// VPN-Verbindungen (WireGuard / OpenVPN), die vor dem Verbinden zu zugeordneten Hosts automatisch aufgebaut werden.
//   Linux:   NetworkManager (nmcli) – kein root nötig. MrTerm legt pro VPN eine Verbindung "mrterm-<id>" an
//            (autoconnect aus). OpenVPN braucht das Plugin networkmanager-openvpn.
//   Windows: WireGuard als Tunnel-Dienst über wireguard.exe (UAC-Abfrage), OpenVPN über die OpenVPN GUI.
const { execFile, spawn } = require('child_process');
const fs = require('fs');
const os = require('os');
const path = require('path');
const i18n = require('../i18n');

function exec(cmd, args) {
  return new Promise((resolve) => {
    execFile(cmd, args, { windowsHide: true, timeout: 90000 }, (err, stdout, stderr) => {
      resolve({ code: err ? (typeof err.code === 'number' ? err.code : err.code === 'ENOENT' ? 'ENOENT' : 1) : 0, stdout: String(stdout || ''), stderr: String(stderr || err?.message || '') });
    });
  });
}
const lastLine = (s) => s.split('\n').map((l) => l.trim()).filter(Boolean).slice(-1)[0] || '';
const sleep = (ms) => new Promise((r) => setTimeout(r, ms));

class VpnManager {
  constructor(store, userDir) {
    this.store = store;
    this.dir = path.join(userDir, 'vpn');
    this.busy = new Map(); // id -> laufendes up() (parallele Verbindungen zum selben VPN nur einmal aufbauen)
    this.started = new Set(); // von MrTerm aufgebaute VPNs
  }

  get(id) { return this.store.get().vpns.find((v) => v.id === id); }
  nmName(v) { return 'mrterm-' + v.id.slice(0, 8); }
  // Interface-/Tunnelname: max. 15 Zeichen (Linux), nur [a-z0-9]
  ifName(v) { return 'mt' + v.id.replace(/-/g, '').slice(0, 10); }

  // ---------------------------------------------------------------- Linux (NetworkManager)
  async nm(args) {
    const r = await exec('nmcli', args);
    if (r.code === 'ENOENT') throw new Error(i18n.t('NetworkManager (nmcli) not found. MrTerm uses NetworkManager for VPN connections.'));
    return r;
  }
  async nmExists(v) {
    const r = await this.nm(['-t', '-f', 'NAME', 'connection', 'show']);
    return r.stdout.split('\n').includes(this.nmName(v));
  }
  async nmImport(v) {
    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'mrterm-vpn-'));
    const file = path.join(tmp, this.ifName(v) + (v.type === 'openvpn' ? '.ovpn' : '.conf'));
    try {
      fs.writeFileSync(file, v.config || '', { mode: 0o600 });
      const r = await this.nm(['connection', 'import', 'type', v.type === 'openvpn' ? 'openvpn' : 'wireguard', 'file', file]);
      if (r.code) {
        const err = lastLine(r.stderr);
        if (v.type === 'openvpn' && /plugin|openvpn/i.test(err)) throw new Error(i18n.t('OpenVPN support for NetworkManager is missing. Install it with: sudo pacman -S networkmanager-openvpn'));
        throw new Error(i18n.t('VPN configuration could not be imported: {err}', { err }));
      }
      const uuid = (r.stdout.match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/) || [])[0];
      const mod = ['connection', 'modify', uuid || this.ifName(v), 'connection.id', this.nmName(v), 'connection.autoconnect', 'no'];
      if (v.type === 'openvpn' && v.username) mod.push('+vpn.data', `username=${v.username}`);
      if (v.type === 'openvpn' && v.password) mod.push('+vpn.data', 'password-flags=0', 'vpn.secrets', `password=${v.password}`);
      const m = await this.nm(mod);
      if (m.code) throw new Error(lastLine(m.stderr));
    } finally {
      fs.rmSync(tmp, { recursive: true, force: true });
    }
  }

  // ---------------------------------------------------------------- Windows
  get wgExe() { return path.join(process.env.ProgramFiles || 'C:\\Program Files', 'WireGuard', 'wireguard.exe'); }
  get ovpnGui() { return path.join(process.env.ProgramFiles || 'C:\\Program Files', 'OpenVPN', 'bin', 'openvpn-gui.exe'); }
  // Programm mit Administratorrechten starten (UAC) und warten
  async elevate(exe, args) {
    const q = (s) => `'${String(s).replace(/'/g, "''")}'`;
    const cmd = `$p = Start-Process -FilePath ${q(exe)} -ArgumentList @(${args.map((a) => q(`"${a}"`)).join(',')}) -Verb RunAs -Wait -WindowStyle Hidden -PassThru; exit $p.ExitCode`;
    const r = await exec('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', cmd]);
    if (r.code) throw new Error(i18n.t('VPN “{name}” could not be connected: {err}', { name: path.basename(exe), err: lastLine(r.stderr) || r.code }));
  }
  winOvpnName(v) { return this.ifName(v) + '.ovpn'; }
  async winOpenvpnUp() {
    const r = await exec('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
      "@(Get-NetAdapter | Where-Object { $_.Status -eq 'Up' -and $_.InterfaceDescription -match 'TAP-Windows|Wintun|OpenVPN|ovpn-dco' }).Count"]);
    return Number(r.stdout.trim()) > 0;
  }

  // ---------------------------------------------------------------- Gemeinsame API
  async isUp(v) {
    if (process.platform === 'win32') {
      if (v.type === 'openvpn') return this.winOpenvpnUp();
      const r = await exec('sc', ['query', `WireGuardTunnel$${this.ifName(v)}`]);
      return /RUNNING/.test(r.stdout);
    }
    const r = await this.nm(['-t', '-f', 'NAME', 'connection', 'show', '--active']);
    return r.stdout.split('\n').includes(this.nmName(v));
  }

  async status() {
    const out = {};
    for (const v of this.store.get().vpns) { try { out[v.id] = await this.isUp(v); } catch { out[v.id] = false; } }
    return out;
  }

  up(id) {
    if (this.busy.has(id)) return this.busy.get(id);
    const p = this._up(id).finally(() => this.busy.delete(id));
    this.busy.set(id, p);
    return p;
  }

  async _up(id) {
    const v = this.get(id);
    if (!v) throw new Error(i18n.t('VPN not found'));
    if (await this.isUp(v)) return;
    const fail = (err) => new Error(i18n.t('VPN “{name}” could not be connected: {err}', { name: v.label, err }));
    if (process.platform === 'win32') {
      fs.mkdirSync(this.dir, { recursive: true });
      if (v.type === 'openvpn') {
        if (!fs.existsSync(this.ovpnGui)) throw new Error(i18n.t('OpenVPN GUI not found. Install OpenVPN from openvpn.net.'));
        const dir = path.join(os.homedir(), 'OpenVPN', 'config', this.ifName(v));
        fs.mkdirSync(dir, { recursive: true });
        fs.writeFileSync(path.join(dir, this.winOvpnName(v)), v.config || '');
        spawn(this.ovpnGui, ['--connect', this.winOvpnName(v)], { detached: true, stdio: 'ignore' }).unref();
      } else {
        if (!fs.existsSync(this.wgExe)) throw new Error(i18n.t('WireGuard for Windows not found. Install it from wireguard.com.'));
        const file = path.join(this.dir, this.ifName(v) + '.conf');
        fs.writeFileSync(file, v.config || '');
        await this.elevate(this.wgExe, ['/installtunnelservice', file]);
      }
      for (let i = 0; i < 60; i++) { if (await this.isUp(v)) { this.started.add(id); return; } await sleep(500); }
      throw fail(i18n.t('timeout'));
    }
    if (!(await this.nmExists(v))) await this.nmImport(v);
    const r = await this.nm(['--wait', '45', 'connection', 'up', 'id', this.nmName(v)]);
    if (r.code) throw fail(lastLine(r.stderr));
    this.started.add(id);
  }

  // Beim Beenden: von MrTerm aufgebaute VPNs mit Option "beim Beenden trennen" wieder abbauen
  async downOnQuit() {
    for (const id of this.started) {
      const v = this.get(id);
      if (v && v.disconnectOnQuit !== false) await this.down(id).catch(() => {});
    }
  }

  async down(id) {
    const v = this.get(id);
    if (!v) return;
    if (process.platform === 'win32') {
      if (v.type === 'openvpn') spawn(this.ovpnGui, ['--command', 'disconnect', this.winOvpnName(v)], { detached: true, stdio: 'ignore' }).unref();
      else if (await this.isUp(v)) await this.elevate(this.wgExe, ['/uninstalltunnelservice', this.ifName(v)]);
      return;
    }
    await this.nm(['connection', 'down', 'id', this.nmName(v)]);
  }

  // Nach Änderung/Löschen: im System hinterlegte Verbindung entfernen, beim nächsten Verbinden wird neu importiert
  async forget(v) {
    if (!v) return;
    try {
      if (process.platform === 'win32') {
        if (v.type !== 'openvpn' && (await this.isUp(v))) await this.elevate(this.wgExe, ['/uninstalltunnelservice', this.ifName(v)]);
        fs.rmSync(path.join(this.dir, this.ifName(v) + '.conf'), { force: true });
        fs.rmSync(path.join(os.homedir(), 'OpenVPN', 'config', this.ifName(v)), { recursive: true, force: true });
      } else if (await this.nmExists(v)) await this.nm(['connection', 'delete', 'id', this.nmName(v)]);
    } catch { /* VPN-Werkzeuge fehlen – nichts aufzuräumen */ }
  }

  // Alle VPNs eines Hosts (inkl. Jump-Host-Kette) aufbauen, bevor verbunden wird
  async ensureForHost(host, onStatus = () => {}) {
    const ids = [];
    for (let h = host, n = 0; h && n < 10; h = h.jumpHostId ? this.store.resolveHost(h.jumpHostId) : null, n++) {
      if (h.vpnId && !ids.includes(h.vpnId)) ids.push(h.vpnId);
    }
    for (const id of ids.reverse()) {
      const v = this.get(id);
      if (!v) continue;
      if (await this.isUp(v)) continue;
      onStatus(i18n.t('Connecting VPN “{name}” …', { name: v.label }));
      await this.up(id);
    }
    return ids.length > 0;
  }
}

module.exports = { VpnManager };