//
// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements.  See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership.  The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License.  You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied.  See the License for the
// specific language governing permissions and limitations
// under the License.
//

package cloudstack

import (
	"fmt"
	"log"
	"net"
	"strconv"
	"strings"

	"github.com/apache/cloudstack-go/v2/cloudstack"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
)

const none = "none"

func resourceCloudStackNetwork() *schema.Resource {
	aclidSchema := &schema.Schema{
		Type:     schema.TypeString,
		Optional: true,
		Default:  none,
	}

	aclidSchema.StateFunc = func(v interface{}) string {
		value := v.(string)

		if value == none {
			aclidSchema.ForceNew = true
		} else {
			aclidSchema.ForceNew = false
		}

		return value
	}

	return &schema.Resource{
		Create: resourceCloudStackNetworkCreate,
		Read:   resourceCloudStackNetworkRead,
		Update: resourceCloudStackNetworkUpdate,
		Delete: resourceCloudStackNetworkDelete,
		Importer: &schema.ResourceImporter{
			State: importStatePassthrough,
		},

		Schema: map[string]*schema.Schema{
			"name": {
				Type:     schema.TypeString,
				Required: true,
			},

			"display_text": {
				Type:     schema.TypeString,
				Optional: true,
				Computed: true,
			},

			"cidr": {
				Type:     schema.TypeString,
				Optional: true,
				Computed: true,
				ForceNew: true,
			},

			"ip6cidr": {
				Type:     schema.TypeString,
				Optional: true,
				ForceNew: true,
				StateFunc: func(v interface{}) string {
					s, ok := v.(string)
					if !ok {
						return ""
					}

					// Leave empty value unchanged.
					if s == "" {
						return s
					}

					// Parse and canonicalize the IPv6 CIDR. If parsing fails,
					// return the original string so invalid input is not altered.
					_, ipnet, err := net.ParseCIDR(s)
					if err != nil {
						return s
					}

					return ipnet.String()
				},
			},

			"gateway": {
				Type:         schema.TypeString,
				Optional:     true,
				Computed:     true,
				ForceNew:     true,
				RequiredWith: []string{"cidr"},
			},

			"ip6gateway": {
				Type:     schema.TypeString,
				Optional: true,
				Computed: true,
				ForceNew: true,
			},

			"startip": {
				Type:         schema.TypeString,
				Optional:     true,
				Computed:     true,
				ForceNew:     true,
				RequiredWith: []string{"cidr"},
			},

			"endip": {
				Type:         schema.TypeString,
				Optional:     true,
				Computed:     true,
				ForceNew:     true,
				RequiredWith: []string{"cidr"},
			},

			"startipv6": {
				Type:     schema.TypeString,
				Optional: true,
				Computed: true,
				ForceNew: true,
			},

			"endipv6": {
				Type:     schema.TypeString,
				Optional: true,
				Computed: true,
				ForceNew: true,
			},

			"network_domain": {
				Type:     schema.TypeString,
				Optional: true,
				Computed: true,
			},

			"network_offering": {
				Type:     schema.TypeString,
				Required: true,
			},

			"vlan": {
				Type:     schema.TypeInt,
				Optional: true,
				ForceNew: true,
			},

			"vpc_id": {
				Type:     schema.TypeString,
				Optional: true,
				ForceNew: true,
			},

			"acl_id": aclidSchema,

			"project": {
				Type:     schema.TypeString,
				Optional: true,
				Computed: true,
				ForceNew: true,
			},

			"source_nat_ip": {
				Type:     schema.TypeBool,
				Optional: true,
				ForceNew: true,
			},

			"source_nat_ip_address": {
				Type:     schema.TypeString,
				Computed: true,
			},

			"source_nat_ip_id": {
				Type:     schema.TypeString,
				Computed: true,
			},

			"zone": {
				Type:     schema.TypeString,
				Required: true,
				ForceNew: true,
			},

			"bypass_vlan_overlap_check": {
				Type:     schema.TypeBool,
				Optional: true,
				Default:  false,
			},

			"tags": tagsSchema(),
		},
	}
}

func resourceCloudStackNetworkCreate(d *schema.ResourceData, meta interface{}) error {
	cs := meta.(*cloudstack.CloudStackClient)

	name := d.Get("name").(string)

	// Retrieve the network_offering ID
	networkofferingid, e := retrieveID(cs, "network_offering", d.Get("network_offering").(string))
	if e != nil {
		return e.Error()
	}

	// Retrieve the zone ID
	zoneid, e := retrieveID(cs, "zone", d.Get("zone").(string))
	if e != nil {
		return e.Error()
	}

	// Create a new parameter struct
	p := cs.Network.NewCreateNetworkParams(name, networkofferingid, zoneid)

	if displaytext, ok := d.GetOk("display_text"); ok {
		p.SetDisplaytext(displaytext.(string))
	} else {
		p.SetDisplaytext(name)
	}

	// Get the network offering to check if it supports specifying IP ranges
	no, _, err := cs.NetworkOffering.GetNetworkOfferingByID(networkofferingid)
	if err != nil {
		return err
	}

	if _, ok := d.GetOk("cidr"); ok {
		m, err := parseCIDR(d, no.Specifyipranges)
		if err != nil {
			return err
		}

		// Set the needed IP config
		p.SetGateway(m["gateway"])
		p.SetNetmask(m["netmask"])

		// Only set the start IP if we have one
		if startip, ok := m["startip"]; ok {
			p.SetStartip(startip)
		}

		// Only set the end IP if we have one
		if endip, ok := m["endip"]; ok {
			p.SetEndip(endip)
		}
	}

	// IPv6 support
	if ip6cidr, ok := d.GetOk("ip6cidr"); ok {
		m6, err := parseCIDRv6(d, no.Specifyipranges)
		if err != nil {
			return err
		}

		p.SetIp6cidr(ip6cidr.(string))

		// Only set the start IPv6 if we have one
		if startipv6, ok := m6["startipv6"]; ok {
			p.SetStartipv6(startipv6)
		}

		// Only set the ipv6 gateway if we have one
		if ip6gateway, ok := m6["ip6gateway"]; ok {
			p.SetIp6gateway(ip6gateway)
		}

		// Only set the end IPv6 if we have one
		if endipv6, ok := m6["endipv6"]; ok {
			p.SetEndipv6(endipv6)
		}
	}

	// Set the network domain if we have one
	if networkDomain, ok := d.GetOk("network_domain"); ok {
		p.SetNetworkdomain(networkDomain.(string))
	}

	if vlan, ok := d.GetOk("vlan"); ok {
		p.SetVlan(strconv.Itoa(vlan.(int)))
	}

	// Bypass VLAN overlap check if necessary
	if bypassVlanOverlapCheck, ok := d.GetOk("bypass_vlan_overlap_check"); ok {
		p.SetBypassvlanoverlapcheck(bypassVlanOverlapCheck.(bool))
	}

	// Check is this network needs to be created in a VPC
	if vpcid, ok := d.GetOk("vpc_id"); ok {
		// Set the vpc id
		p.SetVpcid(vpcid.(string))

		// Since we're in a VPC, check if we want to associate an ACL list
		if aclid, ok := d.GetOk("acl_id"); ok && aclid.(string) != none {
			// Set the acl ID
			p.SetAclid(aclid.(string))
		}

		// If no project is explicitly set, try to inherit it from the VPC
		if _, ok := d.GetOk("project"); !ok {
			// Get the VPC to retrieve its project
			// Use listall to search across all projects
			vpcParams := cs.VPC.NewListVPCsParams()
			vpcParams.SetId(vpcid.(string))
			vpcParams.SetListall(true)
			vpcList, err := cs.VPC.ListVPCs(vpcParams)
			if err == nil && vpcList.Count > 0 && vpcList.VPCs[0].Projectid != "" {
				log.Printf("[DEBUG] Inheriting project %s from VPC %s", vpcList.VPCs[0].Projectid, vpcid.(string))
				p.SetProjectid(vpcList.VPCs[0].Projectid)
			}
		}
	}

	// If there is a project supplied, we retrieve and set the project id
	// This will override the inherited project from VPC if explicitly set
	if err := setProjectid(p, cs, d); err != nil {
		return err
	}

	// Create the new network
	r, err := cs.Network.CreateNetwork(p)
	if err != nil {
		return fmt.Errorf("Error creating network %s: %s", name, err)
	}

	d.SetId(r.Id)

	// Set tags if necessary
	if err = setTags(cs, d, "network"); err != nil {
		return fmt.Errorf("Error setting tags: %v", err)
	}

	if d.Get("source_nat_ip").(bool) {
		// Create a new parameter struct
		p := cs.Address.NewAssociateIpAddressParams()

		// Set required options
		p.SetNetworkid(r.Id)
		p.SetZoneid(zoneid)

		if vpcid, ok := d.GetOk("vpc_id"); ok {
			// Set the vpcid
			p.SetVpcid(vpcid.(string))
		}

		// If there is a project supplied, we retrieve and set the project id
		if err := setProjectid(p, cs, d); err != nil {
			return err
		}

		// Associate a new IP address
		ip, err := cs.Address.AssociateIpAddress(p)
		if err != nil {
			return fmt.Errorf("Error associating a new IP address: %s", err)
		}
		d.Set("source_nat_ip_address", ip.Ipaddress)
		d.Set("source_nat_ip_id", ip.Id)

		// Set the additional partial
	}

	return resourceCloudStackNetworkRead(d, meta)
}

func resourceCloudStackNetworkRead(d *schema.ResourceData, meta interface{}) error {
	cs := meta.(*cloudstack.CloudStackClient)

	// Get the network details
	// First try with the project from state (if any)
	project := d.Get("project").(string)
	n, count, err := cs.Network.GetNetworkByID(
		d.Id(),
		cloudstack.WithProject(project),
	)

	// If not found and no explicit project was set, try with projectid=-1
	// This handles the case where the project was inherited from VPC
	if count == 0 && project == "" {
		n, count, err = cs.Network.GetNetworkByID(
			d.Id(),
			cloudstack.WithProject("-1"),
		)
	}

	if err != nil {
		if count == 0 {
			log.Printf(
				"[DEBUG] Network %s does no longer exist", d.Get("name").(string))
			d.SetId("")
			return nil
		}

		return err
	}

	d.Set("name", n.Name)
	d.Set("display_text", n.Displaytext)
	d.Set("cidr", n.Cidr)
	d.Set("gateway", n.Gateway)
	d.Set("network_domain", n.Networkdomain)
	d.Set("vpc_id", n.Vpcid)

	// Always set IPv6 fields to detect drift when IPv6 is removed server-side
	d.Set("ip6cidr", n.Ip6cidr)
	d.Set("ip6gateway", n.Ip6gateway)

	// Note: CloudStack API may not return startipv6 and endipv6 fields
	// These are typically only set during network creation

	if n.Aclid == "" {
		n.Aclid = none
	}
	d.Set("acl_id", n.Aclid)

	tags := make(map[string]interface{})
	for _, tag := range n.Tags {
		tags[tag.Key] = tag.Value
	}
	d.Set("tags", tags)

	setValueOrID(d, "network_offering", n.Networkofferingname, n.Networkofferingid)
	setValueOrID(d, "project", n.Project, n.Projectid)
	setValueOrID(d, "zone", n.Zonename, n.Zoneid)

	if d.Get("source_nat_ip").(bool) {
		ip, count, err := cs.Address.GetPublicIpAddressByID(
			d.Get("source_nat_ip_id").(string),
			cloudstack.WithProject(d.Get("project").(string)),
		)
		if err != nil {
			if count == 0 {
				log.Printf(
					"[DEBUG] Source NAT IP with ID %s is no longer associated", d.Id())
				d.Set("source_nat_ip", false)
				d.Set("source_nat_ip_id", "")
				return nil
			}

			return err
		}

		if n.Id != ip.Associatednetworkid {
			d.Set("source_nat_ip", false)
			d.Set("source_nat_ip_id", "")
		}
	}

	return nil
}

func resourceCloudStackNetworkUpdate(d *schema.ResourceData, meta interface{}) error {
	cs := meta.(*cloudstack.CloudStackClient)
	name := d.Get("name").(string)

	// Create a new parameter struct
	p := cs.Network.NewUpdateNetworkParams(d.Id())

	// Check if the name or display text is changed
	if d.HasChange("name") || d.HasChange("display_text") {
		p.SetName(name)

		// Compute/set the display text
		displaytext := d.Get("display_text").(string)
		if displaytext == "" {
			displaytext = name
		}
		p.SetDisplaytext(displaytext)
	}

	// Check if the cidr is changed
	if d.HasChange("cidr") {
		p.SetGuestvmcidr(d.Get("cidr").(string))
	}

	// Check if the network domain is changed
	if d.HasChange("network_domain") {
		p.SetNetworkdomain(d.Get("network_domain").(string))
	}

	// Check if the network offering is changed
	if d.HasChange("network_offering") {
		// Retrieve the network_offering ID
		networkofferingid, e := retrieveID(cs, "network_offering", d.Get("network_offering").(string))
		if e != nil {
			return e.Error()
		}
		// Set the new network offering
		p.SetNetworkofferingid(networkofferingid)
	}

	// Update the network
	_, err := cs.Network.UpdateNetwork(p)
	if err != nil {
		return fmt.Errorf(
			"Error updating network %s: %s", name, err)
	}

	// Replace the ACL if the ID has changed
	if d.HasChange("acl_id") {
		p := cs.NetworkACL.NewReplaceNetworkACLListParams(d.Get("acl_id").(string))
		p.SetNetworkid(d.Id())

		_, err := cs.NetworkACL.ReplaceNetworkACLList(p)
		if err != nil {
			return fmt.Errorf("Error replacing ACL: %s", err)
		}
	}

	// Update tags if they have changed
	if d.HasChange("tags") {
		if err := updateTags(cs, d, "Network"); err != nil {
			return fmt.Errorf("Error updating tags on ACL %s: %s", name, err)
		}
	}

	return resourceCloudStackNetworkRead(d, meta)
}

func resourceCloudStackNetworkDelete(d *schema.ResourceData, meta interface{}) error {
	cs := meta.(*cloudstack.CloudStackClient)

	// Create a new parameter struct
	p := cs.Network.NewDeleteNetworkParams(d.Id())

	// Delete the network
	_, err := cs.Network.DeleteNetwork(p)
	if err != nil {
		// This is a very poor way to be told the ID does no longer exist :(
		if strings.Contains(err.Error(), fmt.Sprintf(
			"Invalid parameter id value=%s due to incorrect long value format, "+
				"or entity does not exist", d.Id())) {
			return nil
		}

		return fmt.Errorf("Error deleting network %s: %s", d.Get("name").(string), err)
	}
	return nil
}

func parseCIDR(d *schema.ResourceData, specifyiprange bool) (map[string]string, error) {
	m := make(map[string]string, 4)

	cidr := d.Get("cidr").(string)
	ip, ipnet, err := net.ParseCIDR(cidr)
	if err != nil {
		return nil, fmt.Errorf("Unable to parse cidr %s: %s", cidr, err)
	}

	msk := ipnet.Mask
	sub := ip.Mask(msk)

	m["netmask"] = fmt.Sprintf("%d.%d.%d.%d", msk[0], msk[1], msk[2], msk[3])

	if gateway, ok := d.GetOk("gateway"); ok {
		m["gateway"] = gateway.(string)
	} else {
		m["gateway"] = fmt.Sprintf("%d.%d.%d.%d", sub[0], sub[1], sub[2], sub[3]+1)
	}

	if startip, ok := d.GetOk("startip"); ok {
		m["startip"] = startip.(string)
	} else if specifyiprange {
		m["startip"] = fmt.Sprintf("%d.%d.%d.%d", sub[0], sub[1], sub[2], sub[3]+2)
	}

	if endip, ok := d.GetOk("endip"); ok {
		m["endip"] = endip.(string)
	} else if specifyiprange {
		m["endip"] = fmt.Sprintf("%d.%d.%d.%d",
			sub[0]+(0xff-msk[0]), sub[1]+(0xff-msk[1]), sub[2]+(0xff-msk[2]), sub[3]+(0xff-msk[3]-1))
	}

	return m, nil
}

// addToIPv6 adds an integer offset to an IPv6 address with proper carry across all bytes.
// Returns a new net.IP with the result.
func addToIPv6(ip net.IP, offset uint64) net.IP {
	result := make(net.IP, len(ip))
	copy(result, ip)

	carry := offset
	// Start from the least significant byte (rightmost) and work backwards
	for i := len(result) - 1; i >= 0 && carry > 0; i-- {
		sum := uint64(result[i]) + carry
		result[i] = byte(sum & 0xff)
		carry = sum >> 8
	}

	return result
}

// validateIPv6InCIDR verifies that a user-supplied IPv6 address parses and falls
// within the given network. It returns a clear local error instead of letting an
// out-of-subnet value surface as an opaque CloudStack API failure at apply time.
func validateIPv6InCIDR(field, value string, ipnet *net.IPNet) error {
	ip := net.ParseIP(value)
	if ip == nil {
		return fmt.Errorf("%s %q is not a valid IP address", field, value)
	}
	if !ipnet.Contains(ip) {
		return fmt.Errorf("%s %q is not within ip6cidr %s", field, value, ipnet.String())
	}
	return nil
}

func parseCIDRv6(d *schema.ResourceData, specifyiprange bool) (map[string]string, error) {
	m := make(map[string]string, 4)

	cidr := d.Get("ip6cidr").(string)
	ip, ipnet, err := net.ParseCIDR(cidr)
	if err != nil {
		return nil, fmt.Errorf("Unable to parse cidr %s: %s", cidr, err)
	}

	// Validate that this is actually an IPv6 CIDR
	if ip.To4() != nil {
		return nil, fmt.Errorf("ip6cidr must be an IPv6 CIDR, got IPv4: %s", cidr)
	}
	if len(ipnet.Mask) != net.IPv6len {
		return nil, fmt.Errorf("ip6cidr must be an IPv6 CIDR with 16-byte mask, got %d bytes: %s", len(ipnet.Mask), cidr)
	}

	// Validate prefix length to ensure we have enough addresses for gateway/start/end
	ones, _ := ipnet.Mask.Size()
	if specifyiprange {
		// When specifyiprange is true, we need at least 3 addresses:
		// - gateway (network + 1)
		// - start IP (network + 2)
		// - end IP (network + 3 or more)
		// This requires a /126 or larger prefix (4 addresses minimum)
		if ones > 126 {
			return nil, fmt.Errorf("ip6cidr prefix /%d is too small for automatic IP range generation; minimum is /126 (4 addresses)", ones)
		}
	} else {
		// When specifyiprange is false, we only need the gateway (network + 1)
		// This requires a /127 or larger prefix (2 addresses minimum)
		if ones > 127 {
			return nil, fmt.Errorf("ip6cidr prefix /%d is too small for automatic gateway generation; minimum is /127 (2 addresses)", ones)
		}
	}

	if gateway, ok := d.GetOk("ip6gateway"); ok {
		gw := gateway.(string)
		if err := validateIPv6InCIDR("ip6gateway", gw, ipnet); err != nil {
			return nil, err
		}
		m["ip6gateway"] = gw
	} else {
		// Default gateway to network address + 1 (e.g., 2001:db8::1)
		gwip := addToIPv6(ipnet.IP, 1)
		m["ip6gateway"] = gwip.String()
	}

	if startipv6, ok := d.GetOk("startipv6"); ok {
		start := startipv6.(string)
		if err := validateIPv6InCIDR("startipv6", start, ipnet); err != nil {
			return nil, err
		}
		m["startipv6"] = start
	} else if specifyiprange {
		// Default start IP to network address + 2
		startip := addToIPv6(ipnet.IP, 2)
		m["startipv6"] = startip.String()
	}

	if endip, ok := d.GetOk("endipv6"); ok {
		end := endip.(string)
		if err := validateIPv6InCIDR("endipv6", end, ipnet); err != nil {
			return nil, err
		}
		m["endipv6"] = end
	} else if specifyiprange {
		ip16 := ipnet.IP.To16()
		if ip16 == nil {
			return nil, fmt.Errorf("cidr not valid for ipv6")
		}

		last := make(net.IP, len(ip16))
		copy(last, ip16)

		for i := range ip16 {
			// Perform bitwise OR with the inverse of the mask
			last[i] |= ^ipnet.Mask[i]
		}
		m["endipv6"] = last.String()
	}

	return m, nil
}