/*
 * The contents of this file are subject to the terms of the Common Development and
 * Distribution License (the License). You may not use this file except in compliance with the
 * License.
 *
 * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
 * specific language governing permission and limitations under the License.
 *
 * When distributing Covered Software, include this CDDL Header Notice in each file and include
 * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
 * Header, with the fields enclosed by brackets [] replaced by your own identifying
 * information: "Portions Copyright [year] [name of copyright owner]".
 *
 * Copyright 2024-2026 3A Systems LLC.
 */

package org.openidentityplatform.opendj.embedded;

import org.apache.commons.io.FileUtils;
import org.forgerock.i18n.LocalizableMessage;
import org.forgerock.opendj.config.client.ManagementContext;
import org.forgerock.opendj.ldap.Connection;
import org.forgerock.opendj.ldap.DN;
import org.forgerock.opendj.ldap.LdapException;
import org.forgerock.opendj.ldap.SearchScope;
import org.forgerock.opendj.ldap.responses.SearchResultEntry;
import org.forgerock.opendj.ldif.ConnectionEntryReader;
import org.forgerock.opendj.ldif.EntryReader;
import org.forgerock.opendj.ldif.LDIFEntryReader;
import org.forgerock.opendj.ldif.LDIFEntryWriter;
import org.forgerock.opendj.server.config.client.BackendCfgClient;
import org.forgerock.opendj.server.embedded.ConfigParameters;
import org.forgerock.opendj.server.embedded.ConnectionParameters;
import org.forgerock.opendj.server.embedded.EmbeddedDirectoryServer;
import org.forgerock.opendj.server.embedded.EmbeddedDirectoryServerException;
import org.forgerock.opendj.server.embedded.SetupParameters;
import org.forgerock.opendj.server.embedded.UpgradeParameters;
import org.opends.server.backends.MemoryBackend;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import java.io.BufferedReader;
import java.io.Closeable;
import java.io.File;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.OutputStream;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
import java.util.concurrent.TimeUnit;
import java.util.function.Predicate;

public class EmbeddedOpenDJ implements Runnable, Closeable {
    private static final String JAR_SCHEMA_DIRECTORY = "opendj/config/schema/";

    private static final String ARCHIVE_NAME = "opendj.zip";

    /**
     * How long the deletion of the instance directory is retried when there is no point in
     * waiting for the full {@link Config#getDeleteTimeout() configured timeout}: from the
     * shutdown hook, where a longer wait only makes Control-C look hung, and from the
     * constructor, where an initialization failure has to be reported promptly. What is still
     * locked when this expires is deleted on JVM exit anyway.
     */
    private static final long SHORT_DELETE_TIMEOUT_MS = 1_000L;

    private static final long INITIAL_DELETE_RETRY_DELAY_MS = 50L;

    private static final long MAX_DELETE_RETRY_DELAY_MS = 500L;

    /** Upper bound on the number of leftover paths reported when the deletion fails. */
    private static final int MAX_REPORTED_REMAINING_PATHS = 20;

    final static Logger logger = LoggerFactory.getLogger(EmbeddedOpenDJ.class.getName());
    final EmbeddedDirectoryServer server;

    final Config config;

    private final File instanceDirectory;
    private final File rootDirectory;
    private final Thread shutdownHook;

    /** Written under {@code this}, read without locking so that a running {@link #close()} blocks nothing. */
    private volatile boolean closed;

    public EmbeddedOpenDJ() {
        this(new Config());
    }

    public EmbeddedOpenDJ(Config config) {

        logger.info("Create embedded OpenDJ instance: {}", config);

        this.config = config;
        File instanceDirectory = null;
        try {
            // Create a fresh per-instance parent directory, only accessible by the
            // current user, instead of the fixed shared {java.io.tmpdir}/opendj
            // directory. The server root inside it must be named "opendj" because
            // setup from an archive requires the server root directory to match the
            // root directory contained in the archive. The whole directory is
            // deleted on close().
            instanceDirectory = Files.createTempDirectory("opendj").toFile();
            File rootDirectory = new File(instanceDirectory, "opendj");
            if (!rootDirectory.mkdir()) {
                // the parent has just been created, so this only fails on a real filesystem error
                throw new IOException("Cannot create the server root directory " + rootDirectory);
            }
            logger.info("OpenDJ server root: {}", rootDirectory);

            File configDirectory = new File(rootDirectory, "config");
            File schemaDirectory = new File(configDirectory, "schema");
            server = EmbeddedDirectoryServer.manageEmbeddedDirectoryServer(
                    ConfigParameters.configParams()
                            .serverRootDirectory(rootDirectory.getPath())
                            .configurationFile(Paths.get(rootDirectory.getPath(), "config", "config.ldif").toString()),
                    ConnectionParameters.connectionParams()
                            .hostName("localhost")
                            .ldapPort(config.getPort())
                            .adminPort(config.getAdminPort())
                            .bindDn("cn=Directory Manager")
                            .bindPassword(config.getAdminPassword()),
                    System.out,
                    System.err);

            copyFilesFromJar(Collections.singletonList(ARCHIVE_NAME),"embedded-opendj/",rootDirectory);
            final File archive = new File(rootDirectory, ARCHIVE_NAME);
            server.extractArchiveForSetup(archive);
            // The archive is only needed for the extraction above. Keeping it would leave a
            // full copy of the distribution in the temporary directory and one more file to
            // delete on close().
            if (!archive.delete()) {
                logger.warn("Cannot delete {} after extracting it", archive);
            }

            server.setup(
                    SetupParameters.setupParams()
                            .baseDn(config.getBaseDN())
                            .backendType(config.getBackendType())
                            .jmxPort(config.getJmxPort())
            );

            List<String> schemaFiles = new ArrayList<>();
            if (config.getLdifSchema() != null) {
                schemaFiles.add(config.getLdifSchema());
            }

            copyFilesFromJar(schemaFiles, JAR_SCHEMA_DIRECTORY, schemaDirectory);

            this.instanceDirectory = instanceDirectory;
            this.rootDirectory = rootDirectory;
        }catch (Exception e) {
            logger.error("Error initializing OpenDJ");
            deleteInstanceDirectory(instanceDirectory, shortDeleteTimeout(config));
            throw new RuntimeException(e);
        }
        shutdownHook = new Thread(this::close, "EmbeddedOpenDJ shutdown hook");
        Runtime.getRuntime().addShutdownHook(shutdownHook);
    }

    /**
     * Returns the server root directory of this embedded instance.
     *
     * @return the server root directory
     * @throws IllegalStateException
     *             If this instance has been closed, and the directory therefore deleted.
     */
    public File getServerRootDirectory() {
        checkNotClosed();
        return rootDirectory;
    }

    @Override
    public void run() {
        checkNotClosed();
        try {
            final DN baseDN = DN.valueOf(config.getBaseDN());
            try (ManagementContext managementContext = server.getConfiguration()) {
                BackendCfgClient userRoot = managementContext.getRootConfiguration().getBackend("userRoot");
                userRoot.setBaseDN((Collections.singletonList(baseDN)));
                userRoot.setEnabled(true);
                userRoot.commit();
            } catch (Exception e) {
                throw new RuntimeException(e);
            }

            logger.info("Check upgrade OpenDJ ...");
            server.upgrade(UpgradeParameters.upgradeParams().isIgnoreErrors(false));

            logger.info("Start OpenDJ ...");
            server.start();

        } catch (Exception e) {
            logger.error("Error starting OpenDJ", e);
            throw new RuntimeException(e);
        }
    }

    /**
     * Stops this instance, if it is still running, and deletes its temporary directory.
     * <p>
     * This method is idempotent: it is also registered as a JVM shutdown hook.
     * <p>
     * When the server cannot be stopped, this instance stays open and keeps its shutdown hook
     * registered, so that a later call - or the hook at JVM exit - retries the stop.
     */
    @Override
    public synchronized void close()  {
        if (closed) {
            return;
        }
        final boolean fromShutdownHook = Thread.currentThread() == shutdownHook;
        if (server.isRunning()) {
            try {
                logger.info("Shutting down OpenDJ ...");
                server.stop(this.getClass().getName(), LocalizableMessage.raw("Stopped after receiving Control-C"));
            }catch (Throwable e) {
                logger.error("Error stopping OpenDJ", e);
                if (!fromShutdownHook) {
                    // The server is still running: deleting its directory now would destroy a
                    // live installation. Leave this instance open, with its shutdown hook still
                    // registered, so that the stop can be retried.
                    return;
                }
                // The JVM is going down and there will be no later attempt, so the temporary
                // directory is removed even though the server has not stopped cleanly.
            }
        }
        closed = true;
        unregisterShutdownHook();
        deleteInstanceDirectory(instanceDirectory,
                fromShutdownHook ? shortDeleteTimeout(config) : config.getDeleteTimeout());
    }

    private void checkNotClosed() {
        if (closed) {
            throw new IllegalStateException("this embedded OpenDJ instance is closed");
        }
    }

    private static long shortDeleteTimeout(Config config) {
        return Math.min(config.getDeleteTimeout(), SHORT_DELETE_TIMEOUT_MS);
    }

    private void unregisterShutdownHook() {
        try {
            Runtime.getRuntime().removeShutdownHook(shutdownHook);
        } catch (IllegalStateException e) {
            // close() was reached from the shutdown hook itself: nothing to unregister
        }
    }

    /**
     * Deletes the temporary directory of an instance, retrying for a bounded period and
     * falling back to a deletion on JVM exit.
     * <p>
     * Deleting once is not enough. On Windows a file cannot be deleted while a handle to it
     * is still open, and {@code server.stop()} does not wait for the server threads to
     * terminate: an embedded server runs them as daemon threads, which the shutdown monitor
     * of the directory server ignores. Some handles are therefore released shortly after
     * {@code stop()} has returned, and a single best-effort deletion loses that race and
     * silently leaks the whole directory, backend data included. Retrying is a way to wait
     * for those handles to be released - a single attempt already removes everything that is
     * not in use at that moment.
     *
     * @param directory
     *            the directory to delete, may be {@code null} when the instance failed to
     *            initialize before creating it
     * @param timeoutMs
     *            how long the deletion is retried, in milliseconds
     */
    static void deleteInstanceDirectory(File directory, long timeoutMs) {
        deleteInstanceDirectory(directory, timeoutMs, FileUtils::deleteQuietly);
    }

    /**
     * Implements {@link #deleteInstanceDirectory(File, long)} with an injectable deletion, so
     * that tests can drive the retries without depending on a genuinely undeletable file.
     *
     * @param deleteAttempt
     *            performs one deletion attempt and reports whether the directory is gone
     */
    static void deleteInstanceDirectory(File directory, long timeoutMs, Predicate<File> deleteAttempt) {
        if (directory == null || !directory.exists()) {
            return;
        }
        final long deadline = System.nanoTime() + TimeUnit.MILLISECONDS.toNanos(timeoutMs);
        long retryDelay = INITIAL_DELETE_RETRY_DELAY_MS;
        while (true) {
            // The second test covers a directory removed by someone else in the meantime:
            // deleteQuietly() reports a failure for a directory that is already gone.
            if (deleteAttempt.test(directory) || !directory.exists()) {
                return;
            }
            if (System.nanoTime() >= deadline) {
                logger.warn("Cannot delete {} within {} ms, some files are still in use. "
                        + "They are now scheduled for deletion on JVM exit:{}",
                        directory, timeoutMs, remainingPaths(directory));
                break;
            }
            try {
                Thread.sleep(retryDelay);
            } catch (InterruptedException e) {
                Thread.currentThread().interrupt();
                logger.warn("Interrupted while deleting {}. What is left is now scheduled "
                        + "for deletion on JVM exit:{}", directory, remainingPaths(directory));
                break;
            }
            retryDelay = Math.min(retryDelay * 2, MAX_DELETE_RETRY_DELAY_MS);
        }
        deleteTreeOnExit(directory);
    }

    /**
     * Describes what is left in the given directory: one path per line, at most
     * {@link #MAX_REPORTED_REMAINING_PATHS} of them, followed by the number of paths left out.
     */
    static String remainingPaths(File directory) {
        final List<String> reported = new ArrayList<>();
        final int total = collectRemainingPaths(directory, reported);
        final StringBuilder description = new StringBuilder();
        for (String path : reported) {
            description.append("\n  ").append(path);
        }
        if (total > reported.size()) {
            description.append("\n  ... and ").append(total - reported.size()).append(" more");
        }
        return description.toString();
    }

    /**
     * Adds at most {@link #MAX_REPORTED_REMAINING_PATHS} paths of the given tree to
     * {@code reported} and returns how many paths it holds in total.
     */
    private static int collectRemainingPaths(File file, List<String> reported) {
        final File[] children = file.listFiles();
        if (children == null || children.length == 0) {
            if (reported.size() < MAX_REPORTED_REMAINING_PATHS) {
                reported.add(file.getPath());
            }
            return 1;
        }
        int total = 0;
        for (File child : children) {
            total += collectRemainingPaths(child, reported);
        }
        return total;
    }

    private static void deleteTreeOnExit(File file) {
        // File.deleteOnExit() deletes in reverse order of registration, so a directory has to
        // be registered before its content for the content to be removed first.
        file.deleteOnExit();
        final File[] children = file.listFiles();
        if (children != null) {
            for (File child : children) {
                deleteTreeOnExit(child);
            }
        }
    }

    private void copyFilesFromJar(List<String> jarFiles, String jarDirectory, File outputDirectory) throws IOException{
        for(String jarFile : jarFiles) {
            File outputFile = new File(outputDirectory, new File(jarFile).getName());
            final String resourcePath = !jarFile.contains("/")
                    ? "/"+jarDirectory + jarFile
                    : jarFile;
            try (InputStream in = new File(jarFile).exists()
                    ? Files.newInputStream(new File(jarFile).toPath())
                    : MemoryBackend.class.getResourceAsStream(resourcePath)) {
                if (in == null) {
                    throw new IOException("cannot find " + resourcePath);
                }
                FileUtils.copyInputStreamToFile(in, outputFile);
            }
        }
    }

    /**
     * Imports the LDIF read from the given stream.
     * <p>
     * The stream is closed by this method, whether the import succeeds or not.
     *
     * @param inputStream
     *            the LDIF to import
     * @throws IllegalStateException
     *             If this instance has been closed.
     */
    public void importData(InputStream inputStream) throws EmbeddedDirectoryServerException, IOException {
        checkNotClosed();
        logger.info("start import ldif from stream");

        org.forgerock.opendj.ldap.Entry  entryBefore;
        long recordCount = 0;
        try (EntryReader reader = new LDIFEntryReader(new BufferedReader(new InputStreamReader(inputStream)));
             Connection connection = server.getInternalConnection()) {
            while (reader.hasNext() && (entryBefore = reader.readEntry()) != null) {
                recordCount++;
                try {
                    connection.add(entryBefore);
                    logger.info("import ldif : {}",entryBefore.getName());
                }catch (LdapException e) {
                    logger.error("import ldif : {} {}",entryBefore.getName(),e.toString());
                }
            }
        }
        if(recordCount == 0) {
            logger.error("no records were imported, check file contents and permissions");
            throw new RuntimeException("no records were imported");
        }
    }

    /**
     * Writes the entries below the given base DN to the given stream, as LDIF.
     * <p>
     * The stream is flushed and closed by this method, whether the export succeeds or not.
     *
     * @param baseDN
     *            the base DN of the subtree to export
     * @param out
     *            where the LDIF is written
     * @throws IllegalStateException
     *             If this instance has been closed.
     */
    public void getData(String baseDN, OutputStream out) throws IOException, EmbeddedDirectoryServerException {
        checkNotClosed();
        // resources are closed in reverse order, so the writer is flushed and closed last
        try (LDIFEntryWriter ldifWriter = new LDIFEntryWriter(out);
             Connection connection = server.getInternalConnection();
             ConnectionEntryReader reader =
                     connection.search(baseDN, SearchScope.WHOLE_SUBTREE, "(objectClass=*)")) {
            while (reader.hasNext()) {
                if (!reader.isReference()) {
                    SearchResultEntry se = reader.readEntry();
                    if (!skipEntry(se)) {
                        ldifWriter.writeEntry(se);
                        logger.info("export {}", se.toString());
                    }
                }
            }
        }
    }

    private boolean skipEntry(SearchResultEntry se) {
        for (String skip : config.getSkipSet()) {
            if (se.getName().toString().toLowerCase().contains(skip)){
                logger.trace("ignore export {}", se);
                return true;
            }
        }
        return false;
    }

    public boolean isRunning() {
        return server != null && server.isRunning();
    }

}