using Microsoft.Extensions.Hosting;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;

namespace ZB.MOM.WW.ScadaBridge.SiteEventLogging;

/// <summary>
/// Predicate the <see cref="EventLogPurgeService"/>
/// consults at the top of every purge tick to decide whether THIS node should
/// run the daily purge. The design states "a daily background job runs on the
/// active node and deletes all events older than 30 days"; the standby's local
/// SQLite receives no writes, so purging there is harmless but unnecessary —
/// and silently doing it anyway diverges from the design.
///
/// Registration is the Host's responsibility (it knows the cluster topology);
/// when no implementation is registered the purge service defaults to "always
/// active" so non-clustered hosts and unit tests are unaffected — backward
/// compatible with the prior "run on every host" behaviour.
/// </summary>
/// <returns><c>true</c> if this node is the active site member and should run the purge; <c>false</c> to skip.</returns>
public delegate bool SiteEventLogActiveNodeCheck();

/// <summary>
/// Predicate the <see cref="EventLogPurgeService"/> consults when a purge actually deleted
/// rows, to decide whether to add the "expect a transient replication backlog" operator note
/// to its purge log line.
///
/// <para>
/// <c>site_events</c> is one of LocalDb's replicated tables, and CDC captures a retention
/// DELETE exactly like any other row change — by design, since Phase 2 there is deliberately
/// no purge-exemption path. So on a replication-enabled node the purge briefly inflates the
/// oplog (health field <c>LocalDbOplogBacklog</c>, Prometheus <c>localdb_oplog_depth</c>),
/// which reads like a replication fault to an operator who does not know a purge just ran.
/// The log line is the breadcrumb that ties the two together; it is a message-wording choice
/// only and changes no purge behaviour.
/// </para>
///
/// <para>
/// Registration is the Host's responsibility — SiteEventLogging has no view of
/// <c>LocalDb:Replication</c> and must not grow one; the Host already owns that predicate
/// (<c>SiteLocalDbSetup.ReplicationIsConfigured</c>, the <c>PeerAddress</c>-OR-<c>ApiKey</c>
/// rule) and passes it in. When no implementation is registered the note is suppressed, which
/// matches the product default: replication is opt-in and off unless configured.
/// </para>
/// </summary>
/// <returns><c>true</c> if this node has LocalDb replication configured; <c>false</c> otherwise.</returns>
public delegate bool SiteEventLogReplicationCheck();

/// <summary>
/// Background service that periodically purges old events from the SQLite event log.
/// Enforces both time-based retention (default 30 days) and storage cap (default 1GB).
/// Runs on a background thread and does not block event recording.
/// </summary>
public class EventLogPurgeService : BackgroundService
{
    /// <summary>Number of events deleted per cap-purge batch.</summary>
    private const int CapPurgeBatchSize = 1000;

    /// <summary>Number of events deleted per retention-purge batch — same size as <see cref="CapPurgeBatchSize"/>.</summary>
    private const int RetentionPurgeBatchSize = 1000;

    private readonly SiteEventLogger _eventLogger;
    private readonly SiteEventLogOptions _options;
    private readonly ILogger<EventLogPurgeService> _logger;
    private readonly SiteEventLogActiveNodeCheck _isActiveNode;
    private readonly SiteEventLogReplicationCheck _isReplicationConfigured;

    /// <summary>Initializes a new instance of <see cref="EventLogPurgeService"/>.</summary>
    /// <param name="eventLogger">The concrete event logger providing lock-guarded database access.</param>
    /// <param name="options">Site event log options (retention days, storage cap, purge interval).</param>
    /// <param name="logger">Logger instance.</param>
    /// <param name="isActiveNode">
    /// Optional active-node check. When <c>null</c>, the
    /// service runs the purge on every tick (preserves the pre-fix behaviour
    /// for non-clustered hosts and existing tests). When supplied — e.g. by
    /// the Host on a site node — each tick early-exits on the standby so the
    /// daily purge runs only on the active node, matching the design.
    /// </param>
    /// <param name="isReplicationConfigured">
    /// Optional LocalDb-replication check. When <c>null</c> — non-clustered hosts,
    /// unit tests — the purge log omits the replication-backlog operator note, matching
    /// the product default that replication is opt-in and off unless configured.
    /// See <see cref="SiteEventLogReplicationCheck"/>.
    /// </param>
    public EventLogPurgeService(
        SiteEventLogger eventLogger,
        IOptions<SiteEventLogOptions> options,
        ILogger<EventLogPurgeService> logger,
        SiteEventLogActiveNodeCheck? isActiveNode = null,
        SiteEventLogReplicationCheck? isReplicationConfigured = null)
    {
        // Depend on the concrete recorder directly: purge must funnel database access
        // through its lock-guarded WithConnection. Taking ISiteEventLogger and
        // downcasting would throw InvalidCastException for any other implementation.
        _eventLogger = eventLogger;
        _options = options.Value;
        _logger = logger;
        _isActiveNode = isActiveNode ?? (static () => true);
        _isReplicationConfigured = isReplicationConfigured ?? (static () => false);
    }

    /// <inheritdoc />
    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
    {
        _logger.LogInformation(
            "Event log purge service started — retention: {Days} days, cap: {Cap} MB, interval: {Interval}",
            _options.RetentionDays, _options.MaxStorageMb, _options.PurgeInterval);

        using var timer = new PeriodicTimer(_options.PurgeInterval);

        // Run an initial purge on startup
        RunPurge();

        while (await timer.WaitForNextTickAsync(stoppingToken).ConfigureAwait(false))
        {
            RunPurge();
        }
    }

    /// <summary>Runs a single purge cycle: first by retention age, then by storage cap.</summary>
    internal void RunPurge()
    {
        try
        {
            // Gate every tick on the active-node check.
            // The standby's local SQLite receives no writes, so purging there
            // is harmless but unnecessary; the design (Component-SiteEventLogging
            // → Storage) explicitly states the purge runs on the active node.
            // Defensive try/catch: a transient cluster-state read failure must
            // not stop the purge loop — fall back to running the purge (the
            // pre-fix behaviour was "always run", which is harmless on standby).
            bool isActive;
            try
            {
                isActive = _isActiveNode();
            }
            catch (Exception checkEx)
            {
                _logger.LogDebug(checkEx,
                    "Active-node check threw during purge tick; running purge to be safe");
                isActive = true;
            }

            if (!isActive)
            {
                _logger.LogDebug("Skipping event log purge tick — this node is not the active site member");
                return;
            }

            PurgeByRetention();
            PurgeByStorageCap();
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error during event log purge");
        }
    }

    /// <summary>
    /// Deletes events older than the retention window, in bounded
    /// <see cref="RetentionPurgeBatchSize"/>-row slices per DELETE statement rather than
    /// one unbounded DELETE for the whole expired set — mirroring the batching already
    /// used a few lines below in <see cref="PurgeByStorageCap"/> (<see cref="CapPurgeBatchSize"/>).
    /// An expired backlog in the tens/hundreds of thousands of rows would otherwise hold a
    /// single SQLite write transaction (and the shared <c>_writeLock</c>) open for the
    /// whole delete, blocking every concurrent <see cref="SiteEventLogger.LogEventAsync"/>
    /// writer-loop flush for that entire duration.
    /// </summary>
    private void PurgeByRetention()
    {
        var cutoff = DateTimeOffset.UtcNow.AddDays(-_options.RetentionDays).ToString("o");
        var totalDeleted = 0;

        while (true)
        {
            var deleted = _eventLogger.WithConnection(connection =>
            {
                using var cmd = connection.CreateCommand();
                cmd.CommandText = $"""
                    DELETE FROM site_events WHERE id IN (
                        SELECT id FROM site_events
                        WHERE timestamp < $cutoff
                        LIMIT {RetentionPurgeBatchSize}
                    )
                    """;
                cmd.Parameters.AddWithValue("$cutoff", cutoff);
                return cmd.ExecuteNonQuery();
            });

            totalDeleted += deleted;

            if (deleted < RetentionPurgeBatchSize)
                break;
        }

        if (totalDeleted > 0)
        {
            _logger.LogInformation("Purged {Count} events older than {Days} days", totalDeleted, _options.RetentionDays);
            LogReplicationBacklogNote(totalDeleted);
        }
    }

    /// <summary>
    /// Emits the operator breadcrumb that explains the oplog backlog spike a purge produces on a
    /// replication-enabled node. No-op when this node has no replication peer.
    /// </summary>
    /// <remarks>
    /// <c>site_events</c> is a replicated table, and a retention/cap DELETE is captured by CDC
    /// exactly like an ordinary write — there is deliberately no purge-exemption path (LocalDb
    /// Phase 2: CDC does all three jobs). The daily purge therefore pushes one oplog row per
    /// deleted event, and the site health report's <c>LocalDbOplogBacklog</c> (Prometheus
    /// <c>localdb_oplog_depth</c>) spikes until the peer acks them. That is expected and drains
    /// on its own; without this line an operator correlating the spike has nothing in the log to
    /// tie it to. Information level because it is only interesting next to the purge line it
    /// follows — the spike itself is not a fault.
    /// </remarks>
    /// <param name="deletedRows">Number of rows the purge just deleted; always &gt; 0 at the call sites.</param>
    private void LogReplicationBacklogNote(int deletedRows)
    {
        bool replicated;
        try
        {
            replicated = _isReplicationConfigured();
        }
        catch (Exception checkEx)
        {
            // A log-wording predicate must never break the purge loop.
            _logger.LogDebug(checkEx, "Replication check threw while composing the purge log note; note suppressed");
            return;
        }

        if (!replicated)
            return;

        _logger.LogInformation(
            "Purged {Count} site_events rows on a replication-enabled node — a transient LocalDb oplog backlog " +
            "is expected while the deletes replicate to the peer. It drains on its own; " +
            "LocalDbReplicationConnected staying true with the backlog returning to ~0 is the healthy signature.",
            deletedRows);
    }

    private void PurgeByStorageCap()
    {
        var capBytes = (long)_options.MaxStorageMb * 1024 * 1024;
        var currentSizeBytes = GetDatabaseSizeBytes();

        if (currentSizeBytes <= capBytes)
            return;

        _logger.LogWarning(
            "Event log size {Size:F1} MB exceeds cap {Cap} MB — purging oldest events",
            currentSizeBytes / (1024.0 * 1024.0), _options.MaxStorageMb);

        // Delete the oldest events in batches until the database is under the cap.
        // The loop also stops if the on-disk size fails to decrease across an
        // iteration (e.g. if vacuum cannot reclaim space), so a cap that can never
        // be met does not silently empty the entire table.
        var totalDeleted = 0;

        while (currentSizeBytes > capBytes)
        {
            var previousSizeBytes = currentSizeBytes;

            var deleted = _eventLogger.WithConnection(connection =>
            {
                using var cmd = connection.CreateCommand();
                // Order by timestamp, NOT by id. The id was a monotonic autoincrement
                // when this was written, so "lowest id" meant "oldest"; since LocalDb
                // Phase 1 it is a GUID and ordering by it would delete an ARBITRARY
                // batch of events rather than the oldest ones. id remains in the ORDER
                // BY only as a tie-break so the batch is deterministic.
                cmd.CommandText = $"""
                    DELETE FROM site_events WHERE id IN (
                        SELECT id FROM site_events
                        ORDER BY timestamp ASC, id ASC
                        LIMIT {CapPurgeBatchSize}
                    )
                    """;
                var rows = cmd.ExecuteNonQuery();

                // Reclaim free pages so page_count/freelist measurement reflects the
                // delete. Effective because auto_vacuum = INCREMENTAL is set at schema
                // creation; harmless otherwise.
                using var vacuumCmd = connection.CreateCommand();
                vacuumCmd.CommandText = "PRAGMA incremental_vacuum";
                vacuumCmd.ExecuteNonQuery();

                return rows;
            });

            if (deleted == 0)
                break;

            totalDeleted += deleted;
            currentSizeBytes = GetDatabaseSizeBytes();

            if (currentSizeBytes >= previousSizeBytes)
            {
                // Size is not shrinking despite deletes — stop rather than wipe the
                // whole table. This should not happen now that logical size is
                // measured, but guards against any future regression.
                _logger.LogWarning(
                    "Event log size did not decrease after a cap-purge batch ({Size:F1} MB); " +
                    "stopping to avoid emptying the log",
                    currentSizeBytes / (1024.0 * 1024.0));
                break;
            }
        }

        // Same CDC cost as the retention purge above — a cap-driven trim is usually the
        // larger of the two, so it gets the same operator breadcrumb.
        if (totalDeleted > 0)
        {
            LogReplicationBacklogNote(totalDeleted);
        }
    }

    /// <summary>
    /// Returns the logical size of the database in bytes — only pages that hold live
    /// data, excluding free pages on the freelist. Measuring logical size (rather than
    /// the raw file size from <c>page_count</c>) means the storage-cap loop observes
    /// space being reclaimed even if free pages have not yet been returned to the OS.
    /// </summary>
    /// <returns>The logical database size in bytes (used pages × page size).</returns>
    internal long GetDatabaseSizeBytes()
    {
        return _eventLogger.WithConnection(connection =>
        {
            using var pageCountCmd = connection.CreateCommand();
            pageCountCmd.CommandText = "PRAGMA page_count";
            var pageCount = (long)pageCountCmd.ExecuteScalar()!;

            using var freeListCmd = connection.CreateCommand();
            freeListCmd.CommandText = "PRAGMA freelist_count";
            var freeListCount = (long)freeListCmd.ExecuteScalar()!;

            using var pageSizeCmd = connection.CreateCommand();
            pageSizeCmd.CommandText = "PRAGMA page_size";
            var pageSize = (long)pageSizeCmd.ExecuteScalar()!;

            var usedPages = Math.Max(0, pageCount - freeListCount);
            return usedPages * pageSize;
        });
    }
}
