package main

import (
	"encoding/json"
	"errors"
	"fmt"
	"log"
	"net"
	"strings"
	"time"

	"github.com/julienschmidt/httprouter"
	"github.com/miekg/dns"

	"git.nemunai.re/lectures/adlin/libadlin"
)

const (
	ControlSocket = "[2a01:e0a:2b:2250::b]:53"
)

var tsigSecret = map[string]string{"ddns.": "so6ZGir4GPAqINNh9U5c3A=="}

func init() {
	router.GET("/api/adomains/", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		return student.GetAssociatedDomains(), nil
	}))
	router.POST("/api/adomains/", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		return true, AddAssociatedDomains(student)
	}))
	router.GET("/api/adomains/:dn", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		return GetAssociatedDomain(student, ps.ByName("dn"))
	}))

	router.GET("/api/ddomains/", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		return []string{student.MyDelegatedDomain()}, nil
	}))
	router.GET("/api/ddomains/:dn/", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		return getRRDelegatedDomain(student, ps.ByName("dn"), "")
	}))
	router.GET("/api/ddomains/:dn/NS", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		return getRRDelegatedDomain(student, ps.ByName("dn"), "NS")
	}))
	router.POST("/api/ddomains/:dn/NS", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		var ue Entry
		if err := json.Unmarshal(body, &ue); err != nil {
			return nil, err
		}
		return true, AddNSDelegatedDomain(student, ps.ByName("dn"), ue.TTL, strings.Join(ue.Values, " "))
	}))
	router.PATCH("/api/ddomains/:dn/NS", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		var ue Entry
		if err := json.Unmarshal(body, &ue); err != nil {
			return nil, err
		}
		return true, UpdateNSDelegatedDomain(student, ps.ByName("dn"), ue.TTL, ue.ValuesFrom, strings.Join(ue.Values, ""))
	}))
	router.DELETE("/api/ddomains/:dn/NS", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		var ue Entry
		if err := json.Unmarshal(body, &ue); err != nil {
			return nil, err
		}
		return true, DeleteRRDelegatedDomain(student, ps.ByName("dn"), "NS", strings.Join(ue.Values, " "))
	}))
	router.GET("/api/ddomains/:dn/GLUE", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		return getRRDelegatedDomain(student, ps.ByName("dn"), "AAAA")
	}))
	router.POST("/api/ddomains/:dn/AAAA", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		var ue Entry
		if err := json.Unmarshal(body, &ue); err != nil {
			return nil, err
		}
		return true, AddGLUEDelegatedDomain(student, ps.ByName("dn"), ue.TTL, strings.Join(ue.Values, " "))
	}))
	router.PATCH("/api/ddomains/:dn/AAAA", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		var ue Entry
		if err := json.Unmarshal(body, &ue); err != nil {
			return nil, err
		}
		return true, UpdateGLUEDelegatedDomain(student, ps.ByName("dn"), ue.TTL, ue.ValuesFrom, strings.Join(ue.Values, " "))
	}))
	router.POST("/api/ddomains/:dn/GLUE", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		var ue Entry
		if err := json.Unmarshal(body, &ue); err != nil {
			return nil, err
		}
		return true, UpdateGLUEDelegatedDomain(student, ps.ByName("dn"), ue.TTL, ue.ValuesFrom, strings.Join(ue.Values, " "))
	}))
	router.DELETE("/api/ddomains/:dn/AAAA", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		var ue Entry
		if err := json.Unmarshal(body, &ue); err != nil {
			return nil, err
		}
		return true, DeleteRRDelegatedDomain(student, ps.ByName("dn"), "AAAA", strings.Join(ue.Values, " "))
	}))
	router.GET("/api/ddomains/:dn/DS", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		return getRRDelegatedDomain(student, ps.ByName("dn"), "DS")
	}))
	router.POST("/api/ddomains/:dn/DS", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		var ue Entry
		if err := json.Unmarshal(body, &ue); err != nil {
			return nil, err
		}
		return true, AddDSDelegatedDomain(student, ps.ByName("dn"), ue.TTL, strings.Join(ue.Values, " "))
	}))
	router.DELETE("/api/ddomains/:dn/DS", apiAuthHandler(func(student adlin.Student, ps httprouter.Params, body []byte) (interface{}, error) {
		var ue Entry
		if err := json.Unmarshal(body, &ue); err != nil {
			return nil, err
		}
		return true, DeleteRRDelegatedDomain(student, ps.ByName("dn"), "DS", strings.Join(ue.Values, " "))
	}))
}

type Entry struct {
	Domain     string   `json:"domain"`
	TTL        uint32   `json:"ttl"`
	RR         string   `json:"rr"`
	ValuesFrom string   `json:"valuesfrom,omitempty"`
	Values     []string `json:"values"`
}

func parseZoneRead(globalDomain string, domain string) (rr []Entry, err error) {
	t := new(dns.Transfer)

	m := new(dns.Msg)
	t.TsigSecret = tsigSecret
	m.SetAxfr(globalDomain)
	m.SetTsig("rndc-key.", dns.HmacSHA256, 300, time.Now().Unix())

	c, err := t.In(m, ControlSocket)
	if err != nil {
		log.Println(globalDomain, err)
		return nil, err
	}

	for {
		response, ok := <-c
		if !ok {
			break
		}

		for _, r := range response.RR {
			if strings.HasSuffix(r.Header().Name, domain) {
				var z string
				if v, ok := r.(*dns.A); ok {
					z = fmt.Sprintf("%s", v.A)
				} else if v, ok := r.(*dns.AAAA); ok {
					z = fmt.Sprintf("%s", v.AAAA)
				} else if v, ok := r.(*dns.NS); ok {
					z = fmt.Sprintf("%s", v.Ns)
				} else if v, ok := r.(*dns.DS); ok {
					z = fmt.Sprintf("%s", v.Digest)
				}
				rr = append(rr, Entry{r.Header().Name, r.Header().Ttl, dns.TypeToString[r.Header().Rrtype], "", []string{z}})
			}
		}
	}

	return
}

func GetAssociatedDomain(student adlin.Student, dn string) (rrs []Entry, err error) {
	domains := student.GetAssociatedDomains()
	found := false
	for _, d := range domains {
		if d == dn {
			found = true
		}
	}

	if !found {
		err = errors.New(fmt.Sprintf("Unable to find domain %q.", dn))
	}

	if entries, errr := parseZoneRead(adlin.AssociatedDomainSuffix, dn); err != nil {
		return nil, errr
	} else {
		for _, e := range entries {
			if e.RR != "RRSIG" && e.RR != "NSEC" && e.RR != "NSEC3" {
				rrs = append(rrs, e)
			}
		}
	}

	return
}

func AddAssociatedDomains(student adlin.Student) (err error) {
	m1 := new(dns.Msg)
	m1.Id = dns.Id()
	m1.Opcode = dns.OpcodeUpdate
	m1.Question = make([]dns.Question, 1)
	m1.Question[0] = dns.Question{adlin.AssociatedDomainSuffix, dns.TypeSOA, dns.ClassINET}

	rrAd := new(dns.A)
	rrAd.Hdr = dns.RR_Header{Name: student.MyAssociatedDomain(), Rrtype: dns.TypeA, Class: dns.ClassINET, Ttl: 0}
	m1.Remove([]dns.RR{rrAd})

	rrAAAAd := new(dns.AAAA)
	rrAAAAd.Hdr = dns.RR_Header{Name: student.MyAssociatedDomain(), Rrtype: dns.TypeAAAA, Class: dns.ClassINET, Ttl: 0}
	m1.Remove([]dns.RR{rrAAAAd})

	c := new(dns.Client)
	c.TsigSecret = tsigSecret
	m1.SetTsig("rndc-key.", dns.HmacSHA256, 300, time.Now().Unix())

	_, _, err = c.Exchange(m1, ControlSocket)
	if err != nil {
		return
	}

	m2 := new(dns.Msg)
	m2.Id = dns.Id()
	m2.Opcode = dns.OpcodeUpdate
	m2.Question = make([]dns.Question, 1)
	m2.Question[0] = dns.Question{adlin.AssociatedDomainSuffix, dns.TypeSOA, dns.ClassINET}

	rrA := new(dns.A)
	rrA.Hdr = dns.RR_Header{Name: student.MyAssociatedDomain(), Rrtype: dns.TypeA, Class: dns.ClassINET, Ttl: 3600}
	rrA.A = net.IPv4(82, 64, 31, 248)
	m2.Insert([]dns.RR{rrA})

	rrAAAA := new(dns.AAAA)
	rrAAAA.Hdr = dns.RR_Header{Name: student.MyAssociatedDomain(), Rrtype: dns.TypeAAAA, Class: dns.ClassINET, Ttl: 3600}
	rrAAAA.AAAA = adlin.StudentIP(student.Id)
	rrAAAA.AAAA[15] = 1
	m2.Insert([]dns.RR{rrAAAA})

	c = new(dns.Client)
	c.TsigSecret = tsigSecret
	m2.SetTsig("rndc-key.", dns.HmacSHA256, 300, time.Now().Unix())

	_, _, err = c.Exchange(m2, ControlSocket)
	return
}

func getRRDelegatedDomain(student adlin.Student, dn string, rr string) (rrs []Entry, err error) {
	domains := []string{student.MyDelegatedDomain()}
	found := false
	for _, d := range domains {
		if d == dn {
			found = true
		}
	}

	if !found {
		err = errors.New(fmt.Sprintf("Unable to find domain %q.", dn))
	}

	if entries, errr := parseZoneRead(adlin.DelegatedDomainSuffix, dn); err != nil {
		return nil, errr
	} else {
		for _, e := range entries {
			if e.RR == rr && strings.HasSuffix(strings.TrimSuffix(e.Domain, "."), strings.TrimSuffix(dn, ".")) {
				rrs = append(rrs, e)
			}
		}
	}

	return
}

func AddNSDelegatedDomain(student adlin.Student, dn string, ttl uint32, ns string) (err error) {
	for _, d := range []string{student.MyDelegatedDomain()} {
		m1 := new(dns.Msg)
		m1.Id = dns.Id()
		m1.Opcode = dns.OpcodeUpdate
		m1.Question = make([]dns.Question, 1)
		m1.Question[0] = dns.Question{adlin.DelegatedDomainSuffix, dns.TypeSOA, dns.ClassINET}

		rrNS := new(dns.NS)
		rrNS.Hdr = dns.RR_Header{Name: d, Rrtype: dns.TypeNS, Class: dns.ClassINET, Ttl: ttl}
		rrNS.Ns = ns
		m1.Insert([]dns.RR{rrNS})

		c := new(dns.Client)
		c.TsigSecret = tsigSecret
		m1.SetTsig("rndc-key.", dns.HmacSHA256, 300, time.Now().Unix())

		_, _, err = c.Exchange(m1, ControlSocket)
	}

	return
}

func UpdateNSDelegatedDomain(student adlin.Student, dn string, ttl uint32, oldns string, ns string) (err error) {
	for _, d := range []string{student.MyDelegatedDomain()} {
		m1 := new(dns.Msg)
		m1.Id = dns.Id()
		m1.Opcode = dns.OpcodeUpdate
		m1.Question = make([]dns.Question, 1)
		m1.Question[0] = dns.Question{adlin.DelegatedDomainSuffix, dns.TypeSOA, dns.ClassINET}

		rrOldNS := new(dns.NS)
		rrOldNS.Hdr = dns.RR_Header{Name: d, Rrtype: dns.TypeNS, Class: dns.ClassINET}
		rrOldNS.Ns = oldns
		m1.Remove([]dns.RR{rrOldNS})

		rrNS := new(dns.NS)
		rrNS.Hdr = dns.RR_Header{Name: d, Rrtype: dns.TypeNS, Class: dns.ClassINET, Ttl: ttl}
		rrNS.Ns = ns
		m1.Insert([]dns.RR{rrNS})

		c := new(dns.Client)
		c.TsigSecret = tsigSecret
		m1.SetTsig("rndc-key.", dns.HmacSHA256, 300, time.Now().Unix())

		_, _, err = c.Exchange(m1, ControlSocket)
	}

	return
}

func AddGLUEDelegatedDomain(student adlin.Student, dn string, ttl uint32, aaaa string) (err error) {
	domains := []string{student.MyDelegatedDomain()}
	found := false
	for _, d := range domains {
		if strings.HasSuffix(dn, d) {
			found = true
		}
	}

	if !found {
		err = errors.New(fmt.Sprintf("Unable to find domain %q in your whitelist.", dn))
		return
	}

	m1 := new(dns.Msg)
	m1.Id = dns.Id()
	m1.Opcode = dns.OpcodeUpdate
	m1.Question = make([]dns.Question, 1)
	m1.Question[0] = dns.Question{adlin.DelegatedDomainSuffix, dns.TypeSOA, dns.ClassINET}

	var rr dns.RR
	rr, err = dns.NewRR(fmt.Sprintf("%s %d IN AAAA %s", dn, ttl, aaaa))
	if err != nil {
		return
	}
	m1.Insert([]dns.RR{rr})

	c := new(dns.Client)
	c.TsigSecret = tsigSecret
	m1.SetTsig("rndc-key.", dns.HmacSHA256, 300, time.Now().Unix())

	_, _, err = c.Exchange(m1, ControlSocket)

	return
}

func UpdateGLUEDelegatedDomain(student adlin.Student, dn string, ttl uint32, oldaaaa string, aaaa string) (err error) {
	domains := []string{student.MyDelegatedDomain()}
	found := false
	for _, d := range domains {
		if strings.HasSuffix(dn, d) {
			found = true
		}
	}

	if !found {
		err = errors.New(fmt.Sprintf("Unable to find domain %q in your whitelist.", dn))
		return
	}

	m1 := new(dns.Msg)
	m1.Id = dns.Id()
	m1.Opcode = dns.OpcodeUpdate
	m1.Question = make([]dns.Question, 1)
	m1.Question[0] = dns.Question{adlin.DelegatedDomainSuffix, dns.TypeSOA, dns.ClassINET}

	var rr dns.RR

	rr, err = dns.NewRR(fmt.Sprintf("%s IN AAAA %s", dn, oldaaaa))
	if err != nil {
		return
	}
	m1.Remove([]dns.RR{rr})

	rr, err = dns.NewRR(fmt.Sprintf("%s %d IN AAAA %s", dn, ttl, aaaa))
	if err != nil {
		return
	}
	m1.Insert([]dns.RR{rr})

	c := new(dns.Client)
	c.TsigSecret = tsigSecret
	m1.SetTsig("rndc-key.", dns.HmacSHA256, 300, time.Now().Unix())

	_, _, err = c.Exchange(m1, ControlSocket)
	return
}

func AddDSDelegatedDomain(student adlin.Student, dn string, ttl uint32, rdata string) (err error) {
	domains := []string{student.MyDelegatedDomain()}
	found := false
	for _, d := range domains {
		if dn == d {
			found = true
		}
	}

	if !found {
		err = errors.New(fmt.Sprintf("Unable to find domain %q in your whitelist.", dn))
		return
	}

	var rr dns.RR
	rr, err = dns.NewRR(fmt.Sprintf("%s IN DNSKEY %s", dn, rdata))
	if err != nil {
		return
	}

	var dnskey dns.DNSKEY
	if v, ok := rr.(*dns.DNSKEY); ok {
		dnskey = *v
	} else {
		err = errors.New(fmt.Sprintf("This is not a valid DNSKEY record."))
		return
	}

	m1 := new(dns.Msg)
	m1.Id = dns.Id()
	m1.Opcode = dns.OpcodeUpdate
	m1.Question = make([]dns.Question, 1)
	m1.Question[0] = dns.Question{adlin.DelegatedDomainSuffix, dns.TypeSOA, dns.ClassINET}

	var ds *dns.DS
	ds = dnskey.ToDS(dns.SHA256)
	if ds == nil {
		err = errors.New(fmt.Sprintf("Unable to generate corresponding DS record, please check given data."))
		return
	}
	m1.Insert([]dns.RR{ds})

	c := new(dns.Client)
	c.TsigSecret = tsigSecret
	m1.SetTsig("rndc-key.", dns.HmacSHA256, 300, time.Now().Unix())

	_, _, err = c.Exchange(m1, ControlSocket)
	return
}

func DeleteRRDelegatedDomain(student adlin.Student, dn string, rr string, values ...string) (err error) {
	domains := []string{student.MyDelegatedDomain()}
	found := false
	for _, d := range domains {
		if strings.HasSuffix(dn, d) {
			found = true
		}
	}

	if !found {
		err = errors.New(fmt.Sprintf("Unable to find domain %q in your whitelist.", dn))
		return
	}

	m1 := new(dns.Msg)
	m1.Id = dns.Id()
	m1.Opcode = dns.OpcodeUpdate
	m1.Question = make([]dns.Question, 1)
	m1.Question[0] = dns.Question{adlin.DelegatedDomainSuffix, dns.TypeSOA, dns.ClassINET}

	rrr, errr := dns.NewRR(fmt.Sprintf("%s %s %s", dn, rr, strings.Join(values, " ")))
	if errr != nil {
		return errr
	}
	m1.Remove([]dns.RR{rrr})

	c := new(dns.Client)
	c.TsigSecret = tsigSecret
	m1.SetTsig("rndc-key.", dns.HmacSHA256, 300, time.Now().Unix())

	_, _, err = c.Exchange(m1, ControlSocket)

	return
}