#!/usr/bin/env bash

# ============================================
# Lifecycle
# ============================================

function cmd::group::on_load() {
  flag::register --name
  flag::register --desc
  flag::register --peer
  flag::register --type
  flag::register --rule
  flag::register --new-name
  flag::register --force
}

# ============================================
# Help
# ============================================

function cmd::group::help() {
  cat <<EOF
Usage: wgctl group <subcommand> [options]

Manage peer groups.

Subcommands:
  list, ls                    List all groups
  show                        Show group details and members
  add, new, create            Create a new group
  remove, rm, del             Remove a group definition
  rename                      Rename a group
  peer add                    Add a peer to a group
  peer remove, peer rm        Remove a peer from a group
  rm-peers                    Remove all peers from WireGuard server
  block                       Block all peers in group
  unblock                     Unblock all peers in group
  rule assign                 Assign a rule to all peers in group
  audit                       Audit all peers in group
  logs                        Show logs for all peers in group
  watch                       Live monitor for all peers in group

Options:
  --name <name>               Group name
  --desc <description>        Group description
  --peer <peer>               Peer name
  --type <type>               Peer device type (for peer resolution)
  --rule <rule>               Rule name (for rule assign)
  --new-name <name>           New name (for rename)
  --force                     Skip confirmation prompts

Examples:
  wgctl group add --name family --desc "Family devices"
  wgctl group peer add --name family --peer phone-nuno
  wgctl group block --name family
  wgctl group rule assign --name family --rule user
  wgctl group audit --name family
EOF
}

# ============================================
# Run
# ============================================

function cmd::group::run() {
  local subcmd="${1:-help}"
  shift || true

  case "$subcmd" in
    list|ls)              cmd::group::list "$@"        ;;
    show)                 cmd::group::show "$@"        ;;
    add|new|create)       cmd::group::add "$@"         ;;
    remove|rm|del|delete) cmd::group::remove "$@"      ;;
    rename)               cmd::group::rename "$@"      ;;
    peer)                 cmd::group::peer "$@"        ;;
    rm-peers)             cmd::group::rm_peers "$@"    ;;
    block)                cmd::group::block "$@"       ;;
    unblock)              cmd::group::unblock "$@"     ;;
    rule)                 cmd::group::rule "$@"        ;;
    audit)                cmd::group::audit "$@"       ;;
    logs)                 cmd::group::logs "$@"        ;;
    watch)                cmd::group::watch "$@"       ;;
    help)                 cmd::group::help             ;;
    *)
      log::error "Unknown subcommand: '${subcmd}'"
      cmd::group::help
      return 1
      ;;
  esac
}

# ============================================
# List
# ============================================

function cmd::group::list() {
  local groups_dir
  groups_dir="$(ctx::groups)"

  local groups=("${groups_dir}"/*.group)
  if [[ ! -f "${groups[0]}" ]]; then
    log::wg "No groups configured"
    return 0
  fi

  log::section "Groups"
  printf "\n  %-20s %-35s %-8s %s\n" "NAME" "DESCRIPTION" "PEERS" "STATUS"
  printf "  %s\n" "$(printf '─%.0s' {1..75})"

  while IFS="|" read -r name desc total blocked; do
    [[ -z "$name" ]] && continue

    local status_color="" status_str="active"
    if [[ "$total" -gt 0 ]]; then
      if [[ "$blocked" -eq "$total" ]]; then
        status_color="\033[1;31m"
        status_str="blocked"
      elif [[ "$blocked" -gt 0 ]]; then
        status_color="\033[1;33m"
        status_str="blocked (${blocked}/${total})"
      else
        status_color="\033[1;32m"
        status_str="active"
      fi
    fi

    local short_desc="${desc:0:33}"
    [[ ${#desc} -gt 33 ]] && short_desc="${short_desc}..."

    printf "  %-20s %-35s %-8s %b\n" \
      "$name" "${short_desc:-—}" "$total" \
      "${status_color}${status_str}\033[0m"
  done < <(json::group_list_data "$groups_dir" "$(ctx::blocks)")

  printf "\n"
}

# function cmd::group::list() {
#   local groups_dir
#   groups_dir="$(ctx::groups)"

#   local groups=("${groups_dir}"/*.group)
#   if [[ ! -f "${groups[0]}" ]]; then
#     log::wg "No groups configured"
#     return 0
#   fi

#   log::section "Groups"

#   printf "\n  %-20s %-35s %-8s %s\n" "NAME" "DESCRIPTION" "PEERS" "STATUS"
#   printf "  %s\n" "$(printf '─%.0s' {1..75})"

#   for group_file in "${groups_dir}"/*.group; do
#     [[ -f "$group_file" ]] || continue

#     local name desc
#     name=$(json::get "$group_file" "name")
#     desc=$(json::get "$group_file" "desc")

#     # Count peers
#     local peers_list=()
#     mapfile -t peers_list < <(json::get "$group_file" "peers")
#     # Filter empty entries
#     local filtered=()
#     for p in "${peers_list[@]:-}"; do
#       [[ -n "$p" ]] && filtered+=("$p")
#     done
#     peers_list=("${filtered[@]:-}")
#     local peer_count=${#peers_list[@]}

#     [[ -z "${peers_list[0]}" ]] && peer_count=0

#     # Check block status
#     local blocked=0 total=0
#     for peer_name in "${peers_list[@]}"; do
#       [[ -z "$peer_name" ]] && continue
#       (( total++ )) || true
#       peers::is_blocked "$peer_name" && (( blocked++ )) || true
#     done

#     local status_color=""
#     local status_str="active"
#     if [[ "$total" -gt 0 ]]; then
#       if [[ "$blocked" -eq "$total" ]]; then
#         status_color="\033[1;31m"
#         status_str="blocked"
#       elif [[ "$blocked" -gt 0 ]]; then
#         status_color="\033[1;33m"
#         status_str="blocked (${blocked}/${total})"
#         # status_color="\033[1;33m"
#         # status_str="${blocked}/${total} blocked"
#       else
#         status_color="\033[1;32m"
#         status_str="active"
#       fi
#     fi

#     local short_desc="${desc:0:33}"
#     [[ ${#desc} -gt 33 ]] && short_desc="${short_desc}..."

#     printf "  %-20s %-35s %-8s %b\n" \
#       "$name" \
#       "${short_desc:-—}" \
#       "$peer_count" \
#       "${status_color}${status_str}\033[0m"
#   done

#   printf "\n"
# }

# ============================================
# Show
# ============================================

function cmd::group::show() {
  local name=""

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name) util::require_flag "--name" "${2:-}" || return 1; name="$2"; shift 2 ;;
      --help) cmd::group::help; return ;;
      *) log::error "Unknown flag: $1"; return 1 ;;
    esac
  done

  [[ -z "$name" ]] && log::error "Missing required flag: --name" && return 1
  group::require_exists "$name" || return 1

  local group_file
  group_file="$(group::path "$name")"

  log::section "Group: ${name}"

  local desc
  desc=$(json::get "$group_file" "desc")
  printf "\n  %-20s %s\n" "Description:" "${desc:-—}"

  # Load peers
  local peers_list=()
  mapfile -t peers_list < <(json::get "$group_file" "peers")
  # Filter empty entries
  local filtered=()
  for p in "${peers_list[@]:-}"; do
    [[ -n "$p" ]] && filtered+=("$p")
  done
  peers_list=("${filtered[@]:-}")
  local peer_count=${#peers_list[@]}

  [[ -z "${peers_list[0]}" ]] && peer_count=0

  printf "  %-20s %s\n" "Peers:" "$peer_count"
  printf "  %s\n" "$(printf '─%.0s' {1..50})"

  if [[ "$peer_count" -gt 0 ]]; then
    printf "\n  %-28s %-15s %-12s %s\n" "NAME" "IP" "RULE" "STATUS"
    printf "  %s\n" "$(printf '─%.0s' {1..65})"
    for peer_name in "${peers_list[@]}"; do
      [[ -z "$peer_name" ]] && continue
      local ip rule status_str status_color
      ip=$(peers::get_ip "$peer_name")
      rule=$(peers::get_meta "$peer_name" "rule")
      rule="${rule:-—}"

      if peers::is_blocked "$peer_name"; then
        status_color="\033[1;31m"
        status_str="blocked"
      else
        status_color="\033[1;32m"
        status_str="active"
      fi

      printf "  %-28s %-15s %-12s %b\n" \
        "$peer_name" "${ip:-—}" "$rule" \
        "${status_color}${status_str}\033[0m"
    done
  else
    printf "  —\n"
  fi

  printf "\n"
}

# ============================================
# Add
# ============================================

function cmd::group::add() {
  local name="" desc=""

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name) util::require_flag "--name" "${2:-}" || return 1; name="$2"; shift 2 ;;
      --desc) util::require_flag "--desc" "${2:-}" || return 1; desc="$2"; shift 2 ;;
      --help) cmd::group::help; return ;;
      *) log::error "Unknown flag: $1"; return 1 ;;
    esac
  done

  [[ -z "$name" ]] && log::error "Missing required flag: --name" && return 1

  if group::exists "$name"; then
    log::error "Group already exists: ${name}"
    return 1
  fi

  local group_file
  group_file="$(group::path "$name")"

  python3 -c "
import json
group = {'name': '${name}', 'desc': '${desc}', 'peers': []}
with open('${group_file}', 'w') as f:
    json.dump(group, f, indent=2)
" </dev/null

  log::wg_success "Group created: ${name}"
}

# ============================================
# Remove
# ============================================

function cmd::group::remove() {
  local name="" force=false

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name)  util::require_flag "--name" "${2:-}" || return 1; name="$2"; shift 2 ;;
      --force) force=true; shift ;;
      --help)  cmd::group::help; return ;;
      *) log::error "Unknown flag: $1"; return 1 ;;
    esac
  done

  [[ -z "$name" ]] && log::error "Missing required flag: --name" && return 1
  group::require_exists "$name" || return 1

  if ! $force; then
    read -r -p "Remove group '${name}'? This only removes the group definition, not the peers. [y/N] " confirm
    case "$confirm" in
      [yY][eE][sS]|[yY]) ;;
      *) log::info "Aborted"; return 0 ;;
    esac
  fi

  rm -f "$(group::path "$name")"
  log::wg_success "Group removed: ${name}"
}

# ============================================
# Rename
# ============================================

function cmd::group::rename() {
  local name="" new_name=""

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name)     util::require_flag "--name" "${2:-}" || return 1; name="$2"; shift 2 ;;
      --new-name) util::require_flag "--new-name" "${2:-}" || return 1; new_name="$2"; shift 2 ;;
      --help) cmd::group::help; return ;;
      *) log::error "Unknown flag: $1"; return 1 ;;
    esac
  done

  [[ -z "$name" ]] && log::error "Missing required flag: --name" && return 1
  [[ -z "$new_name" ]] && log::error "Missing required flag: --new-name" && return 1
  group::require_exists "$name" || return 1

  if group::exists "$new_name"; then
    log::error "Group already exists: ${new_name}"
    return 1
  fi

  local old_file new_file
  old_file="$(group::path "$name")"
  new_file="$(group::path "$new_name")"

  # Update name field in file
  json::set "$old_file" "name" "\"$new_name\""
  mv "$old_file" "$new_file"

  log::wg_success "Group renamed: ${name} → ${new_name}"
}

# ============================================
# Peer subcommand
# ============================================

function cmd::group::peer() {
  local subcmd="${1:-help}"
  shift || true

  case "$subcmd" in
    add)           cmd::group::peer_add "$@"    ;;
    remove|rm|del) cmd::group::peer_remove "$@" ;;
    *)
      log::error "Unknown peer subcommand: '${subcmd}'"
      cmd::group::help
      return 1
      ;;
  esac
}

function cmd::group::peer_add() {
  local name="" peer="" type=""

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name) util::require_flag "--name" "${2:-}" || return 1; name="$2"; shift 2 ;;
      --peer) util::require_flag "--peer" "${2:-}" || return 1; peer="$2"; shift 2 ;;
      --type) util::require_flag "--type" "${2:-}" || return 1; type="$2"; shift 2 ;;
      --help) cmd::group::help; return ;;
      *) log::error "Unknown flag: $1"; return 1 ;;
    esac
  done

  [[ -z "$name" ]] && log::error "Missing required flag: --name" && return 1
  [[ -z "$peer" ]] && log::error "Missing required flag: --peer" && return 1
  group::require_exists "$name" || return 1

  peer=$(peers::resolve_and_require "$peer" "$type") || return 1

  # Check if already in group
  if group::peers "$name" | grep -qF "$peer"; then
    log::wg_warning "'${peer}' is already in group '${name}'"
    return 0
  fi

  group::add_peer "$name" "$peer"
  log::wg_success "Added '${peer}' to group '${name}'"
}

function cmd::group::peer_remove() {
  local name="" peer="" type=""

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name) util::require_flag "--name" "${2:-}" || return 1; name="$2"; shift 2 ;;
      --peer) util::require_flag "--peer" "${2:-}" || return 1; peer="$2"; shift 2 ;;
      --type) util::require_flag "--type" "${2:-}" || return 1; type="$2"; shift 2 ;;
      --help) cmd::group::help; return ;;
      *) log::error "Unknown flag: $1"; return 1 ;;
    esac
  done

  [[ -z "$name" ]] && log::error "Missing required flag: --name" && return 1
  [[ -z "$peer" ]] && log::error "Missing required flag: --peer" && return 1
  group::require_exists "$name" || return 1

  peer=$(peers::resolve_and_require "$peer" "$type") || return 1
  group::remove_peer "$name" "$peer"
  log::wg_success "Removed '${peer}' from group '${name}'"
}

# ============================================
# Remove peers from WireGuard
# ============================================

function cmd::group::rm_peers() {
  local name="" force=false

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name)  util::require_flag "--name" "${2:-}" || return 1; name="$2"; shift 2 ;;
      --force) force=true; shift ;;
      --help)  cmd::group::help; return ;;
      *) log::error "Unknown flag: $1"; return 1 ;;
    esac
  done

  [[ -z "$name" ]] && log::error "Missing required flag: --name" && return 1
  group::require_exists "$name" || return 1

  local peers_list=()
  mapfile -t peers_list < <(group::peers "$name")
  local peer_count=${#peers_list[@]}
  [[ -z "${peers_list[0]}" ]] && peer_count=0

  if [[ "$peer_count" -eq 0 ]]; then
    log::wg_warning "Group '${name}' has no peers"
    return 0
  fi

  if ! $force; then
    read -r -p "Remove all ${peer_count} peers in group '${name}' from WireGuard? [y/N] " confirm
    case "$confirm" in
      [yY][eE][sS]|[yY]) ;;
      *) log::info "Aborted"; return 0 ;;
    esac
  fi

  local count=0
  for peer_name in "${peers_list[@]}"; do
    [[ -z "$peer_name" ]] && continue
    cmd::remove::run --name "$peer_name" --force
    (( count++ )) || true
  done

  log::wg_success "Removed ${count} peers from WireGuard (group '${name}' definition kept)"
}

# ============================================
# Block / Unblock
# ============================================

function cmd::group::block() {
  local name="" force=false

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name)  util::require_flag "--name" "${2:-}" || return 1; name="$2"; shift 2 ;;
      --force) force=true; shift ;;
      --help)  cmd::group::help; return ;;
      *) log::error "Unknown flag: $1"; return 1 ;;
    esac
  done

  [[ -z "$name" ]] && log::error "Missing required flag: --name" && return 1
  group::require_exists "$name" || return 1

  local peers_list=()
  mapfile -t peers_list < <(group::peers "$name")
  [[ -z "${peers_list[0]}" ]] && log::wg_warning "Group '${name}' has no peers" && return 0

  # log::section "Blocking group: ${name}"

  local count=0 blocked_names=()
  for peer_name in "${peers_list[@]}"; do
    [[ -z "$peer_name" ]] && continue
    if peers::is_blocked "$peer_name"; then
      log::wg_warning "${peer_name} — already blocked"
      continue
    fi
    ( core::set_quiet; load_command block; cmd::block::run --name "$peer_name" --force )
    blocked_names+=("$peer_name")
    (( count++ )) || true
  done

  [[ "$count" -eq 0 ]] && return 0

  # if [[ "$count" -gt 0 ]]; then
  #   printf "\n"
  #   for n in "${blocked_names[@]}"; do
  #     log::wg "  Blocked: ${n}"
  #   done
  # fi

  # log::wg_block "Blocked ${count} peers in group '${name}'"
  log::wg_block "All peers from ${name} have been blocked (${count} peers)."
}

function cmd::group::unblock() {
  local name="" force=false

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name)  util::require_flag "--name" "${2:-}" || return 1; name="$2"; shift 2 ;;
      --force) force=true; shift ;;
      --help)  cmd::group::help; return ;;
      *) log::error "Unknown flag: $1"; return 1 ;;
    esac
  done

  [[ -z "$name" ]] && log::error "Missing required flag: --name" && return 1
  group::require_exists "$name" || return 1

  local peers_list=()
  mapfile -t peers_list < <(group::peers "$name")
  [[ -z "${peers_list[0]}" ]] && log::wg_warning "Group '${name}' has no peers" && return 0

  # log::section "Unblocking group: ${name}"

  local count=0 unblocked_names=()
  for peer_name in "${peers_list[@]}"; do
    [[ -z "$peer_name" ]] && continue
    if ! peers::is_blocked "$peer_name"; then
      log::wg_warning "${peer_name} — not blocked"
      continue
    fi
    ( core::set_quiet; load_command unblock; cmd::unblock::run --name "$peer_name" --force )
    unblocked_names+=("$peer_name")
    (( count++ )) || true
  done

  [[ "$count" -eq 0 ]] && return 0

  # if [[ "$count" -gt 0 ]]; then
  #   printf "\n"
  #   for n in "${blocked_names[@]}"; do
  #     log::wg "  Unblocked: ${n}"
  #   done
  # fi

  log::wg_unblock "All peers from ${name} have been unblocked (${count} peers)."
}

# ============================================
# Rule assign
# ============================================

function cmd::group::rule() {
  local subcmd="${1:-help}"
  shift || true
  case "$subcmd" in
    assign) cmd::group::rule_assign "$@" ;;
    *)
      log::error "Unknown rule subcommand: '${subcmd}'"
      cmd::group::help
      return 1
      ;;
  esac
}

function cmd::group::rule_assign() {
  local name="" rule=""

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name) util::require_flag "--name" "${2:-}" || return 1; name="$2"; shift 2 ;;
      --rule) util::require_flag "--rule" "${2:-}" || return 1; rule="$2"; shift 2 ;;
      --help) cmd::group::help; return ;;
      *) log::error "Unknown flag: $1"; return 1 ;;
    esac
  done

  [[ -z "$name" ]] && log::error "Missing required flag: --name" && return 1
  [[ -z "$rule" ]] && log::error "Missing required flag: --rule" && return 1
  group::require_exists "$name" || return 1
  rule::require_exists "$rule" || return 1

  local peers_list=()
  mapfile -t peers_list < <(group::peers "$name")
  [[ -z "${peers_list[0]}" ]] && log::wg_warning "Group '${name}' has no peers" && return 0

  local count=0
  for peer_name in "${peers_list[@]}"; do
    [[ -z "$peer_name" ]] && continue
    cmd::rule::assign --name "$rule" --peer "$peer_name"
    (( count++ )) || true
  done

  log::wg_success "Assigned rule '${rule}' to ${count} peers in group '${name}'"
}

# ============================================
# Audit
# ============================================

function cmd::group::audit() {
  local name=""

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name) util::require_flag "--name" "${2:-}" || return 1; name="$2"; shift 2 ;;
      --help) cmd::group::help; return ;;
      *) log::error "Unknown flag: $1"; return 1 ;;
    esac
  done

  [[ -z "$name" ]] && log::error "Missing required flag: --name" && return 1
  group::require_exists "$name" || return 1

  local peers_list=()
  mapfile -t peers_list < <(group::peers "$name")
  [[ -z "${peers_list[0]}" ]] && log::wg_warning "Group '${name}' has no peers" && return 0

  # Run audit filtered to group peers
  load_command audit
  # Pass first peer as filter — audit handles the rest per-peer
  # Actually run full audit and filter output
  local peer_args=()
  for peer_name in "${peers_list[@]}"; do
    [[ -z "$peer_name" ]] && continue
    peer_args+=("$peer_name")
  done

  test::reset
  log::section "Audit: Group '${name}'"

  # Precompute fw counts
  declare -A peer_fw_counts
  while IFS=":" read -r pname count; do
    [[ -n "$pname" ]] && peer_fw_counts["$pname"]="$count"
  done < <(json::audit_fw_counts "$(ctx::clients)")

  test::section "Peer Rules"
  for peer_name in "${peer_args[@]}"; do
    cmd::audit::check_peer "$peer_name" false "${peer_fw_counts[$peer_name]:-0}"
  done

  test::summary
}

# ============================================
# Logs
# ============================================

function cmd::group::logs() {
  local name="" limit=50

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name)  util::require_flag "--name" "${2:-}" || return 1; name="$2"; shift 2 ;;
      --limit) util::require_flag "--limit" "${2:-}" || return 1; limit="$2"; shift 2 ;;
      --help)  cmd::group::help; return ;;
      *) log::error "Unknown flag: $1"; return 1 ;;
    esac
  done

  [[ -z "$name" ]] && log::error "Missing required flag: --name" && return 1
  group::require_exists "$name" || return 1

  local peers_list=()
  mapfile -t peers_list < <(group::peers "$name")
  [[ -z "${peers_list[0]}" ]] && log::wg_warning "Group '${name}' has no peers" && return 0

  log::section "Logs: Group '${name}'"

  for peer_name in "${peers_list[@]}"; do
    [[ -z "$peer_name" ]] && continue
    printf "\n  \033[1;37m── %s ──\033[0m\n" "$peer_name"
    load_command logs
    cmd::logs::show --name "$peer_name" --limit "$limit"
  done
}

# ============================================
# Watch
# ============================================

function cmd::group::watch() {
  local name=""

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name) util::require_flag "--name" "${2:-}" || return 1; name="$2"; shift 2 ;;
      --help) cmd::group::help; return ;;
      *) log::error "Unknown flag: $1"; return 1 ;;
    esac
  done

  [[ -z "$name" ]] && log::error "Missing required flag: --name" && return 1
  group::require_exists "$name" || return 1

  local peers_list=()
  mapfile -t peers_list < <(group::peers "$name")
  [[ -z "${peers_list[0]}" ]] && log::wg_warning "Group '${name}' has no peers" && return 0

  # Build comma-separated peer list for watch filter
  # Watch already supports --type filter but not multiple peers
  # For now, use follow mode filtered to group peers one at a time
  # or just run watch with no filter (shows all, user sees group context)
  log::section "Live Monitor: Group '${name}'"
  printf "  Monitoring peers: %s\n\n" "${peers_list[*]}"

  load_command logs
  # Use follow mode — it shows all peers but user knows context
  # Future: add --peers flag to follow for multi-peer filter
  cmd::logs::follow "" "" "" false false
}