pub mod vfs;
pub mod security;
pub mod server;
pub mod metrics;

use std::net::SocketAddr;
use std::path::PathBuf;
use std::sync::Arc;
use axum::{Router, routing::get};
use clap::Parser;
use tonic::transport::{Identity, Server, ServerTlsConfig};
use vfs::local::LocalVfs;
use furumi_common::proto::remote_file_system_server::RemoteFileSystemServer;
use server::RemoteFileSystemImpl;
use security::AuthInterceptor;

#[derive(Parser, Debug)]
#[command(version, about = "Furumi-ng: remote filesystem server over encrypted gRPC")]
struct Args {
    /// IP address and port to bind the gRPC server to
    #[arg(short, long, env = "FURUMI_BIND", default_value = "0.0.0.0:50051")]
    bind: String,

    /// Document root directory to expose via VFS
    #[arg(short, long, env = "FURUMI_ROOT", default_value = ".")]
    root: PathBuf,

    /// Authentication Bearer token (leave empty to disable auth)
    #[arg(short, long, env = "FURUMI_TOKEN", default_value = "")]
    token: String,

    /// IP address and port for the Prometheus metrics HTTP endpoint
    #[arg(long, env = "FURUMI_METRICS_BIND", default_value = "0.0.0.0:9090")]
    metrics_bind: String,

    /// Disable TLS encryption (not recommended, use only for debugging)
    #[arg(long, default_value_t = false)]
    no_tls: bool,
}

async fn metrics_handler() -> String {
    metrics::render_metrics()
}

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Install ring as the default crypto provider for rustls (must be before any TLS usage)
    rustls::crypto::ring::default_provider()
        .install_default()
        .expect("Failed to install rustls crypto provider");
    
    tracing_subscriber::fmt::init();

    let args = Args::parse();
    let addr: SocketAddr = args.bind.parse().unwrap_or_else(|e| {
        eprintln!("Error: Invalid bind address '{}': {}", args.bind, e);
        eprintln!("  Expected format: IP:PORT (e.g. 0.0.0.0:50051)");
        std::process::exit(1);
    });

    let metrics_addr: SocketAddr = args.metrics_bind.parse().unwrap_or_else(|e| {
        eprintln!("Error: Invalid metrics bind address '{}': {}", args.metrics_bind, e);
        eprintln!("  Expected format: IP:PORT (e.g. 0.0.0.0:9090)");
        std::process::exit(1);
    });
    
    // Resolve the document root to an absolute path for safety and clarity
    let root_path = std::fs::canonicalize(&args.root)
        .unwrap_or_else(|_| args.root.clone());
    
    if !root_path.exists() || !root_path.is_dir() {
        eprintln!("Error: Root path {:?} does not exist or is not a directory", root_path);
        std::process::exit(1);
    }

    let vfs = Arc::new(LocalVfs::new(&root_path));
    let remote_fs = RemoteFileSystemImpl::new(vfs);
    let auth = AuthInterceptor::new(args.token.clone());
    let svc = RemoteFileSystemServer::with_interceptor(remote_fs, auth.clone());

    // Print startup info
    println!("Furumi-ng Server listening on {}", addr);
    if args.no_tls {
        println!("WARNING: TLS is DISABLED — traffic is unencrypted");
    } else {
        println!("TLS: enabled (auto-generated self-signed certificate)");
    }
    if args.token.is_empty() {
        println!("WARNING: Authentication is DISABLED");
    } else {
        println!("Authentication: enabled (Bearer token)");
    }
    println!("Document Root: {:?}", root_path);
    println!("Metrics: http://{}/metrics", metrics_addr);

    // Spawn the Prometheus metrics HTTP server on a separate port
    let metrics_app = Router::new().route("/metrics", get(metrics_handler));
    let metrics_listener = tokio::net::TcpListener::bind(metrics_addr).await?;
    tokio::spawn(async move {
        axum::serve(metrics_listener, metrics_app).await.unwrap();
    });

    let mut builder = Server::builder()
        .tcp_keepalive(Some(std::time::Duration::from_secs(60)))
        .http2_keepalive_interval(Some(std::time::Duration::from_secs(60)));

    if !args.no_tls {
        let cert_pair = rcgen::generate_simple_self_signed(vec![
            "localhost".to_string(),
            "furumi-ng".to_string(),
        ])
        .expect("Failed to generate self-signed certificate");

        let cert_pem = cert_pair.cert.pem();
        let key_pem = cert_pair.signing_key.serialize_pem();

        let identity = Identity::from_pem(cert_pem, key_pem);
        let tls_config = ServerTlsConfig::new().identity(identity);
        builder = builder.tls_config(tls_config)?;
    }

    builder
        .add_service(svc)
        .serve(addr)
        .await?;

    Ok(())
}