//go:build linux
// +build linux

package platform

import (
	"fmt"
	"os"
	"path/filepath"
	"strings"

	"github.com/safedep/dry/log"
	"github.com/safedep/dry/utils"
	"github.com/safedep/pmg/sandbox"
	"github.com/safedep/pmg/sandbox/util"
)

// bubblewrapPolicyTranslator translates PMG SandboxPolicy to Bubblewrap (bwrap) CLI arguments.
//
// Bubblewrap uses command-line arguments instead of profile files (like Seatbelt).
// The translator generates arguments for:
// - Filesystem bind mounts (--bind, --ro-bind, --dev-bind)
// - Network isolation (--unshare-net)
// - Process isolation (--unshare-pid, --unshare-ipc)
// - Device access (--dev-bind /dev/null, etc.)
// - Essential system permissions
type bubblewrapPolicyTranslator struct {
	config *bubblewrapConfig
}

// newBubblewrapPolicyTranslator creates a new translator with the given config.
func newBubblewrapPolicyTranslator(config *bubblewrapConfig) *bubblewrapPolicyTranslator {
	return &bubblewrapPolicyTranslator{
		config: config,
	}
}

// translate converts a PMG SandboxPolicy to bwrap CLI arguments.
// Returns a slice of arguments to pass to the bwrap command.
func (t *bubblewrapPolicyTranslator) translate(policy *sandbox.SandboxPolicy) ([]string, error) {
	args := []string{}

	// 1. Add essential system permissions (filesystem, devices, proc)
	systemArgs, err := t.addEssentialSystemPermissions()
	if err != nil {
		return nil, fmt.Errorf("failed to add essential system permissions: %w", err)
	}
	args = append(args, systemArgs...)

	// 2. Add isolation namespaces
	isolationArgs := t.addIsolationNamespaces(policy)
	args = append(args, isolationArgs...)

	// 3. Add filesystem rules (allow read, allow write, deny patterns)
	filesystemArgs, err := t.translateFilesystem(policy)
	if err != nil {
		return nil, fmt.Errorf("failed to translate filesystem rules: %w", err)
	}
	args = append(args, filesystemArgs...)

	// 4. Add PTY support if needed
	if utils.SafelyGetValue(policy.AllowPTY) {
		ptyArgs := t.addPTYSupport()
		args = append(args, ptyArgs...)
	}

	// 5. Add tmpdir support (package managers need writable temp directory)
	tmpdirArgs := t.addTmpdirSupport()
	args = append(args, tmpdirArgs...)

	log.Debugf("Translated policy '%s' to %d bwrap arguments", policy.Name, len(args))

	return args, nil
}

// addEssentialSystemPermissions adds bind mounts for essential system paths and devices
// that package managers need to function properly.
func (t *bubblewrapPolicyTranslator) addEssentialSystemPermissions() ([]string, error) {
	args := []string{}

	// Add essential system paths (read-only)
	for _, path := range t.config.getEssentialSystemPaths() {
		// Use --ro-bind-try which doesn't fail if path doesn't exist
		args = append(args, "--ro-bind-try", path, path)
	}

	// Add essential device files
	for _, device := range t.config.getEssentialDevices() {
		args = append(args, "--dev-bind-try", device, device)
	}

	// Add proc filesystem (read-only for safety)
	for _, procPath := range t.config.procPaths {
		args = append(args, "--proc", procPath)
	}

	return args, nil
}

// addIsolationNamespaces adds namespace isolation arguments based on policy and config.
func (t *bubblewrapPolicyTranslator) addIsolationNamespaces(policy *sandbox.SandboxPolicy) []string {
	args := []string{}

	// Network isolation
	hasAllowRules := len(policy.Network.AllowOutbound) > 0
	hasDenyAll := false
	for _, pattern := range policy.Network.DenyOutbound {
		if pattern == "*:*" {
			hasDenyAll = true
			break
		}
	}

	if t.config.shouldUnshareNetwork(hasAllowRules, hasDenyAll) {
		args = append(args, "--unshare-net")
		log.Debugf("Network isolated (--unshare-net)")
	} else {
		log.Debugf("Network allowed (no --unshare-net)")
	}

	// PID namespace isolation
	if t.config.unsharePID {
		args = append(args, "--unshare-pid")
	}

	// IPC namespace isolation
	if t.config.unshareIPC {
		args = append(args, "--unshare-ipc")
	}

	// New session
	if t.config.newSession {
		args = append(args, "--new-session")
	}

	// Die with parent
	if t.config.dieWithParent {
		args = append(args, "--die-with-parent")
	}

	return args
}

// translateFilesystem converts filesystem policy rules to bwrap bind mount arguments.
//
// Bubblewrap filesystem isolation works via bind mounts:
// - --ro-bind: Read-only bind mount
// - --bind: Read-write bind mount
// - --dev-bind: Device file bind mount
// - Paths not mounted are inaccessible (deny-by-default)
//
// Strategy:
// 1. Start with essential system paths (added separately)
// 2. Add user-specified allow_read paths (read-only bind mounts)
// 3. Add user-specified allow_write paths (read-write bind mounts)
// 4. Handle deny patterns by mounting /dev/null (prevents creation)
// 5. Add mandatory deny patterns
func (t *bubblewrapPolicyTranslator) translateFilesystem(policy *sandbox.SandboxPolicy) ([]string, error) {
	args := []string{}

	// Track paths we've already bound to avoid duplicates
	boundPaths := make(map[string]bool)

	// Add essential system paths to bound paths (already handled separately)
	for _, path := range t.config.getEssentialSystemPaths() {
		boundPaths[path] = true
	}

	// 1. Process allow_read rules (read-only bind mounts)
	for _, pattern := range policy.Filesystem.AllowRead {
		expanded, err := util.ExpandVariables(pattern)
		if err != nil {
			log.Warnf("Failed to expand variables in allow_read pattern '%s': %v", pattern, err)
			continue
		}

		readArgs, err := t.processReadRule(expanded, boundPaths)
		if err != nil {
			log.Warnf("Failed to process allow_read rule '%s': %v", expanded, err)
			continue
		}
		args = append(args, readArgs...)
	}

	// 2. Process allow_write rules (read-write bind mounts)
	for _, pattern := range policy.Filesystem.AllowWrite {
		expanded, err := util.ExpandVariables(pattern)
		if err != nil {
			log.Warnf("Failed to expand variables in allow_write pattern '%s': %v", pattern, err)
			continue
		}

		writeArgs, err := t.processWriteRule(expanded, boundPaths)
		if err != nil {
			log.Warnf("Failed to process allow_write rule '%s': %v", expanded, err)
			continue
		}
		args = append(args, writeArgs...)
	}

	// 3. Process deny_write rules (mount /dev/null to prevent creation)
	allowGitConfig := utils.SafelyGetValue(policy.AllowGitConfig)
	denyPatterns := append([]string{}, policy.Filesystem.DenyWrite...)

	// Add mandatory deny patterns
	mandatoryDenies := util.GetMandatoryDenyPatterns(allowGitConfig)
	denyPatterns = append(denyPatterns, mandatoryDenies...)

	for _, pattern := range denyPatterns {
		expanded, err := util.ExpandVariables(pattern)
		if err != nil {
			log.Warnf("Failed to expand variables in deny pattern '%s': %v", pattern, err)
			continue
		}

		denyArgs, err := t.processDenyRule(expanded)
		if err != nil {
			// Deny rules failing is not critical (file may not exist yet)
			log.Debugf("Deny rule '%s' skipped: %v", expanded, err)
			continue
		}
		args = append(args, denyArgs...)
	}

	return args, nil
}

// processReadRule handles a single allow_read rule, expanding globs and creating ro-bind mounts.
func (t *bubblewrapPolicyTranslator) processReadRule(path string, boundPaths map[string]bool) ([]string, error) {
	args := []string{}

	// Check if path contains glob pattern
	if util.ContainsGlob(path) {
		// Expand glob pattern to concrete paths
		paths, err := t.expandGlobPattern(path, t.config.maxGlobDepth, t.config.maxGlobPaths)
		if err != nil {
			return nil, fmt.Errorf("failed to expand glob pattern: %w", err)
		}

		// Create read-only bind for each expanded path
		for _, p := range paths {
			if !boundPaths[p] {
				args = append(args, "--ro-bind-try", p, p)
				boundPaths[p] = true
			}
		}
	} else {
		// Literal path - create read-only bind
		if !boundPaths[path] {
			args = append(args, "--ro-bind-try", path, path)
			boundPaths[path] = true
		}
	}

	return args, nil
}

// processWriteRule handles a single allow_write rule, expanding globs and creating rw-bind mounts.
func (t *bubblewrapPolicyTranslator) processWriteRule(path string, boundPaths map[string]bool) ([]string, error) {
	args := []string{}

	// Check if path contains glob pattern
	if util.ContainsGlob(path) {
		// Expand glob pattern to concrete paths
		paths, err := t.expandGlobPattern(path, t.config.maxGlobDepth, t.config.maxGlobPaths)
		if err != nil {
			return nil, fmt.Errorf("failed to expand glob pattern: %w", err)
		}

		// Create read-write bind for each expanded path
		for _, p := range paths {
			if !boundPaths[p] {
				args = append(args, "--bind-try", p, p)
				boundPaths[p] = true
			} else {
				// Path already bound as read-only, upgrade to read-write
				// This is a limitation of the simple approach - we'd need to track
				// and replace the previous bind. For now, log warning.
				log.Warnf("Path '%s' already bound, cannot upgrade to read-write", p)
			}
		}
	} else {
		// Literal path - create read-write bind
		if !boundPaths[path] {
			args = append(args, "--bind-try", path, path)
			boundPaths[path] = true
		}
	}

	return args, nil
}

// processDenyRule handles deny rules by mounting /dev/null to prevent file creation.
// This technique is borrowed from Anthropic's sandbox-runtime.
func (t *bubblewrapPolicyTranslator) processDenyRule(path string) ([]string, error) {
	args := []string{}

	// For glob patterns, expand and deny each path
	if util.ContainsGlob(path) {
		// For deny rules, we scan for existing files matching the pattern
		paths, err := t.expandGlobPattern(path, t.config.mandatoryDenyScanDepth, t.config.maxGlobPaths)
		if err != nil {
			// If glob expansion fails, it's not critical for deny rules
			return args, nil
		}

		for _, p := range paths {
			// Mount /dev/null to prevent access
			args = append(args, "--ro-bind", "/dev/null", p)
		}
	} else {
		// For literal paths, check if they exist
		if _, err := os.Stat(path); err == nil {
			// File exists - mount /dev/null over it
			args = append(args, "--ro-bind", "/dev/null", path)
		} else if os.IsNotExist(err) {
			// File doesn't exist - find first non-existent ancestor and block it
			nonExistentPath := t.findFirstNonExistentPath(path)
			if nonExistentPath != "" {
				args = append(args, "--ro-bind", "/dev/null", nonExistentPath)
			}
		}
	}

	return args, nil
}

// findFirstNonExistentPath walks up the directory tree to find the first path component
// that doesn't exist. This allows us to block file creation by mounting /dev/null.
//
// Example: If /home/user/.env doesn't exist but /home/user does, returns /home/user/.env
func (t *bubblewrapPolicyTranslator) findFirstNonExistentPath(path string) string {
	path = filepath.Clean(path)

	// Walk up the tree
	for path != "/" && path != "." {
		if _, err := os.Stat(path); os.IsNotExist(err) {
			// Check if parent exists
			parent := filepath.Dir(path)
			if _, err := os.Stat(parent); err == nil {
				// Parent exists, this is the first non-existent path
				return path
			}
		}
		path = filepath.Dir(path)
	}

	return ""
}

// expandGlobPattern expands a glob pattern to a list of concrete paths.
// Implements depth limiting and path count limiting to prevent DoS.
func (t *bubblewrapPolicyTranslator) expandGlobPattern(pattern string, maxDepth int, maxPaths int) ([]string, error) {
	// Handle ** globstar patterns specially
	if strings.Contains(pattern, "**") {
		return t.expandGlobstarPattern(pattern, maxDepth, maxPaths)
	}

	// Use filepath.Glob for simple patterns (*, ?, [])
	matches, err := filepath.Glob(pattern)
	if err != nil {
		return nil, fmt.Errorf("glob expansion failed: %w", err)
	}

	// Limit number of matches
	if len(matches) > maxPaths {
		log.Warnf("Glob pattern '%s' matched %d paths, limiting to %d", pattern, len(matches), maxPaths)
		matches = matches[:maxPaths]
	}

	return matches, nil
}

// expandGlobstarPattern expands patterns containing ** (recursive glob).
// This requires custom implementation since filepath.Glob doesn't support **.
func (t *bubblewrapPolicyTranslator) expandGlobstarPattern(pattern string, maxDepth int, maxPaths int) ([]string, error) {
	// Split pattern at **
	parts := strings.Split(pattern, "**")
	if len(parts) != 2 {
		return nil, fmt.Errorf("only one ** globstar supported per pattern")
	}

	basePath := strings.TrimSuffix(parts[0], "/")
	suffix := strings.TrimPrefix(parts[1], "/")

	// If base path is empty, start from root
	if basePath == "" {
		basePath = "/"
	}

	// Expand base path variables
	var err error
	basePath, err = util.ExpandVariables(basePath)
	if err != nil {
		return nil, fmt.Errorf("failed to expand base path: %w", err)
	}

	// Check if base path exists
	if _, err := os.Stat(basePath); os.IsNotExist(err) {
		// Base path doesn't exist yet, return just the base
		return []string{basePath}, nil
	}

	matches := []string{}

	// Walk the directory tree with depth limiting
	err = t.walkWithDepthLimit(basePath, suffix, maxDepth, maxPaths, &matches)
	if err != nil {
		return nil, fmt.Errorf("failed to walk directory tree: %w", err)
	}

	return matches, nil
}

// walkWithDepthLimit walks a directory tree with depth limiting.
func (t *bubblewrapPolicyTranslator) walkWithDepthLimit(root string, suffix string, maxDepth int, maxPaths int, matches *[]string) error {
	err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
		if err != nil {
			// Skip paths we can't access
			return nil
		}

		// Calculate depth
		relPath, err := filepath.Rel(root, path)
		if err != nil {
			return nil
		}
		depth := len(strings.Split(relPath, string(filepath.Separator)))

		// Enforce depth limit
		if maxDepth > 0 && depth > maxDepth {
			if info.IsDir() {
				return filepath.SkipDir
			}
			return nil
		}

		// Match suffix
		if suffix == "" || strings.HasSuffix(path, suffix) {
			*matches = append(*matches, path)

			// Enforce path count limit
			if len(*matches) >= maxPaths {
				return filepath.SkipAll
			}
		}

		return nil
	})

	return err
}

// addPTYSupport adds arguments for pseudo-terminal support.
// Required for interactive package manager commands.
func (t *bubblewrapPolicyTranslator) addPTYSupport() []string {
	args := []string{}

	// Bind /dev/pts for PTY allocation
	args = append(args, "--dev-bind-try", "/dev/pts", "/dev/pts")

	// Bind /dev/ptmx for PTY master
	args = append(args, "--dev-bind-try", "/dev/ptmx", "/dev/ptmx")

	return args
}

// addTmpdirSupport adds arguments for temporary directory access.
// Package managers need writable temp space for downloads, extraction, etc.
func (t *bubblewrapPolicyTranslator) addTmpdirSupport() []string {
	args := []string{}

	tmpDir := os.TempDir()

	// Bind tmp directory as writable
	// Use --bind instead of --bind-try to ensure it's available
	args = append(args, "--bind", tmpDir, tmpDir)

	return args
}