import * as azure from "@pulumi/azure";
import * as azuread from "@pulumi/azuread";
import * as random from "@pulumi/random";
import { AzureSqlServerResult, AzurePrincipalResult, AzureAdGroupResult } from "../AzureResources";
import { Subscription, SubscriptionResources } from "../Subscription";
import PulumiIdentity from "../PulumiIdentity";
import { createApplicationWithPassword } from "..";

export type SqlServerReference = {
    Name: string;
} & Partial<SqlServer>;

export type SqlServer = {
    Name: string;
    ResourceGroupName: string;
    Location: string;
    ServerAdminName: string;
    ServerAdminSecretName: string;
    AzureAdminGroup: string;
    AzureAdminName: string;
    AzureAdminSecretName: string;
    AzureAdminLogin: string;
};

export const SqlServerDefaults = {
    ServerAdminName: (name: string) => `${name}-admin`,
    ServerAdminSecretName: (name: string) => `Db-${name}-ServerAdminPassword`,
    AzureAdminName: (name: string) => `${name}-admin`,
    AzureAdminSecretName: (name: string) => `Db-${name}-AzureAdminPassword`,
    AzureAdminLogin: "sql-admin",
    AzureAdminGroup: (name: string) => `SQL-Admins-${name}`,
};

export type SqlServerResourceArgs = {
    SqlServerArgs: {
        name: string;
        resourceGroupName: string;
        location: string;
        fullyQualifiedDomainName: string;
    };
    AdminGroupArgs: {
        name: string;
    }
    SqlServerAdminArgs: {
        displayName: string;
    };
};

export type SqlServerResources = {
    SqlServer: AzureSqlServerResult;
    AdminGroup: AzureAdGroupResult;
    SqlServerAdmin: AzurePrincipalResult;
} & SqlServer;

export type SqlServerResult = SqlServer & SqlServerResourceArgs & SqlServerResources;

const getSqlServerArgs = (args: SqlServerReference, subscription: Subscription): SqlServer & SqlServerResourceArgs => {

    let params: SqlServer = {
        Name: args.Name,
        ResourceGroupName: args.ResourceGroupName || subscription.ResourceGroupName,
        Location: args.Location || subscription.DefaultLocation,
        ServerAdminName: args.ServerAdminName || SqlServerDefaults.ServerAdminName(args.Name),
        ServerAdminSecretName: args.ServerAdminSecretName || SqlServerDefaults.ServerAdminSecretName(args.Name),
        AzureAdminGroup: args.AzureAdminGroup || SqlServerDefaults.AzureAdminGroup(args.Name),
        AzureAdminName: args.AzureAdminName || SqlServerDefaults.AzureAdminName(args.Name),
        AzureAdminSecretName: args.AzureAdminSecretName || SqlServerDefaults.AzureAdminSecretName(args.Name),
        AzureAdminLogin: args.AzureAdminLogin || SqlServerDefaults.AzureAdminLogin
    };

    return ({
        ...params,
        SqlServerArgs: {
            name: params.Name,
            resourceGroupName: params.ResourceGroupName,
            location: params.Location,
            fullyQualifiedDomainName: `${params.Name}.database.windows.net`
        },
        AdminGroupArgs: {
            name: params.AzureAdminGroup
        },
        SqlServerAdminArgs: {
            displayName: params.AzureAdminName
        }
    });
};

export const getSqlServer = async (subscription: SubscriptionResources, database: SqlServerReference): Promise<SqlServerResult> => new Promise(async (resolve) => {

    let args = getSqlServerArgs(database, subscription);

    let principal = await azure.ad.getServicePrincipal(args.SqlServerAdminArgs);
    let group = await azuread.getGroup(args.AdminGroupArgs);

    resolve({
        ...args,
        SqlServer: args.SqlServerArgs,
        AdminGroup: group,
        SqlServerAdmin: principal
    });
});

export const createSqlServer = async (subscription: SubscriptionResources, database: SqlServerReference): Promise<SqlServerResult> => new Promise(async (resolve) => {

    let args = getSqlServerArgs(database, subscription);

    const serverPassword = new random.RandomString(`Database-${args.Name}-Server-Password-Random`, { length: 64 });
    new azure.keyvault.Secret(args.ServerAdminSecretName, {
        name: args.ServerAdminSecretName,
        contentType: "DB Server Admin Password",
        keyVaultId: subscription.KeyVault.id,
        value: serverPassword.result
    });

    const sqlServer = new azure.sql.SqlServer(args.Name, {
        name: args.Name,
        resourceGroupName: args.ResourceGroupName,
        location: args.Location,
        version: "12.0",
        administratorLogin: args.ServerAdminName,
        administratorLoginPassword: serverPassword.result
    });

    const group = new azuread.Group(args.AzureAdminGroup, args.AdminGroupArgs);

    const password = new random.RandomString(`Database-${args.Name}-Admin-Password-Random`, { length: 64 });
    const principal = createApplicationWithPassword(args.AzureAdminName, password.result);
    new azure.keyvault.Secret(args.AzureAdminSecretName, {
        name: args.AzureAdminSecretName,
        contentType: "DB Azure Admin Password",
        keyVaultId: subscription.KeyVault.id,
        value: principal.ServicePrincipalPassword.value
    });

    new azure.sql.ActiveDirectoryAdministrator(args.AzureAdminGroup, {
        login: args.AzureAdminGroup,
        tenantId: PulumiIdentity.TenantId,
        serverName: sqlServer.name,
        resourceGroupName: sqlServer.resourceGroupName,
        objectId: group.id
    });

    new azure.sql.FirewallRule("sql-AllowAzureAccess", {
        name: "sql-AllowAzureAccess",
        serverName: sqlServer.name,
        resourceGroupName: sqlServer.resourceGroupName,
        startIpAddress: "0.0.0.0",
        endIpAddress: "0.0.0.0"
    });

    resolve({
        ...args,
        SqlServer: sqlServer,
        AdminGroup: group,
        SqlServerAdmin: principal.ServicePrincipal
    })
});