#!/usr/bin/env bash

# ============================================
# Lifecycle
# ============================================

function cmd::watch::on_load() {
  flag::register --type
  flag::register --name
  flag::register --peers
  flag::register --blocked
  flag::register --restricted
  flag::register --allowed
  flag::register --raw
}

# ============================================
# Help
# ============================================

function cmd::watch::help() {
  cat <<EOF
Usage: wgctl watch [options]

Live monitor of WireGuard activity.
  - Handshakes from connected peers (green)
  - Connection attempts from blocked peers (red)
  - Firewall drops from restricted peers (red)

Options:
  --name <name>     Filter by client name
  --type <type>     Filter by device type
  --blocked         Show only blocked peer attempts
  --allowed         Show only handshakes
  --restricted      Show only firewall drop events
  --raw             Show raw IPs without service annotation

Examples:
  wgctl watch
  wgctl watch --name phone-nuno
  wgctl watch --blocked
  wgctl watch --type phone
EOF
}

# ============================================
# Run
# ============================================

function cmd::watch::run() {
  local filter_name="" filter_type="" filter_peers=""
  local blocked_only=false allowed_only=false restricted_only=false
  local raw=false

  rm -f /tmp/wgctl_hs_* /tmp/wgctl_attempt_* 2>/dev/null || true

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name)       filter_name="$2";     shift 2 ;;
      --type)       filter_type="$2";     shift 2 ;;
      --peers)      filter_peers="$2";    shift 2 ;;
      --blocked)    blocked_only=true;    shift   ;;
      --allowed)    allowed_only=true;    shift   ;;
      --restricted) restricted_only=true; shift   ;;
      --raw)        raw=true;             shift   ;;
      --help)       cmd::watch::help;     return  ;;
      *)
        log::error "Unknown flag: $1"
        cmd::watch::help
        return 1
        ;;
    esac
  done

  local net_file=""
  $raw || net_file="$(ctx::net)"

  log::section "wgctl — Live Monitor (Ctrl+C to stop)"
  printf "\n"

  # Fixed display widths for watch (dynamic measurement not possible in stream)
  local w_client=20 w_dest=18

  # Handshake poller (background)
  if ! $blocked_only && ! $restricted_only; then
    (
      while true; do
        cmd::watch::_poll_handshakes \
          "$filter_name" "$filter_type" "$filter_peers" "$w_client" "$w_dest"
        sleep 5
      done
    ) &
    local poller_pid=$!
  fi

  # Event tailer (background)
  cmd::watch::_tail_events \
    "$filter_name" "$filter_type" "$filter_peers" \
    "$blocked_only" "$restricted_only" "$allowed_only" \
    "$net_file" "$w_client" "$w_dest" &
  local tailer_pid=$!

  trap "kill $tailer_pid ${poller_pid:-} 2>/dev/null; \
    rm -f /tmp/wgctl_hs_* /tmp/wgctl_attempt_*; printf '\n'; exit 0" INT TERM

  wait
}

# ============================================
# Handshake Poller
# ============================================

function cmd::watch::_poll_handshakes() {
  local filter_name="${1:-}" filter_type="${2:-}" filter_peers="${3:-}"
  local w_client="${4:-20}" w_dest="${5:-30}"

  local peer_set=()
  [[ -n "$filter_peers" ]] && IFS=',' read -ra peer_set <<< "$filter_peers"

  while IFS= read -r line; do
    local public_key ts
    public_key=$(echo "$line" | awk '{print $1}')
    ts=$(echo "$line" | awk '{print $2}')
    [[ -z "$ts" || "$ts" == "0" ]] && continue

    # Find client by public key
    local client_name=""
    for conf in "$(ctx::clients)"/*.conf; do
      [[ -f "$conf" ]] || continue
      local cname
      cname=$(basename "$conf" .conf)
      local key
      key=$(keys::public "$cname" 2>/dev/null || echo "")
      if [[ "$key" == "$public_key" ]]; then
        client_name="$cname"
        break
      fi
    done
    [[ -z "$client_name" ]] && continue
    [[ -n "$filter_name" && "$client_name" != "$filter_name" ]] && continue

    # Dedup — only emit if handshake is new
    local safe_key
    safe_key=$(echo "$public_key" | md5sum | cut -d' ' -f1)
    local prev_ts_file="/tmp/wgctl_hs_${safe_key}"
    local prev_ts="0"
    [[ -f "$prev_ts_file" ]] && prev_ts=$(cat "$prev_ts_file")
    [[ "$ts" == "$prev_ts" ]] && continue
    echo "$ts" > "$prev_ts_file"

    local ts_fmt
    ts_fmt=$(fmt::datetime_short "$ts")
    local endpoint
    endpoint=$(monitor::endpoint_for_key "$public_key")

    ui::watch::wg_row "$ts_fmt" "$client_name" "${endpoint:-—}" "handshake" \
      "$w_client" "$w_dest"

  done < <(wg show "$(config::interface)" latest-handshakes 2>/dev/null)
}

# ============================================
# Event Tailer
# ============================================

function cmd::watch::_tail_events() {
  local filter_name="${1:-}" filter_type="${2:-}" filter_peers="${3:-}"
  local blocked_only="${4:-false}" restricted_only="${5:-false}" allowed_only="${6:-false}"
  local net_file="${7:-}" w_client="${8:-20}" w_dest="${9:-30}"

  local peer_set=()
  [[ -n "$filter_peers" ]] && IFS=',' read -ra peer_set <<< "$filter_peers"

  # Build ip->name map
  declare -A ip_to_name=()
  while IFS= read -r conf; do
    local cname
    cname=$(basename "$conf" .conf)
    local ip
    ip=$(grep "^Address" "$conf" 2>/dev/null | awk '{print $3}' | cut -d'/' -f1)
    [[ -n "$ip" && -n "$cname" ]] && ip_to_name["$ip"]="$cname"
  done < <(find "$(ctx::clients)" -name "*.conf" 2>/dev/null)

  # Load net services if not --raw
  declare -A _svc_cache=()
  function _resolve_dest() {
    local dest_ip="${1:-}" dest_port="${2:-}" proto="${3:-}"
    [[ -z "$net_file" || ! -f "$net_file" ]] && echo "" && return
    local key="${dest_ip}:${dest_port}:${proto}"
    if [[ -z "${_svc_cache[$key]+x}" ]]; then
      _svc_cache[$key]=$(net::reverse_lookup "$dest_ip" "$dest_port" "$proto" 2>/dev/null || true)
    fi
    echo "${_svc_cache[$key]:-}"
  }

  declare -A _WATCH_LAST_FW=()
  declare -A _WATCH_LAST_WG=()

  local source_file
  source_file=$(mktemp)
  echo "wg" > "$source_file"
  trap "rm -f '$source_file'" EXIT

  tail -f "$(ctx::events_log)" "$(ctx::fw_events_log)" 2>/dev/null \
  | while IFS= read -r line; do
    [[ -z "$line" ]] && continue

    if [[ "$line" == "==> "* ]]; then
      [[ "$line" == *"fw_events"* ]] && echo "fw" > "$source_file" || echo "wg" > "$source_file"
      continue
    fi

    local source
    source=$(cat "$source_file")

    if [[ "$source" == "fw" ]]; then
      $allowed_only && continue

      local fw_data
      fw_data=$(python3 "$(ctx::json_helper)" parse_fw_event "$line" 2>/dev/null) || continue
      [[ -z "$fw_data" ]] && continue

      local ts src_ip dest_ip dest_port proto
      IFS='|' read -r ts src_ip dest_ip dest_port proto <<< "$fw_data"
      [[ -z "$src_ip" ]] && continue

      local client="${ip_to_name[$src_ip]:-$src_ip}"
      [[ -n "$filter_name" && "$client" != "$filter_name" ]] && continue

      # Dedup
      local fw_key="${src_ip}:${dest_ip}:${dest_port}:${proto}"
      local now; now=$(date +%s)
      local window=30
      [[ "$proto" == "17" || "$proto" == "udp" ]] && window=10
      [[ "$proto" == "1"  || "$proto" == "icmp" ]] && window=5
      local last="${_WATCH_LAST_FW[$fw_key]:-0}"
      (( now - last < window )) && continue
      _WATCH_LAST_FW["$fw_key"]="$now"

      local ts_fmt
      ts_fmt=$(fmt::datetime_short "$(json::iso_to_ts "$ts" 2>/dev/null || echo 0)")

      local dest_display
      dest_display=$(resolve::dest "$dest_ip" "$dest_port" "$proto")

      ui::watch::fw_row "$ts_fmt" "$client" "$dest_display" "$w_client" "$w_dest"

    else
      $restricted_only && continue

      local ev_data
      ev_data=$(python3 "$(ctx::json_helper)" parse_event "$line" 2>/dev/null) || continue
      [[ -z "$ev_data" ]] && continue

      local ts client endpoint event
      IFS='|' read -r ts client endpoint event <<< "$ev_data"
      [[ -n "$filter_name" && "$client" != "$filter_name" ]] && continue
      $blocked_only && [[ "$event" != "attempt" ]] && continue
      $allowed_only && [[ "$event" != "handshake" ]] && continue

      # Dedup
      local wg_key="${client}:${endpoint}:${event}"
      local now; now=$(date +%s)
      local last="${_WATCH_LAST_WG[$wg_key]:-0}"
      (( now - last < 30 )) && continue
      _WATCH_LAST_WG["$wg_key"]="$now"

      local ts_fmt
      ts_fmt=$(fmt::datetime_short "$(json::iso_to_ts "$ts" 2>/dev/null || echo 0)")

      ui::watch::wg_row "$ts_fmt" "$client" "${endpoint:-—}" "$event" \
        "$w_client" "$w_dest"
    fi
  done

  rm -f "$source_file"
}