#!/usr/bin/env python3
"""
DomainFront Tunnel — Bypass DPI censorship via Domain Fronting.

Run a local HTTP proxy that tunnels all traffic through a CDN using
domain fronting: the TLS SNI shows an allowed domain while the encrypted
HTTP Host header routes to your Cloudflare Worker relay.
"""

import argparse
import asyncio
import json
import logging
import os
import re
import subprocess
import sys

from cert_installer import install_ca, is_ca_trusted
from mitm import CA_CERT_FILE
from proxy_server import ProxyServer

__version__ = "1.0.0"


def setup_logging(level_name: str):
    level = getattr(logging, level_name.upper(), logging.INFO)
    logging.basicConfig(
        level=level,
        format="%(asctime)s [%(name)-12s] %(levelname)-7s %(message)s",
        datefmt="%H:%M:%S",
    )


def parse_args():
    parser = argparse.ArgumentParser(
        prog="domainfront-tunnel",
        description="Local HTTP proxy that tunnels traffic through domain fronting.",
    )
    parser.add_argument(
        "-c", "--config",
        default=os.environ.get("DFT_CONFIG", "config.json"),
        help="Path to config file (default: config.json, env: DFT_CONFIG)",
    )
    parser.add_argument(
        "-p", "--port",
        type=int,
        default=None,
        help="Override listen port (env: DFT_PORT)",
    )
    parser.add_argument(
        "--host",
        default=None,
        help="Override listen host (env: DFT_HOST)",
    )
    parser.add_argument(
        "--log-level",
        choices=["DEBUG", "INFO", "WARNING", "ERROR"],
        default=None,
        help="Override log level (env: DFT_LOG_LEVEL)",
    )
    parser.add_argument(
        "-v", "--version",
        action="version",
        version=f"%(prog)s {__version__}",
    )
    parser.add_argument(
        "--install-cert",
        action="store_true",
        help="Install the MITM CA certificate as a trusted root and exit.",
    )
    parser.add_argument(
        "--no-cert-check",
        action="store_true",
        help="Skip the certificate installation check on startup.",
    )
    return parser.parse_args()


def _windows_listener_details(host: str, port: int) -> tuple[str, str] | None:
    """Best-effort lookup of the process listening on host:port on Windows."""
    if os.name != "nt":
        return None

    try:
        result = subprocess.run(
            ["netstat", "-ano", "-p", "tcp"],
            capture_output=True,
            text=True,
            check=True,
        )
    except Exception:
        return None

    port_suffix = f":{port}"
    host_variants = {
        f"{host}:{port}",
        f"0.0.0.0:{port}",
        f"[::]:{port}",
        f"[::1]:{port}",
        f"::{port}",
    }

    pid = None
    for line in result.stdout.splitlines():
        parts = line.split()
        if len(parts) < 5 or parts[0] != "TCP":
            continue
        local_addr, state, candidate_pid = parts[1], parts[3].upper(), parts[4]
        if state != "LISTENING":
            continue
        if local_addr in host_variants or local_addr.endswith(port_suffix):
            pid = candidate_pid
            break

    if not pid:
        return None

    try:
        proc = subprocess.run(
            ["tasklist", "/FI", f"PID eq {pid}", "/FO", "CSV", "/NH"],
            capture_output=True,
            text=True,
            check=True,
        )
        line = proc.stdout.strip().splitlines()[0]
        name = line.split(",")[0].strip('"') if line else "unknown"
    except Exception:
        name = "unknown"

    return pid, name


def _is_addr_in_use_error(exc: OSError) -> bool:
    text = str(exc).lower()
    return (
        getattr(exc, "errno", None) in {48, 98, 10048}
        or getattr(exc, "winerror", None) == 10048
        or "address already in use" in text
        or "only one usage of each socket address" in text
    )


def _bind_target_from_error(exc: OSError, config: dict) -> tuple[str, int]:
    text = str(exc)
    match = re.search(r"\('([^']+)',\s*(\d+)\)", text)
    if match:
        return match.group(1), int(match.group(2))
    return (
        config.get("listen_host", "127.0.0.1"),
        config.get("listen_port", 8080),
    )


def main():
    args = parse_args()
    config_path = args.config

    try:
        with open(config_path) as f:
            config = json.load(f)
    except FileNotFoundError:
        print(f"Config not found: {config_path}")
        print("Copy config.example.json to config.json and fill in your values.")
        sys.exit(1)
    except json.JSONDecodeError as e:
        print(f"Invalid JSON in config: {e}")
        sys.exit(1)

    # Environment variable overrides
    if os.environ.get("DFT_AUTH_KEY"):
        config["auth_key"] = os.environ["DFT_AUTH_KEY"]
    if os.environ.get("DFT_SCRIPT_ID"):
        config["script_id"] = os.environ["DFT_SCRIPT_ID"]

    # CLI argument overrides
    if args.port is not None:
        config["listen_port"] = args.port
    elif os.environ.get("DFT_PORT"):
        config["listen_port"] = int(os.environ["DFT_PORT"])

    if args.host is not None:
        config["listen_host"] = args.host
    elif os.environ.get("DFT_HOST"):
        config["listen_host"] = os.environ["DFT_HOST"]

    if args.log_level is not None:
        config["log_level"] = args.log_level
    elif os.environ.get("DFT_LOG_LEVEL"):
        config["log_level"] = os.environ["DFT_LOG_LEVEL"]

    for key in ("auth_key",):
        if key not in config:
            print(f"Missing required config key: {key}")
            sys.exit(1)

    mode = config.get("mode", "domain_fronting")
    if mode == "custom_domain" and "custom_domain" not in config:
        print("Mode 'custom_domain' requires 'custom_domain' in config")
        sys.exit(1)
    if mode == "domain_fronting":
        for key in ("front_domain", "worker_host"):
            if key not in config:
                print(f"Mode 'domain_fronting' requires '{key}' in config")
                sys.exit(1)
    if mode == "google_fronting":
        if "worker_host" not in config:
            print("Mode 'google_fronting' requires 'worker_host' in config (your Cloud Run URL)")
            sys.exit(1)
    if mode == "apps_script":
        sid = config.get("script_ids") or config.get("script_id")
        if not sid or (isinstance(sid, str) and sid == "YOUR_APPS_SCRIPT_DEPLOYMENT_ID"):
            print("Mode 'apps_script' requires 'script_id' in config.")
            print("Deploy the Apps Script from appsscript/Code.gs and paste the Deployment ID.")
            sys.exit(1)

    # ── Certificate installation ──────────────────────────────────────────
    if args.install_cert:
        setup_logging("INFO")
        _log = logging.getLogger("Main")
        _log.info("Installing CA certificate…")
        ok = install_ca(CA_CERT_FILE)
        sys.exit(0 if ok else 1)

    setup_logging(config.get("log_level", "INFO"))
    log = logging.getLogger("Main")

    mode = config.get("mode", "domain_fronting")
    log.info("DomainFront Tunnel starting (mode: %s)", mode)

    if config.get("socks5_enabled"):
        log.info(
            "SOCKS5 address     : %s:%d",
            config.get("listen_host", "127.0.0.1"),
            config.get("socks5_port", 1080),
        )

    if mode == "custom_domain":
        log.info("Custom domain    : %s", config["custom_domain"])
    elif mode == "google_fronting":
        log.info("Google fronting   : SNI=%s → Host=%s",
                 config.get("front_domain", "www.google.com"), config["worker_host"])
        log.info("Google IP         : %s", config.get("google_ip", "216.239.38.120"))
    elif mode == "apps_script":
        log.info("Apps Script relay : SNI=%s → script.google.com",
                 config.get("front_domain", "www.google.com"))
        script_ids = config.get("script_ids") or config.get("script_id")
        if isinstance(script_ids, list):
            log.info("Script IDs        : %d scripts (round-robin)", len(script_ids))
            for i, sid in enumerate(script_ids):
                log.info("  [%d] %s", i + 1, sid)
        else:
            log.info("Script ID         : %s", script_ids)

        # Ensure CA file exists before checking / installing it.
        # MITMCertManager generates ca/ca.crt on first instantiation.
        if not os.path.exists(CA_CERT_FILE):
            from mitm import MITMCertManager
            MITMCertManager()  # side-effect: creates ca/ca.crt + ca/ca.key

        # Auto-install MITM CA if not already trusted
        if not args.no_cert_check:
            if not is_ca_trusted(CA_CERT_FILE):
                log.warning("MITM CA is not trusted — attempting automatic installation…")
                ok = install_ca(CA_CERT_FILE)
                if ok:
                    log.info("CA certificate installed. You may need to restart your browser.")
                else:
                    log.error(
                        "Auto-install failed. Run with --install-cert (may need admin/sudo) "
                        "or manually install ca/ca.crt as a trusted root CA."
                    )
            else:
                log.info("MITM CA is already trusted.")
    else:
        log.info("Front domain (SNI) : %s", config.get("front_domain", "?"))
        log.info("Worker host (Host) : %s", config.get("worker_host", "?"))

    log.info("Proxy address      : %s:%d", config.get("listen_host", "127.0.0.1"), config.get("listen_port", 8080))

    try:
        asyncio.run(ProxyServer(config).start())
    except OSError as e:
        if _is_addr_in_use_error(e):
            host, port = _bind_target_from_error(e, config)
            log.error("Cannot listen on %s:%d because that address is already in use.", host, port)
            details = _windows_listener_details(host, port)
            if details:
                pid, name = details
                log.error("Port %d is currently held by PID %s (%s).", port, pid, name)
            log.error(
                "Stop the other process or choose another port, for example: python main.py -p 9090"
            )
            sys.exit(1)
        raise
    except KeyboardInterrupt:
        log.info("Stopped")


if __name__ == "__main__":
    main()