import type { Database } from "bun:sqlite";
import { join } from "node:path";
import { Hono } from "hono";
import { bodyLimit } from "hono/body-limit";
import { secureHeaders } from "hono/secure-headers";
import { registerStatus } from "../admin/console.ts";
import { registerIssues } from "../admin/issues.ts";
import { registerReleases } from "../admin/releases.ts";
import { registerRepos } from "../admin/repos.ts";
import { registerSite } from "../admin/site.ts";
import { openBucket } from "../bucket/reader.ts";
import { isSafePath } from "../bucket/repo.ts";
import { registerIssuePages } from "../issues/pages.ts";
import { registerArchivesPage } from "../pages/archives.ts";
import { registerDocsPages } from "../pages/docs.ts";
import { registerFileRoutes } from "../pages/files.ts";
import { registerFrontPages } from "../pages/front.ts";
import { registerHousekeeping } from "../pages/housekeeping.ts";
import { registerProfilePage } from "../pages/profile.ts";
import { registerReleasesPage } from "../pages/releases.ts";
import { registerRepoPage } from "../pages/repo.ts";
import { registerSavePage } from "../pages/save.ts";
import { registerReleaseRoutes } from "../releases/routes.ts";
import { registerTarballRoutes } from "../tarball/archive.ts";
import type { Config } from "./config.ts";
import { registerLogin } from "./login.ts";

const MAX_BODY_BYTES = 64 * 1024;
const PUBLIC_DIR = join(import.meta.dir, "../../public");
// §18 allows Bunny Fonts: its stylesheet and the font files it points at.
const FONTS = "https://fonts.bunny.net";

/** The Hono app with §25's headers and body cap, and every route built so far. */
export function createApp(config: Config, kepr: Database): Hono {
	const app = new Hono();
	// §25 allows images from the presigned host, which is the bucket endpoint's origin.
	const imgSrc =
		config.bucket.kind === "s3" ? ["'self'", new URL(config.bucket.endpoint).origin] : ["'self'"];
	app.use(
		secureHeaders({
			contentSecurityPolicy: {
				defaultSrc: ["'self'"],
				scriptSrc: ["'self'"],
				styleSrc: ["'self'", FONTS],
				fontSrc: [FONTS],
				imgSrc,
				objectSrc: ["'none'"],
				baseUri: ["'none'"],
				formAction: ["'self'"],
				frameAncestors: ["'none'"],
			},
			xFrameOptions: "DENY",
		}),
	);
	app.use(
		bodyLimit({ maxSize: MAX_BODY_BYTES, onError: (c) => c.text("Request body too large", 413) }),
	);
	// `/static/assets/` is the operator's uploads in `data/assets/` (§19), such as the signature.
	const assetsDir = join(config.dataDir, "assets");
	app.get("/static/:path{.+}", async (c) => {
		const path = c.req.param("path");
		const file = Bun.file(
			path.startsWith("assets/") ? join(assetsDir, path.slice(7)) : join(PUBLIC_DIR, path),
		);
		if (!isSafePath(path) || !(await file.exists())) return c.notFound();
		c.header("Cache-Control", "public, max-age=3600");
		return c.body(await file.bytes(), 200, { "Content-Type": file.type });
	});
	const ctx = { domain: config.domain, kepr, mirrorDir: join(config.dataDir, "mirror") };
	const bucket = openBucket(config.bucket);
	// Before every other route, so the admin guard runs ahead of each `/admin` handler.
	registerLogin(app, ctx, config.adminPasswordHash);
	const admin = {
		...ctx,
		dataDir: config.dataDir,
		sync: { bucket, kepr, mirrorDir: ctx.mirrorDir, tarballDir: join(config.dataDir, "tarballs") },
	};
	registerStatus(app, admin);
	registerRepos(app, admin);
	registerIssues(app, admin);
	registerReleases(app, admin);
	registerSite(app, admin);
	registerHousekeeping(app, ctx);
	registerFrontPages(app, ctx);
	registerDocsPages(app, ctx);
	registerProfilePage(app, ctx);
	registerRepoPage(app, ctx);
	registerFileRoutes(app, ctx);
	registerSavePage(app, ctx);
	registerArchivesPage(app, ctx);
	registerReleasesPage(app, ctx);
	registerIssuePages(app, ctx);
	registerTarballRoutes(app, ctx, join(config.dataDir, "tarballs"));
	registerReleaseRoutes(app, ctx, bucket);
	return app;
}