package api

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
	"scm/model"
	"scm/utils"
)

func CreateCert(w http.ResponseWriter, r *http.Request) {
	if r.Method == "GET" {
		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
		return
	}
	var requestData model.CreateCertRequest
	if err := json.NewDecoder(r.Body).Decode(&requestData); err != nil {
		http.Error(w, "invalid JSON format", http.StatusBadRequest)
		return
	}
	caCert, caKey, err := utils.LoadRootCertAndKey(
		fmt.Sprintf(
			"%s/%s/%s.crt",
			os.Getenv("CERTS_PATH"),
			"root",
			"root",
		),
		fmt.Sprintf(
			"%s/%s/%s.key",
			os.Getenv("CERTS_PATH"),
			"root",
			"root",
		),
		requestData.CAKeyPassword,
	)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		fmt.Println("error loading certificate and key:", err)
		return
	}
	// TODO: Implement create certificate endpoint
	serverKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		fmt.Println("error generating server key:", err)
		return
	}
	serverCert, err := utils.CreateServerCert(caCert, caKey, serverKey, requestData)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		fmt.Println("error creating server certificate:", err)
		return
	}
	err = utils.CheckExistsOrCreateDir(requestData.DNSNames[0])
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	err = utils.SavePEMFile(
		fmt.Sprintf(
			"%s/%s/%s.crt",
			os.Getenv("CERTS_PATH"),
			requestData.DNSNames[0],
			requestData.DNSNames[0],
		),
		"CERTIFICATE",
		serverCert,
	)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		fmt.Println("error saving certificate:", err)
		return
	}
	err = utils.SavePEMFile(
		fmt.Sprintf(
			"%s/%s/%s.key",
			os.Getenv("CERTS_PATH"),
			requestData.DNSNames[0],
			requestData.DNSNames[0],
		),
		"RSA PRIVATE KEY",
		x509.MarshalPKCS1PrivateKey(serverKey),
	)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		fmt.Println("error saving private key:", err)
		return
	}
	fmt.Fprintf(w, "%s", `{"status": "success", "message": "Certificate created successfully"}`)
}

// func createServerCert(
// 	caCert *x509.Certificate,
// 	caKey *rsa.PrivateKey,
// 	serverKey *rsa.PrivateKey,
// 	certdata model.CreateCertificateRequest,
// ) ([]byte, error) {
// 	// Шаблон серверного сертификата
// 	template := x509.Certificate{
// 		SerialNumber: big.NewInt(time.Now().Unix()),
// 		Subject: pkix.Name{
// 			Organization:       certdata.OrganizationName,
// 			CommonName:         certdata.CommonName,
// 			OrganizationalUnit: certdata.OrganizationUnit,
// 		},
// 		NotBefore:   time.Now(),
// 		NotAfter:    time.Now().AddDate(1, 0, 0), // 1 год
// 		KeyUsage:    x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
// 		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
// 		DNSNames:    certdata.DNSNames,
// 	}

// 	// Создаем сертификат, подписанный CA
// 	return x509.CreateCertificate(
// 		rand.Reader,
// 		&template,
// 		caCert,
// 		&serverKey.PublicKey,
// 		caKey,
// 	)
// }