/*
Copyright 2021.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package tor

import (
	"context"

	corev1 "k8s.io/api/core/v1"
	apierrors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime/schema"
	"k8s.io/apimachinery/pkg/types"
	"k8s.io/apimachinery/pkg/util/runtime"
	k8slog "sigs.k8s.io/controller-runtime/pkg/log"

	torv1alpha2 "github.com/bugfest/tor-controller/apis/tor/v1alpha2"
	"github.com/cockroachdb/errors"
	"github.com/m1/go-generate-password/generator"
)

const (
	passwordLength = 16
)

func (r *Reconciler) reconcileControlSecret(ctx context.Context, tor *torv1alpha2.Tor) error {
	logger := k8slog.FromContext(ctx)

	secretName := tor.SecretName()
	namespace := tor.Namespace

	if secretName == "" {
		// We choose to absorb the error here as the worker would requeue the
		// resource otherwise. Instead, the next time the resource is updated
		// the resource will be queued again.
		runtime.HandleError(errors.New("secret name must be specified"))

		return nil
	}

	var secret corev1.Secret
	err := r.Get(ctx, types.NamespacedName{Name: secretName, Namespace: namespace}, &secret)

	password := generateRandomPassword()
	newSecret := torSecret(tor, password)

	if apierrors.IsNotFound(err) {
		err := r.Create(ctx, newSecret)
		if err != nil {
			return errors.Wrapf(err, "failed to create secret %#v", newSecret)
		}

		secret = *newSecret
	} else if err != nil {
		return errors.Wrapf(err, "failed to get secret %s", secretName)
	}

	var tmpSecret corev1.Secret
	for _, secretRef := range tor.Spec.Control.SecretRef {
		err := r.Get(ctx, types.NamespacedName{Name: secretRef.Name, Namespace: namespace}, &tmpSecret)
		if err != nil {
			return errors.Wrapf(err, "failed to get secret %s", secretRef.Name)
		}

		for k := range tmpSecret.Data {
			if k == secretRef.Key {
				// Adds all the referenced secrets to Tor.Spec.Control.Secret for later use
				tor.Spec.Control.Secret = append(tor.Spec.Control.Secret, string(tmpSecret.Data[k]))
			}
		}
	}

	if len(tor.Spec.Control.Secret) == 0 && len(tor.Spec.Control.SecretRef) == 0 {
		// If the user did not define any password in the Control spec,
		// update Control Secrets with the generated one
		for _, s := range secret.Data {
			tor.Spec.Control.Secret = append(tor.Spec.Control.Secret, string(s))
		}
	}

	if !metav1.IsControlledBy(&secret.ObjectMeta, tor) {
		// msg := fmt.Sprintf("Secret %s already exists and is not controller by %s", secret.Name, OnionBalancedService.Name)
		// TODO: generate MessageResourceExists event
		// msg := fmt.Sprintf(MessageResourceExists, service.Name)
		// bc.recorder.Event(OnionBalancedService, corev1.EventTypeWarning, ErrResourceExists, msg)
		// return errors.New(msg)
		logger.Info("Secret already exists and is not controlled by",
			"secret", secret.Name,
			"controller", tor.Name)

		return nil
	}

	return nil
}

func torSecret(tor *torv1alpha2.Tor, password string) *corev1.Secret {
	return &corev1.Secret{
		ObjectMeta: metav1.ObjectMeta{
			Name:      tor.SecretName(),
			Namespace: tor.Namespace,
			OwnerReferences: []metav1.OwnerReference{
				*metav1.NewControllerRef(tor, schema.GroupVersionKind{
					Group:   torv1alpha2.GroupVersion.Group,
					Version: torv1alpha2.GroupVersion.Version,
					Kind:    "Tor",
				}),
			},
		},
		Type: "tor.k8s.torproject.org/control-password",
		Data: map[string][]byte{
			"control": []byte(password),
		},
	}
}

func generateRandomPassword() string {
	config := generator.Config{
		Length:                     passwordLength,
		IncludeSymbols:             false,
		IncludeNumbers:             true,
		IncludeLowercaseLetters:    true,
		IncludeUppercaseLetters:    true,
		ExcludeSimilarCharacters:   true,
		ExcludeAmbiguousCharacters: true,
	}
	g, _ := generator.New(&config)

	pwd, _ := g.Generate()

	return *pwd
}
