs *barrierServer) RotateKey(ctx context.Context, req *pb.RotateKeyRequest) (*pb.RotateKeyResponse, error) {
	if req.KeyId == "" {
		return nil, status.Error(codes.InvalidArgument, "key_id is required")
	}

	if err := bs.s.sealMgr.Barrier().RotateKey(ctx, req.KeyId); err != nil {
		if errors.Is(err, barrier.ErrKeyNotFound) {
			return nil, status.Error(codes.NotFound, "key not found")
		}
		bs.s.logger.Error("grpc: rotate key", "key_id", req.KeyId, "error", err)
		return nil, status.Error(codes.Internal, "rotation failed")
	}

	bs.s.logger.Info("audit: DEK rotated", "key_id", req.KeyId)
	return &pb.RotateKeyResponse{Ok: true}, nil
}

func (bs *barrierServer) Migrate(ctx context.Context, _ *pb.MigrateBarrierRequest) (*pb.MigrateBarrierResponse, error) {
	migrated, err := bs.s.sealMgr.Barrier().MigrateToV2(ctx)
	if err != nil {
		bs.s.logger.Error("grpc: barrier migration", "error", err)
		return nil, status.Error(codes.Internal, "migration failed")
	}

	bs.s.logger.Info("audit: barrier migrated to v2", "entries_migrated", migrated)
	return &pb.MigrateBarrierResponse{Migrated: int32(migrated)}, nil
}