/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package crdclient

import (
	"sync"

	api "github.com/apache/dubbo-kubernetes/api/resource/v1alpha1"
	"github.com/apache/dubbo-kubernetes/pkg/core/logger"
	"github.com/apache/dubbo-kubernetes/pkg/core/model"
	"github.com/apache/dubbo-kubernetes/pkg/core/schema/collection"
	gvks "github.com/apache/dubbo-kubernetes/pkg/core/schema/gvk"
	"github.com/apache/dubbo-kubernetes/pkg/dds/storage"
	"k8s.io/utils/strings/slices"
)

type PushContext struct {
	rootNamespace string
	mutex         *sync.Mutex
	revision      map[string]int64
	storage       *storage.Storage
	cache         ConfigStoreCache
}

type Handler interface {
	NotifyWithIndex(schema collection.Schema) error
}

func NewHandler(storage *storage.Storage, rootNamespace string, cache ConfigStoreCache) *PushContext {
	return &PushContext{
		mutex:         &sync.Mutex{},
		revision:      map[string]int64{},
		storage:       storage,
		rootNamespace: rootNamespace,
		cache:         cache,
	}
}

func (p *PushContext) NotifyWithIndex(schema collection.Schema) error {
	gvk := schema.Resource().GroupVersionKind()
	configs, err := p.cache.List(gvk, NamespaceAll)
	data := make([]model.Config, 0)
	if err != nil {
		logger.Sugar().Error("[DDS] fail to get the cache from client-go Index")
		return err
	}
	if gvk.String() == gvks.AuthorizationPolicy {
		// WARNING: the client-go cache is read-only, if we must change the resource, we need to deep copy first
		for _, config := range configs {
			deepCopy := authorization(config, p.rootNamespace)
			data = append(data, deepCopy)
		}
	} else if gvk.String() == gvks.AuthenticationPolicy {
		// WARNING: the client-go cache is read-only, if we must change the resource, we need to deep copy first
		for _, config := range configs {
			deepCopy := authentication(config, p.rootNamespace)
			data = append(data, deepCopy)
		}
	} else {
		data = configs
	}

	p.mutex.Lock()
	p.revision[gvk.String()]++
	p.mutex.Unlock()

	origin := &storage.OriginImpl{
		Gvk:  gvk.String(),
		Rev:  p.revision[gvk.String()],
		Data: data,
	}

	p.storage.Mutex.Lock()
	defer p.storage.Mutex.Unlock()

	p.storage.LatestRules[gvk.String()] = origin
	for _, c := range p.storage.Connection {
		c.RawRuleQueue.Add(origin)
	}
	return nil
}

func authorization(config model.Config, rootNamespace string) model.Config {
	deepCopy := config.DeepCopy()
	policy := deepCopy.Spec.(*api.AuthorizationPolicy)
	if rootNamespace == deepCopy.Namespace {
		return deepCopy
	}
	if policy.GetRules() == nil {
		policy.Rules = []*api.AuthorizationPolicyRule{}
		policy.Rules = append(policy.Rules, &api.AuthorizationPolicyRule{
			To: &api.AuthorizationPolicyTarget{
				Namespaces: []string{deepCopy.Namespace},
			},
		})
	} else {
		for _, rule := range policy.Rules {
			if rule.To == nil {
				rule.To = &api.AuthorizationPolicyTarget{}
			}
			if !slices.Contains(rule.To.Namespaces, deepCopy.Namespace) {
				rule.To.Namespaces = append(rule.To.Namespaces, deepCopy.Namespace)
			}
		}
	}
	return deepCopy
}

func authentication(config model.Config, rootNamespace string) model.Config {
	deepCopy := config.DeepCopy()
	policy := deepCopy.Spec.(*api.AuthenticationPolicy)
	if rootNamespace != config.Namespace {
		if policy.GetSelector() == nil {
			policy.Selector = []*api.AuthenticationPolicySelector{}
			policy.Selector = append(policy.Selector, &api.AuthenticationPolicySelector{
				Namespaces: []string{config.Namespace},
			})
		} else {
			for _, selector := range policy.Selector {
				if !slices.Contains(selector.Namespaces, config.Namespace) {
					selector.Namespaces = append(selector.Namespaces, config.Namespace)
				}
			}
		}
	}
	return deepCopy
}