// Server-side invoice PDF rendering via the shared HTML -> PDF pipeline
// (OPL-2602). This is the HTML-first replacement for the imperative
// `@libpdf/core` path in `./app-renderer`: it renders the SAME config-driven
// `templates-html` React template the user sees on screen to a self-contained
// HTML document, then hands that document to `@scribe.cool/core/pdf`'s
// `renderPdf()` so what prints matches the preview.
//
// Like `./app-renderer` and `../pdf`, this module pulls in the heavy renderer
// (playwright-core, and on serverless @sparticuz/chromium), so it is
// intentionally NOT re-exported from `./index`. Import it directly from
// "@scribe.cool/core/invoice/render-html-pdf" only on PDF download/email paths.
//
// SECURITY (untrusted config):
//   - The template config is user/org-controlled (DB-backed). Its brand colors
//     are serialized into a RAW <style> block we build by hand, where React's
//     escaping does NOT apply — so a poisoned value like
//     `red;}</style><script>…` would break out. `sanitizeInvoiceConfig` runs a
//     STRICT zod schema at the render boundary and FAILS CLOSED (substitutes a
//     safe default) per field, so nothing unvalidated ever reaches the markup.
//   - Logos are accepted ONLY as `data:image/…` URIs. We do NOT fetch remote
//     (http/https) logo URLs server-side — that would be an SSRF sink (cloud
//     metadata, localhost, RFC1918, internal hosts). A non-data: logo is dropped
//     with a logged warning. (Hardened remote-logo fetching is a separate
//     ticket: HTTPS-only + private-IP blocking + redirect re-validation.)
//   - The pipeline itself also treats the final HTML as untrusted: JS off, and
//     every subresource aborted unless its scheme is data:/blob:. We never widen
//     that allow-list.

import { createElement } from "react";
import { z } from "zod";
import { getDefaultTemplate } from "../db";
import type { InvoiceTemplateConfig } from "../db/schema";
import {
  buildPrintCss,
  type PaperSize,
  type PDFRenderOptions,
  renderPdf,
} from "../pdf";
import { HEX_COLOR } from "../utils/color";
import {
  configToCssVars,
  selectHtmlInvoiceTemplate,
  selectHtmlInvoiceTemplateMeta,
} from "./templates-html";
import type {
  InvoicePageSize,
  InvoiceTemplateData,
} from "./templates-html/types";

export interface RenderInvoiceHtmlPdfOptions {
  /** Normalized invoice payload (same shape the on-screen preview consumes). */
  invoice: InvoiceTemplateData;
  /** User-editable branding/layout config from the invoice_templates table. */
  config: InvoiceTemplateConfig;
  /**
   * Built-in template to render ("minimal" | "mandala"). Unknown/omitted falls
   * back to "minimal" — the same default the on-screen previews use.
   */
  templateName?: string | null;
  /** Print page geometry. Defaults to "letter". */
  pageSize?: InvoicePageSize;
}

/** Map the template's page-size token to the pipeline's paper-size token. */
function toPaperSize(pageSize: InvoicePageSize): PaperSize {
  return pageSize === "a4" ? "A4" : "Letter";
}

/** Resolve PDF options from template metadata without launching a browser. */
export function getInvoicePdfRenderOptions(
  templateName: string | null | undefined,
  pageSize: InvoicePageSize = "letter",
): PDFRenderOptions {
  const options: PDFRenderOptions = {
    paperSize: toPaperSize(pageSize),
    printBackground: true,
  };
  if (selectHtmlInvoiceTemplateMeta(templateName).fullBleed) {
    options.margin = "0";
  }
  return options;
}

// ── Config sanitization (fail-closed) ──────────────────────

/** Logos must be self-contained image data URIs; remote URLs are rejected. */
const DATA_IMAGE_URI = /^data:image\//i;
/** Upper bound on any free-text field, to cap document size / pathological input. */
const MAX_TEXT = 2000;

/**
 * Validate a (possibly poisoned) `InvoiceTemplateConfig` BEFORE any value
 * reaches `configToCssVars` / the raw `<style>` block or the React template.
 *
 * Every field is validated with a strict zod schema and `.catch(default)` so an
 * invalid value FAILS CLOSED to that field's safe default rather than being
 * serialized verbatim. Unknown keys are stripped (zod's default object mode).
 * Colors must be strict hex, so they cannot contain CSS/HTML breakout
 * characters (`;`, `}`, `<`, `>`); the logo must be a `data:image/…` URI or it
 * is dropped (never fetched).
 */
export function sanitizeInvoiceConfig(
  config: InvoiceTemplateConfig,
): InvoiceTemplateConfig {
  const defaults = getDefaultTemplate();
  const hexColor = (fallback: string) =>
    z.string().trim().regex(HEX_COLOR).catch(fallback);
  const boundedText = z.string().max(MAX_TEXT);
  const optionalText = boundedText.optional().catch(undefined);

  const schema = z.object({
    logo: z
      .string()
      .regex(DATA_IMAGE_URI)
      .max(5_000_000)
      .optional()
      .catch(undefined),
    companyName: boundedText.catch(defaults.companyName),
    companyAddress: optionalText,
    companyEmail: optionalText,
    companyPhone: optionalText,
    primaryColor: hexColor(defaults.primaryColor),
    accentColor: hexColor(defaults.accentColor),
    textColor: hexColor(defaults.textColor),
    headerStyle: z
      .enum(["classic", "modern", "minimal"])
      .catch(defaults.headerStyle),
    showLogo: z.boolean().catch(defaults.showLogo),
    showCompanyDetails: z.boolean().catch(defaults.showCompanyDetails),
    showHours: z.boolean().catch(defaults.showHours),
    showRate: z.boolean().catch(defaults.showRate),
    showProjectBreakdown: z.boolean().catch(defaults.showProjectBreakdown),
    footerText: optionalText,
    paymentInstructions: optionalText,
    paymentMethods: z
      .array(
        z.object({
          type: boundedText,
          label: boundedText,
          details: z.record(z.string(), boundedText),
        }),
      )
      .optional()
      .catch(undefined),
  });

  // Guard against a non-object config; every field has a default/catch, so an
  // empty object parses to a fully-valid default-ish config.
  const input = config && typeof config === "object" ? (config as object) : {};
  const parsed = schema.parse(input);
  if (config?.logo && parsed.logo === undefined) {
    console.warn(
      "[invoice] logo is not a data:image/ URI; omitting it from the PDF (remote logo URLs are not fetched).",
    );
  }
  return parsed as InvoiceTemplateConfig;
}

/** Serialize a `configToCssVars` object into CSS custom-property declarations. */
function cssVarsToDeclarations(
  vars: Record<string, string | undefined>,
): string {
  return Object.entries(vars)
    .filter(([, value]) => value !== undefined && value !== null)
    .map(([name, value]) => `  ${name}: ${value};`)
    .join("\n");
}

/**
 * Build the full, self-contained HTML document for an invoice. The selected
 * `templates-html` React template already injects its own scoped print CSS and
 * CSS-variable scope; here we additionally place the shared `buildPrintCss`
 * base and the `configToCssVars` palette on `:root` in the document <head> so
 * the document carries the print base even outside the template's frame.
 *
 * The config is sanitized (fail-closed) before any value is rendered or
 * serialized into the `<style>` block. Async because `react-dom/server` is
 * loaded at runtime (see below).
 */
export async function buildInvoiceHtmlDocument(
  options: RenderInvoiceHtmlPdfOptions,
): Promise<string> {
  const pageSize: InvoicePageSize = options.pageSize ?? "letter";
  const paperSize = toPaperSize(pageSize);
  const config = sanitizeInvoiceConfig(options.config);

  // `react-dom/server` is imported dynamically: Next.js (App Router) statically
  // forbids importing it anywhere in a route's module graph, even from a
  // server-only Route Handler. A runtime import keeps it out of that static
  // graph while still running purely server-side here.
  const { renderToStaticMarkup } = await import("react-dom/server");
  const Template = selectHtmlInvoiceTemplate(options.templateName);
  const body = renderToStaticMarkup(
    createElement(Template, { invoice: options.invoice, config, pageSize }),
  );

  const rootVars = cssVarsToDeclarations(
    configToCssVars(config) as Record<string, string | undefined>,
  );
  const printCss = buildPrintCss({ paperSize });

  return `<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8" />
<style>
:root {
${rootVars}
}
/* Full-bleed templates size themselves to 100vh; the UA's default body
   margin would push them past the page and spill an empty trailing page. */
html, body { margin: 0; padding: 0; }
${printCss}
</style>
</head>
<body>
${body}
</body>
</html>`;
}

/**
 * Render an invoice to PDF bytes via the shared HTML -> PDF pipeline. The
 * runtime (local Chromium vs serverless @sparticuz/chromium) is autodetected by
 * the pipeline from the environment; callers do not select it here.
 */
export async function renderInvoiceHtmlPdf(
  options: RenderInvoiceHtmlPdfOptions,
): Promise<Uint8Array> {
  const html = await buildInvoiceHtmlDocument(options);
  // printBackground: true — the mandala template relies on background fills.
  return renderPdf(
    html,
    getInvoicePdfRenderOptions(options.templateName, options.pageSize),
  );
}