package validator

import (
	"encoding/json"
	"fmt"
	"math"
	"regexp"
	"strings"
	"unicode"
	"unicode/utf8"

	"browser.local/platform/domain"
)

const (
	maxGameClientBridgeArrayItems       = 4096
	maxGameClientBridgeIdentifierLength = 180
	maxGameClientBridgeObjectKeys       = 64
	maxGameClientBridgePayloadDepth     = 16
	maxGameClientBridgePayloadNodes     = 8192
	maxGameClientBridgePayloadSize      = 64 * 1024
	maxGameClientBridgePayloadString    = 16 * 1024
	maxGameClientBridgeSessionLength    = 4096
)

var (
	gameClientBridgeAcronymBoundary = regexp.MustCompile(`([A-Z]+)([A-Z][a-z])`)
	gameClientBridgeCamelBoundary   = regexp.MustCompile(`([a-z0-9])([A-Z])`)
	gameClientBridgeNonWord         = regexp.MustCompile(`[^A-Za-z0-9]+`)
)

func ValidateGameClientBridgeQueueRequest(request domain.GameClientBridgeQueueRequest) error {
	var violations []string
	violations = appendGameClientBridgeIdentifier(violations, "serverInstanceId", request.ServerInstanceID, true)
	violations = appendGameClientBridgeIdentifier(violations, "pluginId", request.PluginID, true)
	violations = appendGameClientBridgeIdentifier(violations, "profileKey", request.ProfileKey, true)
	violations = appendGameClientBridgeIdentifier(violations, "commandType", request.CommandType, true)
	violations = appendGameClientBridgeIdentifier(violations, "idempotencyKey", request.IdempotencyKey, true)
	if request.ExpiresAt.IsZero() {
		violations = append(violations, "expiresAt is required")
	}
	if request.Priority < 0 || request.Priority > 100 {
		violations = append(violations, "priority must be between 0 and 100")
	}
	violations = append(violations, validateGameClientBridgePayload(request.Payload)...)
	return finish(violations)
}

func ValidateGameClientBridgeClaimRequest(request domain.GameClientBridgeClaimRequest) error {
	var violations []string
	violations = appendGameClientBridgeSession(violations, request.SessionToken)
	if request.Limit < 0 || request.Limit > 50 {
		violations = append(violations, "limit must be between 0 and 50")
	}
	return finish(violations)
}

func ValidateGameClientBridgeAckRequest(request domain.GameClientBridgeAckRequest) error {
	var violations []string
	violations = appendGameClientBridgeSession(violations, request.SessionToken)
	violations = appendGameClientBridgeIdentifier(violations, "commandId", request.CommandID, true)
	if request.FencingToken == 0 {
		violations = append(violations, "fencingToken is required")
	}
	return finish(violations)
}

func ValidateGameClientBridgeResultRequest(request domain.GameClientBridgeResultRequest) error {
	var violations []string
	violations = appendGameClientBridgeSession(violations, request.SessionToken)
	violations = appendGameClientBridgeIdentifier(violations, "commandId", request.CommandID, true)
	if request.FencingToken == 0 {
		violations = append(violations, "fencingToken is required")
	}
	if request.Status != domain.GameClientBridgeResultSucceeded && request.Status != domain.GameClientBridgeResultFailed && request.Status != domain.GameClientBridgeResultUnknown && request.Status != domain.GameClientBridgeResultCancelled {
		violations = append(violations, "status is invalid")
	}
	violations = appendGameClientBridgeText(violations, "summary", request.Summary, 512)
	violations = append(violations, validateGameClientBridgePayload(request.Payload)...)
	return finish(violations)
}

func ValidateGameClientBridgeCancelRequest(request domain.GameClientBridgeCancelRequest) error {
	var violations []string
	violations = appendGameClientBridgeIdentifier(violations, "commandId", request.CommandID, true)
	violations = appendGameClientBridgeText(violations, "reason", request.Reason, 256)
	return finish(violations)
}

func ValidateGameClientBridgeSnapshotIngestRequest(request domain.GameClientBridgeSnapshotIngestRequest) error {
	var violations []string
	violations = appendGameClientBridgeSession(violations, request.SessionToken)
	violations = appendGameClientBridgeIdentifier(violations, "type", request.Type, true)
	violations = appendGameClientBridgeIdentifier(violations, "schemaVersion", request.SchemaVersion, true)
	violations = appendGameClientBridgeIdentifier(violations, "streamKey", request.StreamKey, true)
	if request.Sequence == 0 {
		violations = append(violations, "sequence must be positive")
	}
	if request.ObservedAt.IsZero() {
		violations = append(violations, "observedAt is required")
	}
	if request.Retention.KeepForSeconds <= 0 || request.Retention.KeepForSeconds > 31*24*60*60 {
		violations = append(violations, "retention.keepForSeconds must be between 1 and 2678400")
	}
	if request.Retention.MaxRecords < 0 || request.Retention.MaxRecords > 10000 {
		violations = append(violations, "retention.maxRecords must be between 0 and 10000")
	}
	if request.Payload == nil {
		violations = append(violations, "payload is required")
	}
	violations = append(violations, validateGameClientBridgePayload(request.Payload)...)
	return finish(violations)
}

func ValidateGameClientBridgeLogStreamRequest(request domain.GameClientBridgeLogStreamRequest) error {
	var violations []string
	violations = appendGameClientBridgeSession(violations, request.SessionToken)
	return finish(violations)
}

func ValidateGameClientBridgeSnapshotQuery(query domain.GameClientBridgeSnapshotQuery) error {
	var violations []string
	violations = appendGameClientBridgeIdentifier(violations, "serverInstanceId", query.ServerInstanceID, true)
	violations = appendGameClientBridgeIdentifier(violations, "pluginId", query.PluginID, true)
	violations = appendGameClientBridgeIdentifier(violations, "profileKey", query.ProfileKey, false)
	violations = appendGameClientBridgeIdentifier(violations, "type", query.Type, false)
	violations = appendGameClientBridgeIdentifier(violations, "streamKey", query.StreamKey, false)
	if query.Limit < 0 || query.Limit > 200 {
		violations = append(violations, "limit must be between 0 and 200")
	}
	return finish(violations)
}

func appendGameClientBridgeIdentifier(violations []string, field, value string, required bool) []string {
	if value == "" {
		if required {
			return append(violations, field+" is required")
		}
		return violations
	}
	if !utf8.ValidString(value) || strings.TrimSpace(value) != value || utf8.RuneCountInString(value) > maxGameClientBridgeIdentifierLength {
		return append(violations, field+" is invalid")
	}
	first, _ := utf8.DecodeRuneInString(value)
	last, _ := utf8.DecodeLastRuneInString(value)
	if !isGameClientBridgeASCIIAlphanumeric(first) || !isGameClientBridgeASCIIAlphanumeric(last) {
		return append(violations, field+" is invalid")
	}
	for _, character := range value {
		if !isGameClientBridgeIdentifierCharacter(character) {
			return append(violations, field+" is invalid")
		}
	}
	if containsUnsafeRuntimeSecret(value) || looksLikeRawHostPath(value) || strings.Contains(value, "://") || strings.Contains(value, "..") {
		return append(violations, field+" is invalid")
	}
	return violations
}

func isGameClientBridgeASCIIAlphanumeric(character rune) bool {
	return character >= 'a' && character <= 'z' || character >= 'A' && character <= 'Z' || character >= '0' && character <= '9'
}

func isGameClientBridgeIdentifierCharacter(character rune) bool {
	return character >= 'a' && character <= 'z' ||
		character >= 'A' && character <= 'Z' ||
		character >= '0' && character <= '9' ||
		character == '.' || character == '_' || character == '-' || character == ':'
}

func appendGameClientBridgeSession(violations []string, value string) []string {
	if strings.TrimSpace(value) == "" {
		return append(violations, "sessionToken is required")
	}
	if !utf8.ValidString(value) || strings.TrimSpace(value) != value || len(value) > maxGameClientBridgeSessionLength || containsControlCharacter(value) {
		return append(violations, "sessionToken is invalid")
	}
	return violations
}

func appendGameClientBridgeText(violations []string, field, value string, maximum int) []string {
	if value == "" {
		return violations
	}
	if !utf8.ValidString(value) || strings.TrimSpace(value) != value || utf8.RuneCountInString(value) > maximum || containsControlCharacter(value) {
		violations = append(violations, field+" is invalid")
	}
	lowered := strings.ToLower(strings.TrimSpace(value))
	if containsUnsafeRuntimeSecret(value) || looksLikeRawHostPath(value) || hasUnsafeGameClientBridgeReference(lowered) || containsEmbeddedGameClientBridgeHostPath(lowered) {
		violations = append(violations, field+" contains unsafe connection or host material")
	}
	for _, reason := range unsafePluginStringReasons(value) {
		violations = append(violations, field+": "+reason)
	}
	return violations
}

func containsControlCharacter(value string) bool {
	for _, character := range value {
		if unicode.IsControl(character) {
			return true
		}
	}
	return false
}

type gameClientBridgePayloadBudget struct {
	nodes int
}

func validateGameClientBridgePayload(payload map[string]any) []string {
	if payload == nil {
		return nil
	}
	budget := gameClientBridgePayloadBudget{}
	violations := validateGameClientBridgePayloadValue("payload", payload, 0, &budget)
	if len(violations) != 0 {
		return violations
	}
	encoded, err := json.Marshal(payload)
	if err != nil {
		return []string{"payload must be valid JSON"}
	}
	if len(encoded) > maxGameClientBridgePayloadSize {
		return []string{"payload is too large"}
	}
	return nil
}

func validateGameClientBridgePayloadValue(field string, value any, depth int, budget *gameClientBridgePayloadBudget) []string {
	budget.nodes++
	if budget.nodes > maxGameClientBridgePayloadNodes {
		return []string{"payload has too many values"}
	}
	if depth > maxGameClientBridgePayloadDepth {
		return []string{"payload nesting is too deep"}
	}

	switch typed := value.(type) {
	case nil, bool:
		return nil
	case string:
		return validateGameClientBridgePayloadString(field, typed)
	case float64:
		if math.IsInf(typed, 0) || math.IsNaN(typed) {
			return []string{field + " must be a finite JSON number"}
		}
		return nil
	case float32:
		if math.IsInf(float64(typed), 0) || math.IsNaN(float64(typed)) {
			return []string{field + " must be a finite JSON number"}
		}
		return nil
	case int, int8, int16, int32, int64, uint, uint8, uint16, uint32, uint64:
		return nil
	case json.Number:
		if _, err := json.Marshal(typed); err != nil {
			return []string{field + " must be a valid JSON number"}
		}
		return nil
	case map[string]any:
		if len(typed) > maxGameClientBridgeObjectKeys {
			return []string{field + " has too many keys"}
		}
		var violations []string
		for key, item := range typed {
			if !validGameClientBridgePayloadKey(key) {
				violations = append(violations, field+" key "+fmt.Sprintf("%q", key)+" is invalid")
				continue
			}
			if unsafeGameClientBridgePayloadKey(key) {
				violations = append(violations, field+" contains forbidden key "+key)
				continue
			}
			violations = append(violations, validateGameClientBridgePayloadValue(field+"."+key, item, depth+1, budget)...)
		}
		return violations
	case []any:
		if len(typed) > maxGameClientBridgeArrayItems {
			return []string{field + " has too many items"}
		}
		var violations []string
		for index, item := range typed {
			violations = append(violations, validateGameClientBridgePayloadValue(fmt.Sprintf("%s[%d]", field, index), item, depth+1, budget)...)
		}
		return violations
	default:
		return []string{fmt.Sprintf("%s uses non-JSON type %T", field, value)}
	}
}

func validateGameClientBridgePayloadString(field, value string) []string {
	var violations []string
	if !utf8.ValidString(value) {
		violations = append(violations, field+" must be valid UTF-8")
	}
	if utf8.RuneCountInString(value) > maxGameClientBridgePayloadString {
		violations = append(violations, field+" is too long")
	}
	if containsControlCharacter(value) {
		violations = append(violations, field+" contains control characters")
	}
	for _, reason := range unsafePluginStringReasons(value) {
		violations = append(violations, field+": "+reason)
	}
	lowered := strings.ToLower(strings.TrimSpace(value))
	if containsUnsafeRuntimeSecret(value) || hasUnsafeGameClientBridgeReference(lowered) || containsEmbeddedGameClientBridgeHostPath(lowered) {
		violations = append(violations, field+" contains unsafe connection material")
	}
	return violations
}

func validGameClientBridgePayloadKey(key string) bool {
	if key == "" || !utf8.ValidString(key) || strings.TrimSpace(key) != key || utf8.RuneCountInString(key) > 80 {
		return false
	}
	for _, character := range key {
		if !isGameClientBridgeIdentifierCharacter(character) || character == ':' {
			return false
		}
	}
	return true
}

func unsafeGameClientBridgePayloadKey(key string) bool {
	tokens := gameClientBridgePayloadKeyTokens(key)
	if len(tokens) == 0 {
		return true
	}
	normalized := strings.Join(tokens, "")
	for _, exact := range []string{
		"absolutepath", "apikey", "commandline", "componentkey", "credential", "credentials", "directsocket", "dsn", "hostpath", "password", "passwd", "rawpath", "rawsql", "runendpoint", "runsocket", "script", "secret", "sessiontoken", "shell", "socket", "sql", "statement", "terminalcommand",
	} {
		if normalized == strings.ReplaceAll(exact, " ", "") {
			return true
		}
	}
	if last := tokens[len(tokens)-1]; last == "password" || last == "passwd" || last == "secret" || last == "credential" || last == "credentials" || last == "dsn" {
		return true
	}
	for _, sequence := range [][]string{
		{"api", "key"},
		{"access", "key"},
		{"private", "key"},
		{"auth", "token"},
		{"access", "token"},
		{"client", "secret"},
		{"storage", "credential"},
		{"component", "key"},
		{"session", "token"},
		{"host", "path"},
		{"raw", "path"},
		{"absolute", "path"},
		{"file", "system", "path"},
		{"direct", "socket"},
		{"socket", "path"},
		{"socket", "address"},
		{"socket", "url"},
		{"socket", "endpoint"},
		{"run", "endpoint"},
		{"run", "url"},
		{"run", "socket"},
		{"run", "token"},
		{"run", "credential"},
		{"raw", "sql"},
		{"raw", "query"},
		{"sql", "text"},
		{"sql", "query"},
		{"sql", "statement"},
		{"arbitrary", "sql"},
		{"shell", "command"},
		{"shell", "script"},
		{"script", "body"},
		{"terminal", "command"},
		{"command", "line"},
		{"arbitrary", "shell"},
	} {
		if gameClientBridgeContainsSensitiveSequence(tokens, sequence) {
			return true
		}
	}
	return false
}

func containsEmbeddedGameClientBridgeHostPath(value string) bool {
	for _, marker := range []string{"/etc/", "/var/", "/tmp/", "/home/", "/root/", "/private/", "/users/", "/volumes/", "/opt/", `:\\`} {
		if strings.Contains(value, marker) {
			return true
		}
	}
	return false
}

func gameClientBridgeContainsSensitiveSequence(tokens, sequence []string) bool {
	for start := 0; start+len(sequence) <= len(tokens); start++ {
		matched := true
		for index, expected := range sequence {
			if tokens[start+index] != expected {
				matched = false
				break
			}
		}
		if !matched {
			continue
		}
		end := start + len(sequence)
		if end == len(tokens) {
			return true
		}
		switch tokens[end] {
		case "address", "body", "content", "material", "path", "raw", "ref", "text", "url", "value":
			return true
		}
	}
	return false
}

func gameClientBridgePayloadKeyTokens(key string) []string {
	withAcronymBoundaries := gameClientBridgeAcronymBoundary.ReplaceAllString(key, `${1} ${2}`)
	withCamelBoundaries := gameClientBridgeCamelBoundary.ReplaceAllString(withAcronymBoundaries, `${1} ${2}`)
	return strings.Fields(strings.ToLower(gameClientBridgeNonWord.ReplaceAllString(withCamelBoundaries, " ")))
}

func hasUnsafeGameClientBridgeReference(value string) bool {
	for _, fragment := range []string{
		"unix://", "tcp://", "mysql://", "postgres://", "postgresql://", "mongodb://", "redis://", "sqlite://", "sqlserver://", "mssql://", "odbc:", "secret://", "vault://", "env://", "http://127.", "https://127.", "http://localhost", "https://localhost",
	} {
		if strings.Contains(value, fragment) {
			return true
		}
	}
	return false
}