package cli

import (
	"encoding/json"
	"fmt"
	"strings"

	"github.com/spf13/cobra"

	"gitea.mynodes.xyz/ilker/llmgw/internal/control/adminapi"
)

func newGuardCmd(client func() *ctlClient, asJSON *bool) *cobra.Command {
	c := &cobra.Command{
		Use:   "guard",
		Short: "Guardrail policies: which apply where",
		Long: "Policies are defined in server.yaml under guard.policies — what requests and\n" +
			"answers are checked for (personal data, secrets, prompt injection, patterns,\n" +
			"tools) and what is done: flag, redact or block. guard.default applies to\n" +
			"every request; attach others to an organization, team, project, user or\n" +
			"key, and everything below is judged by them too. Policies narrow: one\n" +
			"attached lower can tighten, never loosen, what applies above it.\n\n" +
			"Targets are written org:Acme, team:Acme/ml, project:Acme/ml/training (or\n" +
			"with IDs), key:KEY-ID or user:USER-ID. An attachment applies at once.",
	}
	c.AddCommand(&cobra.Command{
		Use:   "list",
		Short: "The policies, and where each is attached",
		Args:  cobra.NoArgs,
		RunE: func(cmd *cobra.Command, _ []string) error {
			var v adminapi.GuardView
			if err := client().get(cmd.Context(), "/api/v1/guard", &v); err != nil {
				return err
			}
			if *asJSON {
				return json.NewEncoder(cmd.OutOrStdout()).Encode(v)
			}
			out := cmd.OutOrStdout()
			fmt.Fprintf(out, "Policies: %s\n", strings.Join(v.Policies, ", "))
			def := strings.Join(v.Default, ", ")
			if def == "" {
				def = "none"
			}
			fmt.Fprintf(out, "Applied to every request: %s\n", def)
			if len(v.Attachments) == 0 {
				fmt.Fprintln(out, "Attached nowhere else.")
				return nil
			}
			fmt.Fprintln(out)
			w := tab()
			fmt.Fprintln(w, "SCOPE\tWHO\tPOLICY")
			for _, a := range v.Attachments {
				who := a.ScopeID
				if a.Name != "" {
					who = a.Name + " (" + a.ScopeID + ")"
				}
				fmt.Fprintf(w, "%s\t%s\t%s\n", a.Scope, who, a.Policy)
			}
			return w.Flush()
		},
	})
	for _, verb := range []struct {
		use, short, method, done string
	}{
		{"attach", "Apply a policy to a scope and everything below it", "POST", "attached to"},
		{"detach", "Stop applying a policy to a scope", "DELETE", "detached from"},
	} {
		c.AddCommand(&cobra.Command{
			Use:     verb.use + " TARGET POLICY",
			Short:   verb.short,
			Example: "  llmgw ctl guard " + verb.use + " project:Acme/finance/payroll finance",
			Args:    cobra.ExactArgs(2),
			RunE: func(cmd *cobra.Command, args []string) error {
				body, _ := json.Marshal(map[string]string{"target": args[0], "policy": args[1]})
				if err := client().do(cmd.Context(), verb.method, "/api/v1/guard/attachments", json.RawMessage(body), nil); err != nil {
					return err
				}
				fmt.Fprintf(cmd.OutOrStdout(), "%s %s %s\n", args[1], verb.done, args[0])
				return nil
			},
		})
	}
	return c
}