/**
 * Export HTTP routes (Phase 8 — AGENTS.md §6.1 and §8).
 *
 * Covers the read-only export surface from the inventory:
 *
 *   GET /_/:room/html, /:room.html
 *   GET /_/:room/csv,  /:room.csv           + Content-Disposition
 *   GET /_/:room/csv.json, /:room.csv.json
 *   GET /_/:room/xlsx, /:room.xlsx          + Content-Disposition (binary)
 *   GET /_/:room/ods,  /:room.ods           + Content-Disposition (binary)
 *   GET /_/:room/fods, /:room.fods          + Content-Disposition (binary)
 *   GET /_/:room/md,   /:room.md
 *
 * Each route dispatches to the target DO's `/_do/<format>` endpoint and
 * streams the body back. Text bodies go through `Response.text()` (fine —
 * each DO response fits in memory by construction); binary bodies are read
 * as `ArrayBuffer` so we can re-emit them verbatim with the correct headers.
 *
 * ─── Multi-sheet export (`GET /_/=:room/xlsx` etc.) ─────────────────────
 *
 * Legacy behavior (src/main.ls:363-392): iterates the TOC sheet rows,
 * fetches each sub-sheet by its `<room>.<N>` key, and merges them into a
 * single workbook with one named sheet per row. This requires DO-to-DO
 * fetches plus some TOC-parsing glue that depends on Phase 6 exec routes
 * and the multi-sheet routing in §1. Scoped out of Phase 8 per the phase
 * spec — routes return `501 Phase 8.1` with a brief explanation body.
 *
 * Route registration is via `registerExports(app)`, separate from
 * `registerRoomRoutes(app)` to avoid collisions with Phase 6's planned
 * POST /_/:room additions on the same file. The registration order in
 * `src/index.ts` is documented there.
 */
/* istanbul ignore file */
import type { Hono } from 'hono';
import {
  MAX_MULTI_SHEETS,
  MAX_MULTI_SHEET_TITLE_LENGTH,
  isSafeMultiSheetLink,
} from '@ethercalc/shared';

import { doFetch } from '../lib/do-dispatch.ts';
import { readBoundedResponseText } from '../lib/cross-sheet.ts';
import { getSessionPrincipal } from '../lib/session-middleware.ts';
import type { SessionPrincipal } from '../lib/session.ts';
import {
  BINARY_CONTENT_TYPES,
  type BinaryFormat,
  buildMultiSheetWorkbookFromSheets,
} from '../lib/xlsx-build.ts';
import {
  ALLOWED_ELEMENTS,
  DANGEROUS_ELEMENTS,
  attributeAction,
} from '../lib/html-sanitize.ts';
import { MAX_IMPORT_CELLS } from '../lib/xlsx-import.ts';
import type { Env, EtherCalcHonoEnv } from '../env.ts';

const TEXT_CT = 'text/plain; charset=utf-8';
const MAX_MULTI_EXPORT_TOC_BYTES = 1024 * 1024;
const MAX_MULTI_EXPORT_SHEET_BYTES = 8 * 1024 * 1024;
const MAX_MULTI_EXPORT_TOTAL_CHARS = 12 * 1024 * 1024;

function multiExportTooLarge(): Response {
  return new Response('multi-sheet export exceeds resource limits', {
    status: 413,
    headers: { 'Content-Type': TEXT_CT },
  });
}

/**
 * Mirror a DO 401/403 auth verdict to the client verbatim (status +
 * text/plain body). Returns null for any other status so callers fall
 * through to their normal handling — export headers (attachment,
 * CSP, content type) never dress up a denial.
 */
async function authVerdict(res: Response): Promise<Response | null> {
  if (res.status !== 401 && res.status !== 403) return null;
  return new Response(await res.text(), {
    status: res.status,
    headers: { 'Content-Type': TEXT_CT },
  });
}

/**
 * Fetch the TOC sheet (at `:room`, sans `=` prefix) and its sub-rooms, then
 * build a single workbook with one worksheet per TOC row. TOC shape matches
 * `packages/client-multi/src/Foldr.ts`: first row is headers; subsequent
 * rows are `[link, title]` where link is `/<subroom>` and title is the
 * user-chosen sheet tab name.
 *
 * Returns `null` when the TOC is missing or empty — caller emits 404.
 * Returns a `Response` when the DO denied a read (401/403) — caller
 * propagates the verdict instead of masking it as a 404.
 */
async function fetchMultiSheetBundle(
  env: Env,
  room: string,
  principal: SessionPrincipal | null,
): Promise<Array<{ name: string; view: unknown }> | Response | null> {
  const tocRes = await doFetch(env, room, '/_do/csv.json', {}, principal);
  const tocDenied = await authVerdict(tocRes);
  if (tocDenied) return tocDenied;
  if (tocRes.status !== 200) return null;
  const tocText = await readBoundedResponseText(
    tocRes,
    MAX_MULTI_EXPORT_TOC_BYTES,
  );
  if (tocText === null) return multiExportTooLarge();
  let rows: unknown;
  try {
    rows = JSON.parse(tocText);
  } catch {
    return null;
  }
  if (!Array.isArray(rows) || rows.length < 2) return null;
  if (rows.length - 1 > MAX_MULTI_SHEETS) return multiExportTooLarge();

  // Skip the header row. Import and export share the same persisted TOC
  // limits, so a hand-edited TOC cannot fan one request out across an
  // unbounded number of Durable Objects.
  const tocRows = rows.slice(1) as unknown[];
  const bundle: Array<{ name: string; view: unknown }> = [];
  let totalChars = 0;
  let totalCells = 0;
  for (const raw of tocRows) {
    if (!Array.isArray(raw)) continue;
    const link = typeof raw[0] === 'string' ? raw[0] : '';
    if (!isSafeMultiSheetLink(link)) continue;
    const subroom = link.slice(1);
    const rawTitle = typeof raw[1] === 'string' ? raw[1] : '';
    const title =
      rawTitle.length > 0 && rawTitle.length <= MAX_MULTI_SHEET_TITLE_LENGTH
        ? rawTitle
        : `Sheet${bundle.length + 1}`;
    const sheetRes = await doFetch(env, subroom, '/_do/sheet-data', {}, principal);
    const sheetDenied = await authVerdict(sheetRes);
    if (sheetDenied) return sheetDenied;
    if (sheetRes.status !== 200) continue;
    const sheetText = await readBoundedResponseText(
      sheetRes,
      MAX_MULTI_EXPORT_SHEET_BYTES,
    );
    if (
      sheetText === null ||
      totalChars + sheetText.length > MAX_MULTI_EXPORT_TOTAL_CHARS
    ) {
      return multiExportTooLarge();
    }
    let view: unknown;
    try {
      view = JSON.parse(sheetText);
    } catch {
      continue;
    }
    const cells =
      view !== null &&
      typeof view === 'object' &&
      'cells' in view &&
      view.cells !== null &&
      typeof view.cells === 'object' &&
      !Array.isArray(view.cells)
        ? Object.keys(view.cells).length
        : 0;
    if (totalCells + cells > MAX_IMPORT_CELLS) {
      return multiExportTooLarge();
    }
    totalChars += sheetText.length;
    totalCells += cells;
    bundle.push({ name: title, view });
  }
  return bundle.length > 0 ? bundle : null;
}

async function dispatchMultiSheetExport(
  env: Env,
  room: string,
  format: BinaryFormat,
  principal: SessionPrincipal | null,
): Promise<Response> {
  const bundle = await fetchMultiSheetBundle(env, room, principal);
  if (bundle instanceof Response) return bundle;
  if (!bundle) {
    return new Response('', { status: 404, headers: { 'Content-Type': TEXT_CT } });
  }
  // `buildMultiSheetWorkbookFromSheets` expects `SocialCalcSheetView` —
  // the JSON we got from the DO is structurally identical.
  const bytes = buildMultiSheetWorkbookFromSheets(
    bundle as ReadonlyArray<{ name: string; view: Parameters<typeof buildMultiSheetWorkbookFromSheets>[0][number]['view'] }>,
    format,
  );
  // `bytes as unknown as BodyInit`: workerd accepts a `Uint8Array` body at
  // runtime; the cast satisfies the stricter `Uint8Array<ArrayBufferLike>`
  // lib typing that doesn't structurally match `BodyInit`.
  return new Response(bytes as unknown as BodyInit, {
    status: 200,
    headers: {
      'Content-Type': BINARY_CONTENT_TYPES[format],
      'Content-Disposition': attachmentHeader(room, format),
      'X-Content-Type-Options': 'nosniff',
    },
  });
}

/**
 * Content-Security-Policy for the HTML export. SocialCalc emits cells whose
 * `valueformat===text-html` are NOT escaped (socialcalc.bundled.ts), so an
 * attacker who can write a room (anonymous write is by design) could plant
 * `<img src=x onerror=…>` / `<script>` that would run in the deployment
 * origin when someone opens `/:room.html`. The exported document is a static
 * `<table>` with inline styles, so we lock it down to exactly that:
 *
 *   - `default-src 'none'` blocks scripts, fetch, frames, objects, etc.
 *     (this alone neutralizes `<script>` and inline `onerror` handlers).
 *   - `style-src 'unsafe-inline'` keeps the table's inline cell styling.
 *   - `img-src` is intentionally omitted (covered by `default-src 'none'`)
 *     so injected `<img>` never loads its `onerror` payload.
 *
 * `frame-ancestors` is deliberately NOT set — the HTML export is a
 * documented external-embed surface (§13 Q8), so we must stay iframe-able.
 */
const HTML_EXPORT_CSP = "default-src 'none'; style-src 'unsafe-inline'";

/** Format registry for dispatcher. Keyed by URL suffix / slot. */
interface ExportFormat {
  /** `/_do/<path>` on the DO. */
  readonly doPath: string;
  /** Content type that overrides whatever the DO sent (for defensive sanity). */
  readonly contentType: string;
  /** Whether this format is binary (read as ArrayBuffer) or text. */
  readonly binary: boolean;
  /** If set, emit `Content-Disposition: attachment; filename="<room>.<ext>"`. */
  readonly attachmentExt?: string;
  /** If set, emit this `Content-Security-Policy` on the response. */
  readonly csp?: string;
  /**
   * If set, run the (text) body through `HTMLRewriter` to strip
   * script-bearing markup before it leaves the worker. Defence-in-depth
   * beyond the CSP for the HTML export — see `lib/html-sanitize.ts`.
   */
  readonly sanitizeHtml?: boolean;
}

/**
 * Sanitize the export with the same element/attribute allowlist as the live
 * client. Active and parser-state elements are removed with their contents;
 * unknown inert tags are unwrapped so their text survives.
 *
 * The decision rules live in `lib/html-sanitize.ts` (pure, coverage-gated);
 * this wiring is workerd-only so the file carries `istanbul ignore file`.
 */
function sanitizeHtmlBody(html: string, headers: Record<string, string>): Response {
  const rewriter = new HTMLRewriter().on('*', {
    element(el) {
      const tag = el.tagName.toLowerCase();
      if (DANGEROUS_ELEMENTS.includes(tag)) {
        el.remove();
        return;
      }
      if (!ALLOWED_ELEMENTS.includes(tag)) {
        el.removeAndKeepContent();
        return;
      }
      // `el.attributes` yields `[name, value]` pairs at runtime (workerd).
      // Collect first because removeAttribute mutates the iterator.
      const attrIter = el.attributes as unknown as Iterable<readonly string[]>;
      const attrs: Array<readonly string[]> = [];
      for (const attr of attrIter) attrs.push(attr);
      for (const attr of attrs) {
        const name = attr[0] ?? '';
        const value = attr[1] ?? '';
        if (attributeAction(name, value) === 'remove') {
          el.removeAttribute(name);
        }
      }
      if (tag === 'a' && el.getAttribute('target')?.toLowerCase() === '_blank') {
        el.setAttribute('rel', 'noopener noreferrer');
      }
    },
  });
  return rewriter.transform(new Response(html, { headers }));
}

const FORMATS: Readonly<Record<string, ExportFormat>> = {
  html: {
    doPath: '/_do/html',
    contentType: 'text/html; charset=utf-8',
    binary: false,
    csp: HTML_EXPORT_CSP,
    sanitizeHtml: true,
  },
  csv: {
    doPath: '/_do/csv',
    contentType: 'text/csv; charset=utf-8',
    binary: false,
    attachmentExt: 'csv',
  },
  'csv.json': {
    doPath: '/_do/csv.json',
    contentType: 'application/json; charset=utf-8',
    binary: false,
  },
  md: {
    doPath: '/_do/md',
    contentType: 'text/x-markdown; charset=utf-8',
    binary: false,
  },
  xlsx: {
    doPath: '/_do/xlsx',
    contentType: BINARY_CONTENT_TYPES.xlsx,
    binary: true,
    attachmentExt: 'xlsx',
  },
  ods: {
    doPath: '/_do/ods',
    contentType: BINARY_CONTENT_TYPES.ods,
    binary: true,
    attachmentExt: 'ods',
  },
  fods: {
    doPath: '/_do/fods',
    contentType: BINARY_CONTENT_TYPES.fods,
    binary: true,
    attachmentExt: 'fods',
  },
};

function attachmentHeader(room: string, ext: string): string {
  // `encodeURI` preserves the shape legacy used everywhere (src/main.ls line
  // 143-144). Spaces become `%20`; quotes are escaped at the header level.
  const safe = encodeURI(room).replace(/"/g, '%22');
  return `attachment; filename="${safe}.${ext}"`;
}

async function dispatchExport(
  env: Env,
  room: string,
  format: ExportFormat,
  principal: SessionPrincipal | null,
): Promise<Response> {
  const res = await doFetch(env, room, format.doPath, {}, principal);
  const denied = await authVerdict(res);
  if (denied) return denied;
  if (res.status === 404) {
    return new Response('', { status: 404, headers: { 'Content-Type': TEXT_CT } });
  }
  const headers: Record<string, string> = {
    'Content-Type': format.contentType,
    // Stop browsers from MIME-sniffing an export (e.g. a `.csv` whose first
    // bytes look like HTML) into an executable type.
    'X-Content-Type-Options': 'nosniff',
  };
  if (format.csp) {
    headers['Content-Security-Policy'] = format.csp;
  }
  if (format.attachmentExt) {
    headers['Content-Disposition'] = attachmentHeader(room, format.attachmentExt);
  }
  if (format.binary) {
    const body = await res.arrayBuffer();
    return new Response(body, { status: res.status, headers });
  }
  const body = await res.text();
  if (format.sanitizeHtml) {
    // 200-only: error bodies are plain text the DO never wraps in markup.
    return sanitizeHtmlBody(body, headers);
  }
  return new Response(body, { status: res.status, headers });
}

/**
 * Register export routes on the Hono app. Call AFTER `registerRoomRoutes`
 * (which owns `/_/:room`) and BEFORE `registerRoomCatchAll` (which owns
 * `/:room`). Hono's trie matches longer literals first, so `/_/:room/csv`
 * still wins over `/_/:room` despite being registered after it.
 */
export function registerExports(app: Hono<EtherCalcHonoEnv>): void {
  // Multi-sheet export routes — AGENTS.md §6.1. These MUST come before the
  // single-sheet routes so Hono's literal prefix matcher routes `/=:room`
  // before `/:room`. Each walks the TOC via DO-to-DO fetches and assembles
  // one workbook with formula-fidelity per sub-sheet.
  for (const fmt of ['xlsx', 'ods', 'fods'] as const) {
    app.get(`/_/=:room/${fmt}`, async (c) =>
      dispatchMultiSheetExport(
        c.env,
        c.req.param('room') ?? '',
        fmt,
        await getSessionPrincipal(c),
      ),
    );
    app.get(`/=:room.${fmt}`, async (c) => {
      const raw = c.req.param('room') ?? '';
      const room = raw.slice(0, raw.length - fmt.length - 1);
      return dispatchMultiSheetExport(c.env, room, fmt, await getSessionPrincipal(c));
    });
  }

  // Single-sheet routes. Registered under both `/_/:room/<fmt>` and
  // `/:room.<fmt>` aliases — legacy API surface preserved byte-for-byte
  // (AGENTS.md §6.1 table entries).
  for (const [key, format] of Object.entries(FORMATS)) {
    // `/_/:room/<key>` form — explicit, no suffix-matching needed.
    //
    // Guard: if the room name starts with `=` we're actually in the
    // multi-sheet path. Hono's `:room` matcher greedily consumes `=room`
    // into the param so we peel it at runtime and hand back the 501 the
    // explicit multi-sheet route above would have emitted.
    app.get(`/_/:room/${key}`, async (c) => {
      const room = c.req.param('room') ?? '';
      const principal = await getSessionPrincipal(c);
      if (room.startsWith('=')) {
        // Multi-sheet only supports binary formats.
        if (format.binary && format.attachmentExt) {
          return dispatchMultiSheetExport(c.env, room.slice(1), format.attachmentExt as BinaryFormat, principal);
        }
        return new Response(
          `multi-sheet ${key} export: only xlsx/ods/fods supported`,
          { status: 501, headers: { 'Content-Type': TEXT_CT } },
        );
      }
      return dispatchExport(c.env, room, format, principal);
    });
    // `/:room.<key>` form — the room name may NOT contain a dot-extension
    // matching another registered format (legacy rule; rooms with dots are
    // encoded via `encodeURI` but the `.xlsx`/`.csv` suffixes are special).
    //
    // Hono's matcher treats `.` as a literal in the pattern, so this route
    // registers exactly as written. Rooms that end in the same suffix would
    // eagerly match this route — that matches legacy behavior.
    app.get(`/:room{.+\\.${key.replace('.', '\\.')}}`, async (c) => {
      const raw = c.req.param('room') ?? '';
      const room = raw.slice(0, raw.length - key.length - 1);
      const principal = await getSessionPrincipal(c);
      if (room.startsWith('=')) {
        if (format.binary && format.attachmentExt) {
          return dispatchMultiSheetExport(c.env, room.slice(1), format.attachmentExt as BinaryFormat, principal);
        }
        return new Response(
          `multi-sheet ${key} export: only xlsx/ods/fods supported`,
          { status: 501, headers: { 'Content-Type': TEXT_CT } },
        );
      }
      return dispatchExport(c.env, room, format, principal);
    });
  }
}