<?php

namespace App\Services\Wireguard;

use App\Models\Host;
use Illuminate\Support\Facades\Process;
use RuntimeException;

/**
 * Real hub on the CluPilot VM. Allocates the next free address in the configured
 * subnet and manages peers with `wg`. Watch-item: the app runs in a container, so
 * the wg interface must be reachable from here (host network / mounted config);
 * verified on the real VM, not in the mocked test-suite.
 */
class LocalWireguardHub implements WireguardHub
{
    public function allocateIp(): string
    {
        $used = array_flip(Host::query()->whereNotNull('wg_ip')->pluck('wg_ip')->all());
        $hubIp = (string) config('provisioning.wireguard.hub_ip');

        [$network, $bits] = explode('/', config('provisioning.wireguard.subnet', '10.66.0.0/24'));
        $bits = (int) $bits;
        $hostBits = 32 - $bits;
        $size = 2 ** $hostBits;
        $base = ip2long($network) & (0xFFFFFFFF << $hostBits) & 0xFFFFFFFF;

        // Skip the network address (offset 0) and broadcast (offset size-1).
        for ($offset = 1; $offset < $size - 1; $offset++) {
            $ip = long2ip($base + $offset);
            if ($ip !== $hubIp && ! isset($used[$ip])) {
                return $ip;
            }
        }

        throw new RuntimeException('WireGuard management subnet exhausted.');
    }

    public function addPeer(string $publicKey, string $ip): void
    {
        Process::run(['wg', 'set', 'wg0', 'peer', $publicKey, 'allowed-ips', $ip.'/32'])->throw();
        Process::run('wg-quick save wg0')->throw(); // persist, else the peer is lost on restart
    }

    public function removePeer(string $publicKey): void
    {
        Process::run(['wg', 'set', 'wg0', 'peer', $publicKey, 'remove'])->throw();
        Process::run('wg-quick save wg0')->throw(); // persist, else the peer is lost on restart
    }

    public function endpoint(): string
    {
        return (string) config('provisioning.wireguard.endpoint');
    }

    public function publicKey(): string
    {
        return (string) config('provisioning.wireguard.hub_public_key');
    }
}