// Package api provides the HTTP API server for ExploreDNS.
//
// The server exposes DNS traversal as a REST service with:
//   - POST /api/traverse — start an asynchronous traversal
//   - GET  /api/traverse/{id} — poll traversal status and results
//   - GET  /api/traverse/{id}/stream — Server-Sent Events for live progress
//   - GET  /api/health — health check
//
// Static frontend assets are embedded at compile time and served from /.
// Unknown paths fall back to index.html to support SPA client-side routing.
package api

import (
	"context"
	"embed"
	"fmt"
	"io/fs"
	"log"
	"net"
	"net/http"
	"os"
	"time"
)

//go:embed static
var staticFiles embed.FS

// Server is the HTTP API server.
type Server struct {
	addr   string
	srv    *http.Server
	cancel context.CancelFunc
}

// NewServer creates a new Server that listens on addr (e.g. ":8080").
func NewServer(addr string) *Server {
	return &Server{addr: addr}
}

// Start builds the HTTP handler, begins listening, and returns when the
// server has accepted its first connection or the address is bound.
// Call Shutdown to stop gracefully.
func (s *Server) Start() error {
	ctx, cancel := context.WithCancel(context.Background())
	s.cancel = cancel
	h := newHandler(ctx)

	sub, err := fs.Sub(staticFiles, "static")
	if err != nil {
		return fmt.Errorf("static filesystem: %w", err)
	}
	h.registerStatic(sub)

	s.srv = &http.Server{
		Addr:              s.addr,
		Handler:           corsMiddleware(h.mux),
		ReadHeaderTimeout: 10 * time.Second,
		ReadTimeout:       30 * time.Second,
		WriteTimeout:      0, // SSE streams need no write timeout
		IdleTimeout:       120 * time.Second,
	}

	ln, err := net.Listen("tcp", s.addr)
	if err != nil {
		return fmt.Errorf("listen %s: %w", s.addr, err)
	}
	s.addr = ln.Addr().String()

	go func() {
		if err := s.srv.Serve(ln); err != nil && err != http.ErrServerClosed {
			log.Printf("api server: %v", err)
		}
	}()

	return nil
}

// Addr returns the address the server is listening on. Valid after Start.
func (s *Server) Addr() string {
	return s.addr
}

// Shutdown gracefully stops the server, waiting up to timeout for in-flight
// requests to complete.
func (s *Server) Shutdown(timeout time.Duration) error {
	if s.cancel != nil {
		s.cancel()
	}
	if s.srv == nil {
		return nil
	}
	ctx, cancel := context.WithTimeout(context.Background(), timeout)
	defer cancel()
	return s.srv.Shutdown(ctx)
}

// corsMiddleware adds CORS headers for cross-origin API access. The
// embedded SPA is served same-origin and needs none, so CORS is off
// unless EXPLOREDNS_CORS_ORIGIN names an allowed origin (use "*" to
// restore the old allow-all behaviour for development).
func corsMiddleware(next http.Handler) http.Handler {
	origin := os.Getenv("EXPLOREDNS_CORS_ORIGIN")
	if origin == "" {
		return next
	}
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Access-Control-Allow-Origin", origin)
		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
		w.Header().Set("Access-Control-Allow-Headers", "Content-Type")

		if r.Method == http.MethodOptions {
			w.WriteHeader(http.StatusNoContent)
			return
		}
		next.ServeHTTP(w, r)
	})
}