// -----------------------------------------------------------------------------
// AuditBundleReader.cs
// Sprint: SPRINT_4300_0001_0002 (One-Command Audit Replay CLI)
// Tasks: REPLAY-005, REPLAY-007 - AuditBundleReader with verification
// Description: Reads and verifies audit bundles for offline replay.
// -----------------------------------------------------------------------------

using System.Collections.Immutable;
using System.Formats.Tar;
using System.IO.Compression;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using StellaOps.AuditPack.Models;

namespace StellaOps.AuditPack.Services;

/// <summary>
/// Reads and verifies audit bundles for deterministic offline replay.
/// </summary>
public sealed class AuditBundleReader : IAuditBundleReader
{
    private static readonly JsonSerializerOptions JsonOptions = new()
    {
        PropertyNamingPolicy = JsonNamingPolicy.CamelCase
    };

    /// <summary>
    /// Reads and verifies an audit bundle.
    /// </summary>
    public async Task<AuditBundleReadResult> ReadAsync(
        AuditBundleReadRequest request,
        CancellationToken cancellationToken = default)
    {
        ArgumentNullException.ThrowIfNull(request);
        ArgumentException.ThrowIfNullOrWhiteSpace(request.BundlePath);

        if (!File.Exists(request.BundlePath))
        {
            return AuditBundleReadResult.Failed("Bundle file not found");
        }

        var tempDir = Path.Combine(Path.GetTempPath(), $"audit-read-{Guid.NewGuid():N}");
        Directory.CreateDirectory(tempDir);

        try
        {
            // Extract bundle
            await ExtractBundleAsync(request.BundlePath, tempDir, cancellationToken);

            // Read manifest
            var manifestPath = Path.Combine(tempDir, "manifest.json");
            if (!File.Exists(manifestPath))
            {
                return AuditBundleReadResult.Failed("Manifest not found in bundle");
            }

            var manifestBytes = await File.ReadAllBytesAsync(manifestPath, cancellationToken);
            var manifest = JsonSerializer.Deserialize<AuditBundleManifest>(manifestBytes, JsonOptions);
            if (manifest is null)
            {
                return AuditBundleReadResult.Failed("Failed to parse manifest");
            }

            var result = new AuditBundleReadResult
            {
                Success = true,
                Manifest = manifest,
                BundleDigest = await ComputeFileDigestAsync(request.BundlePath, cancellationToken),
                ExtractedPath = request.ExtractToPath is not null ? null : tempDir
            };

            // Verify signature if requested
            if (request.VerifySignature)
            {
                var signaturePath = Path.Combine(tempDir, "manifest.sig");
                if (File.Exists(signaturePath))
                {
                    var signatureBytes = await File.ReadAllBytesAsync(signaturePath, cancellationToken);
                    var signatureResult = await VerifySignatureAsync(
                        manifestBytes, signatureBytes, request.PublicKey, cancellationToken);

                    result = result with
                    {
                        SignatureVerified = signatureResult.Verified,
                        SignatureKeyId = signatureResult.KeyId,
                        SignatureError = signatureResult.Error
                    };

                    if (!signatureResult.Verified && request.RequireValidSignature)
                    {
                        return result with
                        {
                            Success = false,
                            Error = $"Signature verification failed: {signatureResult.Error}"
                        };
                    }
                }
                else if (request.RequireValidSignature)
                {
                    return AuditBundleReadResult.Failed("Signature file not found but signature is required");
                }
            }

            // Verify merkle root if requested
            if (request.VerifyMerkleRoot)
            {
                var merkleResult = await VerifyMerkleRootAsync(tempDir, manifest, cancellationToken);
                result = result with
                {
                    MerkleRootVerified = merkleResult.Verified,
                    MerkleRootError = merkleResult.Error
                };

                if (!merkleResult.Verified && request.RequireValidMerkleRoot)
                {
                    return result with
                    {
                        Success = false,
                        Error = $"Merkle root verification failed: {merkleResult.Error}"
                    };
                }
            }

            // Verify input digests if requested
            if (request.VerifyInputDigests)
            {
                var digestResult = await VerifyInputDigestsAsync(tempDir, manifest, cancellationToken);
                result = result with
                {
                    InputDigestsVerified = digestResult.Verified,
                    InputDigestErrors = digestResult.Errors
                };

                if (!digestResult.Verified && request.RequireValidInputDigests)
                {
                    return result with
                    {
                        Success = false,
                        Error = $"Input digest verification failed: {string.Join("; ", digestResult.Errors ?? [])}"
                    };
                }
            }

            // Extract contents if requested
            if (request.ExtractToPath is not null)
            {
                if (Directory.Exists(request.ExtractToPath))
                {
                    if (!request.OverwriteExisting)
                    {
                        return result with
                        {
                            Success = false,
                            Error = "Extract path already exists and overwrite is not enabled"
                        };
                    }
                    Directory.Delete(request.ExtractToPath, recursive: true);
                }

                Directory.Move(tempDir, request.ExtractToPath);
                result = result with { ExtractedPath = request.ExtractToPath };

                // Create a new temp dir for cleanup
                tempDir = Path.Combine(Path.GetTempPath(), $"audit-read-empty-{Guid.NewGuid():N}");
            }

            // Load replay inputs if requested
            if (request.LoadReplayInputs)
            {
                var extractPath = result.ExtractedPath ?? tempDir;
                var inputs = await LoadReplayInputsAsync(extractPath, manifest, cancellationToken);
                result = result with { ReplayInputs = inputs };
            }

            return result;
        }
        catch (Exception ex)
        {
            return AuditBundleReadResult.Failed($"Failed to read bundle: {ex.Message}");
        }
        finally
        {
            // Clean up temp directory
            try
            {
                if (Directory.Exists(tempDir) && request.ExtractToPath is null)
                {
                    // Only cleanup if we didn't move to extract path
                    Directory.Delete(tempDir, recursive: true);
                }
            }
            catch
            {
                // Ignore cleanup errors
            }
        }
    }

    private static async Task ExtractBundleAsync(string bundlePath, string targetDir, CancellationToken ct)
    {
        await using var fileStream = File.OpenRead(bundlePath);
        await using var gzipStream = new GZipStream(fileStream, CompressionMode.Decompress);
        await TarFile.ExtractToDirectoryAsync(gzipStream, targetDir, overwriteFiles: true, ct);
    }

    private static async Task<string> ComputeFileDigestAsync(string filePath, CancellationToken ct)
    {
        await using var stream = File.OpenRead(filePath);
        var hash = await SHA256.HashDataAsync(stream, ct);
        return $"sha256:{Convert.ToHexString(hash).ToLowerInvariant()}";
    }

    private static async Task<SignatureVerificationResult> VerifySignatureAsync(
        byte[] manifestBytes,
        byte[] signatureEnvelopeBytes,
        AsymmetricAlgorithm? publicKey,
        CancellationToken cancellationToken)
    {
        try
        {
            var signer = new AuditBundleSigner();
            var result = await signer.VerifyAsync(
                new AuditBundleVerificationRequest
                {
                    EnvelopeBytes = signatureEnvelopeBytes,
                    PublicKey = publicKey
                },
                cancellationToken);

            if (!result.Success)
            {
                return new SignatureVerificationResult
                {
                    Verified = false,
                    Error = result.Error
                };
            }

            // Verify payload digest matches manifest
            var manifestDigest = ComputeSha256(manifestBytes);
            if (result.PayloadDigest != manifestDigest)
            {
                return new SignatureVerificationResult
                {
                    Verified = false,
                    Error = "Manifest digest does not match signed payload"
                };
            }

            var keyId = result.VerifiedSignatures?.FirstOrDefault()?.KeyId;
            var anyVerified = publicKey is null || (result.VerifiedSignatures?.Any(s => s.Verified) ?? false);

            return new SignatureVerificationResult
            {
                Verified = anyVerified,
                KeyId = keyId
            };
        }
        catch (Exception ex)
        {
            return new SignatureVerificationResult
            {
                Verified = false,
                Error = ex.Message
            };
        }
    }

    private static async Task<MerkleVerificationResult> VerifyMerkleRootAsync(
        string bundleDir,
        AuditBundleManifest manifest,
        CancellationToken cancellationToken)
    {
        try
        {
            var entries = new List<BundleEntry>();

            // Verify all files listed in manifest
            foreach (var file in manifest.Files)
            {
                var filePath = Path.Combine(bundleDir, file.RelativePath.Replace('/', Path.DirectorySeparatorChar));
                if (!File.Exists(filePath))
                {
                    return new MerkleVerificationResult
                    {
                        Verified = false,
                        Error = $"Missing file: {file.RelativePath}"
                    };
                }

                var content = await File.ReadAllBytesAsync(filePath, cancellationToken);
                var digest = ComputeSha256(content);

                if (digest != file.Digest)
                {
                    return new MerkleVerificationResult
                    {
                        Verified = false,
                        Error = $"Digest mismatch for {file.RelativePath}: expected {file.Digest}, got {digest}"
                    };
                }

                entries.Add(new BundleEntry(file.RelativePath, digest, content.Length));
            }

            // Compute and verify merkle root
            var computedRoot = ComputeMerkleRoot(entries);

            if (computedRoot != manifest.MerkleRoot)
            {
                return new MerkleVerificationResult
                {
                    Verified = false,
                    Error = $"Merkle root mismatch: expected {manifest.MerkleRoot}, got {computedRoot}"
                };
            }

            return new MerkleVerificationResult { Verified = true };
        }
        catch (Exception ex)
        {
            return new MerkleVerificationResult
            {
                Verified = false,
                Error = ex.Message
            };
        }
    }

    private static async Task<InputDigestVerificationResult> VerifyInputDigestsAsync(
        string bundleDir,
        AuditBundleManifest manifest,
        CancellationToken cancellationToken)
    {
        var errors = new List<string>();

        // Verify SBOM digest
        var sbomPath = Path.Combine(bundleDir, "sbom.json");
        if (File.Exists(sbomPath))
        {
            var sbomContent = await File.ReadAllBytesAsync(sbomPath, cancellationToken);
            var sbomDigest = ComputeSha256(sbomContent);
            if (sbomDigest != manifest.Inputs.SbomDigest)
            {
                errors.Add($"SBOM digest mismatch: expected {manifest.Inputs.SbomDigest}, got {sbomDigest}");
            }
        }
        else
        {
            errors.Add("SBOM file not found");
        }

        // Verify feeds digest
        var feedsPath = Path.Combine(bundleDir, "feeds", "feeds-snapshot.ndjson");
        if (File.Exists(feedsPath))
        {
            var feedsContent = await File.ReadAllBytesAsync(feedsPath, cancellationToken);
            var feedsDigest = ComputeSha256(feedsContent);
            if (feedsDigest != manifest.Inputs.FeedsDigest)
            {
                errors.Add($"Feeds digest mismatch: expected {manifest.Inputs.FeedsDigest}, got {feedsDigest}");
            }
        }
        else
        {
            errors.Add("Feeds snapshot file not found");
        }

        // Verify policy digest
        var policyPath = Path.Combine(bundleDir, "policy", "policy-bundle.tar.gz");
        if (File.Exists(policyPath))
        {
            var policyContent = await File.ReadAllBytesAsync(policyPath, cancellationToken);
            var policyDigest = ComputeSha256(policyContent);
            if (policyDigest != manifest.Inputs.PolicyDigest)
            {
                errors.Add($"Policy digest mismatch: expected {manifest.Inputs.PolicyDigest}, got {policyDigest}");
            }
        }
        else
        {
            errors.Add("Policy bundle file not found");
        }

        // Verify VEX digest (optional)
        if (manifest.Inputs.VexDigest is not null)
        {
            var vexPath = Path.Combine(bundleDir, "vex", "vex-statements.json");
            if (File.Exists(vexPath))
            {
                var vexContent = await File.ReadAllBytesAsync(vexPath, cancellationToken);
                var vexDigest = ComputeSha256(vexContent);
                if (vexDigest != manifest.Inputs.VexDigest)
                {
                    errors.Add($"VEX digest mismatch: expected {manifest.Inputs.VexDigest}, got {vexDigest}");
                }
            }
            else
            {
                errors.Add("VEX file not found but digest specified in manifest");
            }
        }

        // Verify scoring digest (optional)
        if (manifest.Inputs.ScoringDigest is not null)
        {
            var scoringPath = Path.Combine(bundleDir, "scoring-rules.json");
            if (File.Exists(scoringPath))
            {
                var scoringContent = await File.ReadAllBytesAsync(scoringPath, cancellationToken);
                var scoringDigest = ComputeSha256(scoringContent);
                if (scoringDigest != manifest.Inputs.ScoringDigest)
                {
                    errors.Add($"Scoring rules digest mismatch: expected {manifest.Inputs.ScoringDigest}, got {scoringDigest}");
                }
            }
            else
            {
                errors.Add("Scoring rules file not found but digest specified in manifest");
            }
        }

        // Verify trust roots digest (optional)
        if (manifest.Inputs.TrustRootsDigest is not null)
        {
            var trustPath = Path.Combine(bundleDir, "trust", "trust-roots.json");
            if (File.Exists(trustPath))
            {
                var trustContent = await File.ReadAllBytesAsync(trustPath, cancellationToken);
                var trustDigest = ComputeSha256(trustContent);
                if (trustDigest != manifest.Inputs.TrustRootsDigest)
                {
                    errors.Add($"Trust roots digest mismatch: expected {manifest.Inputs.TrustRootsDigest}, got {trustDigest}");
                }
            }
            else
            {
                errors.Add("Trust roots file not found but digest specified in manifest");
            }
        }

        return new InputDigestVerificationResult
        {
            Verified = errors.Count == 0,
            Errors = errors.Count > 0 ? [.. errors] : null
        };
    }

    private static async Task<ReplayInputs> LoadReplayInputsAsync(
        string bundleDir,
        AuditBundleManifest manifest,
        CancellationToken cancellationToken)
    {
        var inputs = new ReplayInputs();

        // Load SBOM
        var sbomPath = Path.Combine(bundleDir, "sbom.json");
        if (File.Exists(sbomPath))
        {
            inputs = inputs with { Sbom = await File.ReadAllBytesAsync(sbomPath, cancellationToken) };
        }

        // Load feeds
        var feedsPath = Path.Combine(bundleDir, "feeds", "feeds-snapshot.ndjson");
        if (File.Exists(feedsPath))
        {
            inputs = inputs with { FeedsSnapshot = await File.ReadAllBytesAsync(feedsPath, cancellationToken) };
        }

        // Load policy
        var policyPath = Path.Combine(bundleDir, "policy", "policy-bundle.tar.gz");
        if (File.Exists(policyPath))
        {
            inputs = inputs with { PolicyBundle = await File.ReadAllBytesAsync(policyPath, cancellationToken) };
        }

        // Load VEX (optional)
        var vexPath = Path.Combine(bundleDir, "vex", "vex-statements.json");
        if (File.Exists(vexPath))
        {
            inputs = inputs with { VexStatements = await File.ReadAllBytesAsync(vexPath, cancellationToken) };
        }

        // Load verdict
        var verdictPath = Path.Combine(bundleDir, "verdict.json");
        if (File.Exists(verdictPath))
        {
            inputs = inputs with { Verdict = await File.ReadAllBytesAsync(verdictPath, cancellationToken) };
        }

        return inputs;
    }

    private static string ComputeSha256(byte[] content)
    {
        var hash = SHA256.HashData(content);
        return $"sha256:{Convert.ToHexString(hash).ToLowerInvariant()}";
    }

    private static string ComputeMerkleRoot(List<BundleEntry> entries)
    {
        if (entries.Count == 0)
        {
            return string.Empty;
        }

        var leaves = entries
            .OrderBy(e => e.Path, StringComparer.Ordinal)
            .Select(e => SHA256.HashData(Encoding.UTF8.GetBytes($"{e.Path}:{e.Digest}")))
            .ToArray();

        while (leaves.Length > 1)
        {
            leaves = PairwiseHash(leaves).ToArray();
        }

        return $"sha256:{Convert.ToHexString(leaves[0]).ToLowerInvariant()}";
    }

    private static IEnumerable<byte[]> PairwiseHash(byte[][] nodes)
    {
        for (var i = 0; i < nodes.Length; i += 2)
        {
            if (i + 1 >= nodes.Length)
            {
                yield return SHA256.HashData(nodes[i]);
                continue;
            }

            var combined = new byte[nodes[i].Length + nodes[i + 1].Length];
            Buffer.BlockCopy(nodes[i], 0, combined, 0, nodes[i].Length);
            Buffer.BlockCopy(nodes[i + 1], 0, combined, nodes[i].Length, nodes[i + 1].Length);
            yield return SHA256.HashData(combined);
        }
    }

    private sealed record BundleEntry(string Path, string Digest, long SizeBytes);
    private sealed record SignatureVerificationResult
    {
        public bool Verified { get; init; }
        public string? KeyId { get; init; }
        public string? Error { get; init; }
    }
    private sealed record MerkleVerificationResult
    {
        public bool Verified { get; init; }
        public string? Error { get; init; }
    }
    private sealed record InputDigestVerificationResult
    {
        public bool Verified { get; init; }
        public ImmutableArray<string>? Errors { get; init; }
    }
}

/// <summary>
/// Interface for audit bundle reading.
/// </summary>
public interface IAuditBundleReader
{
    Task<AuditBundleReadResult> ReadAsync(
        AuditBundleReadRequest request,
        CancellationToken cancellationToken = default);
}

#region Request and Result Models

/// <summary>
/// Request for reading an audit bundle.
/// </summary>
public sealed record AuditBundleReadRequest
{
    public required string BundlePath { get; init; }

    /// <summary>
    /// Verify the manifest signature.
    /// </summary>
    public bool VerifySignature { get; init; } = true;

    /// <summary>
    /// Fail if signature is invalid.
    /// </summary>
    public bool RequireValidSignature { get; init; }

    /// <summary>
    /// Verify the merkle root.
    /// </summary>
    public bool VerifyMerkleRoot { get; init; } = true;

    /// <summary>
    /// Fail if merkle root is invalid.
    /// </summary>
    public bool RequireValidMerkleRoot { get; init; } = true;

    /// <summary>
    /// Verify input digests match manifest.
    /// </summary>
    public bool VerifyInputDigests { get; init; } = true;

    /// <summary>
    /// Fail if input digests are invalid.
    /// </summary>
    public bool RequireValidInputDigests { get; init; } = true;

    /// <summary>
    /// Extract bundle contents to this path.
    /// </summary>
    public string? ExtractToPath { get; init; }

    /// <summary>
    /// Overwrite existing extraction directory.
    /// </summary>
    public bool OverwriteExisting { get; init; }

    /// <summary>
    /// Load replay inputs into memory.
    /// </summary>
    public bool LoadReplayInputs { get; init; }

    /// <summary>
    /// Public key for signature verification.
    /// </summary>
    public AsymmetricAlgorithm? PublicKey { get; init; }
}

/// <summary>
/// Result of reading an audit bundle.
/// </summary>
public sealed record AuditBundleReadResult
{
    public bool Success { get; init; }
    public AuditBundleManifest? Manifest { get; init; }
    public string? BundleDigest { get; init; }
    public string? ExtractedPath { get; init; }
    public string? Error { get; init; }

    // Signature verification
    public bool? SignatureVerified { get; init; }
    public string? SignatureKeyId { get; init; }
    public string? SignatureError { get; init; }

    // Merkle root verification
    public bool? MerkleRootVerified { get; init; }
    public string? MerkleRootError { get; init; }

    // Input digest verification
    public bool? InputDigestsVerified { get; init; }
    public ImmutableArray<string>? InputDigestErrors { get; init; }

    // Replay inputs
    public ReplayInputs? ReplayInputs { get; init; }

    public static AuditBundleReadResult Failed(string error) => new()
    {
        Success = false,
        Error = error
    };
}

/// <summary>
/// Loaded replay inputs from a bundle.
/// </summary>
public sealed record ReplayInputs
{
    public byte[]? Sbom { get; init; }
    public byte[]? FeedsSnapshot { get; init; }
    public byte[]? PolicyBundle { get; init; }
    public byte[]? VexStatements { get; init; }
    public byte[]? Verdict { get; init; }
}

#endregion