import type {
    BUN_SQLITE_WGUI_CLIENT_ROUTES,
    BUN_SQLITE_WGUI_TLS_CERTIFICATES,
} from "@/db/types/db";
import BunSQLite from "@moduletrace/bun-sqlite";
import type { TableType } from "@/src/types";
import { TlsData } from "@/src/data/tls-data";
import grabCaddyStatus from "../caddy/grab-caddy-status";
import grabCaddySettings from "../caddy/grab-caddy-settings";
import grabCertDirNames from "../caddy/grab-cert-dir-names";
import readAcmeEnv from "./read-acme-env";
import readCertificateExpiry from "./read-certificate-expiry";

export default async function grabTlsStatus() {
    const certificates_res = await BunSQLite.select<
        BUN_SQLITE_WGUI_TLS_CERTIFICATES,
        TableType
    >({
        table: "tls_certificates",
        query: {
            order: { field: "hostname", strategy: "ASC" },
        },
    });

    const routes_res = await BunSQLite.select<
        BUN_SQLITE_WGUI_CLIENT_ROUTES,
        TableType
    >({
        table: "client_routes",
    });

    const acme_env = readAcmeEnv();
    const now = Date.now();
    const renew_before = TlsData.RenewBeforeDays * 24 * 60 * 60 * 1000;

    const certificates = (certificates_res.payload || []).map(
        (certificate) => {
            const expires_at = readCertificateExpiry({
                cert_path: certificate.cert_path,
            });

            let status = certificate.status || "missing";

            if (expires_at) {
                if (expires_at <= now) {
                    status = "error";
                } else if (expires_at - now <= renew_before) {
                    status = "expiring";
                } else if (status != "issuing") {
                    status = "active";
                }
            }

            return {
                ...certificate,
                hostname: certificate.hostname?.trim().toLowerCase(),
                expires_at: expires_at || certificate.expires_at || null,
                status,
                has_certificate: Boolean(expires_at),
            };
        },
    );

    const known_hostnames = new Set(
        certificates
            .map((certificate) => certificate.hostname)
            .filter(Boolean),
    );

    for (let i = 0; i < (routes_res.payload || []).length; i++) {
        const route = routes_res.payload?.[i];
        const hostname = route?.hostname?.trim().toLowerCase();

        if (!hostname || known_hostnames.has(hostname)) {
            continue;
        }

        const { CERT_FILE, KEY_FILE } = grabCertDirNames({ hostname });

        certificates.push({
            hostname,
            provider: "letsencrypt",
            challenge: "dns-01",
            cert_path: CERT_FILE,
            key_path: KEY_FILE,
            status: "missing",
            auto_renew: 1,
            expires_at: null,
            has_certificate: false,
        });

        known_hostnames.add(hostname);
    }

    certificates.sort((a, b) =>
        (a.hostname || "").localeCompare(b.hostname || ""),
    );

    const settings = await grabCaddySettings();

    return {
        caddy: grabCaddyStatus(settings),
        certificates,
        acme: {
            env_path: acme_env.exists ? `/etc/wgui/acme.env` : null,
            env_exists: acme_env.exists,
            provider:
                acme_env.values.ACME_DNS_PROVIDER ||
                TlsData.DefaultDnsProvider ||
                null,
            email_configured: Boolean(acme_env.values.ACME_EMAIL),
            credential_keys: acme_env.keys.filter(
                (key) =>
                    key != "ACME_EMAIL" && key != "ACME_DNS_PROVIDER",
            ),
            staging: TlsData.AcmeStaging,
        },
        https_port: settings.https_port,
        http_port: settings.http_port,
        redirect: settings.redirect,
    };
}