package network

import (
	"fmt"
	"strings"

	"github.com/gofrs/uuid"
	"github.com/sirupsen/logrus"
	"github.rackspace.com/DCM/tools"
	"github.rackspace.com/gorax/asaapi/pkg/asa"
	"github.rackspace.com/gorax/clients/coreAPI"
	"github.rackspace.com/gorax/clients/mydp"
	"github.rackspace.com/gorax/clients/sshAPI"
	"github.rackspace.com/gorax/passkey"
)

// FetchDPASA is a method to try local auth first, and if it failed, attempt the Rackspace ISE service
// account login. If both fail, return an error
func FetchDPASA(dp *mydp.Client, pw *passkey.Client, d tools.Device) (*asa.ASA, error) {
	if dp == nil {
		var err error
		dp, err = mydp.New(
			pw.Service.MyDPSvc.Credential.Username,
			pw.Service.MyDPSvc.Credential.Password,
			false,
		)
		if err != nil {
			return nil, fmt.Errorf("FetchDPASA:mydp.New:%s", err)
		}
	}
	uid, _ := uuid.NewV4()
	core := &coreAPI.Client{
		SessionInfo: coreAPI.SessionInfo{
			Username: pw.Service.MyDPSvc.Credential.Username,
		},
	}
	dpDev, err := dp.DeviceByDeviceID(d.Linked.ID)
	if err != nil {
		return nil, fmt.Errorf("FetchDPASA:DeviceByDeviceID:%s", err)
	}
	sshClient, err := sshAPI.NewDPSSHAPIClient(*dpDev, core, "asa", true, uid)
	if err != nil {
		return nil, fmt.Errorf("FetchDPASA:NewSSHAPIClient:%s", err)
	}

	a, err := asa.NewOptASA(
		d.Linked.ID,
		pw.Service.MyDPSvc.Credential.Username,
		pw.Service.MyDPSvc.Credential.Password,
		asa.WithMyDPInfo(dpDev),
		asa.WithSSHAPI(sshClient),
	)
	if err != nil {
		return nil, fmt.Errorf("FetchDPASA:NewOptASA:%s", err)
	}

	// Attempt to call the ASA to authenticate to it. If we do not get an error here,
	// we have a valid session to the ASA and we can exit.
	//
	// If we do not have a valid session, we need to reinitialize the ASA with Rackspace ISE
	// credentials and try again.
	// Skipping lint here because we need the error in the if/else statement
	//nolint
	if err := a.GetHostname(); err == nil {
		return a, nil
	} else {
		if strings.Contains(strings.ToLower(err.Error()), "unable to authenticate") {
			logrus.Warn("Datapipe credentials did not work. Re-establishing with Rackspace ISE creds")
			sshClient.UseAuth("rackspace")
			if a, err = asa.NewOptASA(
				d.Linked.ID,
				pw.Service.TacacsLogin.Credential.Username,
				pw.Service.TacacsLogin.Credential.Password,
				asa.WithMyDPInfo(dpDev),
				asa.WithSSHAPI(sshClient),
			); err != nil {
				return nil, fmt.Errorf("NewOptASA:RS:ASA:%s", err)
			}
			if err := a.GetHostname(); err == nil {
				return a, nil
			}
		}
	}
	return nil, fmt.Errorf("[%d]Unable to authenticate to the ASA", d.ID)
}