"""Connection settings of the OPC server a write command targets (SIENTIAPDE-1975 GW1).

The Laborious only knows the `server_id` of a write tag (pipeline `write_tags`); the
connection (url, security, certificate) belongs to the gateway, which owns every OPC
session. A server already in the pool is written through that connection. Otherwise it
is resolved from the tag database (`connectors` → `opc_certificates`) with the rule the
Orchestrator uses to build the read slots (SIENTIAPDE-1974 D1), in the slot format.
"""

from typing import Any

from sientia_do.observability.logger import Logger

from ingestor.connection.certificates import (
    CERTIFICATE_LOOKUP,
    client_certificate_id,
    has_security,
    resolve_certificate,
)
from ingestor.connection.clock import MonotonicClock
from ingestor.connection.pool import OpcConnectionPool

CONNECTORS = 'connectors'


def _connector_pipeline(server_id: str) -> list[dict[str, Any]]:
    """The active OPC UA connector `server_id` (connector_id is its slug), with its
    certificate. Only the fields used are projected."""
    return [
        {'$match': {'connector_id': server_id, 'type': 'opc_ua', 'status': 'Active'}},
        {'$limit': 1},
        CERTIFICATE_LOOKUP,
        {
            '$project': {
                '_id': 0,
                'connector_id': 1,
                'url': 1,
                'subscription_period_ms': 1,
                'security.mode': 1,
                'security.policy': 1,
                'security.client_certificate_id': 1,
                'certificates': 1,
            }
        },
    ]


class ServerConfigResolver:
    """Resolve and cache the connection settings of an OPC server by `server_id`.

    Order: the live pooled connection (what the read path opened, so writes never fight
    the reads over settings), then MongoDB. Lookups are cached for `ttl_s`; a server
    that is not found, for `missing_ttl_s`, so a pipeline pointing at a removed server
    does not query MongoDB on every command.

    # ponytail: the MongoDB fallback goes away once write commands are routed to the pod
    # that owns the connection (SIENTIAPDE-1974 D1, new card).
    """

    def __init__(
        self,
        pool: OpcConnectionPool,
        mongo,
        logger: Logger,
        ttl_s: float = 60.0,
        missing_ttl_s: float = 10.0,
        metadata: dict | None = None,
    ):
        self.pool = pool
        self.mongo = mongo
        self.logger = logger
        self.ttl_s = ttl_s
        self.missing_ttl_s = missing_ttl_s
        self.metadata = metadata or {}
        self.clock = MonotonicClock()
        self._cache: dict[str, tuple[dict[str, Any] | None, float]] = {}

    async def resolve(self, server_id: str) -> dict[str, Any] | None:
        """Connection settings for `server_id`, or None when no source knows it.

        Raises:
            Exception: When MongoDB cannot be read (the caller reports the write as
                failed).
        """
        server_id = str(server_id)
        pooled = self.pool.config_for(server_id)
        if pooled is not None:
            return pooled
        now = self.clock.elapsed()
        cached = self._cache.get(server_id)
        if cached is not None:
            cfg, cached_at = cached
            if now - cached_at < (self.ttl_s if cfg is not None else self.missing_ttl_s):
                return dict(cfg) if cfg is not None else None
        cfg = await self._lookup(server_id)
        self._cache[server_id] = (cfg, now)
        return dict(cfg) if cfg is not None else None

    async def _lookup(self, server_id: str) -> dict[str, Any] | None:
        connectors = await self.mongo.aggregate(
            CONNECTORS, _connector_pipeline(server_id), self.metadata
        )
        connector = connectors[0] if connectors else None
        if connector is None or not connector.get('url') or not has_security(connector):
            self.logger.warning(
                f'OPC server {server_id} not found, not active or incomplete (url, '
                f'security.mode, security.policy) in {CONNECTORS}'
            )
            return None
        certificate = resolve_certificate(connector)
        if certificate is None and client_certificate_id(connector) is not None:
            self.logger.warning(
                f'OPC server {server_id}: client_certificate_id '
                f'{client_certificate_id(connector)} has no active client certificate in '
                f'opc_certificates; connecting without security'
            )
        return {
            'server_id': server_id,
            'url': connector['url'],
            'subscription_period_ms': connector.get('subscription_period_ms'),
            'security': {
                'mode': connector['security']['mode'],
                'policy': connector['security']['policy'],
            },
            'certificate': certificate,
        }