DodoSSH/src/DodoSSH.Client.Import/HetznerServer.cs

using System.Globalization;
using System.Net;
using System.Net.Sockets;
using DodoSSH.Client.Domain;

namespace DodoSSH.Client.Import;

/// <summary>
/// Which of a Hetzner server's addresses an import should dial.
/// </summary>
/// <remarks>
/// One choice for the whole import rather than one per row, for the reason the ssh_config screen's key tick
/// is one control: an estate is reached the same way throughout — everything over the public internet, or
/// everything across the private network from a machine already inside it — and a per-server dropdown would
/// be forty answers to one question.
/// </remarks>
public enum HetznerAddressKind
{
    /// <summary>The public IPv4 address, which is how all but the cheapest Hetzner servers are reached.</summary>
    PublicIPv4 = 0,

    /// <summary>The public IPv6 address, for an estate that is v6 throughout — or a server with no v4 at all.</summary>
    PublicIPv6 = 1,

    /// <summary>The address on the first private network the server is attached to.</summary>
    Private = 2,
}

/// <summary>
/// An address an import settled on, and what it had to assume to get there.
/// </summary>
/// <param name="Value">What the host will dial.</param>
/// <param name="Warning">
/// What is not simply a fact the API stated, or null where it is. Every one of these is a place the import
/// is deciding something on somebody's behalf, and a bookmark that dials the wrong machine is worse than one
/// that was never offered — so they are shown beside the row rather than folded away.
/// </param>
public sealed record HetznerAddress(string Value, string? Warning);

/// <summary>
/// One server a Hetzner Cloud project holds, as the import sees it.
/// </summary>
/// <remarks>
/// <para>
/// Deliberately not a <see cref="HostSecret"/>, on exactly the reasoning <see cref="ImportedHost"/> gives:
/// this is a candidate nobody has agreed to import, and it carries facts a stored host has no field for —
/// the server's own id, what it is running, where it runs, and which of its several addresses were on offer.
/// </para>
/// <para>
/// <b>There is no key here and there cannot be.</b> The Cloud API will name the SSH keys a project holds and
/// hand over their public halves; the private halves have never been in Hetzner's hands. So an imported host
/// authenticates with a key that was already in this keychain or it asks for a password, and the import
/// screen says so rather than leaving somebody to find out at connect time.
/// </para>
/// </remarks>
/// <param name="Id">The server's id in the project, which is the one name of it that never changes.</param>
/// <param name="Name">What the project calls it, which is what the user will recognise.</param>
/// <param name="Status">
/// <c>running</c>, <c>off</c>, <c>initializing</c> and the rest. Shown on the row and deliberately not
/// stored: it stays true for as long as it takes somebody to press a button in the Hetzner console.
/// </param>
/// <param name="PublicIPv4">The public IPv4 address, or null on a server that has none.</param>
/// <param name="PublicIPv6Network">
/// The public IPv6 <em>network</em> — Hetzner routes a whole /64 and the API reports the prefix, not an
/// address. See <see cref="FirstIPv6Address"/> for what this import does with that.
/// </param>
/// <param name="PrivateAddresses">The addresses it has on private networks, in the order the API gave them.</param>
/// <param name="ServerType">The plan — <c>cx22</c>, <c>ccx13</c> — or null where the API did not say.</param>
/// <param name="Location">Where it runs, as a person would say it: <c>fsn1 · Falkenstein, DE</c>.</param>
/// <param name="Image">What it was built from, which is the best available hint at which user logs in.</param>
/// <param name="Labels">The project's own labels, as <c>key=value</c>, sorted.</param>
public sealed record HetznerServer(
    long Id,
    string Name,
    string Status,
    string? PublicIPv4,
    string? PublicIPv6Network,
    IReadOnlyList<string> PrivateAddresses,
    string? ServerType,
    string? Location,
    string? Image,
    IReadOnlyList<string> Labels)
{
    /// <summary>Whether the API gave this server a public IPv4 address at all.</summary>
    /// <remarks>
    /// Not a formality. Hetzner bills IPv4 separately now, and a project built since then can be entirely
    /// IPv6-only — which is exactly the case an import that assumed a v4 would get silently wrong.
    /// </remarks>
    public bool HasPublicIPv4 => PublicIPv4 is { Length: > 0 };

    /// <summary>
    /// The address inside the routed /64 that a stock Hetzner image actually answers on.
    /// </summary>
    /// <remarks>
    /// <para>
    /// <b>This is a convention and not a fact the API stated</b>, which is why every use of it carries a
    /// warning. What the API reports is <c>2a01:4f8:1c17:d00::/64</c> — a network, which nothing can dial.
    /// The address Hetzner's own images configure is the first one in it, and the console shows the same
    /// thing; a server whose operator moved it elsewhere in the /64 will not answer here.
    /// </para>
    /// <para>
    /// Computed by setting the low byte rather than by string surgery on the prefix, so a network the API
    /// spells some other way still yields an address rather than a malformed string.
    /// </para>
    /// </remarks>
    public string? FirstIPv6Address
    {
        get
        {
            if (PublicIPv6Network is not { Length: > 0 } network)
            {
                return null;
            }

            var slash = network.IndexOf('/', StringComparison.Ordinal);
            var prefix = slash < 0 ? network : network[..slash];

            if (!IPAddress.TryParse(prefix, out var parsed)
                || parsed.AddressFamily != AddressFamily.InterNetworkV6)
            {
                return null;
            }

            var bytes = parsed.GetAddressBytes();
            bytes[^1] = 1;

            return new IPAddress(bytes).ToString();
        }
    }

    /// <summary>
    /// Settles on the address this server would be dialled at, or null where the choice has none to offer.
    /// </summary>
    /// <remarks>
    /// The two public choices fall back to each other and the private one does not, and that asymmetry is
    /// deliberate. Falling back between v4 and v6 reaches the same machine over the same internet, so the
    /// worst case is a route somebody did not pick; falling back from a private address to a public one
    /// would put an address on the open internet into a bookmark that was asked to stay off it. So a server
    /// with no private address is simply not importable under that choice, and the screen says which.
    /// </remarks>
    public HetznerAddress? Resolve(HetznerAddressKind kind)
    {
        var six = FirstIPv6Address;

        return kind switch
        {
            HetznerAddressKind.PublicIPv4 when HasPublicIPv4 => new(PublicIPv4!, null),
            HetznerAddressKind.PublicIPv4 when six is not null => new(
                six,
                $"No public IPv4. This is the first address of {PublicIPv6Network}, which is where Hetzner's "
                    + "own images put the server — the API reports the network, not an address."),
            HetznerAddressKind.PublicIPv6 when six is not null => new(
                six,
                $"The API reports {PublicIPv6Network} rather than an address. This is the first address in "
                    + "it, which is where Hetzner's own images put the server."),
            HetznerAddressKind.PublicIPv6 when HasPublicIPv4 => new(
                PublicIPv4!,
                "No public IPv6 on this server, so this is its IPv4 address."),
            HetznerAddressKind.Private when PrivateAddresses.Count > 1 => new(
                PrivateAddresses[0],
                $"On {PrivateAddresses.Count} private networks. This is the first the API listed."),
            HetznerAddressKind.Private when PrivateAddresses.Count == 1 => new(PrivateAddresses[0], null),
            _ => null,
        };
    }

    /// <summary>Turns this into the host that would be stored.</summary>
    /// <remarks>
    /// <para>
    /// <b>Nothing here authenticates.</b> There is no key to bring — see the remark on this record — so the
    /// host arrives bound to nothing and asks for a password until somebody points it at a key already in
    /// the keychain. That is the same shape an <c>ssh_config</c> import has with its key tick off, and it is
    /// stated on the screen rather than discovered at connect time.
    /// </para>
    /// <para>
    /// <b>What goes in the notes is what does not go stale.</b> The id, the plan, the location and the image
    /// survive; the power state does not, so it is a column on the import screen and never a note. A note
    /// saying "running" about a machine somebody switched off last March is worse than no note.
    /// </para>
    /// </remarks>
    /// <param name="address">The address to dial, from <see cref="Resolve"/>.</param>
    /// <param name="username">The login user, or null and empty for none.</param>
    /// <param name="port">The SSH port.</param>
    public HostSecret ToSecret(HetznerAddress address, string? username, int port)
    {
        ArgumentNullException.ThrowIfNull(address);

        return new HostSecret
        {
            Label = Name,
            Hostname = address.Value,
            Port = port,
            Username = string.IsNullOrWhiteSpace(username) ? null : username.Trim(),
            Notes = Describe(address),
        };
    }

    /// <summary>What the note says about where this came from, plus whatever the address had to assume.</summary>
    private string Describe(HetznerAddress address)
    {
        var facts = new List<string> { string.Create(CultureInfo.InvariantCulture, $"server {Id}") };

        if (ServerType is { Length: > 0 } plan)
        {
            facts.Add(plan);
        }

        if (Location is { Length: > 0 } where)
        {
            facts.Add(where);
        }

        if (Image is { Length: > 0 } image)
        {
            facts.Add($"image {image}");
        }

        if (Labels.Count > 0)
        {
            facts.Add($"labels {string.Join(", ", Labels)}");
        }

        var sentence = $"Imported from Hetzner Cloud: {string.Join(", ", facts)}.";

        return address.Warning is { Length: > 0 } warning ? $"{sentence} {warning}" : sentence;
    }
}

/// <summary>
/// Everything a Hetzner Cloud project yielded: the servers it can offer, and what it could not.
/// </summary>
/// <param name="Servers">The importable candidates, in the order the API returned them.</param>
/// <param name="Warnings">
/// What the read could not represent, at project level — a page that came back malformed, a server the API
/// described without a name. The counterpart of <see cref="SshConfigImport.Warnings"/>.
/// </param>
public sealed record HetznerImport(IReadOnlyList<HetznerServer> Servers, IReadOnlyList<string> Warnings);