import https from "node:https";
import { lookup } from "node:dns/promises";
import { BlockList, isIP } from "node:net";
import type { Readable } from "node:stream";
import { fileTypeFromBuffer } from "file-type";
import sharp from "sharp";
import { z } from "zod";

export const SourceImportKind = z.enum(["product_page", "fabric_page", "fabric_card", "fabric_sample"]);
export type SourceImportKind = z.infer<typeof SourceImportKind>;
/**
 * Rodzaje pobierania szersze niż wiersze source_imports — "product_image" to
 * zdjęcia galerii vendora pobierane wewnątrz joba import_product. Nie jest
 * osobnym rodzajem importu (kolumna kind w DB ma CHECK na SourceImportKind).
 */
export const SourceFetchKind = z.enum(["product_page", "fabric_page", "fabric_card", "fabric_sample", "product_image", "leg_page", "leg_image"]);
export type SourceFetchKind = z.infer<typeof SourceFetchKind>;
export const SOURCE_FETCH_VERSION = "source-fetch-v1";
const PRODUCT_HOSTS = new Set(["bobochicparis.com", "www.bobochicparis.com"]);
const PRODUCT_IMAGE_HOSTS = new Set(["bobochicparis.com", "www.bobochicparis.com", "cdn.bobochicparis.com"]);
const FABRIC_HOSTS = new Set(["sic.com.pl", "www.sic.com.pl", "davis.pl", "www.davis.pl", "pim.davis.pl", "lechfabrics.com", "www.lechfabrics.com"]);
const LEG_HOSTS = new Set(["mir-tex24.pl", "www.mir-tex24.pl"]);
const IMAGE_MIMES = new Set(["image/png", "image/jpeg", "image/webp"]);
const LIMITS = { timeoutMs: 30000, maxRedirects: 3, maxBytes: 25 * 1024 * 1024 };

export class SourceFetchError extends Error {
  constructor(public readonly code: string, message: string, public readonly retryable = false) { super(message); }
}

export function normalizeSourceUrl(raw: string, kind: SourceFetchKind) {
  const invalid = () => new SourceFetchError("invalid_url", "Niedozwolony URL źródła. Wymagany HTTPS, obsługiwany dostawca i publiczny adres bez danych logowania.");
  if (!SourceFetchKind.safeParse(kind).success || raw.length > 2048 || /[\s\\\u0000-\u001f\u007f]/.test(raw) || /%(?:0[0-9a-f]|1[0-9a-f]|7f|5c)/i.test(raw)) throw invalid();
  let url: URL;
  try { url = new URL(raw); } catch { throw invalid(); }
  const hosts = kind === "product_page" ? PRODUCT_HOSTS : kind === "product_image" ? PRODUCT_IMAGE_HOSTS : kind.startsWith("leg_") ? LEG_HOSTS : FABRIC_HOSTS;
  if (url.protocol !== "https:" || !hosts.has(url.hostname) || url.port || url.username || url.password) throw invalid();
  for (const [key, value] of url.searchParams) {
    if (!["v", "id_product_attribute", "lang"].includes(key) || !/^[\w.-]{1,64}$/.test(value) || url.searchParams.getAll(key).length !== 1) throw invalid();
  }
  if (url.hash && (kind !== "product_page" || url.hash.length > 512 || !/^#\/[\w/,.-]*$/.test(url.hash))) throw invalid();
  const requestedUrl = url.href;
  const fragment = url.hash || null;
  url.hash = "";
  return { requestedUrl, fetchUrl: url.href, fragment };
}

const blocked = new BlockList();
for (const [network, bits] of [
  ["0.0.0.0", 8], ["10.0.0.0", 8], ["100.64.0.0", 10], ["127.0.0.0", 8], ["169.254.0.0", 16],
  ["172.16.0.0", 12], ["192.0.0.0", 24], ["192.0.2.0", 24], ["192.88.99.0", 24], ["192.168.0.0", 16],
  ["198.18.0.0", 15], ["198.51.100.0", 24], ["203.0.113.0", 24], ["224.0.0.0", 4], ["240.0.0.0", 4],
] as const) blocked.addSubnet(network, bits, "ipv4");
for (const [network, bits] of [["2001::", 23], ["2001:db8::", 32], ["2002::", 16], ["3fff::", 20]] as const) blocked.addSubnet(network, bits, "ipv6");
const globalV6 = new BlockList();
globalV6.addSubnet("2000::", 3, "ipv6");

export function isPublicAddress(address: string): boolean {
  const family = isIP(address);
  return family === 4 ? !blocked.check(address, "ipv4") : family === 6 && globalV6.check(address, "ipv6") && !blocked.check(address, "ipv6");
}

interface Address { address: string; family: number }
export interface SourceResponse { status: number; headers: Record<string, string | undefined>; body: Readable }
interface RequestInput { url: URL; address: Address; signal: AbortSignal }
interface FetchDependencies {
  resolve: (hostname: string) => Promise<Address[]>;
  request: (input: RequestInput) => Promise<SourceResponse>;
}
export interface FetchedSource {
  buffer: Buffer;
  mime: string;
  finalUrl: string;
  redirects: Array<{ from: string; to: string; status: number }>;
  fetchedAt: string;
}
export type SourceFetcher = (url: string, kind: SourceFetchKind, signal?: AbortSignal) => Promise<FetchedSource>;

function requestPinned({ url, address, signal }: RequestInput): Promise<SourceResponse> {
  return new Promise((resolve, reject) => {
    const req = https.request(url, {
      method: "GET", agent: false, family: address.family,
      servername: url.hostname, rejectUnauthorized: true, signal, maxHeaderSize: 16384,
      lookup: (_hostname, _options, callback) => callback(null, address.address, address.family),
      headers: { "User-Agent": "VilmalSourceImporter/1.0", Accept: "text/html,application/xhtml+xml,application/pdf,image/jpeg,image/png,image/webp", "Accept-Encoding": "identity" },
    }, (res) => {
      const headers: Record<string, string | undefined> = {};
      for (const key of ["content-type", "content-length", "content-encoding", "location"]) {
        const value = res.headers[key];
        headers[key] = Array.isArray(value) ? value.join(",") : value;
      }
      resolve({ status: res.statusCode ?? 0, headers, body: res });
    });
    req.once("error", reject);
    req.end();
  });
}

function abortable<T>(promise: Promise<T>, signal: AbortSignal): Promise<T> {
  if (signal.aborted) {
    void promise.catch(() => {});
    return Promise.reject(signal.reason);
  }
  return new Promise((resolve, reject) => {
    const abort = () => reject(signal.reason);
    signal.addEventListener("abort", abort, { once: true });
    promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
  });
}

export async function validateSourceBytes(buffer: Buffer, declaredMime: string, kind: SourceFetchKind): Promise<string> {
  if (!buffer.length) throw new SourceFetchError("invalid_mime", "Źródło zwróciło pusty plik.");
  const mime = declaredMime.split(";")[0]!.trim().toLowerCase();
  if (kind.endsWith("_page")) {
    const prefix = buffer.subarray(0, 2048).toString("utf8");
    if (!["text/html", "application/xhtml+xml"].includes(mime) || !/^\s*(?:<!doctype\s+html|<html[\s>]|<\?xml[\s]|<!--)/i.test(prefix)) throw new SourceFetchError("invalid_mime", "Źródło nie zawiera oczekiwanego dokumentu HTML.");
    return mime;
  }
  const detected = await fileTypeFromBuffer(buffer);
  if (!detected || detected.mime !== mime || !(kind === "fabric_card" ? mime === "application/pdf" : IMAGE_MIMES.has(mime))) throw new SourceFetchError("invalid_mime", "Typ i zawartość pliku nie odpowiadają rodzajowi importu.");
  if (kind === "fabric_sample" || kind === "product_image" || kind === "leg_image") {
    try {
      const meta = await sharp(buffer, { limitInputPixels: 40_000_000 }).metadata();
      if (!meta.width || !meta.height || meta.width > 12000 || meta.height > 12000 || (meta.pages ?? 1) > 1) throw new Error("dimensions");
    } catch { throw new SourceFetchError("invalid_image", "Niepoprawna próbka lub przekroczone wymiary obrazu."); }
  }
  return mime;
}

export function createSourceFetcher(deps: Partial<FetchDependencies> = {}, options: Partial<typeof LIMITS> = {}): SourceFetcher {
  const resolve = deps.resolve ?? ((hostname) => lookup(hostname, { all: true, verbatim: true }));
  const request = deps.request ?? requestPinned;
  const limits = { ...LIMITS, ...options };
  return async (rawUrl, kind, externalSignal) => {
    let current = normalizeSourceUrl(rawUrl, kind).fetchUrl;
    const deadline = new AbortController();
    const timer = setTimeout(() => deadline.abort(), limits.timeoutMs);
    const signal = externalSignal ? AbortSignal.any([deadline.signal, externalSignal]) : deadline.signal;
    const redirects: FetchedSource["redirects"] = [];
    const maxBytes = Math.min(limits.maxBytes, kind.endsWith("_page") ? 5 * 1024 * 1024 : kind === "fabric_sample" ? 10 * 1024 * 1024 : LIMITS.maxBytes);
    let body: Readable | undefined;
    try {
      signal.throwIfAborted();
      for (;;) {
        const url = new URL(current);
        const addresses = await abortable(resolve(url.hostname), signal);
        if (!addresses.length || addresses.some((a) => !isPublicAddress(a.address) || isIP(a.address) !== a.family)) throw new SourceFetchError("blocked_address", "DNS źródła wskazuje niedozwolony adres sieciowy.");
        const address = addresses.find((a) => a.family === 4) ?? addresses[0]!;
        const res = await abortable(request({ url, address, signal }), signal);
        body = res.body;
        if ([301, 302, 303, 307, 308].includes(res.status)) {
          body.destroy();
          if (redirects.length >= limits.maxRedirects) throw new SourceFetchError("redirect_limit", "Przekroczono limit przekierowań źródła.");
          if (!res.headers.location) throw new SourceFetchError("invalid_url", "Przekierowanie źródła nie ma adresu docelowego.");
          let next: string;
          try { next = new URL(res.headers.location, current).href; } catch { throw new SourceFetchError("invalid_url", "Niepoprawne przekierowanie źródła."); }
          const to = normalizeSourceUrl(next, kind).fetchUrl;
          redirects.push({ from: current, to, status: res.status });
          current = to;
          continue;
        }
        if (res.status !== 200) throw new SourceFetchError("http_error", `Źródło odpowiedziało HTTP ${res.status}.`, [408, 429].includes(res.status) || res.status >= 500);
        const encoding = res.headers["content-encoding"]?.trim().toLowerCase();
        if (encoding && encoding !== "identity") throw new SourceFetchError("encoded_response", "Źródło zignorowało żądanie nieskompresowanej odpowiedzi.");
        const length = res.headers["content-length"];
        if (length && (!/^\d+$/.test(length) || Number(length) > maxBytes)) throw new SourceFetchError("size_limit", "Plik źródłowy przekracza limit rozmiaru.");
        const buffer = await abortable((async () => {
          const chunks: Buffer[] = [];
          let bytes = 0;
          for await (const chunk of res.body) {
            const part = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
            bytes += part.length;
            if (bytes > maxBytes) throw new SourceFetchError("size_limit", "Plik źródłowy przekracza limit rozmiaru.");
            chunks.push(part);
          }
          if (length && Number(length) !== bytes) throw new SourceFetchError("incomplete_response", "Niekompletna odpowiedź źródła.", true);
          return Buffer.concat(chunks, bytes);
        })(), signal);
        const mime = await abortable(validateSourceBytes(buffer, res.headers["content-type"] ?? "", kind), signal);
        return { buffer, mime, finalUrl: current, redirects, fetchedAt: new Date().toISOString() };
      }
    } catch (err) {
      if (signal.aborted) throw new SourceFetchError(deadline.signal.aborted ? "timeout" : "cancelled", deadline.signal.aborted ? "Przekroczono czas pobierania źródła." : "Pobieranie źródła przerwane.", true);
      if (err instanceof SourceFetchError) throw err;
      throw new SourceFetchError("network_error", "Nie udało się bezpiecznie pobrać źródła.", true);
    } finally {
      clearTimeout(timer);
      body?.destroy();
    }
  };
}

export const fetchSource = createSourceFetcher();