package openresty

import (
	"crypto/sha256"
	"crypto/x509"
	"encoding/base64"
	"encoding/hex"
	"encoding/json"
	"encoding/pem"
	"errors"
	"fmt"
	"net/url"
	"regexp"
	"sort"
	"strings"
)

func RenderJSON(sourceJSON string, certificateFiles []SupportFile) (*Result, error) {
	var doc Document
	if err := json.Unmarshal([]byte(strings.TrimSpace(sourceJSON)), &doc); err != nil {
		return nil, fmt.Errorf("openresty source config json is invalid: %w", err)
	}
	return Render(doc, certificateFiles)
}

func Render(doc Document, certificateFiles []SupportFile) (*Result, error) {
	mainConfig := RenderMainConfig(doc.OpenRestyConfig)
	routeConfig, err := RenderRouteConfig(doc, certificateFiles)
	if err != nil {
		return nil, err
	}
	wafConfig, err := RenderWAFConfig(doc.WAF)
	if err != nil {
		return nil, err
	}
	powConfig, err := RenderPoWConfig(doc)
	if err != nil {
		return nil, err
	}
	files := append([]SupportFile(nil), certificateFiles...)
	files = append(files, SupportFile{Path: "pow_config.json", Content: powConfig})
	files = append(files, SupportFile{Path: "waf_config.json", Content: wafConfig})
	files = DedupeSupportFiles(files)
	return &Result{
		MainConfig:   mainConfig,
		RouteConfig:  routeConfig,
		SupportFiles: files,
		Checksum:     ChecksumBundle(mainConfig, routeConfig, files),
	}, nil
}

func RenderMainConfig(cfg ConfigSnapshot) string {
	templateText := cfg.MainConfigTemplate
	if strings.TrimSpace(templateText) == "" {
		templateText = defaultMainConfigTemplate
	}
	return renderMainConfigTemplate(templateText, cfg)
}

func ValidateMainConfigTemplate(templateText string) error {
	trimmed := strings.TrimSpace(templateText)
	if trimmed == "" {
		return errors.New("OpenRestyMainConfigTemplate 不能为空")
	}
	for _, placeholder := range requiredMainConfigTemplatePlaceholders {
		if !strings.Contains(trimmed, placeholder) {
			return fmt.Errorf("OpenRestyMainConfigTemplate 必须保留占位符 %s", placeholder)
		}
	}
	return nil
}

func RenderRouteConfig(doc Document, certificateFiles []SupportFile) (string, error) {
	var builder strings.Builder
	builder.WriteString("# This file is generated by OpenFlare. Do not edit manually.\n")
	certificates := certificatesByID(certificateFiles)
	for _, route := range doc.Routes {
		domains := normalizedRouteDomains(route)
		if len(domains) == 0 {
			return "", fmt.Errorf("route %s domains are invalid", route.Domain)
		}
		serverNames := renderServerNames(domains)
		displayName := strings.TrimSpace(route.SiteName)
		if displayName == "" {
			displayName = domains[0]
		}
		upstreams := route.Upstreams
		if len(upstreams) == 0 && strings.TrimSpace(route.OriginURL) != "" {
			upstreams = []string{route.OriginURL}
		}
		upstreamConfig := buildRouteUpstreamConfig(route, upstreams)
		if upstreamConfig.UsesNamedUpstream {
			builder.WriteString(renderNamedUpstreamBlock(upstreamConfig))
		}
		cacheConfig := routeCacheConfig{Enabled: route.CacheEnabled, Policy: route.CachePolicy, Rules: route.CacheRules}
		limitConfig := routeLimitConfig{LimitConnPerServer: route.LimitConnPerServer, LimitConnPerIP: route.LimitConnPerIP, LimitRate: route.LimitRate}
		powEnabled, _ := getPoWConfigForRoute(route.ID, doc.WAF)
		if route.PoWEnabled {
			powEnabled = true
		}
		if !route.EnableHTTPS {
			builder.WriteString(renderHTTPProxyServer(serverNames, displayName, route.OriginURL, route.OriginHost, route.CustomHeaders, cacheConfig, limitConfig, upstreamConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword, doc.OpenRestyConfig))
			continue
		}
		certIDs := normalizeCertIDs(route.CertID, route.CertIDs)
		domainCertIDs := normalizeDomainCertIDs(domains, certIDs, route.DomainCertIDs)
		if len(certIDs) == 0 {
			return "", fmt.Errorf("路由 %s 未配置证书", route.Domain)
		}
		httpOnlyDomains := make([]string, 0, len(domains))
		domainsByCertID := make(map[uint][]string, len(certIDs))
		for index, domain := range domains {
			if index >= len(domainCertIDs) || domainCertIDs[index] == 0 {
				httpOnlyDomains = append(httpOnlyDomains, domain)
				continue
			}
			domainsByCertID[domainCertIDs[index]] = append(domainsByCertID[domainCertIDs[index]], domain)
		}
		for _, certID := range certIDs {
			assignedDomains := domainsByCertID[certID]
			if len(assignedDomains) == 0 {
				continue
			}
			certPEM, ok := certificates[certID]
			if !ok {
				return "", fmt.Errorf("route %s certificate %d does not exist", route.Domain, certID)
			}
			if err := validateCertificateCoverage(certPEM, assignedDomains); err != nil {
				return "", fmt.Errorf("site %s certificate validation failed: %w", displayName, err)
			}
		}
		if route.RedirectHTTP {
			if len(httpOnlyDomains) > 0 {
				builder.WriteString(renderHTTPProxyServer(renderServerNames(httpOnlyDomains), displayName, route.OriginURL, route.OriginHost, route.CustomHeaders, cacheConfig, limitConfig, upstreamConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword, doc.OpenRestyConfig))
			}
			for _, certID := range certIDs {
				if assignedDomains := domainsByCertID[certID]; len(assignedDomains) > 0 {
					builder.WriteString(renderHTTPRedirectServer(renderServerNames(assignedDomains)))
				}
			}
		} else {
			builder.WriteString(renderHTTPProxyServer(serverNames, displayName, route.OriginURL, route.OriginHost, route.CustomHeaders, cacheConfig, limitConfig, upstreamConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword, doc.OpenRestyConfig))
		}
		for _, certID := range certIDs {
			if assignedDomains := domainsByCertID[certID]; len(assignedDomains) > 0 {
				builder.WriteString(renderHTTPSServer(renderServerNames(assignedDomains), displayName, route.OriginURL, route.OriginHost, certID, route.CustomHeaders, cacheConfig, limitConfig, upstreamConfig, powEnabled, route.BasicAuthEnabled, route.BasicAuthUsername, route.BasicAuthPassword, doc.OpenRestyConfig))
			}
		}
	}
	return builder.String(), nil
}

func RenderPoWConfig(doc Document) (string, error) {
	type domainEntry struct {
		Domains []string   `json:"domains"`
		Enabled bool       `json:"enabled"`
		Config  *PoWConfig `json:"config"`
	}
	entries := make([]domainEntry, 0)
	for _, route := range doc.Routes {
		powEnabled, powConfig := getPoWConfigForRoute(route.ID, doc.WAF)
		if route.PoWEnabled {
			powEnabled = true
			if route.PoWConfig != nil {
				powConfig = route.PoWConfig
			}
		}
		if !powEnabled {
			continue
		}
		entries = append(entries, domainEntry{Domains: normalizedRouteDomains(route), Enabled: true, Config: powConfig})
	}
	if len(entries) == 0 {
		return "{}", nil
	}
	data, err := json.Marshal(entries)
	return string(data), err
}

func RenderWAFConfig(snapshot WAFDocument) (string, error) {
	type wafRuntimeRuleGroup struct {
		ID                uint     `json:"id"`
		Name              string   `json:"name"`
		IsGlobal          bool     `json:"is_global"`
		BlockStatusCode   int      `json:"block_status_code"`
		BlockResponseBody string   `json:"block_response_body"`
		IPWhitelist       []string `json:"ip_whitelist"`
		IPBlacklist       []string `json:"ip_blacklist"`
		CountryWhitelist  []string `json:"country_whitelist"`
		CountryBlacklist  []string `json:"country_blacklist"`
		RegionWhitelist   []string `json:"region_whitelist"`
		RegionBlacklist   []string `json:"region_blacklist"`
	}
	type wafRuntimeConfig struct {
		DefaultBlockStatusCode int                   `json:"default_block_status_code"`
		RuleGroups             []wafRuntimeRuleGroup `json:"rule_groups"`
		SiteRuleGroups         map[string][]uint     `json:"site_rule_groups"`
	}
	groups := make([]wafRuntimeRuleGroup, 0, len(snapshot.RuleGroups))
	globalGroupIDs := make([]uint, 0)
	enabledGroupIDs := make(map[uint]struct{}, len(snapshot.RuleGroups))
	ipGroupsByID := make(map[uint]WAFIPGroup, len(snapshot.IPGroups))
	for _, group := range snapshot.IPGroups {
		ipGroupsByID[group.ID] = group
	}
	for _, group := range snapshot.RuleGroups {
		if !group.Enabled {
			continue
		}
		statusCode := group.BlockStatusCode
		if statusCode == 0 {
			statusCode = defaultWAFBlockStatus
		}
		if group.IsGlobal {
			globalGroupIDs = append(globalGroupIDs, group.ID)
		}
		enabledGroupIDs[group.ID] = struct{}{}
		groups = append(groups, wafRuntimeRuleGroup{
			ID:                group.ID,
			Name:              group.Name,
			IsGlobal:          group.IsGlobal,
			BlockStatusCode:   statusCode,
			BlockResponseBody: group.BlockResponseBody,
			IPWhitelist:       expandWAFIPGroups(group.IPWhitelist, group.IPWhitelistGroups, ipGroupsByID),
			IPBlacklist:       expandWAFIPGroups(group.IPBlacklist, group.IPBlacklistGroups, ipGroupsByID),
			CountryWhitelist:  group.CountryWhitelist,
			CountryBlacklist:  group.CountryBlacklist,
			RegionWhitelist:   group.RegionWhitelist,
			RegionBlacklist:   group.RegionBlacklist,
		})
	}
	sort.Slice(groups, func(i, j int) bool {
		if groups[i].IsGlobal != groups[j].IsGlobal {
			return groups[i].IsGlobal
		}
		return groups[i].ID < groups[j].ID
	})
	sort.Slice(globalGroupIDs, func(i, j int) bool { return globalGroupIDs[i] < globalGroupIDs[j] })
	siteRuleGroups := make(map[string][]uint, len(snapshot.Bindings))
	for _, binding := range snapshot.Bindings {
		ids := append([]uint{}, globalGroupIDs...)
		for _, id := range binding.RuleGroupIDs {
			if _, ok := enabledGroupIDs[id]; ok {
				ids = append(ids, id)
			}
		}
		siteRuleGroups[binding.SiteName] = uniqueUintIDs(ids)
	}
	data, err := json.Marshal(wafRuntimeConfig{DefaultBlockStatusCode: defaultWAFBlockStatus, RuleGroups: groups, SiteRuleGroups: siteRuleGroups})
	return string(data), err
}

func expandWAFIPGroups(direct []string, groupIDs []uint, ipGroupsByID map[uint]WAFIPGroup) []string {
	items := append([]string{}, direct...)
	for _, id := range groupIDs {
		group, ok := ipGroupsByID[id]
		if !ok || !group.Enabled {
			continue
		}
		items = append(items, group.IPList...)
	}
	items = uniqueStrings(items)
	sort.Strings(items)
	return items
}

func ChecksumBundle(mainConfig string, routeConfig string, supportFiles []SupportFile) string {
	var builder strings.Builder
	builder.WriteString(mainConfig)
	builder.WriteString("\n--route-config--\n")
	builder.WriteString(routeConfig)
	builder.WriteString("\n--support-files--\n")
	files := DedupeSupportFiles(supportFiles)
	sort.Slice(files, func(i int, j int) bool { return files[i].Path < files[j].Path })
	for _, file := range files {
		if file.Path == SourceConfigFileName {
			continue
		}
		builder.WriteString(file.Path)
		builder.WriteString("\n")
		builder.WriteString(file.Content)
		builder.WriteString("\n")
	}
	sum := sha256.Sum256([]byte(builder.String()))
	return hex.EncodeToString(sum[:])
}

func DedupeSupportFiles(files []SupportFile) []SupportFile {
	if len(files) == 0 {
		return nil
	}
	unique := make(map[string]SupportFile, len(files))
	for _, file := range files {
		unique[file.Path] = file
	}
	result := make([]SupportFile, 0, len(unique))
	for _, file := range unique {
		result = append(result, file)
	}
	return result
}

func renderMainConfigTemplate(templateText string, cfg ConfigSnapshot) string {
	replacer := strings.NewReplacer(
		"{{OpenRestyWorkerProcesses}}", cfg.WorkerProcesses,
		"{{OpenRestyWorkerConnections}}", fmt.Sprintf("%d", cfg.WorkerConnections),
		"{{OpenRestyWorkerRlimitNofile}}", fmt.Sprintf("%d", cfg.WorkerRlimitNofile),
		"{{OpenRestyConnectionUpgradeMap}}", renderConnectionUpgradeMap(),
		"{{OpenRestyDefaultServerBlock}}", renderDefaultServerBlock(),
		"{{OpenRestyAccessLogPath}}", AccessLogPlaceholder,
		"{{OpenRestyErrorLogPath}}", ErrorLogPlaceholder,
		"{{OpenRestyEventsUseDirective}}", renderTemplateDirective(cfg.EventsUse != "", fmt.Sprintf("use %s;", cfg.EventsUse)),
		"{{OpenRestyEventsMultiAcceptDirective}}", renderTemplateDirective(cfg.EventsMultiAcceptEnabled, "multi_accept on;"),
		"{{OpenRestyKeepaliveTimeout}}", fmt.Sprintf("%d", cfg.KeepaliveTimeout),
		"{{OpenRestyKeepaliveRequests}}", fmt.Sprintf("%d", cfg.KeepaliveRequests),
		"{{OpenRestyClientHeaderTimeout}}", fmt.Sprintf("%d", cfg.ClientHeaderTimeout),
		"{{OpenRestyClientBodyTimeout}}", fmt.Sprintf("%d", cfg.ClientBodyTimeout),
		"{{OpenRestyClientMaxBodySize}}", cfg.ClientMaxBodySize,
		"{{OpenRestyLargeClientHeaderBuffers}}", cfg.LargeClientHeaderBuffers,
		"{{OpenRestySendTimeout}}", fmt.Sprintf("%d", cfg.SendTimeout),
		"{{OpenRestyProxyConnectTimeout}}", fmt.Sprintf("%d", cfg.ProxyConnectTimeout),
		"{{OpenRestyProxySendTimeout}}", fmt.Sprintf("%d", cfg.ProxySendTimeout),
		"{{OpenRestyProxyReadTimeout}}", fmt.Sprintf("%d", cfg.ProxyReadTimeout),
		"{{OpenRestyProxyRequestBuffering}}", onOff(cfg.ProxyRequestBuffering),
		"{{OpenRestyProxyBuffering}}", onOff(cfg.ProxyBufferingEnabled),
		"{{OpenRestyProxyBuffers}}", cfg.ProxyBuffers,
		"{{OpenRestyProxyBufferSize}}", cfg.ProxyBufferSize,
		"{{OpenRestyProxyBusyBuffersSize}}", cfg.ProxyBusyBuffersSize,
		"{{OpenRestyGzip}}", onOff(cfg.GzipEnabled),
		"{{OpenRestyGzipMinLength}}", fmt.Sprintf("%d", cfg.GzipMinLength),
		"{{OpenRestyGzipCompLevel}}", fmt.Sprintf("%d", cfg.GzipCompLevel),
		"{{OpenRestyResolverDirective}}", renderTemplateDirective(cfg.Resolvers != "", fmt.Sprintf("resolver %s;", cfg.Resolvers)),
		"{{OpenRestyCacheBlock}}", renderOpenRestyCacheTemplateBlock(cfg),
		"{{OpenRestyRouteConfigInclude}}", RouteConfigPlaceholder,
	)
	return replacer.Replace(templateText)
}

func renderTemplateDirective(enabled bool, statement string) string {
	if !enabled {
		return ""
	}
	return fmt.Sprintf("    %s\n", statement)
}

func renderOpenRestyCacheTemplateBlock(cfg ConfigSnapshot) string {
	lines := []string{renderOpenRestyLimitZoneBlock()}
	if !cfg.CacheEnabled {
		lines = append(lines, renderOpenRestyObservabilityTemplateBlock())
		return strings.Join(lines, "")
	}
	lines = append(lines, strings.Join([]string{
		fmt.Sprintf("    proxy_cache_path %s levels=%s keys_zone=openflare_cache:10m inactive=%s max_size=%s;", cfg.CachePath, cfg.CacheLevels, cfg.CacheInactive, cfg.CacheMaxSize),
		fmt.Sprintf("    proxy_cache_key \"%s\";", cfg.CacheKeyTemplate),
		fmt.Sprintf("    proxy_cache_lock %s;", onOff(cfg.CacheLockEnabled)),
		fmt.Sprintf("    proxy_cache_lock_timeout %s;", cfg.CacheLockTimeout),
		fmt.Sprintf("    proxy_cache_use_stale %s;", cfg.CacheUseStale),
		"",
	}, "\n"))
	lines = append(lines, renderOpenRestyObservabilityTemplateBlock())
	return strings.Join(lines, "")
}

func renderOpenRestyLimitZoneBlock() string {
	return "    limit_conn_zone $server_name zone=openflare_conn_per_server:10m;\n    limit_conn_zone $binary_remote_addr zone=openflare_conn_per_ip:10m;\n"
}

func renderOpenRestyObservabilityTemplateBlock() string {
	return fmt.Sprintf("    lua_shared_dict openflare_observability 10m;\n    lua_shared_dict openflare_pow_challenges 10m;\n    lua_shared_dict openflare_pow_sessions 10m;\n    lua_shared_dict openflare_pow_config 1m;\n    lua_shared_dict openflare_waf_config 1m;\n    init_worker_by_lua_file %s/observability/init.lua;\n    log_by_lua_file %s/observability/log.lua;\n\n    server {\n        listen %s;\n        server_name openflare-observability;\n        access_log off;\n\n        location = /openflare/stub_status {\n            stub_status;\n        }\n\n        location = /openflare/observability {\n            default_type application/json;\n            content_by_lua_file %s/observability/read.lua;\n        }\n    }\n\n", LuaDirPlaceholder, LuaDirPlaceholder, ObservabilityListenPlaceholder, LuaDirPlaceholder)
}

func renderHTTPProxyServer(serverNames string, siteName string, originURL string, originHost string, customHeaders []CustomHeader, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, powEnabled bool, basicAuthEnabled bool, basicAuthUsername string, basicAuthPassword string, cfg ConfigSnapshot) string {
	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n%s%s    location / {\n%s%s%s%s%s    }\n%s}\n\n", serverNames, renderAccessBlock(siteName, powEnabled), renderPowLocationBlocks(powEnabled), renderBasicAuthBlock(basicAuthEnabled, basicAuthUsername, basicAuthPassword), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig, cfg), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig), renderPowStaticLocationBlock(powEnabled))
}

func renderHTTPRedirectServer(serverNames string) string {
	return fmt.Sprintf("server {\n    listen 80;\n    server_name %s;\n\n    return 301 https://$host$request_uri;\n}\n\n", serverNames)
}

func renderHTTPSServer(serverNames string, siteName string, originURL string, originHost string, certificateID uint, customHeaders []CustomHeader, cacheConfig routeCacheConfig, limitConfig routeLimitConfig, upstreamConfig routeUpstreamConfig, powEnabled bool, basicAuthEnabled bool, basicAuthUsername string, basicAuthPassword string, cfg ConfigSnapshot) string {
	certPath := fmt.Sprintf("%s/%d.crt", CertDirPlaceholder, certificateID)
	keyPath := fmt.Sprintf("%s/%d.key", CertDirPlaceholder, certificateID)
	return fmt.Sprintf("server {\n    listen 443 ssl;\n    http2 on;\n    server_name %s;\n    ssl_certificate %s;\n    ssl_certificate_key %s;\n%s%s    location / {\n%s%s%s%s%s    }\n%s}\n\n", serverNames, certPath, keyPath, renderAccessBlock(siteName, powEnabled), renderPowLocationBlocks(powEnabled), renderBasicAuthBlock(basicAuthEnabled, basicAuthUsername, basicAuthPassword), renderProxyHeaderBlock(originURL, originHost, customHeaders, upstreamConfig, cfg), renderRouteLimitBlock(limitConfig), renderRouteCacheBlock(cacheConfig, cfg), renderProxyPassBlock(originURL, upstreamConfig), renderPowStaticLocationBlock(powEnabled))
}

func renderProxyHeaderBlock(originURL string, originHost string, customHeaders []CustomHeader, upstreamConfig routeUpstreamConfig, cfg ConfigSnapshot) string {
	var builder strings.Builder
	if strings.TrimSpace(originHost) != "" {
		builder.WriteString(fmt.Sprintf("        proxy_set_header Host %s;\n", quoteNginxStringLiteral(originHost)))
	} else {
		builder.WriteString("        proxy_set_header Host $host;\n")
	}
	if upstreamServerName := resolveUpstreamServerName(originURL, originHost); upstreamServerName != "" {
		builder.WriteString("        proxy_ssl_server_name on;\n")
		builder.WriteString(fmt.Sprintf("        proxy_ssl_name %s;\n", quoteNginxStringLiteral(upstreamServerName)))
	}
	builder.WriteString("        proxy_set_header X-Real-IP $remote_addr;\n")
	builder.WriteString("        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n")
	builder.WriteString("        proxy_set_header X-Forwarded-Proto $scheme;\n")
	if cfg.WebsocketEnabled {
		builder.WriteString("        proxy_http_version 1.1;\n")
		builder.WriteString("        proxy_set_header Connection $connection_upgrade;\n")
		builder.WriteString("        proxy_set_header Upgrade $http_upgrade;\n")
	} else if upstreamConfig.UsesNamedUpstream {
		builder.WriteString("        proxy_http_version 1.1;\n")
		builder.WriteString("        proxy_set_header Connection \"\";\n")
	}
	for _, header := range customHeaders {
		builder.WriteString(fmt.Sprintf("        proxy_set_header %s %s;\n", header.Key, quoteNginxStringLiteral(header.Value)))
	}
	return builder.String()
}

func renderAccessBlock(siteName string, powEnabled bool) string {
	escapedSiteName := escapeNginxString(siteName)
	if !powEnabled {
		return fmt.Sprintf("    set $openflare_waf_site \"%s\";\n    access_by_lua_file %s/waf/check.lua;\n", escapedSiteName, LuaDirPlaceholder)
	}
	return fmt.Sprintf(`    set $openflare_waf_site "%s";
    access_by_lua_block {
        if not string.find(package.path, "%s/?.lua", 1, true) then
            package.path = "%s/?.lua;%s/?/init.lua;" .. package.path
        end
        require("waf.runtime").check()
        if ngx.ctx.openflare_waf_blocked then
            return
        end
        require("pow.runtime").check()
    }
`, escapedSiteName, LuaDirPlaceholder, LuaDirPlaceholder, LuaDirPlaceholder)
}

func renderBasicAuthBlock(enabled bool, username, password string) string {
	if !enabled || username == "" || password == "" {
		return ""
	}
	encoded := base64.StdEncoding.EncodeToString([]byte(username + ":" + password))
	return fmt.Sprintf("        rewrite_by_lua_block {\n            local auth = ngx.var.http_authorization\n            if auth ~= \"Basic %s\" then\n                ngx.header[\"WWW-Authenticate\"] = 'Basic realm=\"Restricted\"'\n                return ngx.exit(401)\n            end\n        }\n", encoded)
}

func renderPowLocationBlocks(powEnabled bool) string {
	if !powEnabled {
		return ""
	}
	return fmt.Sprintf("\n    location = %spass-challenge {\n        content_by_lua_file %s/pow/verify.lua;\n    }\n\n    location = %smake-challenge {\n        content_by_lua_file %s/pow/challenge.lua;\n    }\n\n", anubisAPIPrefix, LuaDirPlaceholder, anubisAPIPrefix, LuaDirPlaceholder)
}

func renderPowStaticLocationBlock(powEnabled bool) string {
	if !powEnabled {
		return ""
	}
	return fmt.Sprintf("    location %s {\n        alias %s/;\n        types {\n            text/css css;\n            application/javascript js mjs;\n            application/json json;\n            image/webp webp;\n            font/woff2 woff2;\n        }\n    }\n\n", anubisStaticPrefix, PowStaticDirPlaceholder)
}

func renderRouteCacheBlock(cacheConfig routeCacheConfig, cfg ConfigSnapshot) string {
	if !cfg.CacheEnabled || !cacheConfig.Enabled {
		return ""
	}
	var builder strings.Builder
	builder.WriteString("        set $openflare_skip_cache 0;\n")
	builder.WriteString("        if ($request_method != GET) {\n            set $openflare_skip_cache 1;\n        }\n")
	builder.WriteString("        if ($http_authorization != \"\") {\n            set $openflare_skip_cache 1;\n        }\n")
	builder.WriteString("        if ($http_cookie ~* \"(session|sess|token|auth|jwt|logged_in|remember|laravel_session|connect\\\\.sid|_session)\") {\n            set $openflare_skip_cache 1;\n        }\n")
	builder.WriteString("        if ($http_cache_control ~* \"(no-cache|no-store|private)\") {\n            set $openflare_skip_cache 1;\n        }\n")
	if condition := renderRouteCachePolicyCondition(cacheConfig); condition != "" {
		builder.WriteString(condition)
	}
	builder.WriteString("        proxy_cache openflare_cache;\n")
	builder.WriteString("        proxy_cache_methods GET;\n")
	builder.WriteString("        proxy_cache_bypass $openflare_skip_cache;\n")
	builder.WriteString("        proxy_no_cache $openflare_skip_cache;\n")
	return builder.String()
}

func renderRouteLimitBlock(limitConfig routeLimitConfig) string {
	var builder strings.Builder
	if limitConfig.LimitConnPerServer > 0 {
		builder.WriteString(fmt.Sprintf("        limit_conn openflare_conn_per_server %d;\n", limitConfig.LimitConnPerServer))
	}
	if limitConfig.LimitConnPerIP > 0 {
		builder.WriteString(fmt.Sprintf("        limit_conn openflare_conn_per_ip %d;\n", limitConfig.LimitConnPerIP))
	}
	if strings.TrimSpace(limitConfig.LimitRate) != "" {
		builder.WriteString(fmt.Sprintf("        limit_rate %s;\n", limitConfig.LimitRate))
	}
	return builder.String()
}

func renderRouteCachePolicyCondition(cacheConfig routeCacheConfig) string {
	switch cacheConfig.Policy {
	case cachePolicySuffix:
		return fmt.Sprintf("        if ($uri !~* %s) {\n            set $openflare_skip_cache 1;\n        }\n", quoteNginxStringLiteral(buildSuffixMatchPattern(cacheConfig.Rules)))
	case cachePolicyPathPrefix:
		return fmt.Sprintf("        if ($uri !~ %s) {\n            set $openflare_skip_cache 1;\n        }\n", quoteNginxStringLiteral(buildPathPrefixMatchPattern(cacheConfig.Rules)))
	case cachePolicyPathExact:
		return fmt.Sprintf("        if ($uri !~ %s) {\n            set $openflare_skip_cache 1;\n        }\n", quoteNginxStringLiteral(buildPathExactMatchPattern(cacheConfig.Rules)))
	default:
		return ""
	}
}

func renderProxyPassBlock(originURL string, upstreamConfig routeUpstreamConfig) string {
	parsed, err := url.Parse(originURL)
	if err != nil || parsed.Host == "" || parsed.Scheme == "" {
		return fmt.Sprintf("        proxy_pass %s;\n", originURL)
	}
	if upstreamConfig.UsesNamedUpstream {
		return fmt.Sprintf("        proxy_pass %s://%s%s;\n", upstreamConfig.Scheme, upstreamConfig.Name, upstreamConfig.ProxyPassURI)
	}
	return fmt.Sprintf("        proxy_pass %s;\n", originURL)
}

func buildRouteUpstreamConfig(route Route, upstreams []string) routeUpstreamConfig {
	if len(upstreams) == 0 {
		return routeUpstreamConfig{}
	}
	if len(upstreams) == 1 {
		parsed, err := url.Parse(strings.TrimSpace(upstreams[0]))
		if err != nil || parsed.Host == "" || parsed.Scheme == "" {
			return routeUpstreamConfig{}
		}
		return routeUpstreamConfig{Name: buildRouteUpstreamName(route), Scheme: parsed.Scheme, ProxyPassURI: buildUpstreamProxyPassURI(parsed), Servers: []string{parsed.Host}, UsesNamedUpstream: true}
	}
	servers := make([]string, 0, len(upstreams))
	var scheme string
	for _, upstream := range upstreams {
		parsed, err := url.Parse(strings.TrimSpace(upstream))
		if err != nil || parsed.Host == "" || parsed.Scheme == "" || (strings.TrimSpace(parsed.EscapedPath()) != "" && strings.TrimSpace(parsed.EscapedPath()) != "/") || parsed.RawQuery != "" {
			return routeUpstreamConfig{}
		}
		if scheme == "" {
			scheme = parsed.Scheme
		} else if scheme != parsed.Scheme {
			return routeUpstreamConfig{}
		}
		servers = append(servers, parsed.Host)
	}
	return routeUpstreamConfig{Name: buildRouteUpstreamName(route), Scheme: scheme, Servers: servers, UsesNamedUpstream: true}
}

func renderNamedUpstreamBlock(upstreamConfig routeUpstreamConfig) string {
	var builder strings.Builder
	builder.WriteString(fmt.Sprintf("upstream %s {\n", upstreamConfig.Name))
	for _, server := range upstreamConfig.Servers {
		builder.WriteString(fmt.Sprintf("    server %s max_fails=3 fail_timeout=10s;\n", server))
	}
	builder.WriteString("    keepalive 128;\n}\n\n")
	return builder.String()
}

func buildRouteUpstreamName(route Route) string {
	identity := strings.TrimSpace(route.SiteName)
	if identity == "" {
		identity = route.Domain
	}
	sanitized := strings.Map(func(r rune) rune {
		switch {
		case r >= 'a' && r <= 'z':
			return r
		case r >= 'A' && r <= 'Z':
			return r + ('a' - 'A')
		case r >= '0' && r <= '9':
			return r
		default:
			return '_'
		}
	}, identity)
	sanitized = strings.Trim(sanitized, "_")
	if sanitized == "" {
		sanitized = "backend"
	}
	return fmt.Sprintf("backend_%s_%d", sanitized, route.ID)
}

func buildUpstreamProxyPassURI(parsed *url.URL) string {
	path := parsed.EscapedPath()
	if path == "/" {
		path = ""
	}
	if parsed.RawQuery == "" {
		return path
	}
	return fmt.Sprintf("%s?%s", path, parsed.RawQuery)
}

func renderConnectionUpgradeMap() string {
	return "    map $http_upgrade $connection_upgrade {\n        default upgrade;\n        ''      \"\";\n    }\n\n"
}

func renderDefaultServerBlock() string {
	return strings.Join([]string{"    server {", "        listen 80 default_server;", "        server_name _;", "", "        return 404;", "    }", "", "    server {", "        listen 443 ssl default_server;", "        server_name _;", "", "        ssl_reject_handshake on;", "    }", ""}, "\n")
}

func normalizedRouteDomains(route Route) []string {
	if len(route.Domains) > 0 {
		return route.Domains
	}
	if strings.TrimSpace(route.Domain) == "" {
		return nil
	}
	return []string{strings.TrimSpace(route.Domain)}
}

func normalizeCertIDs(primaryCertID *uint, certIDs []uint) []uint {
	candidates := make([]uint, 0, len(certIDs)+1)
	if primaryCertID != nil && *primaryCertID != 0 {
		candidates = append(candidates, *primaryCertID)
	}
	candidates = append(candidates, certIDs...)
	seen := make(map[uint]struct{}, len(candidates))
	normalized := make([]uint, 0, len(candidates))
	for _, id := range candidates {
		if id == 0 {
			continue
		}
		if _, ok := seen[id]; ok {
			continue
		}
		seen[id] = struct{}{}
		normalized = append(normalized, id)
	}
	return normalized
}

func normalizeDomainCertIDs(domains []string, certIDs []uint, domainCertIDs []uint) []uint {
	if len(domainCertIDs) > 0 {
		normalized := make([]uint, len(domainCertIDs))
		copy(normalized, domainCertIDs)
		return normalized
	}
	if len(certIDs) == 1 {
		normalized := make([]uint, len(domains))
		for index := range normalized {
			normalized[index] = certIDs[0]
		}
		return normalized
	}
	if len(certIDs) == len(domains) {
		normalized := make([]uint, len(certIDs))
		copy(normalized, certIDs)
		return normalized
	}
	return []uint{}
}

func certificatesByID(files []SupportFile) map[uint]string {
	result := make(map[uint]string)
	for _, file := range files {
		if !strings.HasSuffix(file.Path, ".crt") {
			continue
		}
		idText := strings.TrimSuffix(file.Path, ".crt")
		var id uint
		if _, err := fmt.Sscanf(idText, "%d", &id); err == nil && id != 0 {
			result[id] = file.Content
		}
	}
	return result
}

func validateCertificateCoverage(certPEM string, domains []string) error {
	block, _ := pem.Decode([]byte(certPEM))
	if block == nil {
		return errors.New("certificate PEM is invalid")
	}
	leaf, err := x509.ParseCertificate(block.Bytes)
	if err != nil {
		return err
	}
	for _, domain := range domains {
		if err := leaf.VerifyHostname(domain); err != nil {
			return fmt.Errorf("certificate does not cover domain %s", domain)
		}
	}
	return nil
}

func getPoWConfigForRoute(routeID uint, snapshot WAFDocument) (bool, *PoWConfig) {
	for _, binding := range snapshot.Bindings {
		if binding.RouteID != routeID {
			continue
		}
		for _, groupID := range binding.RuleGroupIDs {
			for _, group := range snapshot.RuleGroups {
				if group.ID == groupID && group.PoWEnabled {
					return true, group.PoWConfig
				}
			}
		}
		break
	}
	for _, group := range snapshot.RuleGroups {
		if group.IsGlobal && group.PoWEnabled {
			return true, group.PoWConfig
		}
	}
	return false, nil
}

func uniqueUintIDs(values []uint) []uint {
	seen := make(map[uint]struct{}, len(values))
	result := make([]uint, 0, len(values))
	for _, value := range values {
		if value == 0 {
			continue
		}
		if _, ok := seen[value]; ok {
			continue
		}
		seen[value] = struct{}{}
		result = append(result, value)
	}
	return result
}

func uniqueStrings(values []string) []string {
	seen := make(map[string]struct{}, len(values))
	result := make([]string, 0, len(values))
	for _, value := range values {
		item := strings.TrimSpace(value)
		if item == "" {
			continue
		}
		if _, ok := seen[item]; ok {
			continue
		}
		seen[item] = struct{}{}
		result = append(result, item)
	}
	return result
}

func resolveUpstreamServerName(originURL string, originHost string) string {
	parsed, err := url.Parse(originURL)
	if err != nil || !strings.EqualFold(parsed.Scheme, "https") {
		return ""
	}
	if strings.TrimSpace(originHost) != "" {
		parsedHost, err := url.Parse("//" + originHost)
		if err == nil && parsedHost.Hostname() != "" {
			return parsedHost.Hostname()
		}
		return originHost
	}
	return parsed.Hostname()
}

func renderServerNames(domains []string) string { return strings.Join(domains, " ") }

func onOff(value bool) string {
	if value {
		return "on"
	}
	return "off"
}

func quoteNginxStringLiteral(value string) string {
	escaped := strings.ReplaceAll(value, `\`, `\\`)
	escaped = strings.ReplaceAll(escaped, `"`, `\"`)
	return fmt.Sprintf(`"%s"`, escaped)
}

func escapeNginxString(value string) string {
	escaped := strings.ReplaceAll(value, `\`, `\\`)
	escaped = strings.ReplaceAll(escaped, `"`, `\"`)
	return escaped
}

func buildSuffixMatchPattern(rules []string) string {
	parts := make([]string, 0, len(rules))
	for _, rule := range rules {
		parts = append(parts, regexp.QuoteMeta(rule))
	}
	return fmt.Sprintf("\\.(?:%s)$", strings.Join(parts, "|"))
}

func buildPathPrefixMatchPattern(rules []string) string {
	parts := make([]string, 0, len(rules))
	for _, rule := range rules {
		trimmed := strings.TrimRight(rule, "/")
		if trimmed == "" {
			trimmed = "/"
		}
		if trimmed == "/" {
			parts = append(parts, "/")
			continue
		}
		parts = append(parts, fmt.Sprintf("%s(?:/|$)", regexp.QuoteMeta(trimmed)))
	}
	return fmt.Sprintf("^(?:%s)", strings.Join(parts, "|"))
}

func buildPathExactMatchPattern(rules []string) string {
	parts := make([]string, 0, len(rules))
	for _, rule := range rules {
		parts = append(parts, regexp.QuoteMeta(rule))
	}
	return fmt.Sprintf("^(?:%s)$", strings.Join(parts, "|"))
}