package controller

import (
	"context"

	"k8s.io/apimachinery/pkg/runtime"
	ctrl "sigs.k8s.io/controller-runtime"
	"sigs.k8s.io/controller-runtime/pkg/client"

	bindv1alpha1 "git.unkin.net/unkin/bind-operator/api/v1alpha1"
)

// BindDNSSECPolicyReconciler validates a signing policy and reports how many
// zones reference it. The dnssec-policy block is rendered into named.conf by
// the BindCluster controller, which watches these policies.
type BindDNSSECPolicyReconciler struct {
	client.Client
	Scheme *runtime.Scheme
}

// +kubebuilder:rbac:groups=bind.unkin.net,resources=binddnssecpolicies,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=bind.unkin.net,resources=binddnssecpolicies/status,verbs=get;update;patch
// +kubebuilder:rbac:groups=bind.unkin.net,resources=bindzones,verbs=get;list;watch

func (r *BindDNSSECPolicyReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
	var policy bindv1alpha1.BindDNSSECPolicy
	if err := r.Get(ctx, req.NamespacedName, &policy); err != nil {
		return ctrl.Result{}, client.IgnoreNotFound(err)
	}

	var zones bindv1alpha1.BindZoneList
	count := int32(0)
	if err := r.List(ctx, &zones, client.InNamespace(policy.Namespace)); err == nil {
		for _, z := range zones.Items {
			if z.Spec.ClusterRef == policy.Spec.ClusterRef && z.Spec.DNSSECPolicyRef == policy.Name {
				count++
			}
		}
	}

	policy.Status.ZoneCount = count
	policy.Status.Ready = policy.Spec.ClusterRef != ""
	policy.Status.ObservedGeneration = policy.Generation
	setReady(&policy.Status.Conditions, policy.Generation, policy.Status.Ready, "Validated", "dnssec-policy rendered into named.conf")
	if err := r.Status().Update(ctx, &policy); err != nil {
		return ctrl.Result{}, err
	}
	return ctrl.Result{}, nil
}

func (r *BindDNSSECPolicyReconciler) SetupWithManager(mgr ctrl.Manager) error {
	return ctrl.NewControllerManagedBy(mgr).
		For(&bindv1alpha1.BindDNSSECPolicy{}).
		Complete(r)
}