// Server-side activity-report PDF rendering via the shared HTML -> PDF pipeline
// (OPL-2598). This is the lazy "Download PDF" backend for the hub `/reports`
// page: it renders the SAME config-driven `ReportTemplate` the user sees to a
// self-contained HTML document, then hands that document to
// `@scribe.cool/core/pdf`'s `renderPdf()` so what prints matches the preview.
//
// Like `../invoice/render-html-pdf` and `../pdf`, this module pulls in the heavy
// renderer (playwright-core, and on serverless @sparticuz/chromium), so it is
// intentionally NOT re-exported from any broad index. Import it directly from
// "@scribe.cool/core/report/render-report-pdf" only on PDF download paths.
//
// SECURITY (untrusted config + report content):
//   - The branding config's colors are serialized into a RAW <style> block we
//     build by hand, where React's escaping does NOT apply — so a poisoned value
//     like `red;}</style><script>…` would break out. `sanitizeReportConfig`
//     runs a STRICT zod schema at the render boundary and FAILS CLOSED
//     (substitutes a safe default) per field, so nothing unvalidated ever
//     reaches the markup. Colors must be strict hex, so they cannot contain
//     CSS/HTML breakout characters (`;`, `}`, `<`, `>`).
//   - All report content (project names, highlights, source/device labels) is
//     rendered as React-escaped children in `ReportTemplate` — never
//     interpolated into the raw HTML/style strings.
//   - The only asset is the optional masthead logo, which `sanitizeReportConfig`
//     validates FAIL-CLOSED to a base64 `data:image/*` URI (remote `http(s)://`
//     logos are dropped to `undefined`), so it can never become an SSRF gadget
//     — mirroring the invoice renderer's logo policy. The pipeline itself also
//     treats the final HTML as untrusted: JS off, and every subresource aborted
//     unless its scheme is data:/blob:. We never widen that allow-list.

import { createElement } from "react";
import { z } from "zod";
import { buildPrintCss, type PaperSize, renderPdf } from "../pdf";
import type { ActivityReport } from "../utils/activity-report";
import { HEX_COLOR } from "../utils/color";
import {
  DEFAULT_REPORT_CONFIG,
  type ReportFilter,
  type ReportPageSize,
  type ReportScope,
  ReportTemplate,
  type ReportTemplateConfig,
  type ReportTemplateProps,
  reportConfigToCssVars,
} from "./report-template";

export interface RenderReportHtmlPdfOptions {
  /** The report view model (same shape the on-screen preview consumes). */
  report: ActivityReport;
  /** Branding/theme config. Defaults to `DEFAULT_REPORT_CONFIG` (sanitized). */
  config?: ReportTemplateConfig;
  /** Who the report covers. Defaults to "me". */
  scope?: ReportScope;
  /** Client/internal filter applied. Defaults to "both". */
  filter?: ReportFilter;
  /** Look-back window used when the report has no explicit range. Default 7. */
  days?: number;
  /** Print page geometry. Defaults to "letter". */
  pageSize?: ReportPageSize;
  /** Optional AI narrative (OPL-2812) — additive Summary lead paragraph. */
  narrative?: ReportTemplateProps["narrative"];
}

/** Map the template's page-size token to the pipeline's paper-size token. */
function toPaperSize(pageSize: ReportPageSize): PaperSize {
  return pageSize === "a4" ? "A4" : "Letter";
}

// ── Config sanitization (fail-closed) ──────────────────────

/** Upper bound on any free-text field, to cap document size / pathological input. */
const MAX_TEXT = 2000;

/**
 * Logo must be a base64 `data:image/*` URI (never a remote URL — that would be
 * an SSRF gadget from these server-side render paths). Capped at 500KB encoded
 * (~375KB raw) to prevent JSON-blob abuse; the same bound the invoice logo uses.
 */
const DATA_IMAGE_URI = /^data:image\/[a-z+.-]+;base64,/i;
const MAX_LOGO_BYTES = 500 * 1024;

/**
 * Validate a (possibly poisoned) `ReportTemplateConfig` BEFORE any value reaches
 * `reportConfigToCssVars` / the raw `<style>` block or the React template.
 *
 * Every field is validated with a strict zod schema and `.catch(default)` so an
 * invalid value FAILS CLOSED to that field's safe default rather than being
 * serialized verbatim. Unknown keys are stripped. Colors must be strict hex, so
 * they cannot contain CSS/HTML breakout characters.
 */
export function sanitizeReportConfig(
  config: ReportTemplateConfig | undefined,
): ReportTemplateConfig {
  const hexColor = (fallback: string) =>
    z.string().trim().regex(HEX_COLOR).catch(fallback);
  const optionalText = z.string().max(MAX_TEXT).optional().catch(undefined);

  const schema = z.object({
    primaryColor: hexColor(DEFAULT_REPORT_CONFIG.primaryColor),
    accentColor: hexColor(DEFAULT_REPORT_CONFIG.accentColor),
    textColor: hexColor(DEFAULT_REPORT_CONFIG.textColor),
    companyName: optionalText,
    logo: z
      .string()
      .regex(DATA_IMAGE_URI)
      .max(MAX_LOGO_BYTES)
      .optional()
      .catch(undefined),
    footerText: optionalText,
  });

  // Guard against a non-object config; every field has a default/catch, so an
  // empty object parses to a fully-valid default config.
  const input = config && typeof config === "object" ? config : {};
  return schema.parse(input) as ReportTemplateConfig;
}

/** Serialize a CSS-vars object into CSS custom-property declarations. */
function cssVarsToDeclarations(
  vars: Record<string, string | undefined>,
): string {
  return Object.entries(vars)
    .filter(([, value]) => value !== undefined && value !== null)
    .map(([name, value]) => `  ${name}: ${value};`)
    .join("\n");
}

/**
 * Build the full, self-contained HTML document for a report. The `ReportTemplate`
 * already injects its own scoped print CSS and CSS-variable scope; here we
 * additionally place the shared `buildPrintCss` base and the
 * `reportConfigToCssVars` palette on `:root` in the document <head> so the
 * document carries the print base even outside the template's frame.
 *
 * The config is sanitized (fail-closed) before any value is rendered or
 * serialized into the `<style>` block. Async because `react-dom/server` is
 * loaded at runtime (see below).
 */
export async function buildReportHtmlDocument(
  options: RenderReportHtmlPdfOptions,
): Promise<string> {
  const pageSize: ReportPageSize = options.pageSize ?? "letter";
  const paperSize = toPaperSize(pageSize);
  const config = sanitizeReportConfig(options.config ?? DEFAULT_REPORT_CONFIG);

  // `react-dom/server` is imported dynamically: Next.js (App Router) statically
  // forbids importing it anywhere in a route's module graph, even from a
  // server-only Route Handler. A runtime import keeps it out of that static
  // graph while still running purely server-side here.
  const { renderToStaticMarkup } = await import("react-dom/server");
  const body = renderToStaticMarkup(
    createElement(ReportTemplate, {
      report: options.report,
      config,
      scope: options.scope,
      filter: options.filter,
      days: options.days,
      pageSize,
      narrative: options.narrative,
    }),
  );

  const rootVars = cssVarsToDeclarations(
    reportConfigToCssVars(config) as Record<string, string | undefined>,
  );
  const printCss = buildPrintCss({ paperSize });

  return `<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8" />
<style>
:root {
${rootVars}
}
${printCss}
</style>
</head>
<body>
${body}
</body>
</html>`;
}

/**
 * Render a report to PDF bytes via the shared HTML -> PDF pipeline. The runtime
 * (local Chromium vs serverless @sparticuz/chromium) is autodetected by the
 * pipeline from the environment; callers do not select it here.
 */
export async function renderReportHtmlPdf(
  options: RenderReportHtmlPdfOptions,
): Promise<Uint8Array> {
  const html = await buildReportHtmlDocument(options);
  const paperSize = toPaperSize(options.pageSize ?? "letter");
  // printBackground: true — the report relies on subtle background fills.
  return renderPdf(html, { paperSize, printBackground: true });
}