// Copyright © 2023 Cisco Systems, Inc. and its affiliates.
// All rights reserved.
//
// Licensed under the Mozilla Public License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//	https://mozilla.org/MPL/2.0/
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
// SPDX-License-Identifier: MPL-2.0
package provider

// RESOURCE NORMAL
import (
	"context"
	"slices"
	"strconv"

	merakigosdk "github.com/meraki/dashboard-api-go/v5/sdk"

	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
	"github.com/hashicorp/terraform-plugin-framework/path"
	"github.com/hashicorp/terraform-plugin-framework/resource"
	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
	"github.com/hashicorp/terraform-plugin-framework/resource/schema/listplanmodifier"
	"github.com/hashicorp/terraform-plugin-framework/resource/schema/objectplanmodifier"
	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
	"github.com/hashicorp/terraform-plugin-framework/resource/schema/setdefault"
	"github.com/hashicorp/terraform-plugin-framework/resource/schema/setplanmodifier"
	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
	"github.com/hashicorp/terraform-plugin-framework/types"
	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
)

var (
	_ resource.Resource              = &NetworksApplianceFirewallL7FirewallRulesResource{}
	_ resource.ResourceWithConfigure = &NetworksApplianceFirewallL7FirewallRulesResource{}
)

func NewNetworksApplianceFirewallL7FirewallRulesResource() resource.Resource {
	return &NetworksApplianceFirewallL7FirewallRulesResource{}
}

type NetworksApplianceFirewallL7FirewallRulesResource struct {
	client *merakigosdk.Client
}

func (r *NetworksApplianceFirewallL7FirewallRulesResource) Configure(ctx context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
	if req.ProviderData == nil {
		return
	}
	client := req.ProviderData.(MerakiProviderData).Client
	r.client = client
}

// Metadata returns the data source type name.
func (r *NetworksApplianceFirewallL7FirewallRulesResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
	resp.TypeName = req.ProviderTypeName + "_networks_appliance_firewall_l7_firewall_rules"
}

func (r *NetworksApplianceFirewallL7FirewallRulesResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
	resp.Schema = schema.Schema{
		Attributes: map[string]schema.Attribute{
			"network_id": schema.StringAttribute{
				MarkdownDescription: `networkId path parameter. Network ID`,
				Required:            true,
			},
			"rules": schema.ListNestedAttribute{
				MarkdownDescription: `An ordered array of the MX L7 firewall rules`,
				Optional:            true,
				PlanModifiers: []planmodifier.List{
					listplanmodifier.UseStateForUnknown(),
				},
				NestedObject: schema.NestedAttributeObject{
					Attributes: map[string]schema.Attribute{

						"policy": schema.StringAttribute{
							MarkdownDescription: `'Deny' traffic specified by this rule
                                        Allowed values: [deny]`,
							Optional: true,
							PlanModifiers: []planmodifier.String{
								stringplanmodifier.UseStateForUnknown(),
							},
							Validators: []validator.String{
								stringvalidator.OneOf(
									"deny",
								),
							},
						},
						"type": schema.StringAttribute{
							MarkdownDescription: `Type of the L7 rule. One of: 'application', 'applicationCategory', 'host', 'port', 'ipRange'`,
							Optional:            true,
							PlanModifiers: []planmodifier.String{
								stringplanmodifier.UseStateForUnknown(),
							},
							Validators: []validator.String{
								stringvalidator.OneOf(
									"application",
									"applicationCategory",
									"host",
									"ipRange",
									"port",
									"blockedCountries",
									"allowedCountries",
								),
							},
						},
						"value": schema.StringAttribute{
							MarkdownDescription: `The 'value' of what you want to block. Format of 'value' varies depending on type of the rule. The application categories and application ids can be retrieved from the the 'MX L7 application categories' endpoint. The countries follow the two-letter ISO 3166-1 alpha-2 format.`,
							Optional:            true,
							PlanModifiers: []planmodifier.String{
								stringplanmodifier.UseStateForUnknown(),
							},
						},
						"value_list": schema.SetAttribute{
							MarkdownDescription: `The 'value_list' of what you want to block. Send a list in request`,
							Computed:            true,
							Optional:            true,
							PlanModifiers: []planmodifier.Set{
								setplanmodifier.UseStateForUnknown(),
							},
							ElementType: types.StringType,
							Default:     setdefault.StaticValue(types.SetNull(basetypes.StringType{})),
						},
						"value_obj": schema.SingleNestedAttribute{
							MarkdownDescription: `The 'value_obj' of what you want to block. Send a dict in request`,
							Computed:            true,
							Optional:            true,
							PlanModifiers: []planmodifier.Object{
								objectplanmodifier.UseStateForUnknown(),
							},
							Attributes: map[string]schema.Attribute{
								"id": schema.StringAttribute{
									Computed: true,
									PlanModifiers: []planmodifier.String{
										stringplanmodifier.UseStateForUnknown(),
									},
								},
								"name": schema.StringAttribute{
									Computed: true,
									PlanModifiers: []planmodifier.String{
										stringplanmodifier.UseStateForUnknown(),
									},
								},
							},
						},
					},
				},
			},
		},
	}
}

func (r *NetworksApplianceFirewallL7FirewallRulesResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
	// Retrieve values from plan
	var data NetworksApplianceFirewallL7FirewallRulesRs

	var item types.Object
	resp.Diagnostics.Append(req.Plan.Get(ctx, &item)...)
	if resp.Diagnostics.HasError() {
		return
	}

	resp.Diagnostics.Append(item.As(ctx, &data, basetypes.ObjectAsOptions{
		UnhandledNullAsEmpty:    true,
		UnhandledUnknownAsEmpty: true,
	})...)

	if resp.Diagnostics.HasError() {
		return
	}
	// Has Paths
	vvNetworkID := data.NetworkID.ValueString()
	//Has Item and not has items

	// UPDATE NO CREATE
	dataRequest := data.toSdkApiRequestUpdate(ctx)
	restyResp2, err := r.client.Appliance.UpdateNetworkApplianceFirewallL7FirewallRules(vvNetworkID, dataRequest)
	//Update
	if err != nil || restyResp2 == nil {
		if restyResp2 != nil {
			resp.Diagnostics.AddError(
				"Failure when executing UpdateNetworkApplianceFirewallL7FirewallRules",
				"Status: "+strconv.Itoa(restyResp2.StatusCode())+"\n"+restyResp2.String(),
			)
			return
		}
		resp.Diagnostics.AddError(
			"Failure when executing UpdateNetworkApplianceFirewallL7FirewallRules",
			err.Error(),
		)
		return
	}

	// Assign data
	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)

}

func (r *NetworksApplianceFirewallL7FirewallRulesResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
	var data NetworksApplianceFirewallL7FirewallRulesRs

	diags := req.State.Get(ctx, &data)
	if resp.Diagnostics.Append(diags...); resp.Diagnostics.HasError() {
		return
	}

	//Has Paths
	// Has Item2

	vvNetworkID := data.NetworkID.ValueString()
	responseGet, restyRespGet, err := r.client.Appliance.GetNetworkApplianceFirewallL7FirewallRules(vvNetworkID)
	if err != nil || restyRespGet == nil {
		if restyRespGet != nil {
			if restyRespGet.StatusCode() == 404 {
				resp.Diagnostics.AddWarning(
					"Resource not found",
					"Deleting resource",
				)
				resp.State.RemoveResource(ctx)
				return
			}
			resp.Diagnostics.AddError(
				"Failure when executing GetNetworkApplianceFirewallL7FirewallRules",
				restyRespGet.String(),
			)
			return
		}
		resp.Diagnostics.AddError(
			"Failure when executing GetNetworkApplianceFirewallL7FirewallRules",
			err.Error(),
		)
		return
	}
	//entro aqui 2
	data = ResponseApplianceGetNetworkApplianceFirewallL7FirewallRulesItemToBodyRs(data, responseGet, true)
	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
}
func (r *NetworksApplianceFirewallL7FirewallRulesResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("network_id"), req.ID)...)
}

func (r *NetworksApplianceFirewallL7FirewallRulesResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
	var plan NetworksApplianceFirewallL7FirewallRulesRs
	merge(ctx, req, resp, &plan)

	if resp.Diagnostics.HasError() {
		return
	}
	//Path Params
	vvNetworkID := plan.NetworkID.ValueString()
	dataRequest := plan.toSdkApiRequestUpdate(ctx)
	restyResp2, err := r.client.Appliance.UpdateNetworkApplianceFirewallL7FirewallRules(vvNetworkID, dataRequest)
	if err != nil || restyResp2 == nil {
		if restyResp2 != nil {
			resp.Diagnostics.AddError(
				"Failure when executing UpdateNetworkApplianceFirewallL7FirewallRules",
				"Status: "+strconv.Itoa(restyResp2.StatusCode())+"\n"+restyResp2.String(),
			)
			return
		}
		resp.Diagnostics.AddError(
			"Failure when executing UpdateNetworkApplianceFirewallL7FirewallRules",
			err.Error(),
		)
		return
	}
	resp.Diagnostics.Append(resp.State.Set(ctx, &plan)...)
}

func (r *NetworksApplianceFirewallL7FirewallRulesResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
	//missing delete
	resp.Diagnostics.AddWarning("Error deleting NetworksApplianceFirewallL7FirewallRules", "This resource has no delete method in the meraki lab, the resource was deleted only in terraform.")
	resp.State.RemoveResource(ctx)
}

// TF Structs Schema
type NetworksApplianceFirewallL7FirewallRulesRs struct {
	NetworkID types.String                                                          `tfsdk:"network_id"`
	Rules     *[]ResponseApplianceGetNetworkApplianceFirewallL7FirewallRulesRulesRs `tfsdk:"rules"`
}

type ResponseApplianceGetNetworkApplianceFirewallL7FirewallRulesRulesRs struct {
	Policy    types.String                                                                `tfsdk:"policy"`
	Type      types.String                                                                `tfsdk:"type"`
	Value     types.String                                                                `tfsdk:"value"`
	ValueList types.Set                                                                   `tfsdk:"value_list"`
	ValueObj  *ResponseWirelessGetNetworkWirelessSsidFirewallL7FirewallRulesRulesValueObj `tfsdk:"value_obj"`
}

// FromBody
func (r *NetworksApplianceFirewallL7FirewallRulesRs) toSdkApiRequestUpdate(ctx context.Context) *merakigosdk.RequestApplianceUpdateNetworkApplianceFirewallL7FirewallRules {
	var requestApplianceUpdateNetworkApplianceFirewallL7FirewallRulesRules []merakigosdk.RequestApplianceUpdateNetworkApplianceFirewallL7FirewallRulesRules

	if r.Rules != nil {
		for _, rItem1 := range *r.Rules {
			var valueR interface{}
			policy := rItem1.Policy.ValueString()
			typeR := rItem1.Type.ValueString()
			value := rItem1.Value.ValueString()
			var valueList []string
			rItem1.ValueList.ElementsAs(ctx, &valueList, false)
			var requestApplianceUpdateNetworkApplianceFirewallL7FirewallRulesRulesValue *merakigosdk.RequestApplianceUpdateNetworkApplianceFirewallL7FirewallRulesRulesValue
			if rItem1.ValueObj != nil {
				name := rItem1.ValueObj.Name.ValueString()
				id := rItem1.ValueObj.ID.ValueString()
				requestApplianceUpdateNetworkApplianceFirewallL7FirewallRulesRulesValue = &merakigosdk.RequestApplianceUpdateNetworkApplianceFirewallL7FirewallRulesRulesValue{
					ID:   id,
					Name: name,
				}
			}
			if !rItem1.Value.IsNull() && !rItem1.Value.IsUnknown() && rItem1.Type.ValueString() != "blockedCountries" && rItem1.Type.ValueString() != "applicationCategory" && rItem1.Type.ValueString() != "allowedCountries" {
				valueR = value
			} else {
				if !rItem1.ValueList.IsNull() && !rItem1.ValueList.IsUnknown() && slices.Contains([]string{"blockedCountries", "allowedCountries"}, rItem1.Type.ValueString()) {
					valueR = valueList
				} else {
					valueR = requestApplianceUpdateNetworkApplianceFirewallL7FirewallRulesRulesValue
				}
			}
			requestApplianceUpdateNetworkApplianceFirewallL7FirewallRulesRules = append(requestApplianceUpdateNetworkApplianceFirewallL7FirewallRulesRules, merakigosdk.RequestApplianceUpdateNetworkApplianceFirewallL7FirewallRulesRules{
				Policy: policy,
				Type:   typeR,
				Value:  valueR,
			})
			//[debug] Is Array: True
		}
	}
	out := merakigosdk.RequestApplianceUpdateNetworkApplianceFirewallL7FirewallRules{
		Rules: func() *[]merakigosdk.RequestApplianceUpdateNetworkApplianceFirewallL7FirewallRulesRules {
			if len(requestApplianceUpdateNetworkApplianceFirewallL7FirewallRulesRules) > 0 || r.Rules != nil {
				return &requestApplianceUpdateNetworkApplianceFirewallL7FirewallRulesRules
			} else {
				rules := make([]merakigosdk.RequestApplianceUpdateNetworkApplianceFirewallL7FirewallRulesRules, 0)
				return &rules
			}
		}(),
	}
	return &out
}

// From gosdk to TF Structs Schema
func ResponseApplianceGetNetworkApplianceFirewallL7FirewallRulesItemToBodyRs(state NetworksApplianceFirewallL7FirewallRulesRs, response *merakigosdk.ResponseApplianceGetNetworkApplianceFirewallL7FirewallRules, is_read bool) NetworksApplianceFirewallL7FirewallRulesRs {
	itemState := NetworksApplianceFirewallL7FirewallRulesRs{
		Rules: func() *[]ResponseApplianceGetNetworkApplianceFirewallL7FirewallRulesRulesRs {
			if response.Rules != nil {
				result := make([]ResponseApplianceGetNetworkApplianceFirewallL7FirewallRulesRulesRs, len(*response.Rules))
				for i, rules := range *response.Rules {
					result[i] = ResponseApplianceGetNetworkApplianceFirewallL7FirewallRulesRulesRs{
						Policy: func() types.String {
							if rules.Policy != "" {
								return types.StringValue(rules.Policy)
							}
							return types.String{}
						}(),
						Type: func() types.String {
							if rules.Type != "" {
								return types.StringValue(rules.Type)
							}
							return types.String{}
						}(),
						Value: func() types.String {
							if rules.Value == nil {
								return types.StringNull()
							}
							return types.StringValue(*rules.Value)
						}(),
						ValueList: func() types.Set {
							if rules.ValueList == nil {
								return types.SetNull(types.StringType)
							}
							return StringSliceToSet(*rules.ValueList)
						}(),
						ValueObj: func() *ResponseWirelessGetNetworkWirelessSsidFirewallL7FirewallRulesRulesValueObj {
							if rules.ValueObj == nil {
								return nil
							}
							return &ResponseWirelessGetNetworkWirelessSsidFirewallL7FirewallRulesRulesValueObj{
								ID: func() types.String {
									if rules.ValueObj.ID != "" {
										return types.StringValue(rules.ValueObj.ID)
									}
									return types.String{}
								}(),
								Name: func() types.String {
									if rules.ValueObj.Name != "" {
										return types.StringValue(rules.ValueObj.Name)
									}
									return types.String{}
								}(),
							}
						}(),
					}
				}
				return &result
			}
			return nil
		}(),
	}
	if is_read {
		return mergeInterfacesOnlyPath(state, itemState).(NetworksApplianceFirewallL7FirewallRulesRs)
	}
	return mergeInterfaces(state, itemState, true).(NetworksApplianceFirewallL7FirewallRulesRs)
}
