// Copyright (c) 2019-2026 Alexander Medvednikov. All rights reserved.
// Use of this source code is governed by a GPL license that can be found in the LICENSE file.
module main

import veb
import validation
import git
import time

struct PrWithUser {
    pr   PullRequest
    user User
}

struct PrCommentWithUser {
    item PrComment
    user User
}

struct PrReviewWithUser {
    review   PrReview
    user     User
    comments []PrReviewComment
}

struct PrTimelineEntry {
mut:
    kind       string // 'comment' or 'review'
    created_at int
    user       User
    comment    PrComment
    review     PrReview
    rcomments  []PrReviewCommentWithUser
}

struct PrReviewCommentWithUser {
    item PrReviewComment
    user User
}

// GET /:username/:repo_name/pulls
@['/:username/:repo_name/pulls']
pub fn (mut app App) handle_get_repo_pulls(mut ctx Context, username string, repo_name string) veb.Result {
    return app.repo_pulls(mut ctx, username, repo_name, 'open')
}

@['/:username/:repo_name/pulls/:tab']
pub fn (mut app App) repo_pulls(mut ctx Context, username string, repo_name string, tab string) veb.Result {
    repo := app.find_repo_by_name_and_username(repo_name, username) or { return ctx.not_found() }
    if !app.has_user_repo_read_access(ctx, ctx.user.id, repo.id) && !repo.is_public {
        return ctx.not_found()
    }
    current_tab := if tab in ['open', 'closed', 'merged'] { tab } else { 'open' }
    status := match current_tab {
        'closed' { PrStatus.closed }
        'merged' { PrStatus.merged }
        else { PrStatus.open }
    }

    prs := app.find_repo_pull_requests(repo.id, status)
    mut prs_with_users := []PrWithUser{}
    for pr in prs {
        author := app.get_user_by_id(pr.author_id) or { continue }
        prs_with_users << PrWithUser{
            pr:   pr
            user: author
        }
    }
    _ := app.get_repo_open_pr_count(repo.id)
    tab_open_class := if current_tab == 'open' { 'pr-tab pr-tab--active' } else { 'pr-tab' }
    tab_merged_class := if current_tab == 'merged' { 'pr-tab pr-tab--active' } else { 'pr-tab' }
    tab_closed_class := if current_tab == 'closed' { 'pr-tab pr-tab--active' } else { 'pr-tab' }
    return $veb.html('templates/pulls.html')
}

// GET /:username/:repo_name/pulls/new
@['/:username/:repo_name/compare']
pub fn (mut app App) new_pull_request_form(mut ctx Context, username string, repo_name string) veb.Result {
    if !ctx.logged_in {
        return ctx.redirect_to_login()
    }
    repo := app.find_repo_by_name_and_username(repo_name, username) or { return ctx.not_found() }
    if !app.has_user_repo_read_access(ctx, ctx.user.id, repo.id) && !repo.is_public {
        return ctx.not_found()
    }
    branches := app.get_all_repo_branches(repo.id)
    base := if 'base' in ctx.query { ctx.query['base'] } else { repo.primary_branch }
    head := if 'head' in ctx.query { ctx.query['head'] } else { '' }
    mut commits := []Commit{}
    mut file_diffs := []FileDiff{}
    mut suggested_title := ''
    mut error_msg := ''
    mut has_compare := false
    if head != '' && head != base {
        has_compare = true
        if !app.contains_repo_branch(repo.id, head) || !app.contains_repo_branch(repo.id, base) {
            error_msg = 'Both base and compare branches must exist in this repository.'
            has_compare = false
        } else {
            commits = repo.list_commits_between(base, head)
            raw_diff := repo.diff_branches(base, head)
            file_diffs = parse_unified_diff(raw_diff)
            if commits.len > 0 {
                suggested_title = commits[0].message
            }
        }
    }
    return $veb.html('templates/new/pull.html')
}

// POST /:username/:repo_name/pulls
@['/:username/:repo_name/pulls'; post]
pub fn (mut app App) handle_create_pull_request(mut ctx Context, username string, repo_name string) veb.Result {
    if !ctx.logged_in {
        return ctx.redirect_to_login()
    }
    repo := app.find_repo_by_name_and_username(repo_name, username) or { return ctx.not_found() }
    if !app.has_user_repo_read_access(ctx, ctx.user.id, repo.id) && !repo.is_public {
        return ctx.not_found()
    }
    title := ctx.form['title']
    description := ctx.form['description']
    head := ctx.form['head']
    base := ctx.form['base']
    if validation.is_string_empty(title) || validation.is_string_empty(head)
        || validation.is_string_empty(base) {
        ctx.error('Title, head and base branches are required')
        return ctx.redirect('/${username}/${repo_name}/compare?base=${base}&head=${head}')
    }
    if head == base {
        ctx.error('Head and base must differ')
        return ctx.redirect('/${username}/${repo_name}/compare')
    }
    if !app.contains_repo_branch(repo.id, head) || !app.contains_repo_branch(repo.id, base) {
        ctx.error('Branches not found')
        return ctx.redirect('/${username}/${repo_name}/compare')
    }
    commits := repo.list_commits_between(base, head)
    if commits.len == 0 {
        ctx.error('No commits between base and head')
        return ctx.redirect('/${username}/${repo_name}/compare?base=${base}&head=${head}')
    }
    pr_id := app.add_pull_request(repo.id, ctx.user.id, title, description, head, base) or {
        ctx.error('Could not create pull request')
        return ctx.redirect('/${username}/${repo_name}/compare')
    }
    app.increment_repo_open_prs(repo.id) or { app.info(err.str()) }
    app.dispatch_webhook(repo.id, 'pr', WebhookPrPayload{
        action: 'opened'
        repo:   '${username}/${repo_name}'
        number: pr_id
        title:  title
        author: ctx.user.username
        head:   head
        base:   base
    })
    return ctx.redirect('/${username}/${repo_name}/pull/${pr_id}')
}

// GET /:username/:repo_name/pull/:id
@['/:username/:repo_name/pull/:id']
pub fn (mut app App) pull_request(mut ctx Context, username string, repo_name string, id string) veb.Result {
    repo := app.find_repo_by_name_and_username(repo_name, username) or { return ctx.not_found() }
    if !app.has_user_repo_read_access(ctx, ctx.user.id, repo.id) && !repo.is_public {
        return ctx.not_found()
    }
    pr := app.find_pull_request_by_id(id.int()) or { return ctx.not_found() }
    if pr.repo_id != repo.id {
        return ctx.not_found()
    }
    author := app.get_user_by_id(pr.author_id) or { return ctx.not_found() }
    commits := repo.list_commits_between(pr.base_branch, pr.head_branch)
    comments := app.get_pr_comments(pr.id)
    reviews := app.get_pr_reviews(pr.id)
    rcomments := app.get_pr_review_comments(pr.id)
    mut timeline := []PrTimelineEntry{}
    for c in comments {
        u := app.get_user_by_id(c.author_id) or { continue }
        timeline << PrTimelineEntry{
            kind:       'comment'
            created_at: c.created_at
            user:       u
            comment:    c
        }
    }
    for r in reviews {
        u := app.get_user_by_id(r.author_id) or { continue }
        mut r_comments := []PrReviewCommentWithUser{}
        for rc in rcomments {
            if rc.review_id == r.id {
                uu := app.get_user_by_id(rc.author_id) or { continue }
                r_comments << PrReviewCommentWithUser{
                    item: rc
                    user: uu
                }
            }
        }
        timeline << PrTimelineEntry{
            kind:       'review'
            created_at: r.created_at
            user:       u
            review:     r
            rcomments:  r_comments
        }
    }
    timeline.sort(a.created_at < b.created_at)
    is_repo_owner := repo.user_id == ctx.user.id
    can_merge := is_repo_owner && pr.is_open()
    can_close := pr.is_open() && (is_repo_owner || pr.author_id == ctx.user.id)
    can_reopen := pr.is_closed() && (is_repo_owner || pr.author_id == ctx.user.id)
    return $veb.html('templates/pull.html')
}

// GET /:username/:repo_name/pull/:id/files
@['/:username/:repo_name/pull/:id/files']
pub fn (mut app App) pull_request_files(mut ctx Context, username string, repo_name string, id string) veb.Result {
    repo := app.find_repo_by_name_and_username(repo_name, username) or { return ctx.not_found() }
    if !app.has_user_repo_read_access(ctx, ctx.user.id, repo.id) && !repo.is_public {
        return ctx.not_found()
    }
    pr := app.find_pull_request_by_id(id.int()) or { return ctx.not_found() }
    if pr.repo_id != repo.id {
        return ctx.not_found()
    }
    author := app.get_user_by_id(pr.author_id) or { return ctx.not_found() }
    raw_diff := repo.diff_branches(pr.base_branch, pr.head_branch)
    file_diffs := parse_unified_diff(raw_diff)
    rcomments := app.get_pr_review_comments(pr.id)
    mut comments_by_key := map[string][]PrReviewCommentWithUser{}
    for rc in rcomments {
        u := app.get_user_by_id(rc.author_id) or { continue }
        key := '${rc.file_path}|${rc.side}|${rc.line_number}'
        comments_by_key[key] << PrReviewCommentWithUser{
            item: rc
            user: u
        }
    }
    return $veb.html('templates/pull_files.html')
}

// POST /:username/:repo_name/pull/:id/comments
@['/:username/:repo_name/pull/:id/comments'; post]
pub fn (mut app App) handle_add_pr_comment(mut ctx Context, username string, repo_name string, id string) veb.Result {
    if !ctx.logged_in {
        return ctx.redirect_to_login()
    }
    repo := app.find_repo_by_name_and_username(repo_name, username) or { return ctx.not_found() }
    pr := app.find_pull_request_by_id(id.int()) or { return ctx.not_found() }
    if pr.repo_id != repo.id {
        return ctx.not_found()
    }
    text := ctx.form['text']
    if validation.is_string_empty(text) {
        return ctx.redirect('/${username}/${repo_name}/pull/${id}')
    }
    app.add_pr_comment(pr.id, ctx.user.id, text) or {
        ctx.error('Could not add comment')
        return ctx.redirect('/${username}/${repo_name}/pull/${id}')
    }
    app.increment_pr_comments(pr.id) or { app.info(err.str()) }
    return ctx.redirect('/${username}/${repo_name}/pull/${id}')
}

// POST /:username/:repo_name/pull/:id/review
@['/:username/:repo_name/pull/:id/review'; post]
pub fn (mut app App) handle_submit_review(mut ctx Context, username string, repo_name string, id string) veb.Result {
    if !ctx.logged_in {
        return ctx.redirect_to_login()
    }
    repo := app.find_repo_by_name_and_username(repo_name, username) or { return ctx.not_found() }
    pr := app.find_pull_request_by_id(id.int()) or { return ctx.not_found() }
    if pr.repo_id != repo.id {
        return ctx.not_found()
    }
    body := ctx.form['body']
    state_str := ctx.form['state']
    state := match state_str {
        'approved' { 1 }
        'changes_requested' { 2 }
        else { 0 }
    }

    review_id := app.add_pr_review(pr.id, ctx.user.id, state, body) or {
        ctx.error('Could not submit review')
        return ctx.redirect('/${username}/${repo_name}/pull/${id}/files')
    }
    // Attach pending line comments from form (file_path|side|line — text)
    for key, val in ctx.form {
        if !key.starts_with('rc::') {
            continue
        }
        text := val.trim_space()
        if text == '' {
            continue
        }
        // rc::file::side::line
        parts := key[4..].split('::')
        if parts.len < 3 {
            continue
        }
        file_path := parts[0]
        side := parts[1]
        line_no := parts[2].int()
        app.add_pr_review_comment(pr.id, ctx.user.id, review_id, file_path, line_no, side, text) or {
            continue
        }
    }
    if body != '' {
        app.increment_pr_comments(pr.id) or {}
    }
    return ctx.redirect('/${username}/${repo_name}/pull/${id}')
}

// POST /:username/:repo_name/pull/:id/line-comment
@['/:username/:repo_name/pull/:id/line-comment'; post]
pub fn (mut app App) handle_add_line_comment(mut ctx Context, username string, repo_name string, id string) veb.Result {
    if !ctx.logged_in {
        return ctx.redirect_to_login()
    }
    repo := app.find_repo_by_name_and_username(repo_name, username) or { return ctx.not_found() }
    pr := app.find_pull_request_by_id(id.int()) or { return ctx.not_found() }
    if pr.repo_id != repo.id {
        return ctx.not_found()
    }
    file_path := ctx.form['file_path']
    side := ctx.form['side']
    line_no := ctx.form['line_number'].int()
    text := ctx.form['text']
    if validation.is_string_empty(text) || validation.is_string_empty(file_path) {
        return ctx.redirect('/${username}/${repo_name}/pull/${id}/files')
    }
    app.add_pr_review_comment(pr.id, ctx.user.id, 0, file_path, line_no, side, text) or {
        ctx.error('Could not add line comment')
        return ctx.redirect('/${username}/${repo_name}/pull/${id}/files')
    }
    return ctx.redirect('/${username}/${repo_name}/pull/${id}/files#${file_path}-${side}-${line_no}')
}

// POST /:username/:repo_name/pull/:id/close
@['/:username/:repo_name/pull/:id/close'; post]
pub fn (mut app App) handle_close_pr(mut ctx Context, username string, repo_name string, id string) veb.Result {
    if !ctx.logged_in {
        return ctx.redirect_to_login()
    }
    repo := app.find_repo_by_name_and_username(repo_name, username) or { return ctx.not_found() }
    pr := app.find_pull_request_by_id(id.int()) or { return ctx.not_found() }
    if pr.repo_id != repo.id {
        return ctx.not_found()
    }
    can_close := repo.user_id == ctx.user.id || pr.author_id == ctx.user.id
    if !can_close {
        return ctx.redirect('/${username}/${repo_name}/pull/${id}')
    }
    if !pr.is_open() {
        return ctx.redirect('/${username}/${repo_name}/pull/${id}')
    }
    app.set_pr_status(pr.id, .closed) or {
        ctx.error('Could not close PR')
        return ctx.redirect('/${username}/${repo_name}/pull/${id}')
    }
    app.decrement_repo_open_prs(repo.id) or {}
    return ctx.redirect('/${username}/${repo_name}/pull/${id}')
}

// POST /:username/:repo_name/pull/:id/reopen
@['/:username/:repo_name/pull/:id/reopen'; post]
pub fn (mut app App) handle_reopen_pr(mut ctx Context, username string, repo_name string, id string) veb.Result {
    if !ctx.logged_in {
        return ctx.redirect_to_login()
    }
    repo := app.find_repo_by_name_and_username(repo_name, username) or { return ctx.not_found() }
    pr := app.find_pull_request_by_id(id.int()) or { return ctx.not_found() }
    if pr.repo_id != repo.id {
        return ctx.not_found()
    }
    can_reopen := repo.user_id == ctx.user.id || pr.author_id == ctx.user.id
    if !can_reopen {
        return ctx.redirect('/${username}/${repo_name}/pull/${id}')
    }
    if !pr.is_closed() {
        return ctx.redirect('/${username}/${repo_name}/pull/${id}')
    }
    if !app.contains_repo_branch(repo.id, pr.head_branch)
        || !app.contains_repo_branch(repo.id, pr.base_branch) {
        ctx.error('Cannot reopen: head or base branch is missing')
        return ctx.redirect('/${username}/${repo_name}/pull/${id}')
    }
    app.set_pr_status(pr.id, .open) or {
        ctx.error('Could not reopen PR')
        return ctx.redirect('/${username}/${repo_name}/pull/${id}')
    }
    app.increment_repo_open_prs(repo.id) or {}
    return ctx.redirect('/${username}/${repo_name}/pull/${id}')
}

// POST /:username/:repo_name/pull/:id/merge
@['/:username/:repo_name/pull/:id/merge'; post]
pub fn (mut app App) handle_merge_pr(mut ctx Context, username string, repo_name string, id string) veb.Result {
    if !ctx.logged_in {
        return ctx.redirect_to_login()
    }
    mut repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.not_found()
    }
    pr := app.find_pull_request_by_id(id.int()) or { return ctx.not_found() }
    if pr.repo_id != repo.id {
        return ctx.not_found()
    }
    if repo.user_id != ctx.user.id {
        return ctx.redirect('/${username}/${repo_name}/pull/${id}')
    }
    if !pr.is_open() {
        return ctx.redirect('/${username}/${repo_name}/pull/${id}')
    }
    merge_message := 'Merge pull request #${pr.id} from ${pr.head_branch}\n\n${pr.title}'
    merge_hash := merge_branches_in_bare(repo, pr.base_branch, pr.head_branch, ctx.user.username,
        merge_message) or {
        ctx.error('Merge failed: ${err}')
        return ctx.redirect('/${username}/${repo_name}/pull/${id}')
    }
    app.set_pr_merged(pr.id, merge_hash) or {
        ctx.error('Merged but failed to update PR record')
        return ctx.redirect('/${username}/${repo_name}/pull/${id}')
    }
    app.decrement_repo_open_prs(repo.id) or {}
    app.delete_repository_files_in_branch(repo.id, pr.base_branch) or {}
    app.update_repo_after_push(repo.id, pr.base_branch) or {
        app.warn('Failed to update repo after merge: ${err}')
    }
    return ctx.redirect('/${username}/${repo_name}/pull/${id}')
}

// User-scoped PR list
@['/:username/pulls']
pub fn (mut app App) handle_get_user_pulls(mut ctx Context, username string) veb.Result {
    if !ctx.logged_in {
        return ctx.not_found()
    }
    exists, user := app.check_username(username)
    if !exists {
        return ctx.not_found()
    }
    mut prs := app.find_user_pull_requests(user.id)
    mut prs_with_repo := []PullRequest{}
    for mut pr in prs {
        r := app.find_repo_by_id(pr.repo_id) or { continue }
        pr.repo_author = r.user_name
        pr.repo_name = r.name
        prs_with_repo << pr
    }
    return $veb.html('templates/user_pulls.html')
}

// --- git helpers ---

// list_commits_between returns commits in head not in base.
fn (r Repo) list_commits_between(base string, head string) []Commit {
    if base == '' || head == '' {
        return []Commit{}
    }
    if !is_safe_ref(base) || !is_safe_ref(head) {
        return []Commit{}
    }
    out :=
        r.git('log ${base}..${head} --pretty=format:%h${log_field_separator}%aE${log_field_separator}%cD${log_field_separator}%s${log_field_separator}%aN')
    mut commits := []Commit{}
    for line in out.split_into_lines() {
        args := line.split(log_field_separator)
        if args.len < 5 {
            continue
        }
        date := time.parse_rfc2822(args[2]) or { time.now() }
        commits << Commit{
            hash:       args[0]
            author:     args[4]
            message:    args[3]
            created_at: int(date.unix())
            author_id:  0
        }
    }
    return commits
}

// diff_branches returns the unified diff between base and head.
fn (r Repo) diff_branches(base string, head string) string {
    if base == '' || head == '' {
        return ''
    }
    if !is_safe_ref(base) || !is_safe_ref(head) {
        return ''
    }
    return r.git('diff --no-color ${base}...${head}')
}

// merge_branches_in_bare performs a merge inside a bare repo using
// git merge-tree to compute the resulting tree, then commit-tree
// and update-ref to advance the base branch. Returns the merge commit hash.
fn merge_branches_in_bare(repo Repo, base string, head string, author string, message string) !string {
    if !is_safe_ref(base) || !is_safe_ref(head) {
        return error('invalid branch name')
    }
    git_dir := repo.git_dir
    base_sha := sh('git -C ${git_dir} rev-parse ${base}')
    head_sha := sh('git -C ${git_dir} rev-parse ${head}')
    if base_sha == '' || head_sha == '' {
        return error('branch refs missing')
    }
    // Try fast-forward first: if base is an ancestor of head, fast-forward.
    is_ancestor_result :=
        git.Git.exec_shell('git -C ${git_dir} merge-base --is-ancestor ${base_sha} ${head_sha}')
    if is_ancestor_result.exit_code == 0 {
        r := git.Git.exec_in_dir(git_dir, ['update-ref', 'refs/heads/${base}', head_sha])
        if r.exit_code != 0 {
            return error('fast-forward update-ref failed: ${r.output}')
        }
        return head_sha
    }
    // Use modern merge-tree --write-tree (Git >= 2.38).
    merge_result :=
        git.Git.exec_shell('git -C ${git_dir} merge-tree --write-tree ${base_sha} ${head_sha}')
    if merge_result.exit_code != 0 {
        return error('merge conflict — cannot auto-merge:\n${merge_result.output}')
    }
    tree_sha := merge_result.output.trim_space().split_into_lines().first()
    if tree_sha == '' {
        return error('failed to compute merge tree')
    }
    commit_sh := 'GIT_AUTHOR_NAME="${author}" GIT_AUTHOR_EMAIL="${author}@gitly" GIT_COMMITTER_NAME="${author}" GIT_COMMITTER_EMAIL="${author}@gitly" git -C ${git_dir} commit-tree ${tree_sha} -p ${base_sha} -p ${head_sha} -m "${shell_escape(message)}"'
    cr := git.Git.exec_shell(commit_sh)
    if cr.exit_code != 0 {
        return error('commit-tree failed: ${cr.output}')
    }
    commit_sha := cr.output.trim_space()
    ur := git.Git.exec_in_dir(git_dir, ['update-ref', 'refs/heads/${base}', commit_sha])
    if ur.exit_code != 0 {
        return error('update-ref failed: ${ur.output}')
    }
    return commit_sha
}

// render_inline_comments returns the HTML rows for any line comments
// attached to a given diff line (matched on file_path, side, line_number).
fn render_inline_comments(file_path string, dline DiffLine, comments_by_key map[string][]PrReviewCommentWithUser) veb.RawHtml {
    mut side := ''
    mut line_no := 0
    if dline.kind == 'add' {
        side = 'new'
        line_no = dline.new_line
    } else if dline.kind == 'del' {
        side = 'old'
        line_no = dline.old_line
    } else {
        return veb.RawHtml('')
    }
    key := '${file_path}|${side}|${line_no}'
    list := comments_by_key[key] or { return veb.RawHtml('') }
    if list.len == 0 {
        return veb.RawHtml('')
    }
    mut out := ''
    for c in list {
        body := html_escape_text(c.item.text)
        username := html_escape_text(c.user.username)
        rel := html_escape_text(c.item.relative())
        out += '<tr class="pr-diff__inline-comment"><td colspan="4">' +
            '<div class="pr-inline-comment">' +
            '<strong>${username}</strong> <span class="pr-inline-comment__meta">commented ${rel}</span>' +
            '<p>${body}</p>' + '</div></td></tr>'
    }
    return veb.RawHtml(out)
}

// is_safe_ref does a strict whitelist check for branch names used in shell.
fn is_safe_ref(name string) bool {
    if name == '' {
        return false
    }
    for ch in name {
        if !(ch.is_letter() || ch.is_digit() || ch in [`-`, `_`, `.`, `/`]) {
            return false
        }
    }
    if name.starts_with('-') || name.contains('..') {
        return false
    }
    return true
}

fn shell_escape(s string) string {
    mut out := ''
    backtick := u8(0x60)
    for ch in s {
        if ch == `"` || ch == `\\` || ch == `$` || ch == backtick {
            out += '\\'
        }
        out += ch.ascii_str()
    }
    return out
}