//! Internal Certificate Authority for Linux Patch Manager.
//!
//! Issues and renews mTLS client certificates for agent communication.
//! Uses rcgen (ECDSA P-256) for all certificate generation.
//! CA key and certificate are stored on disk under `base_dir`
//! (default: /etc/patch-manager/ca/).
//! Certificate metadata is persisted in the `certificates` PostgreSQL table.

use std::path::{Path, PathBuf};

use anyhow::{Context, Result};
use chrono::{DateTime, Duration as ChronoDuration, Utc};
use rand::RngCore;
use rcgen::{
    BasicConstraints, Certificate, CertificateParams, DistinguishedName, DnType,
    ExtendedKeyUsagePurpose, Ia5String, IsCa, KeyPair, KeyUsagePurpose, SanType,
    SerialNumber, PKCS_ECDSA_P256_SHA256,
};
use sqlx::{PgPool, Row};
use time::{Duration as TimeDuration, OffsetDateTime};
use uuid::Uuid;

// ---------------------------------------------------------------------------
// Public types
// ---------------------------------------------------------------------------

/// Returned by [`CertAuthority::issue_client_cert`] and [`CertAuthority::renew_cert`].
///
/// The private key is intentionally **not** stored in the database.
#[derive(Debug, Clone)]
pub struct IssuedCert {
    /// PEM-encoded public certificate.
    pub cert_pem: String,
    /// PEM-encoded private key (PKCS#8).
    pub key_pem: String,
    /// Hex-encoded 16-byte random serial number.
    pub serial_number: String,
    /// Certificate expiry timestamp (UTC).
    pub expires_at: DateTime<Utc>,
}

// ---------------------------------------------------------------------------
// CertAuthority
// ---------------------------------------------------------------------------

/// Thread-safe, cloneable handle to the internal certificate authority.
///
/// CA certificate and key are held in memory as PEM strings; rcgen objects
/// are reconstructed on demand so this struct is unconditionally `Send + Sync`.
#[derive(Debug, Clone)]
pub struct CertAuthority {
    #[allow(dead_code)]
    base_dir: PathBuf,
    /// PEM-encoded CA certificate (public cert only).
    ca_cert_pem: String,
    /// PEM-encoded CA private key (PKCS#8).
    ca_key_pem: String,
}

// ---------------------------------------------------------------------------
// Private helpers
// ---------------------------------------------------------------------------

/// Generate a 16-byte cryptographically-random serial number.
/// Returns `(rcgen::SerialNumber, hex_encoded_string)`.
fn make_serial() -> (SerialNumber, String) {
    let mut bytes = [0u8; 16];
    rand::rngs::OsRng.fill_bytes(&mut bytes);
    let hex_serial = hex::encode(bytes);
    let serial = SerialNumber::from_slice(&bytes);
    (serial, hex_serial)
}

/// `OffsetDateTime::now_utc()` offset forward by `days` (for rcgen params).
fn odt_offset_days(days: i64) -> OffsetDateTime {
    OffsetDateTime::now_utc() + TimeDuration::days(days)
}

/// `chrono::Utc::now()` offset forward by `days` (for DB / return values).
fn chrono_offset_days(days: i64) -> DateTime<Utc> {
    Utc::now() + ChronoDuration::days(days)
}

/// Build a `CertificateParams` with common fields pre-filled.
/// Caller still needs to set `is_ca`, `key_usages`, `extended_key_usages`, and `subject_alt_names`.
fn base_params(
    cn: &str,
    validity_days: i64,
) -> Result<(CertificateParams, String, DateTime<Utc>)> {
    let (serial, serial_hex) = make_serial();
    let expires_at = chrono_offset_days(validity_days);

    let mut params = CertificateParams::default();
    params.not_before = OffsetDateTime::now_utc();
    params.not_after = odt_offset_days(validity_days);
    params.serial_number = Some(serial);

    let mut dn = DistinguishedName::new();
    dn.push(DnType::CommonName, cn);
    params.distinguished_name = dn;

    Ok((params, serial_hex, expires_at))
}

/// Write `contents` to `path` and set Unix permissions to `0600`.
async fn write_protected(path: &Path, contents: &str) -> Result<()> {
    use std::os::unix::fs::PermissionsExt;
    tokio::fs::write(path, contents).await?;
    let perms = std::fs::Permissions::from_mode(0o600);
    tokio::fs::set_permissions(path, perms).await?;
    Ok(())
}

// ---------------------------------------------------------------------------
// impl CertAuthority
// ---------------------------------------------------------------------------

impl CertAuthority {
    // -----------------------------------------------------------------------
    // Construction
    // -----------------------------------------------------------------------

    /// Load an existing CA from disk, or generate a brand-new one if absent.
    ///
    /// Files managed:
    /// * `{base_dir}/ca.key`  — PKCS#8 PEM private key (mode `0600`)
    /// * `{base_dir}/ca.crt`  — PEM certificate         (mode `0600`)
    ///
    /// On first generation the CA row is inserted into `certificates`
    /// with `host_id = NULL` (marks it as the root CA record).
    pub async fn init(base_dir: &Path, db: &PgPool) -> Result<Self> {
        let key_path = base_dir.join("ca.key");
        let crt_path = base_dir.join("ca.crt");

        // ── Load existing CA ──────────────────────────────────────────────
        if key_path.exists() && crt_path.exists() {
            tracing::info!(path = %base_dir.display(), "Loading existing root CA from disk");

            let ca_key_pem = tokio::fs::read_to_string(&key_path)
                .await
                .context("read ca.key")?;
            let ca_cert_pem = tokio::fs::read_to_string(&crt_path)
                .await
                .context("read ca.crt")?;

            // Validate that both PEMs parse without error.
            KeyPair::from_pem(&ca_key_pem)
                .context("parse CA private-key PEM")?;
            CertificateParams::from_ca_cert_pem(&ca_cert_pem)
                .context("parse CA certificate PEM")?;

            tracing::info!("Root CA loaded successfully");
            return Ok(Self {
                base_dir: base_dir.to_owned(),
                ca_cert_pem,
                ca_key_pem,
            });
        }

        // ── Generate new CA ───────────────────────────────────────────────
        tracing::info!(
            path = %base_dir.display(),
            "Generating new root CA (ECDSA P-256, 10-year validity)"
        );
        tokio::fs::create_dir_all(base_dir)
            .await
            .context("create CA directory")?;

        let ca_key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256)
            .context("generate CA key pair")?;

        let (serial, serial_hex) = make_serial();
        let expires_at = chrono_offset_days(365 * 10);

        let mut params = CertificateParams::default();
        params.not_before = OffsetDateTime::now_utc();
        params.not_after = odt_offset_days(365 * 10);
        params.serial_number = Some(serial);
        params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
        params.key_usages = vec![
            KeyUsagePurpose::KeyCertSign,
            KeyUsagePurpose::CrlSign,
        ];

        let mut dn = DistinguishedName::new();
        dn.push(DnType::CommonName, "Patch Manager Root CA");
        dn.push(DnType::OrganizationName, "Patch Manager");
        params.distinguished_name = dn;

        let ca_cert_obj = params.self_signed(&ca_key)
            .context("self-sign CA certificate")?;
        let ca_cert_pem = ca_cert_obj.pem();
        let ca_key_pem  = ca_key.serialize_pem();

        write_protected(&key_path, &ca_key_pem)
            .await
            .context("write ca.key")?;
        write_protected(&crt_path, &ca_cert_pem)
            .await
            .context("write ca.crt")?;

        tracing::info!(
            serial = %serial_hex,
            expires_at = %expires_at,
            "Root CA generated and written to disk"
        );

        // Persist CA cert metadata (host_id = NULL marks the root CA row).
        sqlx::query(
            "INSERT INTO certificates \
             (host_id, serial_number, common_name, status, expires_at, cert_pem) \
             VALUES (NULL, $1, 'Patch Manager Root CA', 'active'::cert_status, $2, $3)",
        )
        .bind(&serial_hex)
        .bind(expires_at)
        .bind(&ca_cert_pem)
        .execute(db)
        .await
        .context("insert root CA cert into database")?;

        tracing::info!("Root CA certificate recorded in database");

        Ok(Self {
            base_dir: base_dir.to_owned(),
            ca_cert_pem,
            ca_key_pem,
        })
    }

    // -----------------------------------------------------------------------
    // Public accessors
    // -----------------------------------------------------------------------

    /// Return the PEM-encoded root CA certificate (public cert only).
    pub fn root_cert_pem(&self) -> &str {
        &self.ca_cert_pem
    }

    // -----------------------------------------------------------------------
    // Certificate issuance
    // -----------------------------------------------------------------------

    /// Issue a one-year mTLS client certificate for a managed host.
    ///
    /// * Subject: `CN=<hostname>`
    /// * Key usage: Digital Signature
    /// * Extended key usage: Client Authentication
    ///
    /// The certificate PEM is stored in `certificates`.
    /// The private key is returned to the caller **only** and never persisted.
    pub async fn issue_client_cert(
        &self,
        host_id: Uuid,
        hostname: &str,
        db: &PgPool,
    ) -> Result<IssuedCert> {
        tracing::info!(host_id = %host_id, hostname, "Issuing mTLS client certificate");

        let key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256)
            .context("generate client key pair")?;

        let (mut params, serial_hex, expires_at) = base_params(hostname, 365)?;
        params.is_ca = IsCa::ExplicitNoCa;
        params.key_usages = vec![KeyUsagePurpose::DigitalSignature];
        params.extended_key_usages = vec![ExtendedKeyUsagePurpose::ClientAuth];

        let (ca_key, ca_cert) = self.ca_objects()?;
        let cert = params
            .signed_by(&key, &ca_cert, &ca_key)
            .context("sign client cert with CA")?;

        let cert_pem = cert.pem();
        let key_pem  = key.serialize_pem();

        sqlx::query(
            "INSERT INTO certificates \
             (host_id, serial_number, common_name, status, expires_at, cert_pem) \
             VALUES ($1, $2, $3, 'active'::cert_status, $4, $5)",
        )
        .bind(host_id)
        .bind(&serial_hex)
        .bind(hostname)
        .bind(expires_at)
        .bind(&cert_pem)
        .execute(db)
        .await
        .context("insert client cert into database")?;

        tracing::info!(
            host_id = %host_id,
            hostname,
            serial = %serial_hex,
            expires_at = %expires_at,
            "Client certificate issued successfully"
        );

        Ok(IssuedCert { cert_pem, key_pem, serial_number: serial_hex, expires_at })
    }

    /// Revoke a certificate by database ID.
    ///
    /// Sets `status = 'revoked'` and `revoked_at = NOW()` in the `certificates` table.
    /// Does **not** reissue a replacement; use [`renew_cert`] for that.
    pub async fn revoke_cert(&self, cert_id: Uuid, db: &PgPool) -> Result<()> {
        tracing::info!(cert_id = %cert_id, "Revoking certificate");

        let rows = sqlx::query(
            "UPDATE certificates \
             SET status = 'revoked'::cert_status, revoked_at = NOW() \
             WHERE id = $1",
        )
        .bind(cert_id)
        .execute(db)
        .await
        .context("revoke certificate in database")?;

        if rows.rows_affected() == 0 {
            anyhow::bail!("certificate not found: {}", cert_id);
        }

        tracing::info!(cert_id = %cert_id, "Certificate revoked");
        Ok(())
    }

    /// Renew a certificate: revoke the existing cert and issue a new one with
    /// the same `host_id` and `common_name`.
    pub async fn renew_cert(&self, cert_id: Uuid, db: &PgPool) -> Result<IssuedCert> {
        tracing::info!(cert_id = %cert_id, "Renewing certificate");

        // Fetch the existing cert's host_id and common_name.
        let row = sqlx::query(
            "SELECT host_id, common_name FROM certificates WHERE id = $1",
        )
        .bind(cert_id)
        .fetch_one(db)
        .await
        .context("fetch certificate for renewal")?;

        let host_id: Uuid = row.try_get("host_id")
            .context("certificate has no host_id (cannot renew root CA)")?;
        let common_name: String = row.try_get("common_name")
            .context("fetch common_name")?;

        // Revoke the old cert first.
        self.revoke_cert(cert_id, db).await?;

        // Issue a fresh cert with the same CN.
        let issued = self.issue_client_cert(host_id, &common_name, db).await?;

        tracing::info!(
            old_cert_id = %cert_id,
            new_serial   = %issued.serial_number,
            "Certificate renewed"
        );
        Ok(issued)
    }

    /// Generate a self-signed TLS certificate for the web UI using the CA.
    ///
    /// * Subject: `CN=<hostname>`
    /// * Key usage: Digital Signature
    /// * Extended key usage: Server Authentication
    /// * SAN: DNS `<hostname>`
    ///
    /// Returns `(cert_pem, key_pem)`. This certificate is **not** stored in the
    /// database; it is intended for runtime use only.
    pub async fn issue_web_tls_cert(
        &self,
        hostname: &str,
    ) -> Result<(String, String)> {
        tracing::info!(hostname, "Issuing web TLS certificate");

        let key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256)
            .context("generate web TLS key pair")?;

        let (mut params, serial_hex, expires_at) = base_params(hostname, 365)?;
        params.is_ca = IsCa::ExplicitNoCa;
        params.key_usages = vec![KeyUsagePurpose::DigitalSignature];
        params.extended_key_usages = vec![ExtendedKeyUsagePurpose::ServerAuth];
        params.subject_alt_names = vec![SanType::DnsName(
            Ia5String::try_from(hostname.to_owned()).context("hostname is not valid IA5")?,
        )];

        let (ca_key, ca_cert) = self.ca_objects()?;
        let cert = params
            .signed_by(&key, &ca_cert, &ca_key)
            .context("sign web TLS cert with CA")?;

        let cert_pem = cert.pem();
        let key_pem  = key.serialize_pem();

        tracing::info!(
            hostname,
            serial = %serial_hex,
            expires_at = %expires_at,
            "Web TLS certificate issued"
        );

        Ok((cert_pem, key_pem))
    }

    // -----------------------------------------------------------------------
    // Private helpers
    // -----------------------------------------------------------------------

    /// Reconstruct rcgen `(KeyPair, Certificate)` from the in-memory PEM strings.
    ///
    /// The returned `Certificate` is used solely as an issuer reference when
    /// signing leaf certificates; it is never distributed directly.
    fn ca_objects(&self) -> Result<(KeyPair, Certificate)> {
        let key = KeyPair::from_pem(&self.ca_key_pem)
            .context("reconstruct CA key pair from PEM")?;
        let params = CertificateParams::from_ca_cert_pem(&self.ca_cert_pem)
            .context("reconstruct CA params from PEM")?;
        let cert = params
            .self_signed(&key)
            .context("reconstruct CA certificate for signing")?;
        Ok((key, cert))
    }
}