use super::RpcHandler;
use anyhow::{Context, Result};
use serde::{Deserialize, Serialize};
use zeroize::Zeroize;

/// Retry configuration for [`bitcoin_rpc_post_with_retry`].
///
/// Exposed as a struct (rather than hard-coded constants inside the function)
/// so tests can dial down timeouts to keep the suite fast while still
/// exercising real retry/backoff behavior.
#[derive(Debug, Clone)]
struct RetryConfig {
    max_attempts: u32,
    attempt_timeout: std::time::Duration,
    /// Length must equal `max_attempts - 1` (one backoff between each
    /// successive attempt). The last attempt is not followed by a backoff.
    backoffs: Vec<std::time::Duration>,
}

impl RetryConfig {
    /// Production retry policy: 3 attempts, 15s each, 500ms + 1500ms backoffs.
    /// Total worst-case wall time: 3 * 15 + 0.5 + 1.5 = 47s.
    fn production() -> Self {
        Self {
            max_attempts: BITCOIN_RPC_MAX_ATTEMPTS,
            attempt_timeout: BITCOIN_RPC_ATTEMPT_TIMEOUT,
            backoffs: BITCOIN_RPC_BACKOFFS.to_vec(),
        }
    }
}

/// Max retry attempts for a single bitcoin_rpc_call invocation.
/// First attempt + 2 retries = 3 total.
const BITCOIN_RPC_MAX_ATTEMPTS: u32 = 3;

/// Per-attempt deadline. Must be >= the reqwest client's own timeout (we
/// build it at 15s in handle_bitcoin_getinfo) — this is the outer safety net.
const BITCOIN_RPC_ATTEMPT_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(15);

/// Backoff between attempts. Index 0 = after first failure, 1 = after second, etc.
/// Chosen to absorb bitcoind's typical block-validation stall (2-5s) without
/// adding noticeable latency on the happy path (first attempt succeeds in ~30ms).
const BITCOIN_RPC_BACKOFFS: [std::time::Duration; 2] = [
    std::time::Duration::from_millis(500),
    std::time::Duration::from_millis(1500),
];

/// Classify a reqwest error as transient (retryable) or fatal.
/// Transient: timeout, connect refused, request/response body IO errors.
/// Fatal: TLS errors, URL parse errors, redirect loops, builder errors.
fn is_transient_transport_error(e: &reqwest::Error) -> bool {
    e.is_timeout() || e.is_connect() || e.is_request() || e.is_body()
}

#[derive(Debug, Serialize)]
struct BitcoinInfo {
    block_height: u64,
    sync_progress: f64,
    chain: String,
    difficulty: f64,
    mempool_size: u64,
    mempool_tx_count: u64,
    verification_progress: f64,
}

#[derive(Debug, Deserialize)]
struct BitcoinRpcResponse<T> {
    result: Option<T>,
    error: Option<serde_json::Value>,
}

#[derive(Debug, Deserialize)]
struct BlockchainInfo {
    chain: Option<String>,
    blocks: Option<u64>,
    difficulty: Option<f64>,
    #[serde(rename = "verificationprogress")]
    verification_progress: Option<f64>,
}

#[derive(Debug, Deserialize)]
struct MempoolInfo {
    size: Option<u64>,
    bytes: Option<u64>,
}

impl RpcHandler {
    pub(super) async fn handle_bitcoin_getinfo(&self) -> Result<serde_json::Value> {
        // Per-attempt timeout (see bitcoin_rpc_call for retry semantics).
        // 15s is enough room for bitcoind to answer getblockchaininfo even
        // during block validation; bitcoin_rpc_call wraps each attempt in a
        // separate tokio::time::timeout too, so this is belt-and-suspenders.
        // connect_timeout is tighter so a dead bitcoind doesn't steal the
        // whole attempt budget on TCP connect alone.
        let client = reqwest::Client::builder()
            .timeout(std::time::Duration::from_secs(15))
            .connect_timeout(std::time::Duration::from_secs(3))
            .build()
            .context("Failed to create HTTP client")?;

        let blockchain_info = self
            .bitcoin_rpc_call::<BlockchainInfo>(&client, "getblockchaininfo", &[])
            .await
            .context("Failed to query getblockchaininfo")?;

        let mempool_info = self
            .bitcoin_rpc_call::<MempoolInfo>(&client, "getmempoolinfo", &[])
            .await
            .unwrap_or(MempoolInfo {
                size: Some(0),
                bytes: Some(0),
            });

        let info = BitcoinInfo {
            block_height: blockchain_info.blocks.unwrap_or(0),
            sync_progress: blockchain_info.verification_progress.unwrap_or(0.0),
            chain: blockchain_info.chain.unwrap_or_else(|| "unknown".into()),
            difficulty: blockchain_info.difficulty.unwrap_or(0.0),
            mempool_size: mempool_info.bytes.unwrap_or(0),
            mempool_tx_count: mempool_info.size.unwrap_or(0),
            verification_progress: blockchain_info.verification_progress.unwrap_or(0.0),
        };

        Ok(serde_json::to_value(info)?)
    }

    /// Call a Bitcoin Core JSON-RPC method.
    ///
    /// Retries up to [`BITCOIN_RPC_MAX_ATTEMPTS`] times on transient
    /// transport errors (timeout / connection refused / send/recv IO).
    /// Does **not** retry when bitcoind responds with a well-formed
    /// `{"error": ...}` body — those are real RPC errors and surfacing
    /// them quickly is the right behavior.
    ///
    /// Motivation: on a syncing pruned node, bitcoind's RPC thread can block
    /// for 5-10 seconds during block validation. A single 10s timeout means
    /// ~30% of UI calls error out even though the node is perfectly healthy.
    /// With retry + backoff, the UI sees a uniform slow-but-successful
    /// response instead of intermittent failures.
    async fn bitcoin_rpc_call<T: serde::de::DeserializeOwned>(
        &self,
        client: &reqwest::Client,
        method: &str,
        params: &[serde_json::Value],
    ) -> Result<T> {
        let (rpc_user, rpc_pass) = crate::bitcoin_rpc::bitcoin_rpc_credentials().await;
        bitcoin_rpc_post_with_retry(
            client,
            crate::constants::BITCOIN_RPC_URL,
            &rpc_user,
            &rpc_pass,
            method,
            params,
        )
        .await
    }

    /// Initialize a Bitcoin Core descriptor wallet with keys derived from the master seed.
    /// Creates a blank wallet and imports BIP-84 (native segwit) descriptors.
    /// Requires: password re-verification, encrypted seed on disk.
    pub(super) async fn handle_bitcoin_init_wallet_from_seed(
        &self,
        params: Option<serde_json::Value>,
    ) -> Result<serde_json::Value> {
        let params = params.ok_or_else(|| anyhow::anyhow!("Missing params"))?;
        let password = params
            .get("password")
            .and_then(|v| v.as_str())
            .ok_or_else(|| anyhow::anyhow!("Missing 'password' for seed access"))?;
        let wallet_name = params
            .get("wallet_name")
            .and_then(|v| v.as_str())
            .unwrap_or("archipelago");

        // Verify user password.
        self.auth_manager
            .verify_password(password)
            .await
            .context("Password verification failed")?;

        // Load encrypted seed.
        let mnemonic = crate::seed::load_seed_encrypted(&self.config.data_dir, password)
            .await
            .context("Failed to load encrypted seed")?;
        let seed = crate::seed::MasterSeed::from_mnemonic(&mnemonic);

        // Derive BIP-84 account xprv.
        let xprv = crate::seed::derive_bitcoin_xprv(&seed)?;
        let mut xprv_str = xprv.to_string();

        let client = reqwest::Client::builder()
            .timeout(std::time::Duration::from_secs(30))
            .build()
            .context("Failed to create HTTP client")?;

        // Step 1: Create a blank descriptor wallet.
        let create_result = self
            .bitcoin_rpc_call::<serde_json::Value>(
                &client,
                "createwallet",
                &[
                    serde_json::json!(wallet_name), // wallet_name
                    serde_json::json!(false),       // disable_private_keys
                    serde_json::json!(true),        // blank
                    serde_json::json!(""),          // passphrase
                    serde_json::json!(false),       // avoid_reuse
                    serde_json::json!(true),        // descriptors
                ],
            )
            .await;

        match create_result {
            Ok(_) => tracing::info!("Created blank descriptor wallet '{}'", wallet_name),
            Err(e) => {
                let msg = e.to_string();
                if msg.contains("already exists") {
                    tracing::info!(
                        "Wallet '{}' already exists, importing descriptors",
                        wallet_name
                    );
                } else {
                    xprv_str.zeroize();
                    return Err(e.context("Failed to create wallet"));
                }
            }
        }

        // Step 2: Import BIP-84 descriptors (external + internal/change).
        // Format: wpkh(xprv/0/*) for receive, wpkh(xprv/1/*) for change.
        let external_desc = format!("wpkh({}/0/*)", xprv_str);
        let internal_desc = format!("wpkh({}/1/*)", xprv_str);

        // Get checksums from Bitcoin Core.
        let ext_info: serde_json::Value = self
            .bitcoin_rpc_call(
                &client,
                "getdescriptorinfo",
                &[serde_json::json!(external_desc)],
            )
            .await
            .context("getdescriptorinfo failed for external descriptor")?;

        let int_info: serde_json::Value = self
            .bitcoin_rpc_call(
                &client,
                "getdescriptorinfo",
                &[serde_json::json!(internal_desc)],
            )
            .await
            .context("getdescriptorinfo failed for internal descriptor")?;

        let ext_desc_with_checksum = ext_info
            .get("descriptor")
            .and_then(|v| v.as_str())
            .ok_or_else(|| anyhow::anyhow!("No descriptor in getdescriptorinfo response"))?;
        let int_desc_with_checksum = int_info
            .get("descriptor")
            .and_then(|v| v.as_str())
            .ok_or_else(|| anyhow::anyhow!("No descriptor in getdescriptorinfo response"))?;

        let import_params = serde_json::json!([
            {
                "desc": ext_desc_with_checksum,
                "timestamp": "now",
                "active": true,
                "internal": false,
                "range": [0, 1000],
            },
            {
                "desc": int_desc_with_checksum,
                "timestamp": "now",
                "active": true,
                "internal": true,
                "range": [0, 1000],
            }
        ]);

        let _import_result: serde_json::Value = self
            .bitcoin_rpc_call(&client, "importdescriptors", &[import_params])
            .await
            .context("importdescriptors failed")?;

        // Zeroize the xprv string from memory.
        xprv_str.zeroize();

        tracing::info!(
            "Bitcoin Core wallet '{}' initialized from master seed (BIP-84)",
            wallet_name
        );

        Ok(serde_json::json!({
            "initialized": true,
            "wallet_name": wallet_name,
        }))
    }
}

/// Free-function counterpart to `RpcHandler::bitcoin_rpc_call`.
///
/// Takes the URL + credentials as parameters so it can be exercised by unit
/// tests against a mock HTTP server without constructing a full `RpcHandler`.
///
/// Production callers go through `RpcHandler::bitcoin_rpc_call`, which loads
/// credentials from the secrets file and points at `BITCOIN_RPC_URL`.
async fn bitcoin_rpc_post_with_retry<T: serde::de::DeserializeOwned>(
    client: &reqwest::Client,
    url: &str,
    rpc_user: &str,
    rpc_pass: &str,
    method: &str,
    params: &[serde_json::Value],
) -> Result<T> {
    bitcoin_rpc_post_with_retry_cfg(
        client,
        url,
        rpc_user,
        rpc_pass,
        method,
        params,
        &RetryConfig::production(),
    )
    .await
}

/// Inner implementation with configurable retry policy (for tests).
async fn bitcoin_rpc_post_with_retry_cfg<T: serde::de::DeserializeOwned>(
    client: &reqwest::Client,
    url: &str,
    rpc_user: &str,
    rpc_pass: &str,
    method: &str,
    params: &[serde_json::Value],
    cfg: &RetryConfig,
) -> Result<T> {
    debug_assert_eq!(
        cfg.backoffs.len(),
        (cfg.max_attempts - 1) as usize,
        "RetryConfig: backoffs.len() must equal max_attempts - 1"
    );

    let body = serde_json::json!({
        "jsonrpc": "1.0",
        "id": "archy",
        "method": method,
        "params": params,
    });

    let mut last_err: Option<anyhow::Error> = None;
    for attempt in 0..cfg.max_attempts {
        if attempt > 0 {
            let backoff = cfg
                .backoffs
                .get(attempt as usize - 1)
                .copied()
                .unwrap_or_else(|| std::time::Duration::from_secs(2));
            tracing::warn!(
                "bitcoin_rpc({}): attempt {} failed, backing off {:?}",
                method,
                attempt,
                backoff
            );
            tokio::time::sleep(backoff).await;
        }

        // Per-attempt hard deadline. Independent of reqwest's built-in timeout
        // so we always cap total time even if reqwest blocks on something
        // weird (e.g., DNS starvation).
        let fut = client
            .post(url)
            .basic_auth(rpc_user, Some(rpc_pass))
            .json(&body)
            .send();

        let send_result = match tokio::time::timeout(cfg.attempt_timeout, fut).await {
            Err(_elapsed) => {
                last_err = Some(anyhow::anyhow!(
                    "Bitcoin RPC send timed out after {:?}",
                    cfg.attempt_timeout
                ));
                continue; // transient: retry
            }
            Ok(r) => r,
        };

        let resp = match send_result {
            Ok(r) => r,
            Err(e) if is_transient_transport_error(&e) => {
                last_err = Some(anyhow::Error::from(e).context("Bitcoin RPC connection failed"));
                continue; // transient: retry
            }
            Err(e) => {
                return Err(anyhow::Error::from(e).context("Bitcoin RPC connection failed"));
            }
        };

        let rpc_resp: BitcoinRpcResponse<T> = resp
            .json()
            .await
            .context("Failed to parse Bitcoin RPC response")?;

        if let Some(err) = rpc_resp.error {
            // RPC-level error: this is a real bitcoind response, not transient.
            anyhow::bail!("Bitcoin RPC error: {}", err);
        }

        return rpc_resp
            .result
            .ok_or_else(|| anyhow::anyhow!("Bitcoin RPC returned null result"));
    }

    Err(last_err
        .unwrap_or_else(|| anyhow::anyhow!("Bitcoin RPC exhausted retries with no error captured")))
}

#[cfg(test)]
mod tests {
    use super::*;
    use hyper::service::{make_service_fn, service_fn};
    use hyper::{Body, Request, Response, Server, StatusCode};
    use std::convert::Infallible;
    use std::net::SocketAddr;
    use std::sync::atomic::{AtomicU32, Ordering};
    use std::sync::Arc;

    /// Spin up a mock bitcoind HTTP server that behaves according to `handler`.
    /// Returns the bound URL and a JoinHandle (dropped = server shutdown via the
    /// oneshot cancel channel).
    async fn spawn_mock<F, Fut>(
        handler: F,
    ) -> (
        String,
        tokio::task::JoinHandle<()>,
        tokio::sync::oneshot::Sender<()>,
    )
    where
        F: Fn(Request<Body>) -> Fut + Send + Sync + Clone + 'static,
        Fut: std::future::Future<Output = Response<Body>> + Send + 'static,
    {
        let addr = SocketAddr::from(([127, 0, 0, 1], 0));
        let make_svc = make_service_fn(move |_| {
            let handler = handler.clone();
            async move {
                Ok::<_, Infallible>(service_fn(move |req| {
                    let handler = handler.clone();
                    async move { Ok::<_, Infallible>(handler(req).await) }
                }))
            }
        });
        let server = Server::bind(&addr).serve(make_svc);
        let url = format!("http://{}", server.local_addr());
        let (tx, rx) = tokio::sync::oneshot::channel::<()>();
        let handle = tokio::spawn(async move {
            let graceful = server.with_graceful_shutdown(async {
                let _ = rx.await;
            });
            let _ = graceful.await;
        });
        (url, handle, tx)
    }

    /// Reply body bitcoind would send for a successful getblockcount.
    fn ok_reply() -> Body {
        Body::from(r#"{"result":42,"error":null,"id":"archy"}"#)
    }

    fn err_reply() -> Body {
        Body::from(r#"{"result":null,"error":{"code":-8,"message":"nope"},"id":"archy"}"#)
    }

    /// Succeeds on first attempt — should not retry.
    #[tokio::test]
    async fn happy_path_first_attempt() {
        let count = Arc::new(AtomicU32::new(0));
        let c = count.clone();
        let (url, _h, _tx) = spawn_mock(move |_req| {
            let c = c.clone();
            async move {
                c.fetch_add(1, Ordering::SeqCst);
                Response::new(ok_reply())
            }
        })
        .await;

        let client = reqwest::Client::builder().build().unwrap();
        let v: u64 =
            bitcoin_rpc_post_with_retry(&client, &url, "user", "pass", "getblockcount", &[])
                .await
                .expect("should succeed");
        assert_eq!(v, 42);
        assert_eq!(count.load(Ordering::SeqCst), 1, "should not have retried");
    }

    /// HTTP 503 with non-JSON body: produces a JSON-parse error which is NOT
    /// classified as transient. Must fail after first attempt.
    /// This guards against the tempting mistake of blanket-retrying every
    /// non-2xx response — which would mask real bitcoind misconfig.
    #[tokio::test]
    async fn does_not_retry_parse_errors() {
        let count = Arc::new(AtomicU32::new(0));
        let c = count.clone();
        let (url, _h, _tx) = spawn_mock(move |_req| {
            let c = c.clone();
            async move {
                c.fetch_add(1, Ordering::SeqCst);
                Response::builder()
                    .status(StatusCode::SERVICE_UNAVAILABLE)
                    .body(Body::from("busy"))
                    .unwrap()
            }
        })
        .await;

        let client = reqwest::Client::builder().build().unwrap();
        let result: Result<u64> =
            bitcoin_rpc_post_with_retry(&client, &url, "user", "pass", "getblockcount", &[]).await;
        assert!(result.is_err(), "non-JSON response should error out");
        assert_eq!(
            count.load(Ordering::SeqCst),
            1,
            "parse errors are not retryable"
        );
    }

    /// Connect-refused (port closed) is the canonical transient transport
    /// error. Must exhaust BITCOIN_RPC_MAX_ATTEMPTS and the total elapsed
    /// time must include at least the sum of the backoffs.
    #[tokio::test]
    async fn retries_exhausted_on_persistent_connect_refused() {
        // Bind a port then immediately drop the listener so the port is closed.
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let closed_url = format!("http://{}", listener.local_addr().unwrap());
        drop(listener);

        let client = reqwest::Client::builder()
            .connect_timeout(std::time::Duration::from_millis(500))
            .build()
            .unwrap();
        let start = std::time::Instant::now();
        let result: Result<u64> =
            bitcoin_rpc_post_with_retry(&client, &closed_url, "user", "pass", "getblockcount", &[])
                .await;
        let elapsed = start.elapsed();
        assert!(result.is_err(), "connect-refused should exhaust retries");
        let min_backoff: std::time::Duration = BITCOIN_RPC_BACKOFFS.iter().sum();
        assert!(
            elapsed >= min_backoff,
            "should have backed off between retries (elapsed={:?}, expected at least {:?})",
            elapsed,
            min_backoff
        );
    }

    /// The motivating scenario: first attempt times out (bitcoind busy),
    /// subsequent attempt succeeds. Uses a short test-only RetryConfig so
    /// the test runs in <1s instead of 15s.
    #[tokio::test]
    async fn retries_on_timeout_then_succeeds() {
        let count = Arc::new(AtomicU32::new(0));
        let c = count.clone();
        // Mock server: first request hangs for 500ms, subsequent requests reply OK.
        let (url, _h, _tx) = spawn_mock(move |_req| {
            let c = c.clone();
            async move {
                let n = c.fetch_add(1, Ordering::SeqCst);
                if n == 0 {
                    tokio::time::sleep(std::time::Duration::from_millis(500)).await;
                }
                Response::new(ok_reply())
            }
        })
        .await;

        let client = reqwest::Client::builder().build().unwrap();
        // Attempt timeout 100ms < server's 500ms sleep => first attempt times out.
        // Backoff 20ms between attempts.
        let cfg = RetryConfig {
            max_attempts: 3,
            attempt_timeout: std::time::Duration::from_millis(100),
            backoffs: vec![
                std::time::Duration::from_millis(20),
                std::time::Duration::from_millis(20),
            ],
        };
        let v: u64 = bitcoin_rpc_post_with_retry_cfg(
            &client,
            &url,
            "user",
            "pass",
            "getblockcount",
            &[],
            &cfg,
        )
        .await
        .expect("second attempt should succeed");
        assert_eq!(v, 42);
        assert!(
            count.load(Ordering::SeqCst) >= 2,
            "expected at least 2 attempts (got {})",
            count.load(Ordering::SeqCst)
        );
    }

    /// bitcoind returned a well-formed `{"error": ...}` body. Must NOT retry.
    #[tokio::test]
    async fn does_not_retry_on_rpc_level_error() {
        let count = Arc::new(AtomicU32::new(0));
        let c = count.clone();
        let (url, _h, _tx) = spawn_mock(move |_req| {
            let c = c.clone();
            async move {
                c.fetch_add(1, Ordering::SeqCst);
                Response::new(err_reply())
            }
        })
        .await;

        let client = reqwest::Client::builder().build().unwrap();
        let result: Result<u64> =
            bitcoin_rpc_post_with_retry(&client, &url, "user", "pass", "getblockcount", &[]).await;
        assert!(result.is_err());
        assert_eq!(
            count.load(Ordering::SeqCst),
            1,
            "RPC-level errors are not transient"
        );
    }

    /// Sanity: retry budget invariants. Chosen to catch regressions where
    /// someone bumps these constants without realizing the total worst-case
    /// wall time implications.
    #[test]
    fn retry_budget_invariants() {
        assert_eq!(BITCOIN_RPC_MAX_ATTEMPTS, 3);
        assert_eq!(
            BITCOIN_RPC_BACKOFFS.len(),
            (BITCOIN_RPC_MAX_ATTEMPTS - 1) as usize
        );
        // Total wall-time ceiling:
        //   3 attempts * 15s  +  (0.5s + 1.5s) backoff  =  47s
        let total: std::time::Duration = BITCOIN_RPC_ATTEMPT_TIMEOUT * BITCOIN_RPC_MAX_ATTEMPTS
            + BITCOIN_RPC_BACKOFFS.iter().sum::<std::time::Duration>();
        assert!(total < std::time::Duration::from_secs(60));
    }
}