//! SSH banner check — TCP connect and verify SSH protocol banner.

use std::time::{Duration, Instant};

use tokio::io::AsyncReadExt;
use tokio::net::TcpStream;

use crate::config::SshBannerConfig;
use crate::types::{HealthSnapshot, HealthStatus};

/// Connect to an SSH server and verify the banner starts with "SSH-".
#[tracing::instrument(skip_all)]
pub async fn check_ssh_banner(target_name: &str, config: &SshBannerConfig) -> HealthSnapshot {
    let addr = format!("{}:{}", config.host, config.port);
    let timeout = Duration::from_secs(config.timeout_secs);
    let checked_at = chrono::Utc::now().to_rfc3339();
    let start = Instant::now();

    let stream = match tokio::time::timeout(timeout, TcpStream::connect(&addr)).await {
        Ok(Ok(stream)) => stream,
        Ok(Err(e)) => {
            return HealthSnapshot {
                id: None,
                target: target_name.to_string(),
                status: HealthStatus::Unreachable,
                checked_at,
                response_time_ms: start.elapsed().as_millis() as i64,
                details: None,
                error: Some(format!("TCP connect to {addr} failed: {e}")),
            };
        }
        Err(_) => {
            return HealthSnapshot {
                id: None,
                target: target_name.to_string(),
                status: HealthStatus::Unreachable,
                checked_at,
                response_time_ms: start.elapsed().as_millis() as i64,
                details: None,
                error: Some(format!("TCP connect to {addr} timed out after {timeout:?}")),
            };
        }
    };

    let mut buf = [0u8; 256];
    let mut stream = stream;
    match tokio::time::timeout(Duration::from_secs(5), stream.read(&mut buf)).await {
        Ok(Ok(n)) if n > 0 => {
            let banner = String::from_utf8_lossy(&buf[..n]);
            let banner = banner.trim().to_string();
            let response_time_ms = start.elapsed().as_millis() as i64;

            if banner.starts_with("SSH-") {
                HealthSnapshot {
                    id: None,
                    target: target_name.to_string(),
                    status: HealthStatus::Operational,
                    checked_at,
                    response_time_ms,
                    details: None,
                    error: None,
                }
            } else {
                HealthSnapshot {
                    id: None,
                    target: target_name.to_string(),
                    status: HealthStatus::Degraded,
                    checked_at,
                    response_time_ms,
                    details: None,
                    error: Some(format!("unexpected banner: {banner}")),
                }
            }
        }
        Ok(Ok(_)) => HealthSnapshot {
            id: None,
            target: target_name.to_string(),
            status: HealthStatus::Degraded,
            checked_at,
            response_time_ms: start.elapsed().as_millis() as i64,
            details: None,
            error: Some("empty response".to_string()),
        },
        Ok(Err(e)) => HealthSnapshot {
            id: None,
            target: target_name.to_string(),
            status: HealthStatus::Degraded,
            checked_at,
            response_time_ms: start.elapsed().as_millis() as i64,
            details: None,
            error: Some(format!("banner read failed: {e}")),
        },
        Err(_) => HealthSnapshot {
            id: None,
            target: target_name.to_string(),
            status: HealthStatus::Degraded,
            checked_at,
            response_time_ms: start.elapsed().as_millis() as i64,
            details: None,
            error: Some("banner read timed out".to_string()),
        },
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use tokio::io::AsyncWriteExt;
    use tokio::net::TcpListener;

    #[tokio::test]
    async fn ssh_banner_unreachable() {
        let config = SshBannerConfig {
            host: "127.0.0.1".to_string(),
            port: 19999,
            timeout_secs: 1,
        };
        let result = check_ssh_banner("test", &config).await;
        assert_eq!(result.status, HealthStatus::Unreachable);
        assert!(result.error.unwrap().contains("TCP connect"));
    }

    #[tokio::test]
    async fn ssh_banner_valid_operational() {
        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();

        tokio::spawn(async move {
            let (mut stream, _) = listener.accept().await.unwrap();
            stream.write_all(b"SSH-2.0-OpenSSH_9.0\r\n").await.unwrap();
        });

        let config = SshBannerConfig {
            host: "127.0.0.1".to_string(),
            port,
            timeout_secs: 5,
        };
        let result = check_ssh_banner("test", &config).await;
        assert_eq!(result.status, HealthStatus::Operational);
        assert!(result.error.is_none());
    }

    #[tokio::test]
    async fn ssh_banner_unexpected_degraded() {
        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();

        tokio::spawn(async move {
            let (mut stream, _) = listener.accept().await.unwrap();
            stream.write_all(b"HTTP/1.1 200 OK\r\n").await.unwrap();
        });

        let config = SshBannerConfig {
            host: "127.0.0.1".to_string(),
            port,
            timeout_secs: 5,
        };
        let result = check_ssh_banner("test", &config).await;
        assert_eq!(result.status, HealthStatus::Degraded);
        assert!(result.error.unwrap().contains("unexpected banner"));
    }

    #[tokio::test]
    async fn ssh_banner_empty_response() {
        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();

        tokio::spawn(async move {
            let (stream, _) = listener.accept().await.unwrap();
            drop(stream); // close immediately
        });

        let config = SshBannerConfig {
            host: "127.0.0.1".to_string(),
            port,
            timeout_secs: 5,
        };
        let result = check_ssh_banner("test", &config).await;
        assert_eq!(result.status, HealthStatus::Degraded);
        assert!(result.error.unwrap().contains("empty response"));
    }

    // Note: the read-error branch (Ok(Err(e))) is difficult to trigger with
    // a real TCP listener without platform-specific tricks. The 4 tested branches
    // cover all reachable paths in normal operation.
}