/*
Copyright 2020 The Flux authors

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package main

import (
	"context"
	"crypto/elliptic"
	"fmt"
	"net/url"
	"os"
	"strings"

	"github.com/manifoldco/promptui"
	"github.com/spf13/cobra"
	corev1 "k8s.io/api/core/v1"
	"k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/types"
	"k8s.io/apimachinery/pkg/util/wait"
	"sigs.k8s.io/controller-runtime/pkg/client"
	"sigs.k8s.io/yaml"

	"github.com/fluxcd/pkg/apis/meta"

	sourcev1 "github.com/fluxcd/source-controller/api/v1"

	"github.com/fluxcd/flux2/v2/internal/flags"
	"github.com/fluxcd/flux2/v2/internal/utils"
	"github.com/fluxcd/flux2/v2/pkg/manifestgen/sourcesecret"
)

type sourceGitFlags struct {
	url                 string
	branch              string
	tag                 string
	semver              string
	refName             string
	commit              string
	username            string
	password            string
	keyAlgorithm        flags.PublicKeyAlgorithm
	keyRSABits          flags.RSAKeyBits
	keyECDSACurve       flags.ECDSACurve
	secretRef           string
	proxySecretRef      string
	provider            flags.SourceGitProvider
	caFile              string
	privateKeyFile      string
	recurseSubmodules   bool
	silent              bool
	ignorePaths         []string
	sparseCheckoutPaths []string
}

var createSourceGitCmd = &cobra.Command{
	Use:   "git [name]",
	Short: "Create or update a GitRepository source",
	Long: `The create source git command generates a GitRepository resource and waits for it to sync.
For Git over SSH, host and SSH keys are automatically generated and stored in a Kubernetes secret.
For private Git repositories, the basic authentication credentials are stored in a Kubernetes secret.`,
	Example: `  # Create a source from a public Git repository master branch
  flux create source git podinfo \
    --url=https://github.com/stefanprodan/podinfo \
    --branch=master

  # Create a source for a Git repository pinned to specific git tag
  flux create source git podinfo \
    --url=https://github.com/stefanprodan/podinfo \
    --tag="3.2.3"

  # Create a source from a public Git repository tag that matches a semver range
  flux create source git podinfo \
    --url=https://github.com/stefanprodan/podinfo \
    --tag-semver=">=3.2.0 <3.3.0"

  # Create a source for a Git repository using SSH authentication
  flux create source git podinfo \
    --url=ssh://git@github.com/stefanprodan/podinfo \
    --branch=master

  # Create a source for a Git repository using SSH authentication and an
  # ECDSA P-521 curve public key
  flux create source git podinfo \
    --url=ssh://git@github.com/stefanprodan/podinfo \
    --branch=master \
    --ssh-key-algorithm=ecdsa \
    --ssh-ecdsa-curve=p521

  # Create a source for a Git repository using SSH authentication and a
  #	passwordless private key from file
  # The public SSH host key will still be gathered from the host
  flux create source git podinfo \
    --url=ssh://git@github.com/stefanprodan/podinfo \
    --branch=master \
    --private-key-file=./private.key

  # Create a source for a Git repository using SSH authentication and a
  # private key with a password from file
  # The public SSH host key will still be gathered from the host
  flux create source git podinfo \
    --url=ssh://git@github.com/stefanprodan/podinfo \
    --branch=master \
    --private-key-file=./private.key \
    --password=<password>

  # Create a source for a Git repository using basic authentication
  flux create source git podinfo \
    --url=https://github.com/stefanprodan/podinfo \
    --branch=master \
    --username=username \
    --password=password

  # Create a source for a Git repository using AWS CodeCommit with IAM credentials
  flux create source git podinfo \
    --url=https://git-codecommit.<region>.amazonaws.com/v1/repos/podinfo \
    --branch=master \
    --provider=aws

  # Create a source for a Git repository using azure provider
  flux create source git podinfo \
    --url=https://dev.azure.com/foo/bar/_git/podinfo \
    --branch=master \
    --provider=azure`,
	RunE: createSourceGitCmdRun,
}

var sourceGitArgs = newSourceGitFlags()

func init() {
	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.url, "url", "", "git address, e.g. ssh://git@host/org/repository")
	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.branch, "branch", "", "git branch")
	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.tag, "tag", "", "git tag")
	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.semver, "tag-semver", "", "git tag semver range")
	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.refName, "ref-name", "", "git reference name")
	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.commit, "commit", "", "git commit")
	createSourceGitCmd.Flags().StringVarP(&sourceGitArgs.username, "username", "u", "", "basic authentication username")
	createSourceGitCmd.Flags().StringVarP(&sourceGitArgs.password, "password", "p", "", "basic authentication password")
	createSourceGitCmd.Flags().Var(&sourceGitArgs.keyAlgorithm, "ssh-key-algorithm", sourceGitArgs.keyAlgorithm.Description())
	createSourceGitCmd.Flags().Var(&sourceGitArgs.keyRSABits, "ssh-rsa-bits", sourceGitArgs.keyRSABits.Description())
	createSourceGitCmd.Flags().Var(&sourceGitArgs.keyECDSACurve, "ssh-ecdsa-curve", sourceGitArgs.keyECDSACurve.Description())
	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.secretRef, "secret-ref", "", "the name of an existing secret containing SSH or basic credentials or github app authentication")
	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.proxySecretRef, "proxy-secret-ref", "", "the name of an existing secret containing the proxy address and credentials")
	createSourceGitCmd.Flags().Var(&sourceGitArgs.provider, "provider", sourceGitArgs.provider.Description())
	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.caFile, "ca-file", "", "path to TLS CA file used for validating self-signed certificates")
	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.privateKeyFile, "private-key-file", "", "path to a passwordless private key file used for authenticating to the Git SSH server")
	createSourceGitCmd.Flags().BoolVar(&sourceGitArgs.recurseSubmodules, "recurse-submodules", false,
		"when enabled, configures the GitRepository source to initialize and include Git submodules in the artifact it produces")
	createSourceGitCmd.Flags().BoolVarP(&sourceGitArgs.silent, "silent", "s", false, "assumes the deploy key is already setup, skips confirmation")
	createSourceGitCmd.Flags().StringSliceVar(&sourceGitArgs.ignorePaths, "ignore-paths", nil, "set paths to ignore in git resource (can specify multiple paths with commas: path1,path2)")
	createSourceGitCmd.Flags().StringSliceVar(&sourceGitArgs.sparseCheckoutPaths, "sparse-checkout-paths", nil, "set paths to sparse checkout in git resource (can specify multiple paths with commas: path1,path2)")

	createSourceCmd.AddCommand(createSourceGitCmd)
}

func newSourceGitFlags() sourceGitFlags {
	return sourceGitFlags{
		keyAlgorithm:  flags.PublicKeyAlgorithm(sourcesecret.ECDSAPrivateKeyAlgorithm),
		keyRSABits:    2048,
		keyECDSACurve: flags.ECDSACurve{Curve: elliptic.P384()},
	}
}

func createSourceGitCmdRun(cmd *cobra.Command, args []string) error {
	name := args[0]

	if sourceGitArgs.url == "" {
		return fmt.Errorf("url is required")
	}

	u, err := url.Parse(sourceGitArgs.url)
	if err != nil {
		return fmt.Errorf("git URL parse failed: %w", err)
	}
	if u.Scheme != "ssh" && u.Scheme != "http" && u.Scheme != "https" {
		return fmt.Errorf("git URL scheme '%s' not supported, can be: ssh, http and https", u.Scheme)
	}

	if sourceGitArgs.branch == "" && sourceGitArgs.tag == "" && sourceGitArgs.semver == "" && sourceGitArgs.commit == "" && sourceGitArgs.refName == "" {
		return fmt.Errorf("a Git ref is required, use one of the following: --branch, --tag, --commit, --ref-name or --tag-semver")
	}

	if sourceGitArgs.caFile != "" && u.Scheme == "ssh" {
		return fmt.Errorf("specifying a CA file is not supported for Git over SSH")
	}

	sourceLabels, err := parseLabels()
	if err != nil {
		return err
	}

	var ignorePaths *string
	if len(sourceGitArgs.ignorePaths) > 0 {
		ignorePathsStr := strings.Join(sourceGitArgs.ignorePaths, "\n")
		ignorePaths = &ignorePathsStr
	}

	gitRepository := sourcev1.GitRepository{
		ObjectMeta: metav1.ObjectMeta{
			Name:      name,
			Namespace: *kubeconfigArgs.Namespace,
			Labels:    sourceLabels,
		},
		Spec: sourcev1.GitRepositorySpec{
			URL: sourceGitArgs.url,
			Interval: metav1.Duration{
				Duration: createArgs.interval,
			},
			RecurseSubmodules: sourceGitArgs.recurseSubmodules,
			Reference:         &sourcev1.GitRepositoryRef{},
			Ignore:            ignorePaths,
			SparseCheckout:    sourceGitArgs.sparseCheckoutPaths,
		},
	}

	if createSourceArgs.fetchTimeout > 0 {
		gitRepository.Spec.Timeout = &metav1.Duration{Duration: createSourceArgs.fetchTimeout}
	}

	if sourceGitArgs.commit != "" {
		gitRepository.Spec.Reference.Commit = sourceGitArgs.commit
		gitRepository.Spec.Reference.Branch = sourceGitArgs.branch
	} else if sourceGitArgs.refName != "" {
		gitRepository.Spec.Reference.Name = sourceGitArgs.refName
	} else if sourceGitArgs.semver != "" {
		gitRepository.Spec.Reference.SemVer = sourceGitArgs.semver
	} else if sourceGitArgs.tag != "" {
		gitRepository.Spec.Reference.Tag = sourceGitArgs.tag
	} else {
		gitRepository.Spec.Reference.Branch = sourceGitArgs.branch
	}

	if sourceGitArgs.secretRef != "" {
		gitRepository.Spec.SecretRef = &meta.LocalObjectReference{
			Name: sourceGitArgs.secretRef,
		}
	}

	if sourceGitArgs.proxySecretRef != "" {
		gitRepository.Spec.ProxySecretRef = &meta.LocalObjectReference{
			Name: sourceGitArgs.proxySecretRef,
		}
	}

	if provider := sourceGitArgs.provider.String(); provider != "" {
		gitRepository.Spec.Provider = provider
	}

	if createArgs.export {
		return printExport(exportGit(&gitRepository))
	}

	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
	defer cancel()

	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
	if err != nil {
		return err
	}

	logger.Generatef("generating GitRepository source")
	if sourceGitArgs.secretRef == "" {
		secretOpts := sourcesecret.Options{
			Name:         name,
			Namespace:    *kubeconfigArgs.Namespace,
			ManifestFile: sourcesecret.MakeDefaultOptions().ManifestFile,
		}
		switch u.Scheme {
		case "ssh":
			keypair, err := sourcesecret.LoadKeyPairFromPath(sourceGitArgs.privateKeyFile, sourceGitArgs.password)
			if err != nil {
				return err
			}
			secretOpts.Keypair = keypair
			secretOpts.SSHHostname = u.Host
			secretOpts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(sourceGitArgs.keyAlgorithm)
			secretOpts.RSAKeyBits = int(sourceGitArgs.keyRSABits)
			secretOpts.ECDSACurve = sourceGitArgs.keyECDSACurve.Curve
			secretOpts.Password = sourceGitArgs.password
		case "https":
			if sourceGitArgs.caFile != "" {
				caBundle, err := os.ReadFile(sourceGitArgs.caFile)
				if err != nil {
					return fmt.Errorf("unable to read TLS CA file: %w", err)
				}
				secretOpts.CACrt = caBundle
			}
			secretOpts.Username = sourceGitArgs.username
			secretOpts.Password = sourceGitArgs.password
		case "http":
			logger.Warningf("insecure configuration: credentials configured for an HTTP URL")
			secretOpts.Username = sourceGitArgs.username
			secretOpts.Password = sourceGitArgs.password
		}
		secret, err := sourcesecret.GenerateGit(secretOpts)
		if err != nil {
			return err
		}
		var s corev1.Secret
		if err = yaml.Unmarshal([]byte(secret.Content), &s); err != nil {
			return err
		}
		if len(s.StringData) > 0 {
			if hk, ok := s.StringData[sourcesecret.KnownHostsSecretKey]; ok {
				logger.Successf("collected public key from SSH server:\n%s", hk)
			}
			if ppk, ok := s.StringData[sourcesecret.PublicKeySecretKey]; ok {
				logger.Generatef("deploy key: %s", ppk)
				if !sourceGitArgs.silent {
					prompt := promptui.Prompt{
						Label:     "Have you added the deploy key to your repository",
						IsConfirm: true,
					}
					if _, err := prompt.Run(); err != nil {
						return fmt.Errorf("aborting")
					}
				}
			}
			logger.Actionf("applying secret with repository credentials")
			if err := upsertSecret(ctx, kubeClient, s); err != nil {
				return err
			}
			gitRepository.Spec.SecretRef = &meta.LocalObjectReference{
				Name: s.Name,
			}
			logger.Successf("authentication configured")
		}
	}

	logger.Actionf("applying GitRepository source")
	namespacedName, err := upsertGitRepository(ctx, kubeClient, &gitRepository)
	if err != nil {
		return err
	}

	logger.Waitingf("waiting for GitRepository source reconciliation")
	if err := wait.PollUntilContextTimeout(ctx, rootArgs.pollInterval, rootArgs.timeout, true,
		isObjectReadyConditionFunc(kubeClient, namespacedName, &gitRepository)); err != nil {
		return err
	}
	logger.Successf("GitRepository source reconciliation completed")

	if gitRepository.Status.Artifact == nil {
		return fmt.Errorf("GitRepository source reconciliation completed but no artifact was found")
	}
	logger.Successf("fetched revision: %s", gitRepository.Status.Artifact.Revision)
	return nil
}

func upsertGitRepository(ctx context.Context, kubeClient client.Client,
	gitRepository *sourcev1.GitRepository) (types.NamespacedName, error) {
	namespacedName := types.NamespacedName{
		Namespace: gitRepository.GetNamespace(),
		Name:      gitRepository.GetName(),
	}

	var existing sourcev1.GitRepository
	err := kubeClient.Get(ctx, namespacedName, &existing)
	if err != nil {
		if errors.IsNotFound(err) {
			if err := kubeClient.Create(ctx, gitRepository); err != nil {
				return namespacedName, err
			} else {
				logger.Successf("GitRepository source created")
				return namespacedName, nil
			}
		}
		return namespacedName, err
	}

	existing.Labels = gitRepository.Labels
	existing.Spec = gitRepository.Spec
	if err := kubeClient.Update(ctx, &existing); err != nil {
		return namespacedName, err
	}
	gitRepository = &existing
	logger.Successf("GitRepository source updated")
	return namespacedName, nil
}
