import "server-only";
import { NextRequest, NextResponse } from "next/server";

const LOCAL_HOSTS = new Set(["127.0.0.1", "::1", "localhost"]);

function bareHost(value: string | null): string {
  if (!value) return "";
  const trimmed = value.trim().toLowerCase();
  if (trimmed === "::1") return trimmed;
  if (trimmed.startsWith("[") && trimmed.includes("]")) {
    return trimmed.slice(1, trimmed.indexOf("]"));
  }
  return trimmed.split(":")[0];
}

function isLocalHost(value: string | null): boolean {
  return LOCAL_HOSTS.has(bareHost(value));
}

function trustedLanEnabled(): boolean {
  return process.env.PINKUDEX_TRUSTED_LAN === "1";
}

function trustedHostnames(): Set<string> {
  const raw = process.env.PINKUDEX_TRUSTED_HOSTNAMES;
  if (!raw) return new Set();
  return new Set(
    raw
      .split(",")
      .map((v) => v.trim().toLowerCase())
      .filter(Boolean),
  );
}

function parseIPv4(value: string): number[] | null {
  const parts = value.split(".");
  if (parts.length !== 4) return null;
  const octets: number[] = [];
  for (const p of parts) {
    if (!/^\d{1,3}$/.test(p)) return null;
    const n = Number(p);
    if (n < 0 || n > 255) return null;
    octets.push(n);
  }
  return octets;
}

function isPrivateIPv4(value: string): boolean {
  const o = parseIPv4(value);
  if (!o) return false;
  // 127.0.0.0/8 (loopback)
  if (o[0] === 127) return true;
  // 10.0.0.0/8
  if (o[0] === 10) return true;
  // 172.16.0.0/12
  if (o[0] === 172 && o[1] >= 16 && o[1] <= 31) return true;
  // 192.168.0.0/16
  if (o[0] === 192 && o[1] === 168) return true;
  // 100.64.0.0/10 (CGNAT / Tailscale)
  if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return true;
  return false;
}

function isPrivateIPv6(value: string): boolean {
  const v = value.toLowerCase();
  if (v === "::1") return true;
  // fc00::/7 (ULA): first byte 0xfc or 0xfd
  if (v.startsWith("fc") || v.startsWith("fd")) return true;
  // fe80::/10 (link-local)
  if (v.startsWith("fe8") || v.startsWith("fe9") || v.startsWith("fea") || v.startsWith("feb")) return true;
  return false;
}

function isTrustedHost(value: string | null): boolean {
  const host = bareHost(value);
  if (!host) return false;
  if (LOCAL_HOSTS.has(host)) return true;
  if (!trustedLanEnabled()) return false;
  if (host.includes(":") || /^[0-9a-f:]+$/i.test(host)) {
    if (isPrivateIPv6(host)) return true;
  }
  if (isPrivateIPv4(host)) return true;
  if (trustedHostnames().has(host)) return true;
  return false;
}

function forwardedFor(req: NextRequest): string[] {
  const out: string[] = [];
  const xff = req.headers.get("x-forwarded-for");
  if (xff) out.push(...xff.split(",").map((v) => v.trim()).filter(Boolean));
  const realIp = req.headers.get("x-real-ip");
  if (realIp) out.push(realIp.trim());
  const forwarded = req.headers.get("forwarded");
  if (forwarded) {
    for (const part of forwarded.split(",")) {
      const m = part.match(/(?:^|;)\s*for="?(\[?[^\]";,]+]?)"?/i);
      if (m) out.push(m[1].trim());
    }
  }
  return out;
}

function sameOriginHeaderIsTrusted(req: NextRequest, header: "origin" | "referer"): boolean {
  const raw = req.headers.get(header);
  if (!raw) return true;
  try {
    return isTrustedHost(new URL(raw).hostname);
  } catch {
    return false;
  }
}

export function assertLocalRequest(req: NextRequest): NextResponse | null {
  const hostIsLocal = isTrustedHost(req.headers.get("host")) && isTrustedHost(req.nextUrl.hostname);
  const forwarded = forwardedFor(req);
  const forwardedIsLocal = forwarded.length === 0 || forwarded.every(isTrustedHost);
  const originIsLocal =
    sameOriginHeaderIsTrusted(req, "origin") && sameOriginHeaderIsTrusted(req, "referer");
  if (hostIsLocal && forwardedIsLocal && originIsLocal) return null;
  return NextResponse.json(
    { error: "This endpoint is only available from the local machine." },
    { status: 403 },
  );
}

export { isLocalHost };