import { execFile, spawn } from "node:child_process";
import { createHash } from "node:crypto";
import { constants } from "node:fs";
import { access } from "node:fs/promises";
import {
  chmod,
  lstat,
  mkdir,
  open,
  readdir,
  readlink,
  realpath,
  symlink,
  readFile,
} from "node:fs/promises";
import type { Stats } from "node:fs";
import {
  delimiter,
  dirname,
  isAbsolute,
  relative,
  resolve,
  sep,
} from "node:path";
import { promisify } from "node:util";
import {
  BUILD_PROTOCOL_VERSION,
  assertSha256Digest,
  type Sha256Digest,
  type WorkspaceFile,
  type WorkspaceManifest,
} from "../shared/build-protocol";

const execFileAsync = promisify(execFile);

export async function gitAvailable(): Promise<boolean> {
  for (const directory of (process.env.PATH ?? "").split(delimiter)) {
    if (!directory) continue;
    try {
      await access(
        resolve(directory, process.platform === "win32" ? "git.exe" : "git"),
        constants.X_OK,
      );
      return true;
    } catch {
      /* Continue searching PATH. */
    }
  }
  return false;
}

export type WorkspaceBlob = {
  digest: Sha256Digest;
  data: Uint8Array;
};

export type WorkspaceSnapshot = {
  manifest: WorkspaceManifest;
  digest: Sha256Digest;
  blobs: WorkspaceBlob[];
};

export type BlobReader =
  | ((digest: Sha256Digest) => Promise<Uint8Array>)
  | { get(digest: Sha256Digest): Promise<Uint8Array> };

function digest(data: Uint8Array | string): Sha256Digest {
  return `sha256:${createHash("sha256").update(data).digest("hex")}`;
}

export function validateWorkspacePath(path: string): void {
  if (
    !path ||
    path.includes("\0") ||
    path.includes("\\") ||
    isAbsolute(path) ||
    path.split("/").some((part) => !part || part === "." || part === "..")
  ) {
    throw new Error(`Unsafe workspace path: ${JSON.stringify(path)}`);
  }
}

function isWithin(root: string, candidate: string): boolean {
  const path = relative(root, candidate);
  return (
    path === "" ||
    (!path.startsWith(`..${sep}`) && path !== ".." && !isAbsolute(path))
  );
}

function assertSafeSymlinkTarget(
  root: string,
  path: string,
  target: string,
  symlinks: Set<string>,
): void {
  const source = resolve(root, path);
  if (
    target.includes("\0") ||
    isAbsolute(target) ||
    !isWithin(root, resolve(dirname(source), target))
  )
    throw new Error(`Symlink escapes workspace: ${path} -> ${target}`);

  // Inspect raw components before normalization: `sub/..` still traverses
  // `sub` when it is a symlink, even though it resolves lexically to `.`.
  const components = path.split("/").slice(0, -1);
  for (const part of target.split(sep === "\\" ? /[\\/]/ : "/")) {
    if (!part || part === ".") continue;
    if (part === "..") components.pop();
    else {
      components.push(part);
      if (symlinks.has(components.join("/")))
        throw new Error(
          `Symlink traverses snapshot symlink: ${path} -> ${target}`,
        );
    }
  }
}

async function gitFiles(root: string, args: string[]): Promise<string[]> {
  const { stdout } = await execFileAsync(
    "git",
    ["-C", root, "ls-files", "-z", ...args],
    {
      encoding: "buffer",
      maxBuffer: 64 * 1024 * 1024,
    },
  );
  const decoder = new TextDecoder("utf-8", { fatal: true });
  const files: string[] = [];
  let start = 0;
  for (
    let end = stdout.indexOf(0);
    end !== -1;
    end = stdout.indexOf(0, start)
  ) {
    if (end > start) files.push(decoder.decode(stdout.subarray(start, end)));
    start = end + 1;
  }
  return files;
}

async function selectedFiles(root: string): Promise<string[]> {
  const [normal, dotenv] = await Promise.all([
    gitFiles(root, ["--cached", "--others", "--exclude-standard"]),
    gitFiles(root, [
      "--others",
      "--ignored",
      "--exclude-standard",
      "--",
      ".env*",
      "**/.env*",
    ]),
  ]);
  return [...new Set([...normal, ...dotenv])].sort((a, b) =>
    Buffer.from(a).compare(Buffer.from(b)),
  );
}

async function selectedAutoFiles(root: string): Promise<string[]> {
  // ls-files includes tracked files even when they now match .gitignore.
  // --no-index makes check-ignore apply the same rules to those paths too.
  const candidates = await gitFiles(root, [
    "--cached",
    "--others",
    "--exclude-standard",
  ]);
  if (candidates.length === 0) return [];
  const child = spawn("git", [
    "-C",
    root,
    "check-ignore",
    "--no-index",
    "--stdin",
    "-z",
  ]);
  const output: Buffer[] = [];
  const errors: Buffer[] = [];
  child.stdout.on("data", (chunk: Buffer) => output.push(chunk));
  child.stderr.on("data", (chunk: Buffer) => errors.push(chunk));
  const completed = new Promise<void>((resolveExit, rejectExit) => {
    child.once("error", rejectExit);
    child.once("close", (code) => {
      if (code === 0 || code === 1) resolveExit();
      else
        rejectExit(
          new Error(
            Buffer.concat(errors).toString("utf8") ||
              `git check-ignore exited with ${code}`,
          ),
        );
    });
  });
  child.stdin.end(Buffer.from(`${candidates.join("\0")}\0`));
  await completed;
  const decoder = new TextDecoder("utf-8", { fatal: true });
  // Decode strictly, like ls-files, so an invalid path cannot silently alias another.
  const ignored = new Set<string>();
  const bytes = Buffer.concat(output);
  let start = 0;
  for (let end = bytes.indexOf(0); end !== -1; end = bytes.indexOf(0, start)) {
    if (end > start) ignored.add(decoder.decode(bytes.subarray(start, end)));
    start = end + 1;
  }
  const selected = candidates
    .filter((path) => !ignored.has(path))
    .sort((a, b) => Buffer.from(a).compare(Buffer.from(b)));
  rejectSelectedAutoSecrets(selected);
  return selected;
}

function rejectSelectedAutoSecrets(paths: string[]): void {
  const unsafe = paths.find((path) => {
    const parts = path.split("/");
    const name = parts.at(-1)!.toLowerCase();
    const directories = parts.slice(0, -1).map((part) => part.toLowerCase());
    const dotenv =
      /^\.env(?:$|[._-]|rc$)/.test(name) &&
      !/^\.env[._-](?:example|sample|template)(?:$|[._-])/.test(name);
    const credentialDirectory = directories.some((part) =>
      [
        ".aws",
        ".azure",
        ".gnupg",
        ".ssh",
        ".kube",
        ".docker",
        "credentials",
        "secrets",
      ].includes(part),
    );
    const conventionalCredential =
      [".npmrc", ".pypirc", ".netrc"].includes(name) ||
      /^(?:id_(?:rsa|dsa|ecdsa|ed25519)|identity)(?:$|\.)/.test(name) ||
      /^(?:credentials?|.*_credentials?)(?:\.|$)/.test(name) ||
      /\.(?:pem|key|p12|pfx|keystore)$/.test(name);
    return dotenv || credentialDirectory || conventionalCredential;
  });
  if (unsafe) {
    throw new Error(
      `build: auto refuses to snapshot potential credentials at ${unsafe}; add it to .gitignore and retry`,
    );
  }
}

async function filesystemFiles(root: string): Promise<string[]> {
  const files: string[] = [];
  const ignoredDirectories = new Set([
    ".git",
    ".hg",
    ".svn",
    "node_modules",
    "vendor",
    "bower_components",
    ".venv",
    "venv",
    "__pycache__",
    ".tox",
    ".mypy_cache",
    ".pytest_cache",
    ".next",
    ".nuxt",
    ".svelte-kit",
    ".cache",
    ".turbo",
    "dist",
    "build",
    "coverage",
    "target",
    "out",
    "tmp",
    "temp",
  ]);
  const sensitiveDirectory =
    /(?:^|[-_.])(?:secrets?|credentials?|configs?)(?:$|[-_.])/i;
  const ignoreRules: Array<{
    base: string;
    pattern: string;
    directory: boolean;
  }> = [];
  const loadIgnore = async (directory: string): Promise<void> => {
    try {
      const content = await readFile(resolve(directory, ".gitignore"), "utf8");
      for (const raw of content.split(/\r?\n/)) {
        const line = raw.trim();
        if (!line || line.startsWith("#")) continue;
        // Negations are skipped: safely re-including descendants requires
        // Git's parent-directory semantics, so fallback stays fail-closed.
        if (line.startsWith("!")) continue;
        const rule = line.replace(/^\//, "");
        if (rule)
          ignoreRules.push({
            base: relative(root, directory).split(sep).join("/"),
            pattern: rule.replace(/\/$/, ""),
            directory: line.endsWith("/"),
          });
      }
    } catch (error) {
      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
    }
  };
  const ignoredByRules = (path: string, isDirectory: boolean): boolean => {
    let ignored = false;
    for (const rule of ignoreRules) {
      const prefix = rule.base ? `${rule.base}/` : "";
      if (rule.base && path !== rule.base && !path.startsWith(prefix)) continue;
      const local =
        rule.base && path.startsWith(prefix) ? path.slice(prefix.length) : path;
      const glob = rule.pattern
        .replace(/[.+^${}()|[\]\\]/g, "\\$&")
        .replace(/\*\*/g, "__DOUBLESTAR__")
        .replace(/\*/g, "[^/]*")
        .replace(/\?/g, "[^/]")
        .replace(/__DOUBLESTAR__/g, ".*");
      const matcher = new RegExp(`^(?:${glob})(?:/.*)?$`);
      const basenameMatcher = new RegExp(`^(?:${glob})$`);
      if (
        (matcher.test(local) ||
          local.split("/").some((part) => basenameMatcher.test(part))) &&
        (!rule.directory || isDirectory || local.includes("/"))
      )
        ignored = true;
    }
    return ignored;
  };
  const visit = async (directory: string): Promise<void> => {
    await loadIgnore(directory);
    for (const entry of await readdir(directory, { withFileTypes: true })) {
      const source = resolve(directory, entry.name);
      const path = relative(root, source).split(sep).join("/");
      if (entry.isDirectory()) {
        if (
          ignoredDirectories.has(entry.name) ||
          sensitiveDirectory.test(entry.name) ||
          ignoredByRules(path, true)
        )
          continue;
        await visit(source);
      } else if (entry.isFile() || entry.isSymbolicLink()) {
        if (ignoredByRules(path, false)) continue;
        if (
          /^\.env/i.test(entry.name) ||
          /(?:secret|credential|password|token|private[-_.]?key)/i.test(
            entry.name,
          ) ||
          /^(?:id_rsa|id_ed25519|known_hosts|config\.json|\.npmrc|\.pypirc|\.netrc)$/i.test(
            entry.name,
          )
        )
          continue;
        files.push(path);
      } else {
        throw new Error(
          `Special files are not allowed in workspaces: ${relative(root, source).split(sep).join("/")}`,
        );
      }
    }
  };
  await visit(root);
  return files.sort((a, b) => Buffer.from(a).compare(Buffer.from(b)));
}

async function isGitRepository(root: string): Promise<boolean> {
  if (!(await gitAvailable())) return false;
  try {
    await execFileAsync("git", ["-C", root, "rev-parse", "--show-toplevel"]);
    return true;
  } catch (error) {
    const code = (error as { code?: unknown }).code;
    const exitCode = (error as { exitCode?: number }).exitCode;
    const message = error instanceof Error ? error.message : String(error);
    if (code === "ENOENT") return false;
    if (
      exitCode === 128 ||
      code === 128 ||
      /not a git repository/i.test(message)
    )
      return false;
    throw error;
  }
}

async function rejectSelectedSpecialFiles(root: string): Promise<void> {
  // Let Git identify ignored directories using its own ignore engine. With
  // --directory, ignored trees are returned as directory entries, so the
  // filesystem walk below can prune them without visiting their contents.
  const ignoredResult = await execFileAsync(
    "git",
    [
      "-C",
      root,
      "ls-files",
      "--others",
      "--ignored",
      "--exclude-standard",
      "--directory",
      "-z",
    ],
    { encoding: "buffer", maxBuffer: 64 * 1024 * 1024 },
  );
  const decoder = new TextDecoder("utf-8", { fatal: true });
  const ignoredDirectories = new Set<string>();
  let start = 0;
  for (
    let end = ignoredResult.stdout.indexOf(0);
    end !== -1;
    end = ignoredResult.stdout.indexOf(0, start)
  ) {
    if (end > start) {
      const path = decoder.decode(ignoredResult.stdout.subarray(start, end));
      if (path.endsWith("/")) ignoredDirectories.add(path.slice(0, -1));
    }
    start = end + 1;
  }

  const specialPaths: string[] = [];
  const visit = async (directory: string): Promise<void> => {
    for (const entry of await readdir(directory, { withFileTypes: true })) {
      if (directory === root && entry.name === ".git") continue;
      const source = resolve(directory, entry.name);
      const path = relative(root, source).split(sep).join("/");
      if (entry.isDirectory()) {
        if (!ignoredDirectories.has(path)) await visit(source);
      } else if (!entry.isFile() && !entry.isSymbolicLink()) {
        specialPaths.push(path);
      }
    }
  };
  await visit(root);

  if (specialPaths.length === 0) return;
  const input = Buffer.from(`${specialPaths.join("\0")}\0`);
  const child = spawn("git", ["-C", root, "check-ignore", "--stdin", "-z"]);
  const output: Buffer[] = [];
  const errors: Buffer[] = [];
  child.stdout.on("data", (chunk: Buffer) => output.push(chunk));
  child.stderr.on("data", (chunk: Buffer) => errors.push(chunk));
  const completed = new Promise<void>((resolveExit, rejectExit) => {
    child.once("error", rejectExit);
    child.once("close", (code) => {
      if (code === 0 || code === 1) resolveExit();
      else
        rejectExit(
          new Error(
            Buffer.concat(errors).toString("utf8") ||
              `git check-ignore exited with ${code}`,
          ),
        );
    });
  });
  child.stdin.end(input);
  await completed;
  const stdout = Buffer.concat(output);
  const ignored = new Set<string>();
  start = 0;
  for (
    let end = stdout.indexOf(0);
    end !== -1;
    end = stdout.indexOf(0, start)
  ) {
    if (end > start) ignored.add(decoder.decode(stdout.subarray(start, end)));
    start = end + 1;
  }
  for (const path of specialPaths) {
    const name = path.slice(path.lastIndexOf("/") + 1);
    if (!ignored.has(path) || name.startsWith(".env"))
      throw new Error(`Special files are not allowed in workspaces: ${path}`);
  }
}

function canonicalManifest(manifest: WorkspaceManifest): string {
  return JSON.stringify({
    version: manifest.version,
    files: manifest.files.map((file) => ({
      path: file.path,
      type: file.type,
      digest: file.digest,
      size: file.size,
      mode: file.mode,
    })),
  });
}

export function serializeWorkspaceManifest(
  manifest: WorkspaceManifest,
): Uint8Array {
  validateWorkspaceManifest(manifest);
  return Buffer.from(canonicalManifest(manifest));
}

export function workspaceManifestDigest(
  manifest: WorkspaceManifest,
): Sha256Digest {
  return digest(serializeWorkspaceManifest(manifest));
}

export function validateWorkspaceManifest(manifest: WorkspaceManifest): void {
  if (
    manifest.version !== BUILD_PROTOCOL_VERSION ||
    !Array.isArray(manifest.files)
  ) {
    throw new Error("Unsupported workspace manifest");
  }

  let previous = "";
  const seen = new Set<string>();
  for (const file of manifest.files) {
    validateWorkspacePath(file.path);
    assertSha256Digest(file.digest);
    if (!Number.isSafeInteger(file.size) || file.size < 0)
      throw new Error(`Invalid size for ${file.path}`);
    if (
      (file.type === "file" && file.mode !== 0o644 && file.mode !== 0o755) ||
      (file.type === "symlink" && file.mode !== 0o777)
    ) {
      throw new Error(`Invalid mode for ${file.path}`);
    }
    if (file.type !== "file" && file.type !== "symlink")
      throw new Error(`Invalid entry type for ${file.path}`);
    if (seen.has(file.path))
      throw new Error(`Duplicate workspace path: ${file.path}`);
    for (const parent of file.path
      .split("/")
      .slice(0, -1)
      .map((_, index, parts) => parts.slice(0, index + 1).join("/"))) {
      if (seen.has(parent))
        throw new Error(`Workspace entry is used as a directory: ${parent}`);
    }
    if (previous && Buffer.from(previous).compare(Buffer.from(file.path)) >= 0)
      throw new Error("Workspace files must be bytewise sorted");
    seen.add(file.path);
    previous = file.path;
  }
}

export async function enumerateWorkspace(
  root: string,
  mode: "default" | "auto" = "default",
): Promise<WorkspaceSnapshot> {
  const repository = await realpath(root);
  const gitBacked = await isGitRepository(repository);
  if (mode === "auto" && !gitBacked)
    throw new Error(
      "build: auto requires Git and a Git repository to apply .gitignore rules safely",
    );
  const paths =
    mode === "auto"
      ? await selectedAutoFiles(repository)
      : gitBacked
        ? await (async () => {
            await rejectSelectedSpecialFiles(repository);
            return selectedFiles(repository);
          })()
        : await filesystemFiles(repository);
  const files: WorkspaceFile[] = [];
  const blobs = new Map<Sha256Digest, Uint8Array>();

  for (const path of paths) {
    validateWorkspacePath(path);
    const source = resolve(repository, path);
    if (!isWithin(repository, source))
      throw new Error(`Workspace path escapes root: ${path}`);
    // Git's index can retain files beneath a directory replaced by a symlink.
    // A leaf O_NOFOLLOW does not protect against following that parent.
    let parent = repository;
    for (const part of path.split("/").slice(0, -1)) {
      parent = resolve(parent, part);
      try {
        if (!(await lstat(parent)).isDirectory())
          throw new Error(`Unsafe workspace parent: ${path}`);
      } catch (error) {
        if ((error as NodeJS.ErrnoException).code === "ENOENT") break;
        throw error;
      }
    }

    let stat: Stats;
    try {
      stat = await lstat(source);
    } catch (error) {
      if ((error as NodeJS.ErrnoException).code === "ENOENT") continue;
      throw error;
    }

    let data: Uint8Array;
    let entry: WorkspaceFile;
    if (stat.isSymbolicLink()) {
      const target = await readlink(source);
      data = Buffer.from(target);
      entry = {
        path,
        type: "symlink",
        digest: digest(data),
        size: data.byteLength,
        mode: 0o777,
      };
    } else if (stat.isFile()) {
      let mode: 0o644 | 0o755;
      const handle = await open(
        source,
        constants.O_RDONLY | constants.O_NOFOLLOW,
      );
      try {
        const opened = await handle.stat();
        if (!opened.isFile()) throw new Error(`Not a regular file: ${path}`);
        mode = opened.mode & 0o111 ? 0o755 : 0o644;
        data = await handle.readFile();
      } finally {
        await handle.close();
      }
      entry = {
        path,
        type: "file",
        digest: digest(data),
        size: data.byteLength,
        mode,
      };
    } else {
      throw new Error(`Special files are not allowed in workspaces: ${path}`);
    }
    files.push(entry);
    blobs.set(entry.digest, data);
  }

  const manifest = {
    version: BUILD_PROTOCOL_VERSION,
    files,
  } satisfies WorkspaceManifest;
  const symlinks = new Set(
    files.filter((file) => file.type === "symlink").map((file) => file.path),
  );
  for (const file of files) {
    if (file.type === "symlink")
      assertSafeSymlinkTarget(
        repository,
        file.path,
        Buffer.from(blobs.get(file.digest)!).toString("utf8"),
        symlinks,
      );
  }
  return {
    manifest,
    digest: workspaceManifestDigest(manifest),
    blobs: [...blobs].map(([blobDigest, data]) => ({
      digest: blobDigest,
      data,
    })),
  };
}

async function ensureParentDirectories(
  root: string,
  path: string,
): Promise<void> {
  let current = root;
  for (const part of path.split("/").slice(0, -1)) {
    current = resolve(current, part);
    try {
      const stat = await lstat(current);
      if (!stat.isDirectory())
        throw new Error(`Workspace parent is not a directory: ${path}`);
    } catch (error) {
      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
      await mkdir(current, { mode: 0o755 });
    }
  }
}

async function readBlob(
  reader: BlobReader,
  blobDigest: Sha256Digest,
): Promise<Uint8Array> {
  return typeof reader === "function"
    ? reader(blobDigest)
    : reader.get(blobDigest);
}

export async function materializeWorkspace(
  destination: string,
  manifest: WorkspaceManifest,
  reader: BlobReader,
): Promise<void> {
  validateWorkspaceManifest(manifest);
  const symlinks = new Set(
    manifest.files
      .filter((file) => file.type === "symlink")
      .map((file) => file.path),
  );
  const linkTargets = new Map<string, string>();
  for (const file of manifest.files) {
    if (file.type !== "symlink") continue;
    const data = await readBlob(reader, file.digest);
    if (data.byteLength !== file.size || digest(data) !== file.digest)
      throw new Error(`Blob verification failed for ${file.path}`);
    const linkTarget = Buffer.from(data).toString("utf8");
    assertSafeSymlinkTarget(destination, file.path, linkTarget, symlinks);
    linkTargets.set(file.path, linkTarget);
  }
  await mkdir(destination, { recursive: false, mode: 0o755 });
  const root = await realpath(destination);

  for (const file of manifest.files.filter((entry) => entry.type === "file")) {
    await ensureParentDirectories(root, file.path);
    const data = await readBlob(reader, file.digest);
    if (data.byteLength !== file.size || digest(data) !== file.digest)
      throw new Error(`Blob verification failed for ${file.path}`);
    const target = resolve(root, file.path);
    const handle = await open(
      target,
      constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY,
      file.mode,
    );
    try {
      await handle.writeFile(data);
      await handle.sync();
    } finally {
      await handle.close();
    }
    await chmod(target, file.mode);
  }

  for (const file of manifest.files.filter(
    (entry) => entry.type === "symlink",
  )) {
    await ensureParentDirectories(root, file.path);
    const linkTarget = linkTargets.get(file.path)!;
    const target = resolve(root, file.path);
    await symlink(linkTarget, target);
  }
}