package PVE::CLI::pvenode;

use strict;
use warnings;

use PVE::API2::ACME;
use PVE::API2::ACMEAccount;
use PVE::API2::ACMEPlugin;
use PVE::API2::Certificates;
use PVE::API2::NodeConfig;
use PVE::API2::Nodes;
use PVE::API2::Tasks;

use PVE::ACME::Challenge;
use PVE::CertHelpers;
use PVE::Certificate;
use PVE::Exception qw(raise_param_exc raise);
use PVE::JSONSchema qw(get_standard_option);
use PVE::NodeConfig;
use PVE::RPCEnvironment;
use PVE::CLIFormatter;
use PVE::RESTHandler;
use PVE::CLIHandler;

use Term::ReadLine;

use base qw(PVE::CLIHandler);

my $nodename = PVE::INotify::nodename();

sub setup_environment {
    PVE::RPCEnvironment->setup_default_cli_env();
}

my $upid_exit = sub {
    my $upid = shift;
    my $status = PVE::Tools::upid_read_status($upid);
    print "Task $status\n";
    exit(PVE::Tools::upid_status_is_error($status) ? -1 : 0);
};

sub param_mapping {
    my ($name) = @_;

    my $load_file_and_encode = sub {
        my ($filename) = @_;

        return PVE::ACME::Challenge->encode_value(
            'string',
            'data',
            PVE::Tools::file_get_contents($filename),
        );
    };

    my $mapping = {
        'upload_custom_cert' => [
            'certificates', 'key',
        ],
        'add_plugin' => [
            [
                'data',
                $load_file_and_encode,
                "File with one key-value pair per line, will be base64url encode for storage in plugin config.",
                0,
            ],
        ],
        'update_plugin' => [
            [
                'data',
                $load_file_and_encode,
                "File with one key-value pair per line, will be base64url encode for storage in plugin config.",
                0,
            ],
        ],
    };

    return $mapping->{$name};
}

__PACKAGE__->register_method({
    name => 'acme_register',
    path => 'acme_register',
    method => 'POST',
    description => "Register a new ACME account with a compatible CA.",
    parameters => {
        additionalProperties => 0,
        properties => {
            name => get_standard_option('pve-acme-account-name'),
            contact => get_standard_option('pve-acme-account-contact'),
            directory => get_standard_option('pve-acme-directory-url', {
                    optional => 1,
            }),
        },
    },
    returns => { type => 'null' },
    code => sub {
        my ($param) = @_;

        my $custom_directory = 0;
        if (!$param->{directory}) {
            my $directories = PVE::API2::ACMEAccount->get_directories({});
            print "Directory endpoints:\n";
            my $i = 0;
            while ($i < @$directories) {
                print $i, ") ", $directories->[$i]->{name}, " (", $directories->[$i]->{url},
                    ")\n";
                $i++;
            }
            print $i, ") Custom\n";

            my $term = Term::ReadLine->new('pvenode');
            my $get_dir_selection = sub {
                my $selection = $term->readline("Enter selection: ");
                if ($selection =~ /^(\d+)$/) {
                    $selection = $1;
                    if ($selection == $i) {
                        $param->{directory} = $term->readline("Enter custom URL: ");
                        $custom_directory = 1;
                        return;
                    } elsif ($selection < $i && $selection >= 0) {
                        $param->{directory} = $directories->[$selection]->{url};
                        return;
                    }
                }
                print "Invalid selection.\n";
            };

            my $attempts = 0;
            while (!$param->{directory}) {
                die "Aborting.\n" if $attempts > 3;
                $get_dir_selection->();
                $attempts++;
            }
        }
        print "\nAttempting to fetch Terms of Service from '$param->{directory}'..\n";
        my $meta = PVE::API2::ACMEAccount->get_meta({ directory => $param->{directory} });
        if ($meta->{termsOfService}) {
            my $tos = $meta->{termsOfService};
            print "Terms of Service: $tos\n";
            my $term = Term::ReadLine->new('pvenode');
            my $agreed = $term->readline('Do you agree to the above terms? [y|N]: ');
            die "Cannot continue without agreeing to ToS, aborting.\n"
                if ($agreed !~ /^y$/i);

            $param->{tos_url} = $tos;
        } else {
            print "No Terms of Service found, proceeding.\n";
        }

        my $eab_enabled = $meta->{externalAccountRequired};
        if (!$eab_enabled && $custom_directory) {
            my $term = Term::ReadLine->new('pvenode');
            my $agreed =
                $term->readline('Do you want to use external account binding? [y|N]: ');
            $eab_enabled = ($agreed =~ /^y$/i);
        } elsif ($eab_enabled) {
            print "The CA requires external account binding.\n";
        }
        if ($eab_enabled) {
            print "You should have received a key id and a key from your CA.\n";
            my $term = Term::ReadLine->new('pvenode');
            my $eab_kid = $term->readline('Enter EAB key id: ');
            my $eab_hmac_key = $term->readline('Enter EAB key: ');

            $param->{'eab-kid'} = $eab_kid;
            $param->{'eab-hmac-key'} = $eab_hmac_key;
        }

        print "\nAttempting to register account with '$param->{directory}'..\n";

        $upid_exit->(PVE::API2::ACMEAccount->register_account($param));
    },
});

my $print_cert_info = sub {
    my ($schema, $cert, $options) = @_;

    my $order = [
        qw(filename fingerprint subject issuer notbefore notafter public-key-type public-key-bits san)
    ];
    PVE::CLIFormatter::print_api_result(
        $cert,
        $schema,
        $order,
        { %$options, noheader => 1, sort_key => 0 },
    );
};

our $cmddef = {
    config => {
        get => [
            'PVE::API2::NodeConfig',
            'get_config',
            [],
            { node => $nodename },
            sub {
                my ($res) = @_;
                print PVE::NodeConfig::write_node_config($res);
            },
        ],
        set => ['PVE::API2::NodeConfig', 'set_options', [], { node => $nodename }],
    },

    startall => ['PVE::API2::Nodes::Nodeinfo', 'startall', [], { node => $nodename }],
    stopall => ['PVE::API2::Nodes::Nodeinfo', 'stopall', [], { node => $nodename }],
    migrateall =>
        ['PVE::API2::Nodes::Nodeinfo', 'migrateall', ['target'], { node => $nodename }],

    cert => {
        info => [
            'PVE::API2::Certificates',
            'info',
            [],
            { node => $nodename },
            sub {
                my ($res, $schema, $options) = @_;

                if (!$options->{'output-format'} || $options->{'output-format'} eq 'text') {
                    for my $cert (sort { $a->{filename} cmp $b->{filename} } @$res) {
                        $print_cert_info->($schema->{items}, $cert, $options);
                    }
                } else {
                    PVE::CLIFormatter::print_api_result($res, $schema, undef, $options);
                }

            },
            $PVE::RESTHandler::standard_output_options,
        ],
        set => [
            'PVE::API2::Certificates',
            'upload_custom_cert',
            ['certificates', 'key'],
            { node => $nodename },
            sub {
                my ($res, $schema, $options) = @_;
                $print_cert_info->($schema, $res, $options);
            },
            $PVE::RESTHandler::standard_output_options,
        ],
        delete =>
            ['PVE::API2::Certificates', 'remove_custom_cert', ['restart'], { node => $nodename }],
    },

    task => {
        list => [
            'PVE::API2::Tasks',
            'node_tasks',
            [],
            { node => $nodename },
            sub {
                my ($data, $schema, $options) = @_;
                foreach my $task (@$data) {
                    if (!defined($task->{status})) {
                        $task->{status} = 'UNKNOWN';
                        # RUNNING is set by the API call and needs to be checked explicitly
                    } elsif (
                        PVE::Tools::upid_status_is_error($task->{status})
                        && $task->{status} ne 'RUNNING'
                    ) {
                        $task->{status} = 'ERROR';
                    }
                }
                PVE::CLIFormatter::print_api_result(
                    $data,
                    $schema,
                    ['upid', 'type', 'id', 'user', 'starttime', 'endtime', 'status'],
                    $options,
                );
            },
            $PVE::RESTHandler::standard_output_options,
        ],
        status => [
            'PVE::API2::Tasks',
            'read_task_status',
            ['upid'],
            { node => $nodename },
            sub {
                my ($data, $schema, $options) = @_;
                PVE::CLIFormatter::print_api_result($data, $schema, undef, $options);
            },
            $PVE::RESTHandler::standard_output_options,
        ],
        # set limit to 1000000, so we see the whole log, not only the first 50 lines by default
        log => [
            'PVE::API2::Tasks',
            'read_task_log',
            ['upid'],
            { node => $nodename, limit => 1000000 },
            sub {
                my ($data, $resultprops) = @_;
                foreach my $line (@$data) {
                    print $line->{t} . "\n";
                }
            },
        ],
    },

    acme => {
        account => {
            list => [
                'PVE::API2::ACMEAccount',
                'account_index',
                [],
                {},
                sub {
                    my ($res) = @_;
                    for my $acc (@$res) {
                        print "$acc->{name}\n";
                    }
                },
            ],
            register => [__PACKAGE__, 'acme_register', ['name', 'contact'], {}, $upid_exit],
            deactivate =>
                ['PVE::API2::ACMEAccount', 'deactivate_account', ['name'], {}, $upid_exit],
            info => [
                'PVE::API2::ACMEAccount',
                'get_account',
                ['name'],
                {},
                sub {
                    my ($data, $schema, $options) = @_;
                    PVE::CLIFormatter::print_api_result($data, $schema, undef, $options);
                },
                $PVE::RESTHandler::standard_output_options,
            ],
            update => ['PVE::API2::ACMEAccount', 'update_account', ['name'], {}, $upid_exit],
        },
        cert => {
            order =>
                ['PVE::API2::ACME', 'new_certificate', [], { node => $nodename }, $upid_exit],
            renew =>
                ['PVE::API2::ACME', 'renew_certificate', [], { node => $nodename }, $upid_exit],
            revoke =>
                ['PVE::API2::ACME', 'revoke_certificate', [], { node => $nodename }, $upid_exit],
        },
        plugin => {
            list => [
                'PVE::API2::ACMEPlugin',
                'index',
                [],
                {},
                sub {
                    my ($data, $schema, $options) = @_;
                    PVE::CLIFormatter::print_api_result($data, $schema, undef, $options);
                },
                $PVE::RESTHandler::standard_output_options,
            ],
            config => [
                'PVE::API2::ACMEPlugin',
                'get_plugin_config',
                ['id'],
                {},
                sub {
                    my ($data, $schema, $options) = @_;
                    PVE::CLIFormatter::print_api_result($data, $schema, undef, $options);
                },
                $PVE::RESTHandler::standard_output_options,
            ],
            add => ['PVE::API2::ACMEPlugin', 'add_plugin', ['type', 'id']],
            set => ['PVE::API2::ACMEPlugin', 'update_plugin', ['id']],
            remove => ['PVE::API2::ACMEPlugin', 'delete_plugin', ['id']],
        },

    },

    wakeonlan => [
        'PVE::API2::Nodes::Nodeinfo',
        'wakeonlan',
        ['node'],
        {},
        sub {
            my ($mac_addr) = @_;

            print "Wake on LAN packet send for '$mac_addr'\n";
        },
    ],

};

1;