package tunnel

import (
	"errors"
	"fmt"
	"net/url"
	"strconv"
	"strings"

	"git.smesh.lol/nostrino/pkg/crypto/secp256k1"
	"git.smesh.lol/nostrino/pkg/nostr"
)

// Scheme is the connection URI scheme of a chain-data gateway.
const Scheme = "nostr+chaindata"

// URI names a gateway and the relays where it can be reached.
//
//	nostr+chaindata://<gateway-pubkey>?relay=<wss-relay>&relay=<wss-relay>&chains=btc,xbt&v=1&name=<label>
//
// The gateway public key replaces the shared secret of NIP-46 style
// connection strings: the gateway is a public chain-data service with its own
// transport identity, not a signer, and a client needs no secret to talk to
// it. Client authentication, where an operator wants it, is a pubkey
// allowlist on the gateway.
type URI struct {
	Gateway [32]byte
	Relays  []string
	// Bridges are optional WebSocket data-plane endpoints. When present the
	// client tries them first and falls back to the relay stream.
	Bridges []string
	Chains  []string
	Version int
	Name    string
}

// ParseURI parses a nostr+chaindata connection string.
func ParseURI(raw string) (*URI, error) {
	u, err := url.Parse(strings.TrimSpace(raw))
	if err != nil {
		return nil, fmt.Errorf("tunnel: parse uri: %w", err)
	}
	if !strings.EqualFold(u.Scheme, Scheme) {
		return nil, fmt.Errorf("tunnel: scheme is %q, want %q", u.Scheme, Scheme)
	}
	if u.User != nil {
		return nil, errors.New("tunnel: connection uri has no userinfo")
	}
	host := strings.ToLower(u.Host)
	if host == "" {
		return nil, errors.New("tunnel: connection uri has no gateway pubkey")
	}
	if len(host) != 64 {
		return nil, errors.New("tunnel: gateway pubkey must be 64 hex characters")
	}
	out := &URI{Gateway: [32]byte{}, Version: 1}
	if err := nostr.Decode32(host, out.Gateway[:]); err != nil {
		return nil, fmt.Errorf("tunnel: gateway pubkey: %w", err)
	}
	if !secp256k1.ValidatePubKey(out.Gateway) {
		return nil, errors.New("tunnel: gateway pubkey is not on the curve")
	}
	q := u.Query()
	for _, relay := range q["relay"] {
		relay = strings.TrimSpace(relay)
		if relay == "" {
			continue
		}
		if !strings.HasPrefix(relay, "ws://") && !strings.HasPrefix(relay, "wss://") {
			return nil, fmt.Errorf("tunnel: relay %q is not ws:// or wss://", relay)
		}
		out.Relays = append(out.Relays, relay)
	}
	if len(out.Relays) == 0 {
		return nil, errors.New("tunnel: connection uri has no relay")
	}
	for _, bridge := range q["bridge"] {
		bridge = strings.TrimSpace(bridge)
		if bridge == "" {
			continue
		}
		if !strings.HasPrefix(bridge, "ws://") && !strings.HasPrefix(bridge, "wss://") {
			return nil, fmt.Errorf("tunnel: bridge %q is not ws:// or wss://", bridge)
		}
		out.Bridges = append(out.Bridges, bridge)
	}
	if raw := q.Get("v"); raw != "" {
		v, err := strconv.Atoi(raw)
		if err != nil || v != 1 {
			return nil, fmt.Errorf("tunnel: unsupported protocol version %q", raw)
		}
		out.Version = v
	}
	if raw := q.Get("chains"); raw != "" {
		for _, c := range strings.Split(raw, ",") {
			c = strings.ToLower(strings.TrimSpace(c))
			if c != "" {
				out.Chains = append(out.Chains, c)
			}
		}
	}
	out.Name = q.Get("name")
	return out, nil
}

// String renders the canonical connection URI.
func (u *URI) String() string {
	q := url.Values{}
	for _, relay := range u.Relays {
		q.Add("relay", relay)
	}
	if len(u.Chains) > 0 {
		q.Set("chains", strings.Join(u.Chains, ","))
	}
	for _, bridge := range u.Bridges {
		q.Add("bridge", bridge)
	}
	q.Set("v", strconv.Itoa(u.Version))
	if u.Name != "" {
		q.Set("name", u.Name)
	}
	return Scheme + "://" + nostr.Hex(u.Gateway[:]) + "?" + q.Encode()
}

// ChainAllowed reports whether the gateway advertised the chain. An empty
// advertised list means the URI did not constrain it.
func (u *URI) ChainAllowed(chain string) bool {
	if len(u.Chains) == 0 {
		return true
	}
	for _, c := range u.Chains {
		if strings.EqualFold(c, chain) {
			return true
		}
	}
	return false
}