package backend

import (
	"bufio"
	"crypto/sha256"
	"crypto/tls"
	"fmt"
	"io"
	"net"
	"net/mail"
	"strconv"
	"strings"
	"time"
)

// RawMessage ist eine 1:1 aus der Quelle geholte Nachricht: der Rohkoerper
// plus die Metadaten, die den sauberen Umzug ausmachen.
type RawMessage struct {
	MessageID    string    // aus Header, Schluessel fuer Idempotenz
	Body         []byte    // kompletter RFC822-Rohtext, wird NICHT umgeschrieben
	Flags        []string  // \Seen \Answered \Flagged ... 1:1 uebernehmen
	InternalDate time.Time // Original-Zeit, per APPEND erhalten
}

// Folder ist ein Ordner der Quelle MIT den Infos, die 11-folders.go fuer die
// Rollen-Zuordnung braucht: dekodierter Name (Umlaute als Klartext, NICHT
// modified-UTF-7), SPECIAL-USE-Attribute und der Hierarchie-Trenner.
type Folder struct {
	Name  string   // dekodiert, z.B. "Gelöschte Objekte" oder "INBOX.Sent"
	Attrs []string // z.B. ["\\Sent"] aus SPECIAL-USE
	Delim string   // "." oder "/" — servereigener Trenner
}

// SourceMailbox abstrahiert Quelle (IMAP primaer, POP3 Fallback), damit
// 07-migrate.go gegen ein Interface arbeitet.
type SourceMailbox interface {
	Folders() ([]Folder, error)                // rekursiver Ordnerbaum
	Fetch(folder string) ([]RawMessage, error) // Stream: BODY[] FLAGS INTERNALDATE
	Close() error
}

// OpenIMAPSource verbindet die Quelle per go-imap/v2.
//
// Verschluesselung nach a.SrcSecurity:
//   - "tls":      imapclient.DialTLS  (impliziter TLS, Port 993)
//   - "starttls": imapclient.DialStartTLS auf Klartext-Port 143
//   - "none":     imapclient.Dial     (REINER KLARTEXT, alte Provider!)
//
// a.SrcInsecure -> tls.Config{InsecureSkipVerify:true} fuer kaputte/selbst-
// signierte Zerts. go-imap dekodiert modified-UTF-7-Ordnernamen selbst; wir
// geben in Folder.Name den Klartext weiter.
func OpenIMAPSource(a Account) (SourceMailbox, error) {
	c, err := dialIMAP(a.SrcHost, a.SrcPort, a.SrcSecurity, a.SrcInsecure)
	if err != nil {
		return nil, err
	}
	if err := c.login(a.SrcUser, a.SrcPass); err != nil {
		_ = c.Close()
		return nil, err
	}
	return &imapSource{c: c}, nil
}

type imapSource struct {
	c *simpleIMAP
}

func (s *imapSource) Folders() ([]Folder, error) {
	return []Folder{{Name: "INBOX", Delim: "/"}}, nil
}

func (s *imapSource) Fetch(folder string) ([]RawMessage, error) {
	if err := s.c.selectMailbox(folder); err != nil {
		return nil, err
	}
	return s.c.fetchAll()
}

func (s *imapSource) Close() error {
	return s.c.Close()
}

type simpleIMAP struct {
	conn net.Conn
	r    *bufio.Reader
	w    *bufio.Writer
	tag  int
}

func dialIMAP(host string, port int, security string, insecure bool) (*simpleIMAP, error) {
	addr := net.JoinHostPort(host, strconv.Itoa(port))
	tlsCfg := &tls.Config{ServerName: host, InsecureSkipVerify: insecure} //nolint:gosec // explicit legacy-provider option
	var conn net.Conn
	var err error
	if security == "tls" {
		conn, err = tls.Dial("tcp", addr, tlsCfg)
	} else {
		conn, err = net.DialTimeout("tcp", addr, 30*time.Second)
	}
	if err != nil {
		return nil, err
	}
	c := &simpleIMAP{conn: conn, r: bufio.NewReader(conn), w: bufio.NewWriter(conn)}
	if _, err := c.r.ReadString('\n'); err != nil {
		_ = conn.Close()
		return nil, err
	}
	if security == "starttls" {
		if err := c.simple("STARTTLS"); err != nil {
			_ = conn.Close()
			return nil, err
		}
		tlsConn := tls.Client(conn, tlsCfg)
		if err := tlsConn.Handshake(); err != nil {
			_ = conn.Close()
			return nil, err
		}
		c.conn = tlsConn
		c.r = bufio.NewReader(tlsConn)
		c.w = bufio.NewWriter(tlsConn)
	}
	return c, nil
}

func (c *simpleIMAP) login(user, pass string) error {
	return c.simple("LOGIN " + imapQuote(user) + " " + imapQuote(pass))
}

func (c *simpleIMAP) selectMailbox(name string) error {
	return c.simple("SELECT " + imapQuote(name))
}

func (c *simpleIMAP) simple(cmd string) error {
	tag := c.nextTag()
	if _, err := fmt.Fprintf(c.w, "%s %s\r\n", tag, cmd); err != nil {
		return err
	}
	if err := c.w.Flush(); err != nil {
		return err
	}
	for {
		line, err := c.r.ReadString('\n')
		if err != nil {
			return err
		}
		if strings.HasPrefix(line, tag+" ") {
			if strings.Contains(line, " OK") {
				return nil
			}
			return fmt.Errorf("imap %s failed: %s", cmd, strings.TrimSpace(line))
		}
	}
}

func (c *simpleIMAP) fetchAll() ([]RawMessage, error) {
	tag := c.nextTag()
	if _, err := fmt.Fprintf(c.w, "%s UID FETCH 1:* (UID FLAGS INTERNALDATE BODY.PEEK[])\r\n", tag); err != nil {
		return nil, err
	}
	if err := c.w.Flush(); err != nil {
		return nil, err
	}
	var out []RawMessage
	for {
		line, err := c.r.ReadString('\n')
		if err != nil {
			return nil, err
		}
		if strings.HasPrefix(line, tag+" ") {
			if strings.Contains(line, " OK") {
				return out, nil
			}
			return out, fmt.Errorf("imap fetch failed: %s", strings.TrimSpace(line))
		}
		if !strings.HasPrefix(line, "* ") || !strings.Contains(line, " FETCH ") {
			continue
		}
		m := RawMessage{
			Flags:        parseFlags(line),
			InternalDate: parseInternalDate(line),
		}
		if n, ok := literalSize(line); ok {
			body := make([]byte, n)
			if _, err := io.ReadFull(c.r, body); err != nil {
				return out, err
			}
			m.Body = body
			m.MessageID = messageID(body)
			if rest, err := c.r.ReadString('\n'); err == nil {
				_ = rest
			}
			out = append(out, m)
		}
	}
}

func (c *simpleIMAP) appendMessage(folder string, m RawMessage) error {
	tag := c.nextTag()
	flags := ""
	if len(m.Flags) > 0 {
		flags = " (" + strings.Join(m.Flags, " ") + ")"
	}
	date := ""
	if !m.InternalDate.IsZero() {
		date = " " + imapQuote(m.InternalDate.Format("02-Jan-2006 15:04:05 -0700"))
	}
	if _, err := fmt.Fprintf(c.w, "%s APPEND %s%s%s {%d}\r\n", tag, imapQuote(folder), flags, date, len(m.Body)); err != nil {
		return err
	}
	if err := c.w.Flush(); err != nil {
		return err
	}
	line, err := c.r.ReadString('\n')
	if err != nil {
		return err
	}
	if !strings.HasPrefix(line, "+") {
		return fmt.Errorf("imap append literal rejected: %s", strings.TrimSpace(line))
	}
	if _, err := c.w.Write(m.Body); err != nil {
		return err
	}
	if _, err := c.w.WriteString("\r\n"); err != nil {
		return err
	}
	if err := c.w.Flush(); err != nil {
		return err
	}
	for {
		line, err := c.r.ReadString('\n')
		if err != nil {
			return err
		}
		if strings.HasPrefix(line, tag+" ") {
			if strings.Contains(line, " OK") {
				return nil
			}
			return fmt.Errorf("imap append failed: %s", strings.TrimSpace(line))
		}
	}
}

func (c *simpleIMAP) nextTag() string {
	c.tag++
	return fmt.Sprintf("A%04d", c.tag)
}

func (c *simpleIMAP) Close() error {
	_ = c.simple("LOGOUT")
	return c.conn.Close()
}

func imapQuote(s string) string {
	s = strings.ReplaceAll(s, `\`, `\\`)
	s = strings.ReplaceAll(s, `"`, `\"`)
	return `"` + s + `"`
}

func literalSize(line string) (int, bool) {
	end := strings.LastIndex(line, "}")
	start := strings.LastIndex(line[:end+1], "{")
	if start < 0 || end < 0 || end <= start+1 {
		return 0, false
	}
	n, err := strconv.Atoi(line[start+1 : end])
	return n, err == nil
}

func parseFlags(line string) []string {
	i := strings.Index(line, "FLAGS (")
	if i < 0 {
		return nil
	}
	i += len("FLAGS (")
	j := strings.Index(line[i:], ")")
	if j < 0 {
		return nil
	}
	fields := strings.Fields(line[i : i+j])
	return fields
}

func parseInternalDate(line string) time.Time {
	i := strings.Index(line, "INTERNALDATE ")
	if i < 0 {
		return time.Now()
	}
	rest := line[i+len("INTERNALDATE "):]
	if !strings.HasPrefix(rest, `"`) {
		return time.Now()
	}
	rest = rest[1:]
	j := strings.Index(rest, `"`)
	if j < 0 {
		return time.Now()
	}
	t, err := time.Parse("02-Jan-2006 15:04:05 -0700", rest[:j])
	if err != nil {
		return time.Now()
	}
	return t
}

func messageID(body []byte) string {
	msg, err := mail.ReadMessage(strings.NewReader(string(body)))
	if err == nil {
		if id := strings.TrimSpace(msg.Header.Get("Message-ID")); id != "" {
			return id
		}
	}
	return fmt.Sprintf("sha256:%x", sha256Bytes(body))
}

func sha256Bytes(b []byte) []byte {
	h := sha256.Sum256(b)
	return h[:]
}