# -*- coding: utf-8 -*-
"""Loogle MCP Hub — gateway FastAPI + OAuth + MCP Streamable HTTP."""

import asyncio
import json
import logging
import os
import secrets
from typing import Optional

import anyio
from fastapi import Depends, FastAPI, Form, HTTPException, Request, Response
from fastapi.middleware.cors import CORSMiddleware
from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse, StreamingResponse
from pydantic import BaseModel
from starlette.concurrency import run_in_threadpool

from . import audit, auth, jwt_utils, oauth
from .db import get_conn, init_db
from .mcp import server as mcp_server

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(name)s %(message)s")
LOGGER = logging.getLogger("loogle_mcp.main")

app = FastAPI(title="Loogle MCP Hub", docs_url=None, redoc_url=None)
app.add_middleware(
    CORSMiddleware,
    allow_origins=[
        "https://claude.ai",
        "https://chatgpt.com",
        "https://chat.openai.com",
    ],
    allow_methods=["GET", "POST", "HEAD", "OPTIONS"],
    allow_headers=["*"],
)
STATIC_DIR = os.path.join(os.path.dirname(__file__), "static")
# Thread per tool MCP ed endpoint sync: i tool fanno I/O bloccante (HTTP, SQLite, Ollama)
MCP_THREAD_LIMIT = int(os.environ.get("MCP_THREAD_LIMIT", "40"))
# Sotto il timeout dei client MCP: meglio un errore chiaro che una connessione appesa
MCP_TOOL_TIMEOUT_S = float(os.environ.get("MCP_TOOL_TIMEOUT_S", "45"))


@app.on_event("startup")
def on_startup() -> None:
    init_db()
    auth.ensure_sessions_table()
    auth.ensure_family_users()
    oauth.ensure_default_client()
    if not os.environ.get("MCP_JWT_SECRET", "").strip():
        secret = secrets.token_urlsafe(48)
        os.environ["MCP_JWT_SECRET"] = secret
        LOGGER.warning("MCP_JWT_SECRET generato — salvalo in .env: %s", secret)


@app.on_event("startup")
async def configure_threadpool() -> None:
    anyio.to_thread.current_default_thread_limiter().total_tokens = MCP_THREAD_LIMIT


# ------------------------------------------------------------------ Health

@app.get("/health")
def health():
    return {"ok": True, "service": "loogle-mcp", "port": int(os.environ.get("MCP_PORT", "8700"))}


# ------------------------------------------------------------------ OAuth metadata

@app.get("/.well-known/oauth-authorization-server")
def oauth_metadata():
    return oauth.authorization_server_metadata()


@app.get("/.well-known/oauth-protected-resource")
def protected_resource():
    return oauth.protected_resource_metadata()


@app.get("/.well-known/oauth-protected-resource/mcp")
def protected_resource_mcp():
    return oauth.protected_resource_metadata()


@app.get("/.well-known/openid-configuration")
def openid_configuration():
    """Fallback discovery usato da Claude se oauth-authorization-server non basta."""
    return oauth.authorization_server_metadata()


# ------------------------------------------------------------------ OAuth endpoints

class RegisterBody(BaseModel):
    client_name: str
    redirect_uris: list[str]


@app.post("/oauth/register")
def oauth_register(body: RegisterBody):
    try:
        return oauth.register_client(body.client_name, body.redirect_uris)
    except HTTPException as exc:
        return JSONResponse(
            status_code=exc.status_code,
            content={"error": "invalid_client_metadata", "error_description": str(exc.detail)},
        )


# Alias root-level OAuth (Claude/ChatGPT fallback se la discovery RFC 8414 fallisce)
@app.post("/register")
def oauth_register_root(body: RegisterBody):
    return oauth_register(body)


@app.get("/oauth/authorize")
def oauth_authorize_get(
    response_type: str,
    client_id: str,
    redirect_uri: str,
    scope: str = "context:read context:write knowledge:read knowledge:write gitea:read gitea:write",
    state: str = "",
    code_challenge: Optional[str] = None,
    code_challenge_method: Optional[str] = None,
):
    if response_type != "code":
        raise HTTPException(400, "response_type must be code")
    html = _login_form(client_id, redirect_uri, scope, state, code_challenge, code_challenge_method)
    return HTMLResponse(html)


@app.post("/oauth/authorize")
def oauth_authorize_post(
    request: Request,
    client_id: str = Form(...),
    redirect_uri: str = Form(...),
    scope: str = Form("context:read context:write knowledge:read knowledge:write gitea:read gitea:write"),
    state: str = Form(""),
    code_challenge: Optional[str] = Form(None),
    code_challenge_method: Optional[str] = Form(None),
    username: str = Form(...),
    password: str = Form(...),
):
    ip = request.client.host if request.client else "?"
    auth.throttle(ip)
    user = auth.authenticate(username, password)
    if not user:
        auth.record_attempt(ip)
        html = _login_form(
            client_id, redirect_uri, scope, state, code_challenge, code_challenge_method,
            error="Credenziali non valide",
        )
        return HTMLResponse(html, status_code=401)
    url = oauth.build_authorize_redirect(
        client_id, redirect_uri, scope, state, code_challenge, code_challenge_method, user["id"]
    )
    return RedirectResponse(url, status_code=302)


@app.get("/authorize")
def oauth_authorize_get_root(
    response_type: str,
    client_id: str,
    redirect_uri: str,
    scope: str = "context:read context:write knowledge:read knowledge:write gitea:read gitea:write",
    state: str = "",
    code_challenge: Optional[str] = None,
    code_challenge_method: Optional[str] = None,
):
    return oauth_authorize_get(
        response_type, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method
    )


@app.post("/authorize")
def oauth_authorize_post_root(
    request: Request,
    client_id: str = Form(...),
    redirect_uri: str = Form(...),
    scope: str = Form("context:read context:write knowledge:read knowledge:write gitea:read gitea:write"),
    state: str = Form(""),
    code_challenge: Optional[str] = Form(None),
    code_challenge_method: Optional[str] = Form(None),
    username: str = Form(...),
    password: str = Form(...),
):
    return oauth_authorize_post(
        request, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method, username, password
    )


@app.post("/oauth/token")
async def oauth_token(request: Request):
    content_type = request.headers.get("content-type", "")
    if "application/json" in content_type:
        body = await request.json()
    else:
        form = await request.form()
        body = dict(form)
    grant_type = body.get("grant_type")
    client_id = body.get("client_id") or os.environ.get("MCP_OAUTH_CLIENT_ID", "loogle-mcp-public")
    if grant_type == "authorization_code":
        return await run_in_threadpool(
            oauth.exchange_code,
            body.get("code", ""),
            client_id,
            body.get("redirect_uri", ""),
            body.get("code_verifier"),
        )
    if grant_type == "refresh_token":
        return await run_in_threadpool(
            oauth.refresh_access_token, body.get("refresh_token", ""), client_id
        )
    raise HTTPException(400, "grant_type non supportato")


@app.post("/token")
async def oauth_token_root(request: Request):
    return await oauth_token(request)


# ------------------------------------------------------------------ MCP endpoint

_UNAUTHENTICATED_METHODS = ("initialize", "notifications/initialized", "ping")


@app.post("/mcp")
async def mcp_post(request: Request):
    header_version = request.headers.get("mcp-protocol-version")
    if header_version and header_version not in mcp_server.SUPPORTED_PROTOCOL_VERSIONS:
        # Non bloccare: Claude/Anthropic mandano versioni nuove; negoziamo nel body initialize
        LOGGER.warning(
            "MCP-Protocol-Version header=%s non in lista locale — continuo (negoziazione JSON-RPC)",
            header_version,
        )
    auth_header = request.headers.get("authorization", "")
    claims = await run_in_threadpool(oauth.bearer_claims_from_header, auth_header)
    try:
        payload = await request.json()
    except Exception:
        raise HTTPException(400, "JSON non valido")
    messages = payload if isinstance(payload, list) else [payload]
    if not all(isinstance(msg, dict) for msg in messages) or not messages:
        return JSONResponse(
            {"jsonrpc": "2.0", "id": None, "error": {"code": -32600, "message": "Invalid Request"}},
            status_code=400,
        )
    if not any(mcp_server.expects_response(msg) for msg in messages):
        # Solo notifiche/response dal client: Streamable HTTP prevede 202 senza corpo
        if not claims and any(msg.get("method") not in _UNAUTHENTICATED_METHODS for msg in messages):
            return Response(status_code=401, headers=_auth_challenge_headers())
        return Response(status_code=202)
    if isinstance(payload, list):
        responses = await _run_with_timeout(mcp_server.handle_batch, payload, claims)
        if responses is None:
            responses = [_timeout_error(msg) for msg in payload if mcp_server.expects_response(msg)]
        return JSONResponse(responses)
    response = await _run_with_timeout(mcp_server.handle_message, payload, claims)
    if response is None:
        response = _timeout_error(payload)
    if not claims and payload.get("method") not in _UNAUTHENTICATED_METHODS:
        return JSONResponse(response, status_code=401, headers=_auth_challenge_headers())
    return JSONResponse(response)


async def _run_with_timeout(fn, payload, claims):
    """I tool sono sincroni e bloccanti: threadpool per non fermare l'event loop.

    Allo scadere ritorna None; il thread prosegue fino alla fine ma il client è già servito.
    """
    try:
        return await asyncio.wait_for(run_in_threadpool(fn, payload, claims), MCP_TOOL_TIMEOUT_S)
    except asyncio.TimeoutError:
        return None


def _timeout_error(msg: dict) -> dict:
    params = msg.get("params") or {}
    target = params.get("name") or msg.get("method")
    LOGGER.warning("MCP %s oltre %.0fs: risposta di timeout al client", target, MCP_TOOL_TIMEOUT_S)
    return {
        "jsonrpc": "2.0",
        "id": msg.get("id"),
        "error": {
            "code": -32000,
            "message": f"Timeout: '{target}' non ha risposto entro {MCP_TOOL_TIMEOUT_S:.0f}s "
                       "(backend lento o non raggiungibile). Riprova tra poco.",
        },
    }


@app.post("/")
async def root_mcp_post(request: Request):
    """Alcuni client (Claude) dopo OAuth POST-ano sulla root invece che su /mcp."""
    ctype = (request.headers.get("content-type") or "").lower()
    accept = (request.headers.get("accept") or "").lower()
    if "json" not in ctype and "json" not in accept and "event-stream" not in accept:
        raise HTTPException(404, "Not Found")
    return await mcp_post(request)


@app.api_route("/mcp", methods=["GET", "HEAD"])
async def mcp_get(request: Request):
    """Streamable HTTP: GET può aprire SSE; HEAD serve alla discovery di Claude."""
    if request.method == "HEAD":
        return Response(
            status_code=200,
            headers={
                **_auth_challenge_headers(),
                "Allow": "GET, HEAD, POST, OPTIONS",
                "Content-Type": "application/json",
            },
        )
    accept = (request.headers.get("accept") or "").lower()
    if "text/event-stream" in accept:
        # Nessun messaggio server-initiated: stream SSE vuoto che si chiude subito
        async def _empty():
            yield ": loogle-mcp ready\n\n"

        return StreamingResponse(
            _empty(),
            media_type="text/event-stream",
            headers={
                **_auth_challenge_headers(),
                "Cache-Control": "no-cache",
                "Connection": "keep-alive",
            },
        )
    return JSONResponse(
        {
            "ok": True,
            "service": "loogle-mcp",
            "transport": "streamable-http",
            "endpoint": "/mcp",
            "hint": "Usa POST JSON-RPC (initialize, tools/list, tools/call)",
        },
        headers=_auth_challenge_headers(),
    )


@app.api_route("/mcp/", methods=["GET", "HEAD", "POST", "OPTIONS"])
async def mcp_slash(request: Request):
    """Evita redirect HTTP su /mcp/ (NPM) che rompe Claude."""
    if request.method == "POST":
        return await mcp_post(request)
    if request.method == "OPTIONS":
        return Response(
            status_code=204,
            headers={
                "Allow": "GET, HEAD, POST, OPTIONS",
                "Access-Control-Allow-Methods": "GET, HEAD, POST, OPTIONS",
                "Access-Control-Allow-Headers": "Authorization, Content-Type, Accept, MCP-Protocol-Version, Mcp-Session-Id",
            },
        )
    return await mcp_get(request)


@app.options("/mcp")
async def mcp_options():
    return Response(
        status_code=204,
        headers={
            "Allow": "GET, HEAD, POST, OPTIONS",
            "Access-Control-Allow-Methods": "GET, HEAD, POST, OPTIONS",
            "Access-Control-Allow-Headers": "Authorization, Content-Type, Accept, MCP-Protocol-Version, Mcp-Session-Id",
        },
    )


def _auth_challenge_headers() -> dict:
    base = jwt_utils.base_url()
    resource_metadata = f"{base}/.well-known/oauth-protected-resource/mcp"
    return {
        "WWW-Authenticate": f'Bearer realm="mcp", resource_metadata="{resource_metadata}"',
    }


# ------------------------------------------------------------------ Dashboard web

class LoginBody(BaseModel):
    username: str
    password: str


class PasswordBody(BaseModel):
    old_password: str
    new_password: str


class RevokeBody(BaseModel):
    refresh_token: str


@app.post("/api/login")
def api_login(body: LoginBody, request: Request, response: Response):
    ip = request.client.host if request.client else "?"
    auth.throttle(ip)
    user = auth.authenticate(body.username.strip(), body.password)
    if not user:
        auth.record_attempt(ip)
        raise HTTPException(401, "Credenziali non valide")
    import datetime
    token = secrets.token_urlsafe(32)
    expires = (
        datetime.datetime.utcnow() + datetime.timedelta(days=auth.SESSION_DAYS)
    ).strftime("%Y-%m-%d %H:%M:%S")
    get_conn().execute(
        "INSERT INTO sessions(token,user_id,expires_at) VALUES (?,?,?)",
        (token, user["id"], expires),
    )
    get_conn().commit()
    response.set_cookie("mcp_session", token, max_age=auth.SESSION_DAYS * 86400, httponly=True, samesite="lax", path="/")
    return {"ok": True, "user": {"username": user["username"], "is_admin": user["is_admin"]}}


@app.post("/api/logout")
def api_logout(request: Request, response: Response):
    token = request.cookies.get("mcp_session", "")
    if token:
        get_conn().execute("DELETE FROM sessions WHERE token=?", (token,))
        get_conn().commit()
    response.delete_cookie("mcp_session", path="/")
    return {"ok": True}


@app.get("/api/me")
def api_me(user=Depends(auth.current_user_from_cookie)):
    return user


@app.post("/api/password")
def api_password(body: PasswordBody, user=Depends(auth.current_user_from_cookie)):
    if len(body.new_password.strip()) < 6:
        raise HTTPException(400, "La nuova password deve avere almeno 6 caratteri")
    if not auth.change_password(user["id"], body.old_password, body.new_password):
        raise HTTPException(400, "Password attuale errata")
    return {"ok": True}


@app.get("/api/projects")
def api_projects(user=Depends(auth.current_user_from_cookie)):
    from .context import store as context_store
    return context_store.list_projects(user["username"])


@app.get("/api/audit")
def api_audit(limit: int = 100, user=Depends(auth.current_user_from_cookie)):
    if user["is_admin"]:
        return audit.list_audit(limit=min(limit, 500))
    return audit.list_audit(limit=min(limit, 200), username=user["username"])


@app.post("/api/admin/revoke-refresh")
def api_revoke_refresh(body: RevokeBody, _=Depends(auth.require_admin)):
    jwt_utils.revoke_refresh_token(body.refresh_token)
    return {"ok": True}


@app.get("/dashboard")
def dashboard_page():
    path = os.path.join(STATIC_DIR, "dashboard.html")
    return HTMLResponse(open(path, encoding="utf-8").read())


@app.get("/")
def root():
    return RedirectResponse("/dashboard")


def _login_form(
    client_id: str,
    redirect_uri: str,
    scope: str,
    state: str,
    code_challenge: Optional[str],
    code_challenge_method: Optional[str],
    error: str = "",
) -> str:
    err = f'<p class="error">{error}</p>' if error else ""
    return f"""<!DOCTYPE html>
<html lang="it"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
<title>Loogle MCP — Login</title>
<style>
body{{font-family:system-ui,sans-serif;max-width:420px;margin:4rem auto;padding:1rem;background:#0f172a;color:#e2e8f0}}
h1{{font-size:1.4rem}} .card{{background:#1e293b;padding:1.5rem;border-radius:12px}}
label{{display:block;margin:.75rem 0 .25rem}} input{{width:100%;padding:.5rem;border-radius:6px;border:1px solid #334155;background:#0f172a;color:#e2e8f0}}
button{{margin-top:1rem;width:100%;padding:.65rem;background:#2563eb;color:#fff;border:none;border-radius:8px;font-size:1rem;cursor:pointer}}
.error{{color:#f87171}} .hint{{font-size:.85rem;color:#94a3b8;margin-top:1rem}}
</style></head><body>
<h1>Loogle MCP Hub</h1>
<p>Accedi con le credenziali famiglia per collegare Claude, ChatGPT o Gemini.</p>
<div class="card">{err}
<form method="post" action="/authorize">
<input type="hidden" name="client_id" value="{client_id}">
<input type="hidden" name="redirect_uri" value="{redirect_uri}">
<input type="hidden" name="scope" value="{scope}">
<input type="hidden" name="state" value="{state}">
<input type="hidden" name="code_challenge" value="{code_challenge or ''}">
<input type="hidden" name="code_challenge_method" value="{code_challenge_method or ''}">
<label>Utente</label><input name="username" autocomplete="username" required>
<label>Password</label><input name="password" type="password" autocomplete="current-password" required>
<button type="submit">Autorizza accesso MCP</button>
</form>
<p class="hint">Primo accesso: password = username (es. lucia/lucia). Cambiala dal dashboard.</p>
</div></body></html>"""