<?php

declare(strict_types=1);

namespace App\Console\Commands;

use App\Http\Facade\SignRSA;
use Illuminate\Console\Command;
use Illuminate\Support\Facades\Crypt;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Schema;
use RuntimeException;
use Throwable;

class ReencryptSecrets extends Command
{
    protected $signature = 'secrets:reencrypt {--dry-run}';

    protected $description = 'Re-encrypt stored secrets with the current APP_KEY and RSA_KEY (old values are read via APP_PREVIOUS_KEYS / RSA_PREVIOUS_*)';

    private const RSA_COLUMNS = [
        ['module_vcenter', 'password'],
        ['infra_management', 'password'],
        ['module_hosting', 'password'],
        ['module_hosting_server', 'password'],
        ['module_dns_server', 'password'],
        ['module_vmware', 'password'],
        ['reinstall_logs', 'password'],
    ];

    private const APP_KEY_COLUMNS = [
        ['dns_manager_servers', 'password'],
        ['module_hosting_plesk_clients', 'password'],
        ['module_vmware', 'plain_password'],
        ['reinstall_logs', 'plain_password'],
    ];

    public function handle(): int
    {
        $failed = 0;

        foreach (self::RSA_COLUMNS as [$table, $column]) {
            $failed += $this->reencryptColumn($table, $column, fn (string $value) => SignRSA::EncryptFunc($this->decryptRsa($value)));
        }

        foreach (self::APP_KEY_COLUMNS as [$table, $column]) {
            $failed += $this->reencryptColumn($table, $column, fn (string $value) => Crypt::encryptString(Crypt::decryptString($value)));
        }

        $failed += $this->reencryptSmtpSetting();

        return $failed === 0 ? self::SUCCESS : self::FAILURE;
    }

    private function reencryptColumn(string $table, string $column, callable $reencrypt): int
    {
        if (!Schema::hasColumn($table, $column)) {
            $this->warn("{$table}.{$column}: column not found, skipped");

            return 0;
        }

        $updated = 0;
        $failed = 0;

        DB::table($table)
            ->select(['id', $column])
            ->whereNotNull($column)
            ->where($column, '!=', '')
            ->chunkById(200, function ($rows) use ($table, $column, $reencrypt, &$updated, &$failed) {
                foreach ($rows as $row) {
                    try {
                        $value = $reencrypt((string) $row->{$column});
                    } catch (Throwable) {
                        $failed++;
                        $this->warn("{$table}#{$row->id}.{$column}: cannot decrypt with current or previous key");
                        continue;
                    }

                    if (!$this->option('dry-run')) {
                        DB::table($table)->where('id', $row->id)->update([$column => $value]);
                    }
                    $updated++;
                }
            });

        $this->info("{$table}.{$column}: {$updated} re-encrypted, {$failed} failed");

        return $failed;
    }

    private function reencryptSmtpSetting(): int
    {
        $setting = DB::table('setting')->where('key', 'smtp')->first();
        $smtp = $setting ? json_decode((string) $setting->value, true) : null;

        if (empty($smtp['password'])) {
            return 0;
        }

        try {
            $smtp['password'] = SignRSA::EncryptFunc($this->decryptRsa($smtp['password']));
        } catch (Throwable) {
            $this->warn('setting[smtp].password: cannot decrypt with current or previous key');

            return 1;
        }

        if (!$this->option('dry-run')) {
            DB::table('setting')->where('key', 'smtp')->update(['value' => json_encode($smtp)]);
        }
        $this->info('setting[smtp].password: re-encrypted');

        return 0;
    }

    private function decryptRsa(string $value): string
    {
        $plain = SignRSA::DecryptFunc($value);
        if ($plain === '') {
            throw new RuntimeException('RSA decrypt failed');
        }

        return $plain;
    }
}