package server

import (
	"io/fs"
	"net/http"
	"strings"
	"time"

	sentryhttp "github.com/getsentry/sentry-go/http"
	"github.com/go-chi/chi/v5"
	chimw "github.com/go-chi/chi/v5/middleware"
	"github.com/prometheus/client_golang/prometheus/promhttp"

	"sneak.berlin/go/dnswatcher/static"
)

// requestTimeout is the maximum duration for handling a request.
const requestTimeout = 60 * time.Second

// SetupRoutes configures all HTTP routes.
func (s *Server) SetupRoutes() {
	s.router = chi.NewRouter()

	// Global middleware
	s.router.Use(chimw.Recoverer)
	s.router.Use(chimw.RequestID)
	s.router.Use(s.mw.SecurityHeaders())
	s.router.Use(s.mw.Logging())
	s.router.Use(chimw.Timeout(requestTimeout))

	// Report panics in handlers to Sentry when DNSWATCHER_SENTRY_DSN is
	// set. Repanic passes each panic on to chimw.Recoverer above, which
	// still answers the request.
	if s.sentryEnabled {
		sentryHandler := sentryhttp.New(sentryhttp.Options{
			Repanic: true,
		})
		s.router.Use(sentryHandler.Handle)
	}

	// Public, unauthenticated, read-only routes, the only ones
	// REPO_POLICIES.md allows wildcard CORS on. CORS is middleware of
	// this whole router, not of a Group, so that it also answers
	// OPTIONS preflight requests, which no route here registers.
	public := chi.NewRouter()
	public.Use(s.mw.CORS())

	// Dashboard (read-only web UI)
	public.Get("/", s.handlers.HandleDashboard())

	// Static assets (embedded CSS/JS)
	public.Mount("/s", http.StripPrefix("/s", staticAssets()))

	// Health check (standard well-known path)
	public.Get(
		"/.well-known/healthcheck",
		s.handlers.HandleHealthCheck(),
	)

	// Legacy health check (keep for backward compatibility)
	public.Get("/health", s.handlers.HandleHealthCheck())

	// API v1 routes
	public.Route("/api/v1", func(r chi.Router) {
		r.Get("/status", s.handlers.HandleStatus())
	})

	s.router.Mount("/", public)

	// Metrics endpoint (optional, with basic auth) and no CORS: a
	// Prometheus scraper is not a browser. It is mounted rather than
	// added with Get so that every method on /metrics, OPTIONS
	// included, ends here instead of falling through to the public
	// router and its CORS. The rate limit comes before Basic Auth, so
	// failed logins count against it and a request over the limit
	// never reaches the password check.
	if s.params.Config.MetricsUsername != "" {
		metrics := chi.NewRouter()
		metrics.Use(s.mw.MetricsRateLimit())
		metrics.Use(s.mw.MetricsAuth())
		metrics.Get("/", promhttp.Handler().ServeHTTP)
		s.router.Mount("/metrics", metrics)
	}
}

// staticAssets serves the embedded static assets, with the /s prefix
// already stripped from the path. A request that names a directory
// answers 404: http.FileServer would answer it with a listing of the
// directory, or with a redirect to that listing when the trailing
// slash is missing.
func staticAssets() http.Handler {
	files := http.FileServer(http.FS(static.Static))

	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// fs.Stat refuses a name that is empty or ends in a slash,
		// so /s/ and /s/css/ answer 404 here along with /s/css.
		name := strings.TrimPrefix(r.URL.Path, "/")

		info, err := fs.Stat(static.Static, name)
		if err != nil || info.IsDir() {
			http.NotFound(w, r)

			return
		}

		files.ServeHTTP(w, r)
	})
}