/**
 * Docker 沙箱实现
 *
 * 使用 Docker 容器提供隔离的执行环境
 *
 * @version 1.0.0
 * @updated 2026-03-22
 */

import { exec, spawn } from "child_process";
import { promisify } from "util";
import * as path from "path";
import * as fs from "fs/promises";
import * as os from "os";
import log from "electron-log";
import { SandboxManager } from "./SandboxManager";
import type {
  SandboxConfig,
  Workspace,
  ExecuteOptions,
  ExecuteResult,
  FileInfo,
  SandboxStatus,
  CleanupResult,
  ContainerInfo,
} from "@shared/types/sandbox";
import {
  SandboxError,
  SandboxErrorCode,
  ExecutionError,
  FileOperationError,
  WorkspaceError,
  toSandboxError,
} from "@shared/errors/sandbox";

const execAsync = promisify(exec);

/**
 * Docker 沙箱配置
 */
export interface DockerSandboxConfig extends SandboxConfig {
  /** Docker 镜像名称 */
  dockerImage: string;
  /** Docker Host 地址（可选） */
  dockerHost?: string;
}

/**
 * Docker 沙箱实现
 */
export class DockerSandbox extends SandboxManager {
  private containerIds: Map<string, string> = new Map();
  private dockerConfig: DockerSandboxConfig;
  private dockerAvailable: boolean = false;
  private dockerVersion: string | null = null;

  constructor(config: DockerSandboxConfig) {
    super(config);
    this.dockerConfig = config;

    // 验证配置
    if (config.type !== "docker") {
      throw new SandboxError(
        'DockerSandbox requires type to be "docker"',
        SandboxErrorCode.CONFIG_INVALID,
      );
    }
  }

  // ============================================================================
  // 初始化与可用性检查
  // ============================================================================

  async init(): Promise<void> {
    log.info("[DockerSandbox] Initializing Docker sandbox...");
    log.debug("[DockerSandbox] config:", {
      type: this.config.type,
      platform: this.config.platform,
      enabled: this.config.enabled,
      workspaceRoot: this.config.workspaceRoot,
      memoryLimit: this.config.memoryLimit,
      cpuLimit: this.config.cpuLimit,
      networkEnabled: this.config.networkEnabled,
      dockerImage: this.dockerConfig.dockerImage,
      dockerHost: this.dockerConfig.dockerHost,
    });

    try {
      // 检查 Docker 是否可用
      this.dockerAvailable = await this.checkDockerAvailable();

      if (!this.dockerAvailable) {
        throw new SandboxError(
          "Docker is not available; ensure Docker Desktop is installed and running",
          SandboxErrorCode.DOCKER_UNAVAILABLE,
        );
      }

      // 拉取镜像（如果需要）
      await this.ensureImageExists();

      this.initialized = true;
      log.info("[DockerSandbox] Initialization complete");
    } catch (error) {
      log.error("[DockerSandbox] Initialization failed:", error);
      throw toSandboxError(
        error,
        "Docker sandbox initialization failed",
        SandboxErrorCode.SANDBOX_UNAVAILABLE,
      );
    }
  }

  async isAvailable(): Promise<boolean> {
    if (!this.dockerAvailable) {
      this.dockerAvailable = await this.checkDockerAvailable();
    }
    return this.dockerAvailable;
  }

  /**
   * 检查 Docker 是否可用
   */
  private async checkDockerAvailable(): Promise<boolean> {
    try {
      const { stdout: versionOut } = await execAsync("docker --version", {
        timeout: 5000,
      });

      // 提取版本号
      const match = versionOut.match(/Docker version ([\d.]+)/);
      this.dockerVersion = match ? match[1] : versionOut.trim();
      log.debug("[DockerSandbox] docker --version:", versionOut.trim());

      // 检查 Docker daemon 是否运行
      const { stdout: infoOut } = await execAsync("docker info", {
        timeout: 5000,
      });
      log.debug(
        "[DockerSandbox] docker info (first 500 chars):",
        infoOut.slice(0, 500),
      );

      log.info(
        "[DockerSandbox] Docker available, version:",
        this.dockerVersion,
      );
      return true;
    } catch (error) {
      log.warn("[DockerSandbox] Docker unavailable:", error);
      return false;
    }
  }

  /**
   * 验证 Docker 镜像名称
   * 只允许字母、数字、冒号、斜杠、点、下划线和连字符
   */
  private validateImageName(image: string): void {
    if (!/^[a-zA-Z0-9_/.:-]+$/.test(image)) {
      throw new SandboxError(
        `Invalid Docker image name: ${image}`,
        SandboxErrorCode.CONFIG_INVALID,
      );
    }
  }

  /**
   * 验证容器 ID
   * 只允许字母、数字和连字符
   */
  private validateContainerId(containerId: string): void {
    if (!/^[a-zA-Z0-9-]+$/.test(containerId)) {
      throw new SandboxError(
        `Invalid container ID: ${containerId}`,
        SandboxErrorCode.CONTAINER_OPERATION_FAILED,
      );
    }
  }

  /**
   * 确保镜像存在
   */
  private async ensureImageExists(): Promise<void> {
    const image = this.dockerConfig.dockerImage;
    this.validateImageName(image);

    try {
      // 检查镜像是否存在
      await execAsync(`docker image inspect ${image}`, { timeout: 10000 });
      log.info("[DockerSandbox] Image already exists:", image);
    } catch {
      // 镜像不存在，尝试拉取
      log.info("[DockerSandbox] Pulling image:", image);
      await execAsync(`docker pull ${image}`, { timeout: 300000 }); // 5 分钟超时
      log.info("[DockerSandbox] Image pull complete:", image);
    }
  }

  // ============================================================================
  // 工作区管理
  // ============================================================================

  async createWorkspace(sessionId: string): Promise<Workspace> {
    log.info("[DockerSandbox] Creating workspace:", sessionId);

    // 检查是否已存在
    if (this.workspaces.has(sessionId)) {
      throw new WorkspaceError(
        `Workspace already exists: ${sessionId}`,
        SandboxErrorCode.WORKSPACE_EXISTS,
        { sessionId },
      );
    }

    const workspaceId = this.generateWorkspaceId(sessionId);
    const workspaceRoot = path.join(this.config.workspaceRoot, workspaceId);

    try {
      // 创建工作区目录
      await this.createWorkspaceDirectories(workspaceRoot);

      // 启动 Docker 容器
      const containerId = await this.startContainer(sessionId, workspaceRoot);
      this.containerIds.set(sessionId, containerId);

      // 创建工作区对象
      const workspace: Workspace = {
        id: workspaceId,
        sessionId,
        rootPath: workspaceRoot,
        projectsPath: path.join(workspaceRoot, "projects"),
        nodeModulesPath: path.join(workspaceRoot, "node_modules"),
        pythonEnvPath: path.join(workspaceRoot, "python-env"),
        binPath: path.join(workspaceRoot, "bin"),
        cachePath: path.join(workspaceRoot, "cache"),
        sandboxConfig: this.config,
        createdAt: new Date(),
        lastAccessedAt: new Date(),
        retentionPolicy: this.createDefaultRetentionPolicy(),
        status: "active",
      };

      this.workspaces.set(sessionId, workspace);

      // 发出事件
      this.emitEvent("workspace:created", { workspace });

      log.info(
        "[DockerSandbox] Workspace created:",
        sessionId,
        "container:",
        containerId,
      );
      return workspace;
    } catch (error) {
      // 清理已创建的资源
      await this.cleanupFailedWorkspace(sessionId, workspaceRoot);

      throw toSandboxError(
        error,
        "Failed to create workspace",
        SandboxErrorCode.WORKSPACE_CREATE_FAILED,
        {
          sessionId,
        },
      );
    }
  }

  async destroyWorkspace(sessionId: string): Promise<void> {
    log.info("[DockerSandbox] Destroying workspace:", sessionId);

    const workspace = this.validateWorkspaceExists(sessionId);

    try {
      workspace.status = "destroying";

      // 停止并删除容器
      const containerId = this.containerIds.get(sessionId);
      if (containerId) {
        await this.stopContainer(containerId);
        this.containerIds.delete(sessionId);
      }

      // 删除工作区目录（根据保留策略）
      if (workspace.retentionPolicy.mode !== "always") {
        await this.deleteWorkspaceDirectory(workspace.rootPath);
      }

      // 从映射中移除
      this.workspaces.delete(sessionId);

      // 发出事件
      this.emitEvent("workspace:destroyed", {
        workspaceId: workspace.id,
        sessionId,
      });

      log.info("[DockerSandbox] Workspace destruction complete:", sessionId);
    } catch (error) {
      workspace.status = "error";
      throw toSandboxError(
        error,
        "Failed to destroy workspace",
        SandboxErrorCode.WORKSPACE_DESTROY_FAILED,
        {
          sessionId,
          workspaceId: workspace.id,
        },
      );
    }
  }

  // ============================================================================
  // 命令执行
  // ============================================================================

  async execute(
    sessionId: string,
    command: string,
    args: string[] = [],
    options: ExecuteOptions = {},
  ): Promise<ExecuteResult> {
    const workspace = this.validateWorkspaceExists(sessionId);
    this.updateLastAccessed(sessionId);

    const containerId = this.containerIds.get(sessionId);
    if (!containerId) {
      throw new ExecutionError(
        "Container is not running",
        SandboxErrorCode.CONTAINER_OPERATION_FAILED,
        {
          sessionId,
        },
      );
    }

    const startTime = Date.now();
    const timeout = options.timeout || 300000; // 默认 5 分钟

    log.info(
      "[DockerSandbox] Executing command:",
      sessionId,
      command,
      args.join(" "),
    );
    log.debug("[DockerSandbox] execute detail:", {
      sessionId,
      command,
      args,
      timeout,
      cwd: options.cwd,
      envKeys: options.env ? Object.keys(options.env) : [],
    });

    // 发出执行开始事件
    this.emitEvent("execute:start", { sessionId, command, args });

    try {
      // 构建 docker exec 命令
      const dockerArgs = this.buildDockerExecArgs(
        containerId,
        command,
        args,
        options,
      );

      const result = await this.executeDockerCommand(dockerArgs, timeout);

      const executeResult: ExecuteResult = {
        stdout: result.stdout,
        stderr: result.stderr,
        exitCode: result.exitCode,
        timedOut: result.timedOut,
        duration: Date.now() - startTime,
        command,
        args,
      };

      // 发出执行完成事件
      this.emitEvent("execute:complete", { sessionId, result: executeResult });

      return executeResult;
    } catch (error) {
      const executeResult: ExecuteResult = {
        stdout: "",
        stderr: error instanceof Error ? error.message : String(error),
        exitCode: 1,
        timedOut: false,
        duration: Date.now() - startTime,
        command,
        args,
      };

      this.emitEvent("execute:error", {
        sessionId,
        error: error instanceof Error ? error.message : String(error),
        command,
      });

      throw toSandboxError(
        error,
        "Command execution failed",
        SandboxErrorCode.EXECUTION_FAILED,
        {
          sessionId,
        },
      );
    }
  }

  // ============================================================================
  // 文件操作
  // ============================================================================

  async readFile(sessionId: string, filePath: string): Promise<string> {
    const workspace = this.validateWorkspaceExists(sessionId);
    this.validatePathInWorkspace(workspace, filePath);

    try {
      // 直接从主机文件系统读取（因为目录已挂载）
      const content = await fs.readFile(filePath, "utf-8");
      this.updateLastAccessed(sessionId);
      return content;
    } catch (error) {
      if ((error as NodeJS.ErrnoException).code === "ENOENT") {
        throw new FileOperationError(
          `File not found: ${filePath}`,
          SandboxErrorCode.FILE_NOT_FOUND,
          {
            sessionId,
            cause: error as Error,
          },
        );
      }
      throw new FileOperationError(
        `File read failed: ${filePath}`,
        SandboxErrorCode.FILE_READ_FAILED,
        {
          sessionId,
          cause: error as Error,
        },
      );
    }
  }

  async writeFile(
    sessionId: string,
    filePath: string,
    content: string,
  ): Promise<void> {
    const workspace = this.validateWorkspaceExists(sessionId);
    this.validatePathInWorkspace(workspace, filePath);

    try {
      // 确保目录存在
      const dir = path.dirname(filePath);
      await fs.mkdir(dir, { recursive: true });

      // 写入文件
      await fs.writeFile(filePath, content, "utf-8");
      this.updateLastAccessed(sessionId);
    } catch (error) {
      throw new FileOperationError(
        `File write failed: ${filePath}`,
        SandboxErrorCode.FILE_WRITE_FAILED,
        { sessionId, cause: error as Error },
      );
    }
  }

  async readDir(sessionId: string, dirPath: string): Promise<FileInfo[]> {
    const workspace = this.validateWorkspaceExists(sessionId);
    this.validatePathInWorkspace(workspace, dirPath);

    try {
      const entries = await fs.readdir(dirPath, { withFileTypes: true });
      const fileInfos: FileInfo[] = [];

      for (const entry of entries) {
        const fullPath = path.join(dirPath, entry.name);
        const stats = await fs.stat(fullPath);

        fileInfos.push({
          name: entry.name,
          path: fullPath,
          isDirectory: entry.isDirectory(),
          size: stats.size,
          modifiedAt: stats.mtime,
        });
      }

      this.updateLastAccessed(sessionId);
      return fileInfos;
    } catch (error) {
      if ((error as NodeJS.ErrnoException).code === "ENOENT") {
        throw new FileOperationError(
          `Directory not found: ${dirPath}`,
          SandboxErrorCode.FILE_NOT_FOUND,
          { sessionId, cause: error as Error },
        );
      }
      throw new FileOperationError(
        `Directory read failed: ${dirPath}`,
        SandboxErrorCode.DIRECTORY_OPERATION_FAILED,
        { sessionId, cause: error as Error },
      );
    }
  }

  async deleteFile(sessionId: string, filePath: string): Promise<void> {
    const workspace = this.validateWorkspaceExists(sessionId);
    this.validatePathInWorkspace(workspace, filePath);

    try {
      await fs.unlink(filePath);
      this.updateLastAccessed(sessionId);
    } catch (error) {
      if ((error as NodeJS.ErrnoException).code === "ENOENT") {
        throw new FileOperationError(
          `File not found: ${filePath}`,
          SandboxErrorCode.FILE_NOT_FOUND,
          {
            sessionId,
            cause: error as Error,
          },
        );
      }
      throw new FileOperationError(
        `File delete failed: ${filePath}`,
        SandboxErrorCode.FILE_DELETE_FAILED,
        { sessionId, cause: error as Error },
      );
    }
  }

  // ============================================================================
  // 清理
  // ============================================================================

  async cleanup(): Promise<CleanupResult> {
    log.info("[DockerSandbox] Starting cleanup...");

    const result: CleanupResult = {
      deletedCount: 0,
      freedSpace: 0,
      errors: [],
    };

    // 停止所有容器
    for (const [sessionId, containerId] of this.containerIds) {
      try {
        await this.stopContainer(containerId);
        result.deletedCount++;
      } catch (error) {
        result.errors.push(`Failed to stop container ${sessionId}: ${error}`);
      }
    }

    this.containerIds.clear();

    // 清理工作区目录
    for (const [sessionId, workspace] of this.workspaces) {
      try {
        if (workspace.retentionPolicy.mode !== "always") {
          const size = await this.getDirectorySize(workspace.rootPath);
          await this.deleteWorkspaceDirectory(workspace.rootPath);
          result.freedSpace += size;
        }
      } catch (error) {
        result.errors.push(`Failed to clean workspace ${sessionId}: ${error}`);
      }
    }

    this.workspaces.clear();

    log.info("[DockerSandbox] Cleanup complete:", result);
    this.emitEvent("cleanup:complete", { result });

    return result;
  }

  // ============================================================================
  // Docker 特有方法
  // ============================================================================

  /**
   * 列出所有容器
   */
  async listContainers(): Promise<ContainerInfo[]> {
    try {
      const { stdout } = await execAsync(
        'docker ps -a --filter "name=qiming-sandbox-" --format "{{.ID}}\t{{.Names}}\t{{.Image}}\t{{.Status}}\t{{.CreatedAt}}"',
      );

      const lines = stdout.trim().split("\n").filter(Boolean);
      const containers: ContainerInfo[] = [];

      for (const line of lines) {
        const [id, name, image, status, createdAt] = line.split("\t");

        // 从容器名称中提取 sessionId
        const sessionMatch = name.match(/qiming-sandbox-(.+)/);
        const sessionId = sessionMatch ? sessionMatch[1] : undefined;

        containers.push({
          id,
          name,
          image,
          status: this.parseDockerStatus(status),
          sessionId,
          createdAt: new Date(createdAt),
        });
      }

      return containers;
    } catch (error) {
      log.error("[DockerSandbox] Failed to list containers:", error);
      return [];
    }
  }

  /**
   * 获取容器日志
   */
  async getContainerLogs(sessionId: string): Promise<string> {
    const containerId = this.containerIds.get(sessionId);
    if (!containerId) {
      throw new SandboxError(
        "Container not found",
        SandboxErrorCode.CONTAINER_OPERATION_FAILED,
        {
          sessionId,
        },
      );
    }

    this.validateContainerId(containerId);

    try {
      const { stdout } = await execAsync(`docker logs ${containerId}`, {
        timeout: 10000,
      });
      return stdout;
    } catch (error) {
      log.error("[DockerSandbox] Failed to get container logs:", error);
      return "";
    }
  }

  /**
   * 获取沙箱状态（包含 Docker 信息）
   */
  async getStatus(): Promise<SandboxStatus> {
    const baseStatus = await super.getStatus();

    return {
      ...baseStatus,
      docker: {
        running: this.dockerAvailable,
        containerCount: this.containerIds.size,
        version: this.dockerVersion || undefined,
      },
    };
  }

  // ============================================================================
  // 私有方法
  // ============================================================================

  /**
   * 创建工作区目录结构
   */
  private async createWorkspaceDirectories(
    workspaceRoot: string,
  ): Promise<void> {
    const directories = [
      workspaceRoot,
      path.join(workspaceRoot, "projects"),
      path.join(workspaceRoot, "node_modules"),
      path.join(workspaceRoot, "python-env"),
      path.join(workspaceRoot, "bin"),
      path.join(workspaceRoot, "cache"),
    ];

    for (const dir of directories) {
      await fs.mkdir(dir, { recursive: true });
    }
  }

  /**
   * 启动 Docker 容器
   */
  private async startContainer(
    sessionId: string,
    workspaceRoot: string,
  ): Promise<string> {
    const containerName = `qiming-sandbox-${sessionId}`;
    const image = this.dockerConfig.dockerImage;

    // 构建容器参数
    const args = [
      "run",
      "-d",
      "--name",
      containerName,
      // 挂载工作区
      "-v",
      `${workspaceRoot}:/workspace`,
      // 内存限制
      "--memory",
      this.config.memoryLimit || "2g",
      // CPU 限制
      "--cpus",
      String(this.config.cpuLimit || 2),
      // 禁用网络（如果配置）
      ...(this.config.networkEnabled === false ? ["--network", "none"] : []),
      // 工作目录
      "-w",
      "/workspace",
      // 环境变量
      "-e",
      "HOME=/workspace",
      "-e",
      "PATH=/usr/local/bin:/usr/bin:/bin:/workspace/bin",
      // 镜像
      image,
      // 保持容器运行
      "tail",
      "-f",
      "/dev/null",
    ];

    log.debug("[DockerSandbox] startContainer args:", args.join(" "));

    const { stdout } = await execAsync(`docker ${args.join(" ")}`, {
      timeout: 60000,
    });
    const containerId = stdout.trim();

    log.info(
      "[DockerSandbox] Container started:",
      containerId,
      "name:",
      containerName,
    );
    return containerId;
  }

  /**
   * 停止并删除容器
   */
  private async stopContainer(containerId: string): Promise<void> {
    this.validateContainerId(containerId);

    try {
      await execAsync(`docker stop ${containerId}`, { timeout: 30000 });
      await execAsync(`docker rm ${containerId}`, { timeout: 30000 });
      log.info("[DockerSandbox] Container stopped and removed:", containerId);
    } catch (error) {
      log.error("[DockerSandbox] Failed to stop container:", error);
      throw error;
    }
  }

  /**
   * 构建 docker exec 参数
   */
  private buildDockerExecArgs(
    containerId: string,
    command: string,
    args: string[],
    options: ExecuteOptions,
  ): string[] {
    const dockerArgs = ["exec"];

    // 工作目录
    if (options.cwd) {
      dockerArgs.push("-w", options.cwd);
    }

    // 环境变量
    if (options.env) {
      for (const [key, value] of Object.entries(options.env)) {
        dockerArgs.push("-e", `${key}=${value}`);
      }
    }

    // 执行命令
    dockerArgs.push(containerId, command, ...args);

    log.debug("[DockerSandbox] docker exec args:", dockerArgs.join(" "));
    return dockerArgs;
  }

  /**
   * 执行 Docker 命令
   */
  private async executeDockerCommand(
    dockerArgs: string[],
    timeout: number,
  ): Promise<{
    stdout: string;
    stderr: string;
    exitCode: number;
    timedOut: boolean;
  }> {
    return new Promise((resolve, reject) => {
      const proc = spawn("docker", dockerArgs, { shell: false });

      let stdout = "";
      let stderr = "";
      let timedOut = false;

      proc.stdout?.on("data", (data) => {
        stdout += data.toString();
      });

      proc.stderr?.on("data", (data) => {
        stderr += data.toString();
      });

      // 超时处理
      const timer = setTimeout(() => {
        timedOut = true;
        proc.kill("SIGKILL");
      }, timeout);

      proc.on("close", (code) => {
        clearTimeout(timer);
        log.debug("[DockerSandbox] docker exec completed:", {
          exitCode: code,
          timedOut,
          stdoutLen: stdout.length,
          stderrLen: stderr.length,
          stderrPreview: stderr.slice(0, 200),
        });
        resolve({
          stdout,
          stderr,
          exitCode: code ?? (timedOut ? 137 : 1),
          timedOut,
        });
      });

      proc.on("error", (error) => {
        clearTimeout(timer);
        log.debug("[DockerSandbox] docker exec error:", error.message);
        reject(error);
      });
    });
  }

  /**
   * 解析 Docker 状态字符串
   */
  private parseDockerStatus(
    status: string,
  ): "running" | "exited" | "paused" | "created" {
    if (status.includes("Up")) return "running";
    if (status.includes("Exited")) return "exited";
    if (status.includes("Paused")) return "paused";
    return "created";
  }

  /**
   * 获取目录大小
   */
  private async getDirectorySize(dirPath: string): Promise<number> {
    try {
      let totalSize = 0;
      const entries = await fs.readdir(dirPath, { withFileTypes: true });

      for (const entry of entries) {
        const fullPath = path.join(dirPath, entry.name);
        if (entry.isDirectory()) {
          totalSize += await this.getDirectorySize(fullPath);
        } else {
          const stats = await fs.stat(fullPath);
          totalSize += stats.size;
        }
      }

      return totalSize;
    } catch {
      return 0;
    }
  }

  /**
   * 删除工作区目录
   */
  private async deleteWorkspaceDirectory(dirPath: string): Promise<void> {
    try {
      await fs.rm(dirPath, { recursive: true, force: true });
    } catch (error) {
      log.error("[DockerSandbox] Failed to delete directory:", dirPath, error);
      throw error;
    }
  }

  /**
   * 清理失败的工作区
   */
  private async cleanupFailedWorkspace(
    sessionId: string,
    workspaceRoot: string,
  ): Promise<void> {
    try {
      // 停止可能已创建的容器
      const containerId = this.containerIds.get(sessionId);
      if (containerId) {
        await this.stopContainer(containerId);
        this.containerIds.delete(sessionId);
      }

      // 删除目录
      await this.deleteWorkspaceDirectory(workspaceRoot);
    } catch (error) {
      log.error("[DockerSandbox] Error cleaning failed workspace:", error);
    }
  }
}

export default DockerSandbox;