use crate::models::inventory::Host;
use crate::output;
use crate::selector::select_item;
use crate::services::inventory::get_hosts;
use clap::Subcommand;
use eyre::{Result, WrapErr};
use std::process::Command;

#[derive(Subcommand)]
pub enum SshCommands {
    #[command(alias = "k")]
    Keygen {
        #[arg(short = 'H', long, help = "Target host")]
        host: Option<String>,
        #[arg(
            short,
            long,
            default_value = "ansible",
            help = "User (ansible or your configured username)"
        )]
        user: String,
        #[arg(short, long, help = "Force overwrite existing key")]
        force: bool,
    },
    #[command(alias = "ak", about = "Add/authorize SSH public key on remote host")]
    AddKey {
        #[arg(short = 'H', long, help = "Target host")]
        host: Option<String>,
        #[arg(short = 'c', long, help = "SSH private key to connect with")]
        connect_with: Option<std::path::PathBuf>,
        #[arg(short = 'a', long, help = "Public key file to authorize on remote")]
        authorize: Option<std::path::PathBuf>,
        #[arg(
            short,
            long,
            default_value = "ansible",
            help = "Remote user to authorize key for"
        )]
        user: String,
        #[arg(short = 'y', long, help = "Skip confirmation prompt")]
        yes: bool,
    },
}

pub fn run_ssh_keygen(host_arg: Option<String>, user: String, force: bool) -> Result<()> {
    let host = match host_arg {
        Some(name) => crate::services::inventory::get_host(&name, None)?,
        None => {
            let hosts = get_hosts(None, None)?;
            select_item(
                &hosts,
                |h: &Host| {
                    format!(
                        "{} ({}:{})",
                        h.name, h.vars.ansible_host, h.vars.ansible_port
                    )
                },
                "Select host",
            )?
            .ok_or_else(|| eyre::eyre!("No host selected"))?
        }
    };

    let ssh_dir = dirs::home_dir()
        .ok_or_else(|| eyre::eyre!("Could not determine home directory"))?
        .join(".ssh/identities");

    std::fs::create_dir_all(&ssh_dir).wrap_err("Failed to create SSH identities directory")?;

    let key_path = ssh_dir.join(format!("{}_{}", user, host.name));

    if key_path.exists() && !force {
        output::success(&format!("Key already exists: {}", key_path.display()));
        return Ok(());
    }

    output::info(&format!("Generating SSH key for {}@{}", user, host.name));

    let mut cmd = Command::new("ssh-keygen");
    cmd.arg("-t")
        .arg("ed25519")
        .arg("-f")
        .arg(&key_path)
        .arg("-C")
        .arg(format!("{}@{}", user, host.name))
        .arg("-N")
        .arg("");

    if force {
        cmd.arg("-y");
    }

    let status = cmd.status().wrap_err("Failed to execute ssh-keygen")?;

    if status.success() {
        output::success(&format!("Generated key: {}", key_path.display()));
        output::info(&format!("Public key: {}.pub", key_path.display()));
        Ok(())
    } else {
        eyre::bail!("ssh-keygen failed")
    }
}

pub fn run_ssh_add_key(
    host_arg: Option<String>,
    connect_with: Option<std::path::PathBuf>,
    authorize: Option<std::path::PathBuf>,
    user: String,
    yes: bool,
) -> Result<()> {
    let host = match host_arg {
        Some(name) => crate::services::inventory::get_host(&name, None)?,
        None => {
            let hosts = get_hosts(None, None)?;
            select_item(
                &hosts,
                |h: &Host| {
                    format!(
                        "{} ({}:{})",
                        h.name, h.vars.ansible_host, h.vars.ansible_port
                    )
                },
                "Select host",
            )?
            .ok_or_else(|| eyre::eyre!("No host selected"))?
        }
    };

    let home_dir =
        dirs::home_dir().ok_or_else(|| eyre::eyre!("Could not determine home directory"))?;

    let connect_key = match connect_with {
        Some(path) => path,
        None => {
            let default_key = home_dir
                .join(".ssh/identities")
                .join(format!("{}_{}", user, host.name));

            if default_key.exists() {
                output::info(&format!(
                    "Using default connection key: {}",
                    default_key.display()
                ));
                default_key
            } else {
                let available_keys = scan_private_keys(&home_dir)?;
                if available_keys.is_empty() {
                    eyre::bail!(
                        "No SSH private keys found. Generate one with 'auberge ssh keygen'"
                    );
                }

                select_item(
                    &available_keys,
                    |path| path.display().to_string(),
                    "Select SSH key to connect with",
                )?
                .ok_or_else(|| eyre::eyre!("No key selected"))?
            }
        }
    };

    if !connect_key.exists() {
        eyre::bail!("Connection key not found: {}", connect_key.display());
    }

    let pubkey_to_authorize = match authorize {
        Some(path) => path,
        None => {
            let available_pubkeys = scan_public_keys(&home_dir)?;
            if available_pubkeys.is_empty() {
                eyre::bail!("No public keys found in ~/.ssh/");
            }

            select_item(
                &available_pubkeys,
                |path| path.display().to_string(),
                "Select public key to authorize on remote",
            )?
            .ok_or_else(|| eyre::eyre!("No key selected"))?
        }
    };

    if !pubkey_to_authorize.exists() {
        eyre::bail!("Public key not found: {}", pubkey_to_authorize.display());
    }

    let pubkey_content = std::fs::read_to_string(&pubkey_to_authorize).wrap_err_with(|| {
        format!(
            "Failed to read public key: {}",
            pubkey_to_authorize.display()
        )
    })?;

    output::info("Add SSH Key");
    output::info(&format!(
        "Host: {} ({}:{})",
        host.name, host.vars.ansible_host, host.vars.ansible_port
    ));
    output::info(&format!("Remote user: {}", user));
    output::info(&format!("Connection key: {}", connect_key.display()));
    output::info(&format!(
        "Key to authorize: {}",
        pubkey_to_authorize.display()
    ));
    output::info(&format!("Public key preview: {}", pubkey_content.trim()));

    if !yes
        && !dialoguer::Confirm::new()
            .with_prompt("Authorize this key on the remote host?")
            .default(false)
            .interact()?
    {
        println!("Cancelled");
        return Ok(());
    }

    output::info("Adding key to remote host");

    let ssh_cmd = format!(
        "mkdir -p ~/.ssh && chmod 700 ~/.ssh && echo '{}' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys && echo 'Key added successfully'",
        pubkey_content.trim()
    );

    let status = Command::new("ssh")
        .arg("-i")
        .arg(&connect_key)
        .arg("-p")
        .arg(host.vars.ansible_port.to_string())
        .arg(format!("{}@{}", user, host.vars.ansible_host))
        .arg(ssh_cmd)
        .status()
        .wrap_err("Failed to execute SSH command")?;

    if !status.success() {
        eyre::bail!("Failed to add key to remote host");
    }

    output::success(&format!(
        "Key authorized successfully on {}@{}",
        user, host.name
    ));
    Ok(())
}

fn scan_private_keys(home_dir: &std::path::Path) -> Result<Vec<std::path::PathBuf>> {
    let mut keys = Vec::new();

    let identities_dir = home_dir.join(".ssh/identities");
    if identities_dir.is_dir() {
        for entry in std::fs::read_dir(&identities_dir)? {
            let entry = entry?;
            let path = entry.path();
            if path.is_file() && path.extension().is_none_or(|ext| ext != "pub") {
                keys.push(path);
            }
        }
    }

    let ssh_dir = home_dir.join(".ssh");
    if ssh_dir.is_dir() {
        for entry in std::fs::read_dir(&ssh_dir)? {
            let entry = entry?;
            let path = entry.path();
            let file_name = path.file_name().and_then(|n| n.to_str()).unwrap_or("");

            if path.is_file()
                && path.extension().is_none_or(|ext| ext != "pub")
                && (file_name.starts_with("id_") || file_name == "identity")
                && file_name != "known_hosts"
                && file_name != "authorized_keys"
                && file_name != "config"
            {
                keys.push(path);
            }
        }
    }

    keys.sort();
    keys.dedup();
    Ok(keys)
}

fn scan_public_keys(home_dir: &std::path::Path) -> Result<Vec<std::path::PathBuf>> {
    let mut keys = Vec::new();

    let identities_dir = home_dir.join(".ssh/identities");
    if identities_dir.is_dir() {
        for entry in std::fs::read_dir(&identities_dir)? {
            let entry = entry?;
            let path = entry.path();
            if path.extension().is_some_and(|ext| ext == "pub") {
                keys.push(path);
            }
        }
    }

    let ssh_dir = home_dir.join(".ssh");
    if ssh_dir.is_dir() {
        for entry in std::fs::read_dir(&ssh_dir)? {
            let entry = entry?;
            let path = entry.path();
            if path.extension().is_some_and(|ext| ext == "pub") {
                keys.push(path);
            }
        }
    }

    keys.sort();
    keys.dedup();
    Ok(keys)
}
