using System.Diagnostics.Eventing.Reader;
using System.Globalization;
using System.Net;
using System.Runtime.Versioning;
using System.Text.RegularExpressions;
using OCSentinelCli.Configuration;

namespace OCSentinelCli;

[SupportedOSPlatform("windows")]
internal sealed class AttackScanner
{
    private static readonly string[] DefaultFtpRoots =
    [
        @"C:\inetpub\logs\LogFiles",
        @"D:\inetpub\logs\LogFiles"
    ];

    private static readonly string[] DefaultFileZillaRoots =
    [
        @"C:\Program Files (x86)\FileZilla Server\Logs",
        @"D:\Program Files (x86)\FileZilla Server\Logs"
    ];

    public ScanResult Run(ScanOptions options)
    {
        DateTimeOffset startedAtUtc = DateTimeOffset.UtcNow;
        ScannerConfiguration configuration = LoadConfiguration(options);
        var attacks = new List<AttackEvent>();
        var errors = new List<string>();
        DateTimeOffset since = DateTimeOffset.Now.AddDays(-options.LookbackDays);

        ScanWindowsLogons(attacks, errors, since);
        ScanSqlLogons(attacks, errors, since);
        ScanExchangeLogons(attacks, errors, since);
        ScanIisFtpLogs(attacks, errors, since, configuration);
        ScanFileZillaLogs(attacks, errors, since, configuration);
        RansomwareBetaSummary ransomwareBeta = RansomwareBetaDetector.Scan(configuration, errors);

        if (configuration.ExcludedIps.Count > 0)
        {
            attacks = attacks
                .Where(attack => !configuration.ExcludedIps.Contains(attack.SourceIp, StringComparer.OrdinalIgnoreCase))
                .ToList();
        }

        attacks.Sort(static (left, right) => left.Timestamp.CompareTo(right.Timestamp));

        List<AggregatedAttack> topSources = attacks
            .GroupBy(static attack => attack.SourceIp)
            .Select(group => AggregatedAttack.FromGroup(group))
            .OrderByDescending(static aggregate => aggregate.Count)
            .ThenBy(static aggregate => aggregate.SourceIp, StringComparer.OrdinalIgnoreCase)
            .Take(options.TopCount)
            .ToList();

        int uniqueIpCount = attacks.Select(static attack => attack.SourceIp).Distinct(StringComparer.OrdinalIgnoreCase).Count();
        AlertAssessment baseAssessment = MergeRansomwareAssessment(AssessAttackActivity(attacks, uniqueIpCount, configuration), ransomwareBeta);
        string baseAlertState = baseAssessment.State;
        string baseAlertReason = baseAssessment.Reason;
        VulnerabilityCorrelationSummary vulnerabilityCorrelation = string.IsNullOrWhiteSpace(options.VulnerabilityCsvPath)
            ? VulnerabilityCorrelationSummary.Empty()
            : VulnerabilityCorrelation.LoadForMachine(Environment.MachineName, options.VulnerabilityCsvPath, errors);
        CorrelationAssessment correlationAssessment = VulnerabilityCorrelation.Assess(baseAlertState, attacks.Count, vulnerabilityCorrelation, configuration);
        DateTimeOffset generatedAtLocal = DateTimeOffset.Now;
        DateTimeOffset generatedAtUtc = DateTimeOffset.UtcNow;

        return new ScanResult
        {
            SchemaVersion = "2.0",
            MachineName = Environment.MachineName,
            NinjaOne = GetNinjaOneContext(options, errors),
            GeneratedAtLocal = generatedAtLocal,
            GeneratedAtUtc = generatedAtUtc,
            ClientVersion = BuildMetadata.Version,
            LookbackDays = options.LookbackDays,
            TotalEvents = attacks.Count,
            UniqueIpCount = uniqueIpCount,
            AlertState = correlationAssessment.FinalAlertState,
            AlertReason = correlationAssessment.CorrelationReason == "No CVE correlation applied." ? baseAlertReason : correlationAssessment.CorrelationReason,
            BaseAlertState = baseAlertState,
            BaseAlertReason = baseAlertReason,
            VulnerabilityCorrelation = vulnerabilityCorrelation,
            RansomwareBeta = ransomwareBeta,
            Runtime = new ScanRuntimeMetadata
            {
                StartedAtUtc = startedAtUtc,
                FinishedAtUtc = generatedAtUtc,
                UploadAttempted = false
            },
            Events = attacks,
            TopSources = topSources,
            Errors = errors
        };
    }

    private static NinjaOneContext GetNinjaOneContext(ScanOptions options, List<string> errors)
    {
        ClientConfiguration? clientConfiguration = null;
        if (!string.IsNullOrWhiteSpace(options.ClientConfigPath))
        {
            try
            {
                clientConfiguration = ClientConfiguration.Load(options.ClientConfigPath);
            }
            catch (Exception exception)
            {
                errors.Add($"Could not load persisted NinjaOne context: {exception.Message}");
            }
        }

        return new NinjaOneContext
        {
            OrganizationId = ReadContextValue("NINJA_ORGANIZATION_ID", clientConfiguration?.NinjaOrganizationId),
            OrganizationName = ReadContextValue("NINJA_ORGANIZATION_NAME", clientConfiguration?.NinjaOrganizationName),
            MachineId = ReadContextValue("NINJA_AGENT_MACHINE_ID", clientConfiguration?.NinjaMachineId),
            NodeId = ReadContextValue("NINJA_AGENT_NODE_ID", clientConfiguration?.NinjaNodeId),
            LocationId = ReadContextValue("NINJA_LOCATION_ID", clientConfiguration?.NinjaLocationId),
            LocationName = ReadContextValue("NINJA_LOCATION_NAME", clientConfiguration?.NinjaLocationName)
        };
    }

    private static string ReadContextValue(string environmentName, string? persistedValue)
    {
        string currentValue = ReadEnvironmentVariable(environmentName);
        return string.IsNullOrWhiteSpace(currentValue) ? persistedValue?.Trim() ?? string.Empty : currentValue;
    }

    private static string ReadEnvironmentVariable(string name)
    {
        return Environment.GetEnvironmentVariable(name)?.Trim() ?? string.Empty;
    }

    private static ScannerConfiguration LoadConfiguration(ScanOptions options)
    {
        if (string.IsNullOrWhiteSpace(options.ConfigPath))
        {
            return new ScannerConfiguration();
        }

        return ScannerConfiguration.Load(options.ConfigPath);
    }

    private static void ScanWindowsLogons(List<AttackEvent> attacks, List<string> errors, DateTimeOffset since)
    {
        const string query = "*[System/EventID=4625]";
        TryScanEventLog("Security", query, errors, eventRecord =>
        {
            if (!TryGetTimestamp(eventRecord, since, out DateTimeOffset timestamp))
            {
                return;
            }

            string ip = ReadProperty(eventRecord, 19);
            if (string.IsNullOrWhiteSpace(ip) || ip == "-")
            {
                return;
            }

            AddAttack(attacks, new AttackEvent
            {
                Timestamp = timestamp,
                SourceIp = ip,
                Target = "Windows login",
                Username = ReadProperty(eventRecord, 5, "[unknown]"),
                Source = "Security",
                InstanceId = 4625
            });
        });
    }

    private static void ScanSqlLogons(List<AttackEvent> attacks, List<string> errors, DateTimeOffset since)
    {
        const string query = "*[System/EventID=18456]";
        TryScanEventLog("Application", query, errors, eventRecord =>
        {
            if (!TryGetTimestamp(eventRecord, since, out DateTimeOffset timestamp))
            {
                return;
            }

            string ip = ExtractIp(ReadProperty(eventRecord, 2));
            if (string.IsNullOrWhiteSpace(ip))
            {
                return;
            }

            AddAttack(attacks, new AttackEvent
            {
                Timestamp = timestamp,
                SourceIp = ip,
                Target = "SQL Server",
                Username = ReadProperty(eventRecord, 0, "[unknown]"),
                Source = "Application",
                InstanceId = 18456
            });
        });
    }

    private static void ScanExchangeLogons(List<AttackEvent> attacks, List<string> errors, DateTimeOffset since)
    {
        const string query = "*[System/EventID=1035]";
        TryScanEventLog("Application", query, errors, eventRecord =>
        {
            if (!TryGetTimestamp(eventRecord, since, out DateTimeOffset timestamp))
            {
                return;
            }

            string ip = ReadProperty(eventRecord, 3);
            if (string.IsNullOrWhiteSpace(ip) || ip.Length <= 4)
            {
                return;
            }

            AddAttack(attacks, new AttackEvent
            {
                Timestamp = timestamp,
                SourceIp = ip,
                Target = "Exchange",
                Username = "[not logged]",
                Source = "Application",
                InstanceId = 1035
            });
        });
    }

    private static void ScanIisFtpLogs(List<AttackEvent> attacks, List<string> errors, DateTimeOffset since, ScannerConfiguration configuration)
    {
        IEnumerable<string> roots = configuration.FtpRoots.Count > 0 ? configuration.FtpRoots : DefaultFtpRoots;
        foreach (string root in roots)
        {
            try
            {
                if (!Directory.Exists(root))
                {
                    continue;
                }

                foreach (string directory in Directory.GetDirectories(root, "FTP*"))
                {
                    foreach (string file in Directory.GetFiles(directory, "*.log"))
                    {
                        ParseIisFtpLogFile(file, attacks, errors, since);
                    }
                }
            }
            catch (Exception ex)
            {
                errors.Add($"FTP scan failed for {root}: {ex.Message}");
            }
        }
    }

    private static void ParseIisFtpLogFile(string filePath, List<AttackEvent> attacks, List<string> errors, DateTimeOffset since)
    {
        string username = "[unknown]";

        try
        {
            foreach (string line in File.ReadLines(filePath))
            {
                if (string.IsNullOrWhiteSpace(line) || line.StartsWith('#'))
                {
                    continue;
                }

                string[] parts = line.Split(' ', StringSplitOptions.RemoveEmptyEntries);
                if (parts.Length < 9)
                {
                    continue;
                }

                if (!DateTime.TryParse(
                        $"{parts[0]} {parts[1]}",
                        CultureInfo.InvariantCulture,
                        DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal,
                        out DateTime timestampUtc))
                {
                    continue;
                }

                var timestamp = new DateTimeOffset(timestampUtc).ToLocalTime();
                if (timestamp < since)
                {
                    continue;
                }

                string sourceIp = parts[2];
                string command = parts[6];
                string parameter = parts[7];
                string status = parts[8];

                if (string.Equals(command, "USER", StringComparison.OrdinalIgnoreCase))
                {
                    username = parameter;
                }
                else if (string.Equals(command, "PASS", StringComparison.OrdinalIgnoreCase)
                    && !string.Equals(status, "230", StringComparison.OrdinalIgnoreCase))
                {
                    AddAttack(attacks, new AttackEvent
                    {
                        Timestamp = timestamp,
                        SourceIp = sourceIp,
                        Target = "FTP login",
                        Username = username,
                        Source = "IIS FTP",
                        InstanceId = -1
                    });
                }
            }
        }
        catch (Exception ex)
        {
            errors.Add($"FTP log parse failed for {filePath}: {ex.Message}");
        }
    }

    private static void ScanFileZillaLogs(List<AttackEvent> attacks, List<string> errors, DateTimeOffset since, ScannerConfiguration configuration)
    {
        IEnumerable<string> roots = configuration.FileZillaRoots.Count > 0 ? configuration.FileZillaRoots : DefaultFileZillaRoots;
        foreach (string root in roots)
        {
            try
            {
                if (!Directory.Exists(root))
                {
                    continue;
                }

                foreach (string file in Directory.GetFiles(root, "*.log"))
                {
                    ParseFileZillaLogFile(file, attacks, errors, since);
                }
            }
            catch (Exception ex)
            {
                errors.Add($"FileZilla scan failed for {root}: {ex.Message}");
            }
        }
    }

    private static void ParseFileZillaLogFile(string filePath, List<AttackEvent> attacks, List<string> errors, DateTimeOffset since)
    {
        string username = "[unknown]";

        try
        {
            foreach (string line in File.ReadLines(filePath))
            {
                if (string.IsNullOrWhiteSpace(line))
                {
                    continue;
                }

                int closeParen = line.IndexOf(')');
                if (closeParen < 0)
                {
                    continue;
                }

                string remainder = line[(closeParen + 1)..];
                int dash = remainder.IndexOf('-');
                if (dash < 0)
                {
                    continue;
                }

                string timestampText = remainder[..dash].Trim();
                remainder = remainder[(dash + 1)..].TrimStart();

                if (!DateTime.TryParse(timestampText, CultureInfo.InvariantCulture, DateTimeStyles.None, out DateTime parsedTimestamp))
                {
                    continue;
                }

                DateTimeOffset timestamp = new(parsedTimestamp);
                if (timestamp < since)
                {
                    continue;
                }

                if (remainder.Contains("(not logged in)", StringComparison.OrdinalIgnoreCase))
                {
                    int idx = remainder.IndexOf(')');
                    if (idx >= 0 && idx + 1 < remainder.Length)
                    {
                        remainder = remainder[(idx + 1)..];
                    }
                }

                int openIp = remainder.IndexOf('(');
                int closeIp = remainder.IndexOf(')');
                if (openIp < 0 || closeIp <= openIp)
                {
                    continue;
                }

                string ip = remainder[(openIp + 1)..closeIp].Trim();
                string message = remainder[(closeIp + 1)..].Trim();

                if (message.Contains("password incorrect", StringComparison.OrdinalIgnoreCase))
                {
                    AddAttack(attacks, new AttackEvent
                    {
                        Timestamp = timestamp,
                        SourceIp = ip,
                        Target = "FileZilla FTP login",
                        Username = username,
                        Source = "FileZilla",
                        InstanceId = -1
                    });
                }
                else if (message.Contains("> USER", StringComparison.OrdinalIgnoreCase))
                {
                    int userIndex = message.IndexOf("> USER", StringComparison.OrdinalIgnoreCase);
                    username = message[(userIndex + 6)..].Trim();
                }
            }
        }
        catch (Exception ex)
        {
            errors.Add($"FileZilla log parse failed for {filePath}: {ex.Message}");
        }
    }

    private static void TryScanEventLog(string logName, string query, List<string> errors, Action<EventRecord> processRecord)
    {
        try
        {
            using var reader = new EventLogReader(new EventLogQuery(logName, PathType.LogName, query));
            for (EventRecord? eventRecord = reader.ReadEvent(); eventRecord != null; eventRecord = reader.ReadEvent())
            {
                using (eventRecord)
                {
                    processRecord(eventRecord);
                }
            }
        }
        catch (Exception ex)
        {
            errors.Add($"Event log scan failed for {logName} ({query}): {ex.Message}");
        }
    }

    private static bool TryGetTimestamp(EventRecord eventRecord, DateTimeOffset since, out DateTimeOffset timestamp)
    {
        if (!eventRecord.TimeCreated.HasValue)
        {
            timestamp = default;
            return false;
        }

        timestamp = new DateTimeOffset(eventRecord.TimeCreated.Value);
        return timestamp >= since;
    }

    private static string ReadProperty(EventRecord eventRecord, int index, string fallback = "")
    {
        if (index < 0 || index >= eventRecord.Properties.Count)
        {
            return fallback;
        }

        object? value = eventRecord.Properties[index].Value;
        return value?.ToString()?.Trim() ?? fallback;
    }

    private static void AddAttack(List<AttackEvent> attacks, AttackEvent attack)
    {
        if (string.IsNullOrWhiteSpace(attack.SourceIp))
        {
            return;
        }

        if (!LooksLikeIpAddress(attack.SourceIp))
        {
            return;
        }

        attacks.Add(attack with { SourceIp = attack.SourceIp.Trim() });
    }

    private static string ExtractIp(string input)
    {
        Match match = Regex.Match(input, @"\b(?:\d{1,3}\.){3}\d{1,3}\b");
        return match.Success ? match.Value : string.Empty;
    }

    private static bool LooksLikeIpAddress(string input)
    {
        return IPAddress.TryParse(input, out _);
    }

    private static AlertAssessment AssessAttackActivity(IReadOnlyList<AttackEvent> attacks, int uniqueIpCount, ScannerConfiguration configuration)
    {
        if (attacks.Count == 0)
        {
            return new AlertAssessment("ok", "No failed login activity observed.");
        }

        TimeSpan window = TimeSpan.FromMinutes(configuration.LoginBurstWindowMinutes);
        int largestBurst = attacks
            .GroupBy(attack => (attack.SourceIp, attack.Username, attack.Target))
            .Select(group => GetPeakEventCount(group.OrderBy(attack => attack.Timestamp).ToList(), window))
            .DefaultIfEmpty(0)
            .Max();
        int largestSpray = attacks
            .GroupBy(attack => attack.SourceIp)
            .Select(group => GetPeakDistinctAccountCount(group.OrderBy(attack => attack.Timestamp).ToList(), window))
            .DefaultIfEmpty(0)
            .Max();

        if (largestBurst >= configuration.CriticalLoginBurstCount || largestSpray >= configuration.CriticalSprayAccountCount)
        {
            return new AlertAssessment("critical", $"High-confidence login attack pattern: burst={largestBurst}, sprayed accounts={largestSpray}, window={configuration.LoginBurstWindowMinutes}m.");
        }

        if (largestBurst >= configuration.WarningLoginBurstCount || largestSpray >= configuration.WarningSprayAccountCount)
        {
            return new AlertAssessment("warning", $"Suspicious login pattern: burst={largestBurst}, sprayed accounts={largestSpray}, window={configuration.LoginBurstWindowMinutes}m.");
        }

        int criticalEventThreshold = Math.Max(configuration.CriticalEventThreshold, configuration.CriticalLoginBurstCount);
        int criticalIpThreshold = Math.Max(configuration.CriticalUniqueIpThreshold, configuration.CriticalSprayAccountCount);
        int warningEventThreshold = Math.Max(configuration.WarningEventThreshold, configuration.WarningLoginBurstCount * 2);
        int warningIpThreshold = Math.Max(configuration.WarningUniqueIpThreshold, configuration.WarningSprayAccountCount);

        if (attacks.Count >= criticalEventThreshold || uniqueIpCount >= criticalIpThreshold)
        {
            return new AlertAssessment("critical", $"Critical volume threshold reached: events={attacks.Count}, unique IPs={uniqueIpCount}.");
        }

        if (attacks.Count >= warningEventThreshold || uniqueIpCount >= warningIpThreshold)
        {
            return new AlertAssessment("warning", $"Elevated failed-login volume: events={attacks.Count}, unique IPs={uniqueIpCount}.");
        }

        return new AlertAssessment("ok", $"Low-volume login errors observed: events={attacks.Count}, unique IPs={uniqueIpCount}; no burst or password-spraying pattern detected.");
    }

    private static AlertAssessment MergeRansomwareAssessment(AlertAssessment loginAssessment, RansomwareBetaSummary ransomwareBeta)
    {
        if (ransomwareBeta.State is not ("warning" or "critical"))
        {
            return loginAssessment;
        }

        int loginPriority = AlertPriority(loginAssessment.State);
        int ransomwarePriority = AlertPriority(ransomwareBeta.State);
        string state = ransomwarePriority > loginPriority ? ransomwareBeta.State : loginAssessment.State;
        string reason = $"{loginAssessment.Reason} {ransomwareBeta.Reason}";
        return new AlertAssessment(state, reason);
    }

    private static int AlertPriority(string state) => state switch
    {
        "critical" => 2,
        "warning" => 1,
        _ => 0
    };

    private static int GetPeakEventCount(IReadOnlyList<AttackEvent> events, TimeSpan window)
    {
        int start = 0;
        int peak = 0;
        for (int end = 0; end < events.Count; end++)
        {
            while (events[end].Timestamp - events[start].Timestamp > window)
            {
                start++;
            }
            peak = Math.Max(peak, end - start + 1);
        }
        return peak;
    }

    private static int GetPeakDistinctAccountCount(IReadOnlyList<AttackEvent> events, TimeSpan window)
    {
        var accounts = new Dictionary<string, int>(StringComparer.OrdinalIgnoreCase);
        int start = 0;
        int peak = 0;
        for (int end = 0; end < events.Count; end++)
        {
            accounts[events[end].Username] = accounts.GetValueOrDefault(events[end].Username) + 1;
            while (events[end].Timestamp - events[start].Timestamp > window)
            {
                string account = events[start].Username;
                accounts[account]--;
                if (accounts[account] == 0)
                {
                    accounts.Remove(account);
                }
                start++;
            }
            peak = Math.Max(peak, accounts.Count);
        }
        return peak;
    }

    private sealed record AlertAssessment(string State, string Reason);
}