#!/bin/bash

################################################################################
# OCP Smart Login/Switch Helper Functions
#
# Purpose: Intelligente OCP Cluster-Verwaltung
#  - Erkennt ob bereits angemeldet & Token noch gültig
#  - Falls ja: nur Context wechseln (schnell)
#  - Falls nein: Full Login durchführen (Browser)
#
# Replaces manual switching between ocLogin* und ocAWS-*/ocSC-* aliases
################################################################################

# Color codes
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

################################################################################
# Check if we're logged in to any cluster
################################################################################

is_oc_logged_in() {
    # Try to get current context - if it fails, we're not logged in
    oc config current-context &>/dev/null
    return $?
}

################################################################################
# Check if current OC session/token is still valid
################################################################################

is_oc_token_valid() {
    # Try a simple command that requires auth (list projects)
    # If it succeeds, token is still valid
    oc get projects &>/dev/null
    return $?
}

################################################################################
# Get remaining token expiry time in seconds (if available)
################################################################################

get_token_expiry_info() {
    # Try to extract token expiry from kubeconfig
    # This is cluster/auth-method specific, so we do a simple check

    if ! oc whoami &>/dev/null; then
        echo "Not authenticated"
        return 1
    fi

    # If we got here, token is valid
    local current_user=$(oc whoami)
    local current_context=$(oc config current-context)

    echo "✓ Authenticated as: $current_user"
    echo "✓ Current context: $current_context"
    return 0
}

################################################################################
# Smart OCP Cluster Switch Function
#
# Usage: oc_smart_switch "aws01t" "AWS-Test1" "context-name" "project" \
#                        "token_value" "server_url" "browser_url"
#
# Example: oc_smart_switch "aws01t" "AWS-Test1" \
#          "kihub-dev/api-aws01t-sbb-aws-test-net:6443/u241100" \
#          "kihub-dev" \
#          "$OPENSHIFT_TOKEN_AWS_TEST" \
#          "https://api.aws01t.sbb-aws-test.net:6443" \
#          "https://oauth-openshift.apps.aws01t.sbb-aws-test.net/oauth/token/request"
################################################################################

oc_smart_switch() {
    local cluster_short="$1"
    local cluster_display="$2"
    local context_name="$3"
    local project_name="$4"
    local token_value="$5"        # <- Now direct token VALUE, not variable name!
    local server_url="$6"
    local browser_url="$7"

    echo -e "${BLUE}═══════════════════════════════════════════════════════════${NC}"
    echo -e "${BLUE}OCP Smart Switch: ${cluster_display}${NC}"
    echo -e "${BLUE}═══════════════════════════════════════════════════════════${NC}"

    # Step 1: Check if logged in at all
    if ! is_oc_logged_in; then
        echo -e "${YELLOW}→ Not logged in to any cluster${NC}"
        echo -e "${YELLOW}→ Performing full login...${NC}"
        _oc_perform_login "$cluster_short" "$token_value" "$server_url" "$browser_url"
        return $?
    fi

    # Step 2: Check if token is still valid
    if ! is_oc_token_valid; then
        echo -e "${YELLOW}→ Current token expired or invalid${NC}"
        echo -e "${YELLOW}→ Performing new login...${NC}"
        _oc_perform_login "$cluster_short" "$token_value" "$server_url" "$browser_url"
        return $?
    fi

    # Step 3: Token is valid - check if we're already on target cluster
    local current_context=$(oc config current-context 2>/dev/null)

    if [[ "$current_context" == "$context_name" ]]; then
        echo -e "${GREEN}✓ Already on ${cluster_display} (context: $current_context)${NC}"
        echo -e "${GREEN}✓ Using current token${NC}"
        _oc_verify_project "$project_name"
        return 0
    fi

    # Step 4: Token valid but different cluster - quick context switch
    echo -e "${GREEN}✓ Token valid, switching context...${NC}"
    echo -e "   From: $current_context"
    echo -e "   To:   $context_name"

    if oc config use-context "$context_name" &>/dev/null; then
        echo -e "${GREEN}✓ Context switched successfully${NC}"

        # Verify the token is still valid for this new context
        if ! is_oc_token_valid; then
            echo -e "${YELLOW}⚠ Token not valid for this cluster${NC}"
            echo -e "${YELLOW}→ Previous login was for a different cluster${NC}"
            echo -e "${YELLOW}→ Performing new login with provided token...${NC}"
            _oc_perform_login "$cluster_short" "$token_value" "$server_url" "$browser_url"
            return $?
        fi

        _oc_verify_project "$project_name"
        return 0
    else
        echo -e "${RED}✗ Failed to switch context${NC}"
        echo -e "${YELLOW}→ This might mean the cluster/context doesn't exist in kubeconfig${NC}"
        echo -e "${YELLOW}→ Performing full login...${NC}"
        _oc_perform_login "$cluster_short" "$token_value" "$server_url" "$browser_url"
        return $?
    fi
}

################################################################################
# Internal: Perform full login
################################################################################

_oc_perform_login() {
    local cluster_short="$1"
    local token_value="$2"        # <- Direct token VALUE (already expanded by alias)
    local server_url="$3"
    local browser_url="$4"


    if [[ -z "$token_value" ]]; then
        echo -e "${YELLOW}→ Token not provided or empty${NC}"
        echo -e "${YELLOW}→ Opening browser for manual token entry...${NC}"

        # Try to find browser
        if command -v open &>/dev/null; then
            open "$browser_url"
        elif command -v xdg-open &>/dev/null; then
            xdg-open "$browser_url"
        else
            echo -e "${RED}✗ Could not open browser. Please manually visit:${NC}"
            echo "   $browser_url"
        fi

        # Prompt for token
        echo -e "${YELLOW}Please copy the token from the browser and paste it here:${NC}"
        if [[ -n "${ZSH_VERSION}" ]]; then
            read "?Token: " manual_token
        else
            read -p "Token: " manual_token
        fi

        if [[ -z "$manual_token" ]]; then
            echo -e "${RED}✗ No token provided${NC}"
            return 1
        fi

        oc login --token="$manual_token" --server="$server_url"
    else
        # Try login with stored token
        echo -e "${BLUE}→ Using provided token...${NC}"
        if oc login --token="$token_value" --server="$server_url" &>/dev/null; then
            echo -e "${GREEN}✓ Login successful with stored token${NC}"
            return 0
        else
            echo -e "${YELLOW}→ Stored token invalid, opening browser...${NC}"

            # Open browser for new token
            if command -v open &>/dev/null; then
                open "$browser_url"
            elif command -v xdg-open &>/dev/null; then
                xdg-open "$browser_url"
            else
                echo -e "${RED}✗ Could not open browser. Please manually visit:${NC}"
                echo "   $browser_url"
            fi

            echo -e "${YELLOW}Please copy the new token and paste it here:${NC}"
            if [[ -n "${ZSH_VERSION}" ]]; then
                read "?Token: " manual_token
            else
                read -p "Token: " manual_token
            fi

            if [[ -z "$manual_token" ]]; then
                echo -e "${RED}✗ No token provided${NC}"
                return 1
            fi

            oc login --token="$manual_token" --server="$server_url"
        fi
    fi
}

################################################################################
# Internal: Verify/switch to target project
################################################################################

_oc_verify_project() {
    local project_name="$1"

    if [[ -z "$project_name" ]]; then
        return 0  # No project to switch
    fi

    # Check if we're already in the right project
    local current_project=$(oc project -q 2>/dev/null)

    if [[ "$current_project" == "$project_name" ]]; then
        echo -e "${GREEN}✓ Already in project: $project_name${NC}"
        return 0
    fi

    # Try to switch project
    if oc project "$project_name" &>/dev/null; then
        echo -e "${GREEN}✓ Switched to project: $project_name${NC}"
        return 0
    else
        echo -e "${YELLOW}⚠ Could not switch to project: $project_name${NC}"
        echo -e "${YELLOW}  Available projects: $(oc get projects -o name | tr '\n' ',' | sed 's/,$//')${NC}"
        return 1
    fi
}

################################################################################
# Convenience: Get cluster status
################################################################################

oc_status() {
    echo -e "${BLUE}═══════════════════════════════════════════════════════════${NC}"
    echo -e "${BLUE}OCP Status${NC}"
    echo -e "${BLUE}═══════════════════════════════════════════════════════════${NC}"

    if ! is_oc_logged_in; then
        echo -e "${RED}✗ Not logged in to any cluster${NC}"
        return 1
    fi

    if ! is_oc_token_valid; then
        echo -e "${RED}✗ Token expired or invalid${NC}"
        return 1
    fi

    get_token_expiry_info
}

################################################################################
# List all available contexts
################################################################################

oc_contexts() {
    echo -e "${BLUE}Available OCP Contexts:${NC}"
    oc config get-contexts
}

################################################################################
# Logout from current cluster
################################################################################

oc_logout() {
    echo -e "${YELLOW}Logging out from current cluster...${NC}"
    oc logout
    echo -e "${GREEN}✓ Logged out${NC}"
}

# Export functions for use in subshells (mainly for bash compatibility)
# Suppress output to avoid console noise during zsh initialization
{
    export -f is_oc_logged_in
    export -f is_oc_token_valid
    export -f get_token_expiry_info
    export -f oc_smart_switch
    export -f _oc_perform_login
    export -f _oc_verify_project
    export -f oc_status
    export -f oc_contexts
    export -f oc_logout
} 2>/dev/null