import * as path from "jsr:@std/path@0.225.2";

export const ENV_PATH = path.join("infra", "stack.env");
export const SPIRE_ENV_PATH = path.join("infra", ".env.spire");
export const COMPOSE_PATH = path.join("infra", "compose.yml");
export const SPIRE_COMPOSE_PATH = path.join("infra", "compose.spire.yml");

export interface AuthSetupConfig {
  reg: string;
  ghcrReg: string;
  domainName: string;
  dbPassword: string;
  dbDataPath: string;
  spireDataPath: string;
  appSecret: string;
}

export const DEFAULT_AUTH_CONFIG: AuthSetupConfig = {
  reg: "quay.atyg.org",
  ghcrReg: "ghcr.atyg.org",
  domainName: "auth.system.local",
  dbPassword: "",
  dbDataPath: "/volume1/docker/auth-yes/data",
  spireDataPath: "/volume1/docker/spire",
  appSecret: "",
};

export async function readEnv(): Promise<Partial<AuthSetupConfig>> {
  const config: Partial<AuthSetupConfig> = {};
  for (
    const filePath of [
      ENV_PATH,
      path.join("infra", ".env"),
      SPIRE_ENV_PATH,
      path.join("infra", "stack.env.spire"),
    ]
  ) {
    try {
      const text = await Deno.readTextFile(filePath);
      for (const line of text.split("\n")) {
        const trimmed = line.trim();
        if (!trimmed || trimmed.startsWith("#")) continue;
        const [key, ...rest] = trimmed.split("=");
        const val = rest.join("=").trim();
        if (key === "REG") config.reg = val;
        if (key === "GHCR_REG") config.ghcrReg = val;
        if (key === "SYSTEM_DOMAIN") config.domainName = val;
        if (key === "POSTGRES_PASSWORD") config.dbPassword = val;
        if (key === "DB_DATA_PATH") config.dbDataPath = val;
        if (key === "SPIRE_DATA_PATH") config.spireDataPath = val;
        if (key === "APP_SECRET") config.appSecret = val;
      }
    } catch (_e) {
      // Ignore and check next
    }
  }
  return config;
}

export function generateEnv(config: AuthSetupConfig): string {
  return `# --- Container Registry ---
REG=${config.reg}

# --- Network & Routing ---
SYSTEM_DOMAIN=${config.domainName}
RP_ID=${config.domainName}
ORIGIN=https://${config.domainName}

# --- Identity Provider Internal App Secret ---
APP_SECRET=${config.appSecret}

# --- Database Configuration ---
POSTGRES_HOST=auth-db
POSTGRES_PORT=5432
POSTGRES_USER=postgres
POSTGRES_DB=authdb
POSTGRES_PASSWORD=${config.dbPassword}
DB_DATA_PATH=${config.dbDataPath || "/volume1/docker/auth-yes/data"}

# --- Valkey Configuration ---
VALKEY_HOST=auth-valkey
VALKEY_PORT=6379
VALKEY_URL=redis://auth-valkey:6379
`;
}

export function generateSpireEnv(config: AuthSetupConfig): string {
  return `# --- Container Registry ---
REG=${config.reg}
GHCR_REG=${config.ghcrReg || "ghcr.atyg.org"}

# --- SPIRE Storage & Persistence ---
SPIRE_DATA_PATH=${config.spireDataPath || "/volume1/docker/spire"}
`;
}