//! Relicario CLI — the platform layer for the Relicario password manager.
//!
//! See module docs for the unlock flow and vault layout.

mod commands;
mod device;
mod gitea;
mod helpers;
mod parse;
mod prompt;
mod session;
mod org_session;

use std::path::PathBuf;

use anyhow::Result;
use clap::{CommandFactory, Parser, Subcommand};
use clap_complete::{generate, Shell};

#[derive(Parser)]
#[command(
    name = "relicario",
    version,
    about = "Relicario — git-backed password manager with reference-image two-factor unlock"
)]
struct Cli {
    #[command(subcommand)]
    command: Commands,
}

#[derive(Subcommand)]
enum Commands {
    /// Initialize a new vault in the current directory.
    Init {
        /// Carrier JPEG to embed the secret into.
        #[arg(long)]
        image: PathBuf,
        /// Output path for the reference image (gitignored).
        #[arg(long, default_value = "reference.jpg")]
        output: PathBuf,
    },

    /// Add a new item. Type-specific flags populate the core; missing fields
    /// are prompted for interactively.
    Add {
        #[command(subcommand)]
        kind: AddKind,
    },

    /// Print an item. Secrets are masked by default; pass --show to reveal.
    Get {
        /// Item id or case-insensitive title substring.
        query: String,
        /// Print secret field values in plaintext.
        #[arg(long)]
        show: bool,
        /// Copy the primary secret (Login.password, Card.number, etc.) to clipboard.
        #[arg(long)]
        copy: bool,
    },

    /// List items.
    List {
        #[arg(long)]
        r#type: Option<String>,
        #[arg(long)]
        group: Option<String>,
        #[arg(long)]
        tag: Option<String>,
        #[arg(long)]
        trashed: bool,
    },

    /// Edit an item interactively.
    Edit {
        query: String,
        /// Decode an `otpauth://` QR image to set the TOTP secret (login items only).
        #[arg(long, value_name = "PATH")]
        totp_qr: Option<PathBuf>,
    },

    /// View captured field history for an item. Values are masked by
    /// default; pass `--show` to reveal them.
    History {
        query: String,
        #[arg(long)]
        show: bool,
        /// Filter to a single field (matches against the synthetic key,
        /// e.g. `login_password`, `card_number`, `totp_secret`).
        #[arg(long)]
        field: Option<String>,
    },

    /// Soft-delete an item (moves to trash; reversible via `restore`).
    Rm { query: String },

    /// Restore a soft-deleted item.
    Restore { query: String },

    /// Permanently purge an item (and its attachments).
    Purge { query: String },

    /// Trash operations.
    Trash {
        #[command(subcommand)]
        action: TrashAction,
    },

    /// Backup operations: pack and unpack `.relbak` archives.
    Backup {
        #[command(subcommand)]
        action: BackupAction,
    },

    /// Import items from another password manager into the unlocked vault.
    Import {
        #[command(subcommand)]
        action: ImportAction,
    },

    /// Attach a file to an item.
    Attach { query: String, file: PathBuf },

    /// List attachments on an item.
    Attachments { query: String },

    /// Extract an attachment to disk.
    Extract {
        query: String,
        aid: String,
        #[arg(long)]
        out: Option<PathBuf>,
    },

    /// Remove an individual attachment from an item (deletes the encrypted
    /// blob and updates the item + manifest). Use `purge` to drop the entire
    /// item and all its attachments at once.
    Detach { query: String, aid: String },

    /// Generate a password or passphrase. When run inside an initialized
    /// vault, falls back to `settings generator-defaults` for unspecified
    /// flags; outside a vault, uses built-in defaults (length 20, safe
    /// symbol set, 5 BIP39 words, space separator).
    #[command(alias = "gen")]
    Generate {
        #[arg(short = 'l', long)]
        length: Option<u32>,
        #[arg(long)]
        bip39: bool,
        #[arg(short = 'w', long)]
        words: Option<u32>,
        #[arg(long)]
        symbols: Option<String>,
        /// Separator for BIP39 words.
        #[arg(long)]
        separator: Option<String>,
    },

    /// View or change vault settings.
    Settings {
        #[command(subcommand)]
        action: SettingsAction,
    },

    /// Sync with the git remote (pull --rebase + push).
    Sync,

    /// Print a summary of the vault: items, attachments, last commit.
    Status,

    /// Lock the vault (no-op in CLI; present for UX parity with the extension).
    Lock,

    /// Emit a shell completion script for the given shell.
    ///
    /// For `--group <TAB>` autocomplete, the bash/zsh/fish scripts read
    /// the plaintext `${RELICARIO_VAULT}/.relicario/groups.cache` file,
    /// which the CLI refreshes on every manifest read. In debug builds, set
    /// `RELICARIO_NO_GROUPS_CACHE=1` to opt out of the cache (completion
    /// will fall back to no value enumeration).
    ///
    /// Pipe stdout to your shell's completion location (e.g.
    /// `relicario completions bash > /etc/bash_completion.d/relicario`).
    Completions {
        #[arg(value_enum)]
        shell: Shell,
    },

    /// Rate a passphrase with zxcvbn — prints score (0-4) and estimated
    /// guesses. Informational only; does not gate vault operations.
    ///
    /// Pass `-` as the argument to read one line from stdin instead, which
    /// keeps the passphrase out of shell history.
    Rate {
        /// Passphrase to score, or `-` to read from stdin.
        passphrase: String,
    },

    /// Manage registered devices (signing keys + deploy keys).
    Device {
        #[command(subcommand)]
        action: DeviceAction,
    },

    /// Recovery QR operations — generate or unwrap the 2FA recovery code.
    RecoveryQr {
        #[command(subcommand)]
        cmd: RecoveryQrCmd,
    },

    /// Manage a multi-user org vault.
    Org {
        /// Path to the org vault directory (overrides RELICARIO_ORG_DIR).
        #[arg(long, global = true)]
        dir: Option<PathBuf>,
        #[command(subcommand)]
        subcommand: OrgCommands,
    },
}

#[derive(Subcommand)]
pub(crate) enum AddKind {
    Login {
        #[arg(long)] title: Option<String>,
        #[arg(long)] username: Option<String>,
        #[arg(long)] url: Option<String>,
        /// Prompt for password (vs reading from stdin or --password).
        #[arg(long)] password_prompt: bool,
        #[arg(long)] password: Option<String>,
        #[arg(long)] group: Option<String>,
        #[arg(long, value_delimiter = ',')] tags: Vec<String>,
        #[arg(long)] favorite: bool,
        /// Decode an `otpauth://` QR image to fill the TOTP secret.
        #[arg(long, value_name = "PATH")] totp_qr: Option<PathBuf>,
    },
    SecureNote {
        #[arg(long)] title: Option<String>,
        #[arg(long)] body_prompt: bool,
        #[arg(long)] group: Option<String>,
        #[arg(long, value_delimiter = ',')] tags: Vec<String>,
    },
    Identity {
        #[arg(long)] title: Option<String>,
        #[arg(long)] full_name: Option<String>,
        #[arg(long)] email: Option<String>,
        #[arg(long)] phone: Option<String>,
        #[arg(long)] date_of_birth: Option<String>,
        #[arg(long)] group: Option<String>,
        #[arg(long, value_delimiter = ',')] tags: Vec<String>,
    },
    Card {
        #[arg(long)] title: Option<String>,
        #[arg(long)] holder: Option<String>,
        #[arg(long)] expiry: Option<String>, // MM/YYYY
        #[arg(long, default_value = "credit")] kind: String,
        #[arg(long)] group: Option<String>,
        #[arg(long, value_delimiter = ',')] tags: Vec<String>,
    },
    Key {
        #[arg(long)] title: Option<String>,
        #[arg(long)] label: Option<String>,
        #[arg(long)] algorithm: Option<String>,
        #[arg(long)] group: Option<String>,
        #[arg(long, value_delimiter = ',')] tags: Vec<String>,
    },
    Document {
        #[arg(long)] title: Option<String>,
        #[arg(long)] file: PathBuf,
        #[arg(long)] group: Option<String>,
        #[arg(long, value_delimiter = ',')] tags: Vec<String>,
    },
    Totp {
        #[arg(long)] title: Option<String>,
        #[arg(long)] issuer: Option<String>,
        #[arg(long)] label: Option<String>,
        #[arg(long)] secret: Option<String>, // base32
        #[arg(long, default_value = "30")] period: u32,
        #[arg(long, default_value = "6")] digits: u8,
        #[arg(long, default_value = "sha1")] algorithm: String,
        #[arg(long)] group: Option<String>,
        #[arg(long, value_delimiter = ',')] tags: Vec<String>,
    },
}

#[derive(Subcommand)]
pub(crate) enum TrashAction {
    /// List trashed items.
    List,
    /// Purge every trashed item past its retention window.
    Empty,
}

#[derive(Subcommand)]
pub(crate) enum SettingsAction {
    /// Show current settings as JSON.
    Show,
    /// Set trash retention (e.g., --days 30 or --forever).
    TrashRetention {
        #[arg(long)] days: Option<u32>,
        #[arg(long)] forever: bool,
    },
    /// Set field history retention.
    HistoryRetention {
        #[arg(long)] last_n: Option<u32>,
        #[arg(long)] days: Option<u32>,
        #[arg(long)] forever: bool,
    },
    /// Set per-attachment max size in bytes.
    AttachmentCap {
        #[arg(long)] per_attachment_max_bytes: Option<u64>,
        #[arg(long)] per_item_max_count: Option<u32>,
        #[arg(long)] per_vault_soft_cap_bytes: Option<u64>,
        #[arg(long)] per_vault_hard_cap_bytes: Option<u64>,
    },
    /// Update the default password / passphrase generator settings used by
    /// `relicario generate` when run inside this vault. Pass `--bip39` or
    /// `--random` to switch mode; per-attribute flags update fields of the
    /// chosen mode.
    GeneratorDefaults {
        /// Switch the default mode to random-character password.
        #[arg(long, conflicts_with = "bip39")]
        random: bool,
        /// Switch the default mode to BIP39 passphrase.
        #[arg(long, conflicts_with = "random")]
        bip39: bool,
        /// Random mode: total password length.
        #[arg(long)] length: Option<u32>,
        /// BIP39 mode: number of words.
        #[arg(long)] words: Option<u32>,
        /// Random mode: symbol charset (`safe`, `extended`, or a custom literal).
        #[arg(long)] symbols: Option<String>,
        /// BIP39 mode: word separator.
        #[arg(long)] separator: Option<String>,
    },
}

#[derive(Subcommand)]
pub(crate) enum BackupAction {
    /// Pack the local vault into a single encrypted `.relbak` file.
    /// Backup passphrase is independent of the vault passphrase.
    Export {
        /// Output `.relbak` path.
        out: PathBuf,
        /// Bundle the reference JPEG into the encrypted envelope.
        #[arg(long)]
        include_image: bool,
        /// Override the reference image path (defaults to the vault's
        /// `reference.jpg` or `RELICARIO_IMAGE`).
        #[arg(long)]
        image: Option<PathBuf>,
        /// Skip bundling `.git/` history.
        #[arg(long)]
        no_history: bool,
    },
    /// Unpack a `.relbak` file into a fresh vault directory.
    Restore {
        /// Input `.relbak` path.
        input: PathBuf,
        /// Target directory (must NOT already contain `.relicario/`).
        /// Defaults to the current directory.
        #[arg(default_value = ".")]
        target: PathBuf,
    },
}

#[derive(Subcommand)]
pub(crate) enum ImportAction {
    /// Import a LastPass CSV export into the unlocked vault.
    /// Each row creates a new item with a freshly-minted ID; title
    /// collisions are kept (no dedup). Failed rows are skipped and
    /// reported on stderr.
    Lastpass {
        /// Path to the LastPass-format CSV export.
        csv: PathBuf,
    },
}

#[derive(Subcommand)]
pub(crate) enum DeviceAction {
    /// Register this machine as a new device.
    ///
    /// Generates two ed25519 keypairs: one for signing commits, one for push
    /// access (deploy key). The deploy public key is registered via the Gitea
    /// API. Both private keys are stored locally in
    /// `~/.config/relicario/devices/<name>/`. The vault's `.relicario/devices.json`
    /// is updated and committed.
    ///
    /// Required environment variables (or flags):
    ///   RELICARIO_GITEA_URL    — e.g. https://git.example.com
    ///   RELICARIO_GITEA_TOKEN  — personal access token with repo write access
    ///   RELICARIO_GITEA_OWNER  — repository owner
    ///   RELICARIO_GITEA_REPO   — repository name
    Add {
        /// Human-readable name for this device (e.g. "laptop-2026").
        #[arg(long)]
        name: String,
        /// Gitea API base URL (overrides RELICARIO_GITEA_URL).
        #[arg(long)]
        gitea_url: Option<String>,
        /// Gitea personal access token (overrides RELICARIO_GITEA_TOKEN).
        #[arg(long)]
        gitea_token: Option<String>,
        /// Gitea repository owner (overrides RELICARIO_GITEA_OWNER).
        #[arg(long)]
        owner: Option<String>,
        /// Gitea repository name (overrides RELICARIO_GITEA_REPO).
        #[arg(long)]
        repo: Option<String>,
        /// Skip Gitea API registration (useful when the remote is not Gitea).
        #[arg(long)]
        no_gitea: bool,
    },
    /// Revoke a registered device.
    ///
    /// Removes the device from `devices.json`, adds it to `revoked.json`,
    /// deletes the deploy key from Gitea, and commits the change.
    Revoke {
        /// Name of the device to revoke.
        #[arg(long)]
        name: String,
    },
    /// List registered devices.
    List,
}

#[derive(clap::Subcommand)]
pub(crate) enum RecoveryQrCmd {
    /// Generate a recovery QR code and display it as ASCII art in the terminal.
    Generate,
    /// Unwrap a recovery QR payload (base64) to recover the image_secret as hex.
    Unwrap,
}

#[derive(clap::Subcommand)]
pub(crate) enum OrgCommands {
    /// Create a new org vault.
    Init {
        #[arg(long)]
        name: String,
    },
    // Admin + item subcommands are added by later tasks (B10-B14).
}

fn main() -> Result<()> {
    let cli = Cli::parse();
    match cli.command {
        Commands::Init { image, output } => commands::init::cmd_init(image, output),
        Commands::Add { kind } => commands::add::cmd_add(kind),
        Commands::Get { query, show, copy } => commands::get::cmd_get(query, show, copy),
        Commands::List { r#type, group, tag, trashed } => commands::list::cmd_list(r#type, group, tag, trashed),
        Commands::Edit { query, totp_qr } => commands::edit::cmd_edit(query, totp_qr),
        Commands::History { query, show, field } => commands::list::cmd_history(query, show, field),
        Commands::Rm { query } => commands::trash::cmd_rm(query),
        Commands::Restore { query } => commands::trash::cmd_restore(query),
        Commands::Purge { query } => commands::trash::cmd_purge(query),
        Commands::Trash { action } => commands::trash::cmd_trash(action),
        Commands::Backup { action } => commands::backup::cmd_backup(action),
        Commands::Import { action } => commands::import::cmd_import(action),
        Commands::Attach { query, file } => commands::attach::cmd_attach(query, file),
        Commands::Attachments { query } => commands::attach::cmd_attachments(query),
        Commands::Extract { query, aid, out } => commands::attach::cmd_extract(query, aid, out),
        Commands::Detach { query, aid } => commands::attach::cmd_detach(query, aid),
        Commands::Generate { length, bip39, words, symbols, separator } => {
            commands::generate::cmd_generate(length, bip39, words, symbols, separator)
        }
        Commands::Settings { action } => commands::settings::cmd_settings(action),
        Commands::Sync => commands::sync::cmd_sync(),
        Commands::Status => commands::status::cmd_status(),
        Commands::Lock => { eprintln!("no cached session to lock"); Ok(()) }
        Commands::Completions { shell } => {
            let mut cmd = Cli::command();
            generate(shell, &mut cmd, "relicario", &mut std::io::stdout());
            Ok(())
        }
        Commands::Rate { passphrase } => commands::rate::cmd_rate(passphrase),
        Commands::Device { action } => commands::device::cmd_device(action),
        Commands::RecoveryQr { cmd } => commands::recovery_qr::cmd_recovery_qr(cmd),
        Commands::Org { dir, subcommand } => {
            let dir_path = dir.as_deref();
            match subcommand {
                OrgCommands::Init { name } => {
                    let d = crate::org_session::org_dir(dir_path)?;
                    commands::org::run_init(&d, &name)?;
                    Ok(())
                }
            }
        }
    }
}

/// Check for test passphrase override (debug builds only; stripped from release).
#[cfg(debug_assertions)]
pub(crate) fn test_passphrase_override() -> Option<String> {
    std::env::var("RELICARIO_TEST_PASSPHRASE").ok()
}
#[cfg(not(debug_assertions))]
pub(crate) fn test_passphrase_override() -> Option<String> {
    None
}

/// Check for test item secret override (debug builds only; stripped from release).
#[cfg(debug_assertions)]
pub(crate) fn test_item_secret_override() -> Option<String> {
    std::env::var("RELICARIO_TEST_ITEM_SECRET").ok()
}
#[cfg(not(debug_assertions))]
pub(crate) fn test_item_secret_override() -> Option<String> {
    None
}

/// Check for test backup passphrase override (debug builds only; stripped from release).
#[cfg(debug_assertions)]
pub(crate) fn test_backup_passphrase_override() -> Option<String> {
    std::env::var("RELICARIO_TEST_BACKUP_PASSPHRASE").ok()
}
#[cfg(not(debug_assertions))]
pub(crate) fn test_backup_passphrase_override() -> Option<String> {
    None
}