use anyhow::Context;
use common::protocol::MessageOrderer;
use common::{ClientAction, ServerAction};
use rand::Rng;
use rustls::{Certificate, ClientConfig, ClientConnection, RootCertStore};
use std::io::{ErrorKind, Read};
use std::net::{TcpStream, UdpSocket};
use std::sync::Arc;
use std::time::{Duration, Instant};

/// Just for TLS SNI.
const SERVER_DNS_NAME: &str = "localhost";
const SERVER_URL: &str = "127.0.0.1:7812";
const KEEPALIVE_INTERVAL: Duration =
    Duration::from_millis(common::protocol::DISCONNECT_THRESHOLD.as_millis() as u64 / 2);

/// Wrapper around UDP and TCP sockets for communicating with the game server.
///
/// ### Implementation details
///
/// TCP is only used for the initial login, which is encrypted with TLS. The
/// root certificate is built into the client. The following gameplay updates
/// are sent over UDP, encrypted with ChaCha20-Poly1305, using a secret shared
/// during the login process. The UDP messages are processed with
/// [MessageOrderer] to make sure they arrive, and that are processed in order.
pub struct GameplaySocket {
    socket: UdpSocket,
    queue: MessageOrderer<ClientAction, ServerAction>,
    peer_id: [u8; 16],
    previous_received_datagram_time: Option<Instant>,
    previous_sent_datagram_time: Option<Instant>,
    pub debug_max_message_length: usize,
}

impl GameplaySocket {
    /// Connects to the game's login servers and sets up the communication
    /// channel. [GameplaySocket::transport] should be called periodically (many
    /// times a second) afterwards, to transport sent messages, as well as
    /// keepalive messages.
    pub fn new() -> anyhow::Result<GameplaySocket> {
        let mut socket = None;
        for _ in 0..100 {
            let port = rand::thread_rng().gen_range(20_000..65000u16);
            if let Ok(bound_socket) = UdpSocket::bind(("0.0.0.0", port)) {
                socket = Some(bound_socket);
            }
        }
        let socket = socket.ok_or_else(|| {
            std::io::Error::new(ErrorKind::Other, "cannot bind the udp gameplay socket")
        })?;
        socket
            .connect(SERVER_URL)
            .context("Failed to connect? This is a bug.")?;
        socket
            .set_nonblocking(true)
            .context("Could not make the UDP socket non-blocking.")?;

        let LoginInfo {
            peer_id,
            encryption_key,
        } = login()?;

        Ok(GameplaySocket {
            socket,
            queue: MessageOrderer::new(encryption_key),
            peer_id,
            previous_received_datagram_time: None,
            previous_sent_datagram_time: None,
            debug_max_message_length: 0,
        })
    }

    /// Returns true after it's been [common::protocol::DISCONNECT_THRESHOLD]
    /// since the last packet from the server.
    pub fn disconnected(&self) -> bool {
        if let Some(t) = self.previous_received_datagram_time {
            Instant::now() - t >= common::protocol::DISCONNECT_THRESHOLD
        } else {
            true
        }
    }

    fn keepalive_needed(&self) -> bool {
        if let Some(t) = self.previous_sent_datagram_time {
            Instant::now() - t >= KEEPALIVE_INTERVAL
        } else {
            false
        }
    }

    /// Sends and receives all pending messages on the UDP socket.
    pub fn transport(&mut self) {
        let mut buf = [0; 65536];
        loop {
            match self.socket.recv_from(&mut buf) {
                Ok((n, peer_addr)) => {
                    self.debug_max_message_length = self.debug_max_message_length.max(n);
                    self.queue.transport_recv(peer_addr, &mut buf[..n]);
                    self.previous_received_datagram_time = Some(Instant::now());
                }
                Err(err) => {
                    if err.kind() != ErrorKind::TimedOut && err.kind() != ErrorKind::WouldBlock {
                        log::debug!("Error receiving UDP datagram: {err}");
                    }
                    break;
                }
            }
        }

        if self.keepalive_needed() {
            self.queue.send(ClientAction::KeepAlive);
        }
        if let Some(mut datagram) = self.queue.transport_send(SERVER_URL) {
            datagram.splice(0..0, self.peer_id);
            if let Err(err) = self.socket.send_to(&datagram, SERVER_URL) {
                log::debug!("Error sending UDP datagram: {err}");
            } else {
                self.previous_sent_datagram_time = Some(Instant::now());
            }
        }
    }

    /// Queues the [ClientAction] for sending during the next
    /// [GameplaySocket::transport].
    pub fn send(&mut self, action: ClientAction) {
        self.queue.send(action);
    }

    /// Returns any [ServerAction]s received during previously called
    /// [GameplaySocket::transport]s.
    pub fn recv(&mut self) -> Option<ServerAction> {
        self.queue.recv()
    }
}

struct LoginInfo {
    peer_id: [u8; 16],
    encryption_key: [u8; 32],
}

fn login() -> anyhow::Result<LoginInfo> {
    let mut tcp_stream =
        TcpStream::connect(SERVER_URL).context("Could not connect to the login server.")?;

    let mut root_store = RootCertStore::empty();
    root_store.add(&Certificate(include_bytes!("../../certs/ca.crt").to_vec()))?;
    let config = Arc::new(
        ClientConfig::builder()
            .with_safe_defaults()
            .with_root_certificates(root_store)
            .with_no_client_auth(),
    );
    let server_name = SERVER_DNS_NAME.try_into().unwrap();
    let mut tls_conn = ClientConnection::new(config, server_name)
        .context("Could not setup rustls ClientConnection for login server.")?;
    tls_conn
        .complete_io(&mut tcp_stream)
        .context("Failed to establish TLS connection to the login server.")?;

    let mut login_server_stream = rustls::Stream::new(&mut tls_conn, &mut tcp_stream);
    let mut peer_id = [0u8; 16];
    let mut encryption_key = [0u8; 32];
    login_server_stream
        .read_exact(&mut peer_id)
        .context("Could not read peer id from login server.")?;
    login_server_stream
        .read_exact(&mut encryption_key)
        .context("Could not read encryption key from login server.")?;
    Ok(LoginInfo {
        peer_id,
        encryption_key,
    })
}