// Resolving what a clip-bench request is allowed to open.
//
// Nothing here takes a path. A request names a PROJECT and a CLIP, both of which
// must be members of the current scan, and a `file` -- which must be one of the
// cached windows the server itself finds for that clip's video. So a plausible
// name that is simply not there fails, and a traversal fails twice: once on the
// membership check and once on resolveInRoots.
import path from "node:path";
import { createReadStream } from "node:fs";
import { realpath, stat } from "node:fs/promises";
import { Readable } from "node:stream";
import { REPORTS_ROOT, inside, resolveInRoots } from "../paths.mjs";
import { walkProjects } from "../projects/walk.mjs";
import { DEFAULT_VARIANT, VARIANTS, WIN_EPS, variantPaths } from "umtool-report-to-video/build-video";
import { rawCacheOf } from "./raw-cache.mjs";
import {
  channelsDirFor,
  clipWindowDirs,
  clipsOf,
  hasShadowChannels,
  readManifest,
} from "../projects/report.mjs";

export async function resolveClip(projectId, clipId) {
  const projects = await walkProjects(REPORTS_ROOT);
  const project = projects.find((p) => p.id === projectId);
  if (!project) return { error: "no such project", status: 404 };
  const manifest = await readManifest(project.dir);
  if (!manifest) return { error: "no manifest", status: 404 };
  const clip = clipsOf(manifest).find((e) => e.id === clipId);
  if (!clip) return { error: "no such clip", status: 404 };
  return { project, manifest, clip };
}

/**
 * The same membership rule for a request that names a PROJECT and a cut, and
 * no clip: the deck's routes. `variant` is checked against the pipeline's own
 * list; absent or empty it is the default cut.
 *
 * @param {string} projectId
 * @param {string | null} [variant]
 */
export async function resolveReport(projectId, variant = null) {
  const v = variant || DEFAULT_VARIANT;
  if (!VARIANTS.includes(v)) {
    return { error: `variant must be one of ${VARIANTS.join(", ")}`, status: 400 };
  }
  const projects = await walkProjects(REPORTS_ROOT);
  const project = projects.find((p) => p.id === projectId);
  if (!project) return { error: "no such project", status: 404 };
  const manifest = await readManifest(project.dir);
  if (!manifest) return { error: "no manifest", status: 404 };
  return { project, manifest, variant: v };
}

/** The clips-raw cache, re-exported so `serve.mjs` stays the bench's one door. */
export { rawCacheOf } from "./raw-cache.mjs";

/**
 * The cache for a project, INCLUDING the corpus clips dirs the editor fetches
 * into.
 *
 * Use this rather than rawCacheOf(project.dir) anywhere a clip's cached windows
 * are the question. A bare rawCacheOf sees only out/clips-raw, so a window the
 * editor fetched reads as "nothing fetched for this clip yet" and the bench
 * offers to download bytes that are already on the disk.
 */
export async function projectCache(project, manifest = null) {
  const m = manifest ?? (await readManifest(project.dir));
  const shadowExists = await hasShadowChannels(project.dir);
  const channelsDir = channelsDirFor(project.dir, m, { shadowExists });
  return rawCacheOf(project.dir, { extraWindows: await clipWindowDirs(m, channelsDir) });
}

/**
 * The cached source windows for a clip: the ones that hold ITS window, widest
 * first, then any that merely overlap it.
 *
 * The bench wants the WIDEST containing file, because that is how much room
 * there is to drag before anything has to be fetched. The BUILD wants the
 * tightest, because it decodes the whole file to find a silence. They are
 * different questions and both are asked here.
 *
 * "Containing" is not optional. clips-raw is keyed by VIDEO, and a report
 * cites the same stream more than once -- ElfpireEva cites one video four
 * times -- so the directory holds a file per clip and "widest for this video"
 * is another clip's file as often as not. The bench then seeks `start - from`
 * into a 44-second file, i.e. 1146 s past its end, and plays nothing or the
 * wrong seconds. A caller with no window (a ledger claim asking for the raw
 * files of its video) still gets every file, widest first.
 *
 * @param {{dir: string}} project
 * @param {{video: string, start?: number, end?: number}} clip
 * @param {Awaited<ReturnType<typeof rawCacheOf>> | null} [cache] a clips-raw
 *   listing already read this request; one is built when none is passed.
 */
export async function windowsFor(project, clip, cache = null) {
  // The cache is optional and passed in by callers that already have one (the
  // bench page asks for every clip), so the directory is read once per request.
  const c = cache ?? (await projectCache(project));
  const all = c.windows(clip.video);
  const width = (w) => w.to - w.from;
  const { start, end } = clip;
  if (!Number.isFinite(start) || !Number.isFinite(end)) {
    return all.sort((a, b) => width(b) - width(a));
  }
  const overlap = (w) => Math.max(0, Math.min(w.to, end) - Math.max(w.from, start));
  const contains = (w) => (w.from <= start + WIN_EPS && w.to >= end - WIN_EPS ? 1 : 0);
  return all
    .filter((w) => overlap(w) > 0)
    .sort((a, b) => contains(b) - contains(a) || overlap(b) - overlap(a) || width(b) - width(a));
}

export function pickWindow(windows, wantedName) {
  if (wantedName) {
    const hit = windows.find((w) => w.name === wantedName);
    return hit ?? null;
  }
  return windows[0] ?? null;
}

/** Absolute, inside a read root, and a member of that clip's own scan. */
export function absOf(win) {
  return win ? resolveInRoots(win.path) : null;
}

/**
 * The BUILT segment for a clip -- the mp4 with the header and the QR burned in.
 *
 * Two directories, because a two-cut manifest writes its default variant under
 * `out/<variant>/segments` while an older tree wrote `out/segments`; the same
 * pair readClipDetail looks in, and for the same reason.
 *
 * The name is built from the clip id the timeline already vouched for, never
 * from anything the client typed, and still goes through resolveInRoots -- the
 * membership check and the root check are two guards and both are cheap.
 *
 * Returns the mtime as well, because a re-render writes the SAME path: without
 * it in the URL a browser would keep showing the segment it cached before the
 * edit, which is the one thing a re-render button must never do.
 */
export async function segmentFor(project, clipId) {
  for (const rel of [
    path.posix.join("out", DEFAULT_VARIANT, "segments"),
    path.posix.join("out", "segments"),
  ]) {
    const relFile = path.posix.join(rel, `${clipId}.mp4`);
    const abs = resolveInRoots(path.join(project.dir, relFile));
    if (!abs) continue;
    const st = await stat(abs).catch(() => null);
    if (st?.isFile()) return { rel: relFile, abs, size: st.size, mtimeMs: Math.round(st.mtimeMs) };
  }
  return null;
}

/**
 * The same membership rule, for a LEDGER claim.
 *
 * A claim id is checked against the ledger of the project named in the request,
 * exactly as a clip id is checked against its timeline. Nothing here takes a
 * path either.
 */
export async function resolveClaim(projectId, claimId) {
  const projects = await walkProjects(REPORTS_ROOT);
  const project = projects.find((p) => p.id === projectId);
  if (!project) return { error: "no such project", status: 404 };
  const manifest = await readManifest(project.dir);
  if (!manifest) return { error: "no manifest", status: 404 };
  const claim = (manifest.ledger ?? []).find((e) => e.id === claimId);
  if (!claim) return { error: "no such claim", status: 404 };
  return { project, manifest, claim };
}


// ---------------------------------------------------------------------------
// Byte ranges.
//
// One implementation for every route here that hands an mp4 to a <video>:
// the built segment, the cut and its preview. Without a 206 the element will
// not seek in a stream it did not fully download.
// ---------------------------------------------------------------------------

/**
 * The response for one file the caller has ALREADY authorised and stat'ed.
 *
 * A `Range` this does not parse is ignored and the whole file is sent; one it
 * parses but cannot satisfy is a 416 carrying only `content-range`. A suffix
 * range (`bytes=-500`) is the LAST n bytes -- Chrome asks for one to find an
 * mp4's moov atom when it is not at the front.
 *
 * @param {Request} request
 * @param {{ abs: string, size: number, headers?: Record<string, string> }} file
 * @returns {Response}
 */
export function rangeResponse(request, { abs, size, headers = {} }) {
  const range = request.headers.get("range");
  const m = range ? /^bytes=(\d*)-(\d*)$/.exec(range.trim()) : null;
  if (m) {
    let start = m[1] ? Number(m[1]) : 0;
    let end = m[2] ? Number(m[2]) : size - 1;
    if (!m[1] && m[2]) {
      // A suffix range: the LAST n bytes.
      start = Math.max(0, size - Number(m[2]));
      end = size - 1;
    }
    if (!Number.isFinite(start) || !Number.isFinite(end) || start > end || start >= size) {
      return new Response(null, { status: 416, headers: { "content-range": `bytes */${size}` } });
    }
    end = Math.min(end, size - 1);
    return new Response(/** @type {ReadableStream} */ (Readable.toWeb(createReadStream(abs, { start, end }))), {
      status: 206,
      headers: {
        ...headers,
        "content-range": `bytes ${start}-${end}/${size}`,
        "content-length": String(end - start + 1),
      },
    });
  }
  return new Response(/** @type {ReadableStream} */ (Readable.toWeb(createReadStream(abs))), {
    headers: { ...headers, "content-length": String(size) },
  });
}

/**
 * The deliverable of one cut, or the short window `--chrome-preview` writes.
 *
 * Built from the manifest's slug and the checked variant through the
 * pipeline's own variantPaths(), never from anything the client typed: `final`
 * is `out/<slug>.mp4` (`out/<slug>-full.mp4` for `full`), `preview` is
 * `out/<variant>/<slug>.preview.mp4`. The mtime rides along for the same
 * reason segmentFor's does -- a re-render writes the same path.
 *
 * @param {{ dir: string }} project
 * @param {{ slug?: string }} manifest
 * @param {string} variant
 * @param {"final" | "preview"} kind
 */
export async function videoFor(project, manifest, variant, kind) {
  const slug = manifest.slug ?? path.basename(project.dir);
  const dirs = variantPaths(path.join(project.dir, "out"), slug, variant);
  const file = kind === "preview" ? path.join(dirs.dir, `${slug}.preview.mp4`) : dirs.final;
  const abs = resolveInRoots(file);
  if (!abs) return null;
  const st = await stat(abs).catch(() => null);
  if (!st?.isFile()) return null;
  return {
    rel: path.relative(project.dir, abs).split(path.sep).join("/"),
    abs,
    size: st.size,
    mtimeMs: Math.round(st.mtimeMs),
  };
}

// ---------------------------------------------------------------------------
// The deck's preview composition.
//
// compose-chrome writes it under out/<variant>/chrome/deck-preview/, and the
// page loads it in an iframe -- so its index.html, and the assets it names by
// RELATIVE url, are served from one prefix by GET /api/report/chrome/files/.
// That route takes a path from the client, which nothing else here does, so
// the whole rule is in deckPreviewFile and it is tested.
// ---------------------------------------------------------------------------

/** The preview project directory of one cut. Never a build's `chrome/deck/`. */
export const deckPreviewDir = (projectDir, variant) =>
  path.join(projectDir, "out", variant, "chrome", "deck-preview");

/**
 * The project id as ONE url segment. Ids are relative paths (`folder/name`),
 * and the composition's relative asset urls only resolve under a prefix with
 * no query string, so the id cannot ride as a parameter or as raw segments.
 */
export const encodeProjectSegment = (id) => Buffer.from(String(id), "utf8").toString("base64url");
export const decodeProjectSegment = (seg) => {
  if (!/^[A-Za-z0-9_-]+$/.test(String(seg ?? ""))) return null;
  return Buffer.from(seg, "base64url").toString("utf8");
};

/** The iframe src for a cut's preview composition. */
export const deckPreviewSrc = (projectId, variant) =>
  `/api/report/chrome/files/${encodeProjectSegment(projectId)}/${variant}/index.html`;

/**
 * Resolve the url segments after `<project>/<variant>/` to a file INSIDE the
 * preview directory, or null.
 *
 * Refused: an empty, `.` or `..` segment; one carrying a slash, a backslash or
 * a NUL (a segment the router decoded from `%2F` is still one segment); an
 * absolute path; and anything whose REAL path -- symlinks followed -- is not
 * under the directory's real path. A symlink inside the directory pointing
 * out of it is the case the realpath is for. A directory is not a file.
 *
 * @param {string} dir the preview directory (deckPreviewDir)
 * @param {string[]} segments
 * @returns {Promise<{ abs: string, size: number } | null>}
 */
export async function deckPreviewFile(dir, segments) {
  if (!Array.isArray(segments) || !segments.length) return null;
  for (const seg of segments) {
    if (typeof seg !== "string" || !seg || seg === "." || seg === "..") return null;
    if (/[\/\\\0]/.test(seg) || path.isAbsolute(seg)) return null;
  }
  const base = path.resolve(dir);
  const abs = path.resolve(base, ...segments);
  if (!inside(base, abs) || abs === base) return null;
  const [realBase, realAbs] = await Promise.all([
    realpath(base).catch(() => null),
    realpath(abs).catch(() => null),
  ]);
  if (!realBase || !realAbs || !inside(realBase, realAbs) || realAbs === realBase) return null;
  const st = await stat(realAbs).catch(() => null);
  if (!st?.isFile()) return null;
  return { abs: realAbs, size: st.size };
}

// ---------------------------------------------------------------------------
// The posts region's preview compositions: one per window, each its own
// project under out/<variant>/chrome/posts-preview-<segment>/ (compose-chrome
// names it; onscreen.mjs checks the name). Served by the same files route
// under one more path segment, `posts-preview-<segment>`, and confined by the
// same deckPreviewFile once the directory is chosen.
// ---------------------------------------------------------------------------

const POSTS_PREVIEW_PREFIX = "posts-preview-";

// The posts FEED's preview composition (`posts.layout: "feed"`): one project
// for the whole cut, out/<variant>/chrome/feed-preview/, served one segment
// deeper under the same prefix, `feed-preview/…`.
const FEED_PREVIEW = "feed-preview";

/** The preview project of a cut's posts feed. */
export const feedPreviewDir = (projectDir, variant) =>
  path.join(projectDir, "out", variant, "chrome", FEED_PREVIEW);

/** The iframe src for a cut's posts-feed preview composition. */
export const feedPreviewSrc = (projectId, variant) =>
  `/api/report/chrome/files/${encodeProjectSegment(projectId)}/${variant}/${FEED_PREVIEW}/index.html`;

// The fact-check STAMPS' preview composition (a schedule that stamps a
// claim): one project for the whole cut, out/<variant>/chrome/stamp-preview/,
// served as the feed's is, `stamp-preview/…`.
const STAMP_PREVIEW = "stamp-preview";

/** The preview project of a cut's fact-check stamps. */
export const stampPreviewDir = (projectDir, variant) =>
  path.join(projectDir, "out", variant, "chrome", STAMP_PREVIEW);

/** The iframe src for a cut's fact-check stamps preview composition. */
export const stampPreviewSrc = (projectId, variant) =>
  `/api/report/chrome/files/${encodeProjectSegment(projectId)}/${variant}/${STAMP_PREVIEW}/index.html`;

/** The preview project of the posts window on one segment. */
export const postsPreviewDir = (projectDir, variant, segment) =>
  path.join(projectDir, "out", variant, "chrome", `${POSTS_PREVIEW_PREFIX}${segment}`);

/** The iframe src for one posts window's preview composition. */
export const postsPreviewSrc = (projectId, variant, segment) =>
  `/api/report/chrome/files/${encodeProjectSegment(projectId)}/${variant}/${POSTS_PREVIEW_PREFIX}${encodeURIComponent(segment)}/index.html`;

/**
 * Which preview directory a files request is for, and the segments left to
 * resolve inside it.
 *
 * `feed-preview/…` is the posts feed's project (one per cut), and
 * `stamp-preview/…` the fact-check stamps' (one per cut).
 * `posts-preview-<segment>/…` is a posts window's project when `<segment>` is
 * one of `segmentIds` -- the cut's own entry ids, which the caller reads from
 * the manifest, so a name the client made up is not a directory this serves.
 * Anything else is a file of the deck's preview, as it always was (the deck's
 * project holds `index.html`, `assets/` and `hyperframes.json`, nothing named
 * like this). The per-segment rules (no `..`, no slash) are deckPreviewFile's
 * and still apply to everything after.
 *
 * @param {string} projectDir
 * @param {string} variant
 * @param {string[]} rest the url segments after `<project>/<variant>/`
 * @param {Iterable<string>} segmentIds
 * @returns {{ dir: string, rest: string[] } | null}
 */
export function previewDirFor(projectDir, variant, rest, segmentIds) {
  if (!Array.isArray(rest) || !rest.length) return null;
  const head = rest[0];
  if (head === FEED_PREVIEW) return { dir: feedPreviewDir(projectDir, variant), rest: rest.slice(1) };
  if (head === STAMP_PREVIEW) return { dir: stampPreviewDir(projectDir, variant), rest: rest.slice(1) };
  if (typeof head === "string" && head.startsWith(POSTS_PREVIEW_PREFIX)) {
    const seg = head.slice(POSTS_PREVIEW_PREFIX.length);
    if (!seg || /[\/\\\0]/.test(seg) || seg === "." || seg === "..") return null;
    if (!new Set(segmentIds).has(seg)) return null;
    return { dir: postsPreviewDir(projectDir, variant, seg), rest: rest.slice(1) };
  }
  return { dir: deckPreviewDir(projectDir, variant), rest };
}