// Command tmplatformd is the TextMachine control plane: HTTP for the frontend, Postgres for the
// read model, and (from P-1 onward) a worker that supervises tmctl processes. It contains no
// translation logic: the engine is spawned, never linked (D39.81).
package main

import (
	"context"
	"errors"
	"log/slog"
	"net"
	"net/http"
	"os"
	"os/signal"
	"syscall"
	"time"

	"textmachine/platform/internal/auth"
	"textmachine/platform/internal/config"
	"textmachine/platform/internal/httpapi"
	"textmachine/platform/internal/pgstore"
)

func main() {
	// Structured logs on stderr, like the engine's: stdout stays free for anything machine-read.
	log := slog.New(slog.NewJSONHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelInfo}))
	if err := run(log); err != nil {
		log.Error("fatal", "err", err)
		os.Exit(1)
	}
}

func run(log *slog.Logger) error {
	cfg, err := config.Load()
	if err != nil {
		return err
	}

	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
	defer stop()

	var db *pgstore.Store
	if cfg.DSN == "" {
		// Deliberate: the process still serves liveness so a supervisor can start it before the
		// database exists. /readyz is the honest signal, and it says no.
		log.Warn("no TM_PLATFORM_DSN: starting without a database, /readyz will report not ready")
	} else {
		if cfg.Migrate {
			if err := pgstore.Migrate(ctx, cfg.DSN); err != nil {
				return err
			}
			log.Info("migrations applied")
		}
		if db, err = pgstore.Open(ctx, cfg.DSN); err != nil {
			return err
		}
		defer db.Close()
	}

	authn := &auth.Authenticator{
		IdleTTL: cfg.SessionIdleTTL,
		Deny:    httpapi.ProblemHandler(http.StatusUnauthorized, "Session missing or invalid"),
	}
	deps := httpapi.Deps{Log: log, Auth: authn, TrustedOrigins: cfg.TrustedOrigins}
	if db != nil {
		deps.DB = db
		authn.Sessions = db
	}
	handler, err := httpapi.New(deps)
	if err != nil {
		return err
	}

	srv := &http.Server{
		Addr:    cfg.Addr,
		Handler: handler,
		// No WriteTimeout: the SSE stream (P-1) is a long-lived response, and a write deadline set
		// here would cut it. Per-request deadlines belong on the handlers that want them.
		ReadHeaderTimeout: 10 * time.Second,
		IdleTimeout:       2 * time.Minute,
		MaxHeaderBytes:    1 << 16,
		BaseContext:       func(net.Listener) context.Context { return ctx },
	}

	errc := make(chan error, 1)
	go func() {
		log.Info("listening", "addr", cfg.Addr)
		errc <- srv.ListenAndServe()
	}()

	select {
	case err := <-errc:
		if errors.Is(err, http.ErrServerClosed) {
			return nil
		}
		return err
	case <-ctx.Done():
		stop() // a second signal now kills instead of waiting
		shutdownCtx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
		defer cancel()
		log.Info("shutting down")
		return srv.Shutdown(shutdownCtx)
	}
}