/**
 * Real-time Alert System
 * Automated notification system for security events
 * Supports multiple notification channels and alert rules
 */

const logger = require('./logger');
const logAggregator = require('./logAggregator');
const { db } = require('../database/db');
const EventEmitter = require('events');
const responseProtocolManager = require('./responseProtocolManager');

class AlertSystem extends EventEmitter {
  constructor() {
    super();
    this.activeAlerts = new Map();
    this.alertRules = new Map();
    this.initialize();
  }

  /**
   * Initialize alert system
   */
  async initialize() {
    await this.createAlertsTable();
    await this.createAlertRulesTable();
    await this.loadAlertRules();
    
    logger.info('[AlertSystem] Initialized - Real-time monitoring enabled');
  }

  /**
   * Create alerts table
   */
  async createAlertsTable() {
    return new Promise((resolve, reject) => {
      db.run(`
        CREATE TABLE IF NOT EXISTS security_alerts (
          id INTEGER PRIMARY KEY AUTOINCREMENT,
          alert_id TEXT UNIQUE NOT NULL,
          rule_id TEXT,
          severity TEXT NOT NULL,
          title TEXT NOT NULL,
          description TEXT NOT NULL,
          affected_entity TEXT,
          source_data TEXT,
          status TEXT DEFAULT 'active',
          acknowledged_at DATETIME,
          acknowledged_by INTEGER,
          resolved_at DATETIME,
          resolved_by INTEGER,
          resolution_notes TEXT,
          notification_sent INTEGER DEFAULT 0,
          created_at DATETIME DEFAULT CURRENT_TIMESTAMP
        )
      `, (err) => {
        if (err) reject(err);
        else {
          db.run(`CREATE INDEX IF NOT EXISTS idx_alerts_severity ON security_alerts(severity, created_at DESC)`);
          db.run(`CREATE INDEX IF NOT EXISTS idx_alerts_status ON security_alerts(status, created_at DESC)`);
          db.run(`CREATE INDEX IF NOT EXISTS idx_alerts_rule ON security_alerts(rule_id)`);
          resolve();
        }
      });
    });
  }

  /**
   * Create alert rules table
   */
  async createAlertRulesTable() {
    return new Promise((resolve, reject) => {
      db.run(`
        CREATE TABLE IF NOT EXISTS alert_rules (
          id INTEGER PRIMARY KEY AUTOINCREMENT,
          rule_id TEXT UNIQUE NOT NULL,
          name TEXT NOT NULL,
          description TEXT,
          rule_type TEXT NOT NULL,
          condition TEXT NOT NULL,
          severity TEXT NOT NULL,
          enabled INTEGER DEFAULT 1,
          notification_channels TEXT,
          cooldown_minutes INTEGER DEFAULT 10,
          created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
          updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
        )
      `, async (err) => {
        if (err) reject(err);
        else {
          await this.createDefaultRules();
          resolve();
        }
      });
    });
  }

  /**
   * Create default alert rules
   */
  async createDefaultRules() {
    const defaultRules = [
      {
        rule_id: 'RULE-BRUTE-FORCE',
        name: 'Brute Force Detection',
        description: 'Alert on brute force attack patterns',
        rule_type: 'anomaly',
        condition: JSON.stringify({ anomaly_type: 'brute_force_attack' }),
        severity: 'critical',
        notification_channels: JSON.stringify(['in_app', 'email']),
        cooldown_minutes: 10
      },
      {
        rule_id: 'RULE-PRIVILEGE-ESC',
        name: 'Privilege Escalation',
        description: 'Alert on privilege escalation attempts',
        rule_type: 'anomaly',
        condition: JSON.stringify({ anomaly_type: 'privilege_escalation' }),
        severity: 'critical',
        notification_channels: JSON.stringify(['in_app', 'email']),
        cooldown_minutes: 5
      },
      {
        rule_id: 'RULE-DATA-EXFIL',
        name: 'Data Exfiltration',
        description: 'Alert on potential data exfiltration',
        rule_type: 'anomaly',
        condition: JSON.stringify({ anomaly_type: 'data_exfiltration' }),
        severity: 'high',
        notification_channels: JSON.stringify(['in_app', 'email']),
        cooldown_minutes: 15
      },
      {
        rule_id: 'RULE-THREAT-CRITICAL',
        name: 'Critical Threat Level',
        description: 'Alert when threat score exceeds 80',
        rule_type: 'threshold',
        condition: JSON.stringify({ metric: 'threat_score', operator: '>=', value: 80 }),
        severity: 'critical',
        notification_channels: JSON.stringify(['in_app', 'email']),
        cooldown_minutes: 30
      },
      {
        rule_id: 'RULE-SUSPICIOUS-IP',
        name: 'Suspicious IP Activity',
        description: 'Alert on suspicious IP behavior',
        rule_type: 'anomaly',
        condition: JSON.stringify({ anomaly_type: 'suspicious_ip' }),
        severity: 'high',
        notification_channels: JSON.stringify(['in_app']),
        cooldown_minutes: 20
      },
      {
        rule_id: 'RULE-SESSION-ANOMALY',
        name: 'Session Anomaly',
        description: 'Alert on unusual session patterns',
        rule_type: 'anomaly',
        condition: JSON.stringify({ anomaly_type: 'session_anomaly' }),
        severity: 'medium',
        notification_channels: JSON.stringify(['in_app']),
        cooldown_minutes: 30
      }
    ];

    for (const rule of defaultRules) {
      await new Promise((resolve, reject) => {
        db.run(
          `INSERT OR IGNORE INTO alert_rules
           (rule_id, name, description, rule_type, condition, severity, notification_channels, cooldown_minutes)
           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
          [
            rule.rule_id,
            rule.name,
            rule.description,
            rule.rule_type,
            rule.condition,
            rule.severity,
            rule.notification_channels,
            rule.cooldown_minutes
          ],
          (err) => {
            if (err) reject(err);
            else resolve();
          }
        );
      });
    }

    logger.info('[AlertSystem] Default alert rules created');
  }

  /**
   * Load alert rules into memory
   */
  async loadAlertRules() {
    return new Promise((resolve, reject) => {
      db.all(
        'SELECT * FROM alert_rules WHERE enabled = 1',
        [],
        (err, rows) => {
          if (err) {
            reject(err);
            return;
          }

          this.alertRules.clear();
          for (const row of rows) {
            this.alertRules.set(row.rule_id, {
              ...row,
              condition: JSON.parse(row.condition),
              notification_channels: JSON.parse(row.notification_channels)
            });
          }

          logger.info(`[AlertSystem] Loaded ${rows.length} alert rules`);
          resolve(rows.length);
        }
      );
    });
  }

  /**
   * Trigger alert based on anomaly
   * Enhanced with automated response protocols
   */
  async triggerAnomalyAlert(anomaly) {
    // Find matching rules
    const matchingRules = [];
    for (const [ruleId, rule] of this.alertRules.entries()) {
      if (rule.rule_type === 'anomaly' && rule.condition.anomaly_type === anomaly.type) {
        matchingRules.push(rule);
      }
    }

    if (matchingRules.length === 0) {
      return;
    }

    // Create alerts for matching rules
    for (const rule of matchingRules) {
      // Check cooldown
      if (await this.isInCooldown(rule.rule_id, anomaly.affected_ip || anomaly.affected_user_id)) {
        logger.debug(`[AlertSystem] Alert ${rule.rule_id} in cooldown period`);
        continue;
      }

      const alertId = await this.createAlert({
        rule_id: rule.rule_id,
        severity: rule.severity,
        title: rule.name,
        description: anomaly.description,
        affected_entity: anomaly.affected_user_id || anomaly.affected_ip,
        source_data: JSON.stringify({
          anomalyId: anomaly.anomaly_id,
          type: anomaly.type,
          confidence: anomaly.confidence,
          patternData: JSON.parse(anomaly.pattern_data || '{}')
        })
      });

      // Send notifications
      await this.sendNotifications(alertId, rule.notification_channels);

      // Execute automated response protocols (CWE-778)
      await this.executeResponseProtocols('anomaly', {
        anomaly_type: anomaly.type,
        severity: rule.severity
      }, {
        alertId,
        ip_address: anomaly.affected_ip,
        user_id: anomaly.affected_user_id,
        confidence: anomaly.confidence
      });
    }
  }

  /**
   * Execute automated response protocols
   * CWE-778: Logs all protocol executions
   */
  async executeResponseProtocols(triggerType, triggerEvent, context = {}) {
    try {
      const result = await responseProtocolManager.executeProtocols(triggerType, triggerEvent, context);
      
      if (result.executed) {
        logger.warn(`[AlertSystem] Executed ${result.protocols.length} response protocol(s)`);
        
        // Log protocol execution (CWE-778)
        logAggregator.aggregate('alert_system', 'warn', 'security', 'Response protocols executed', {
          triggerType,
          protocolsExecuted: result.protocols.length,
          protocols: result.protocols.map(p => ({
            protocolId: p.protocolId,
            protocolName: p.protocolName,
            status: p.status,
            actionsExecuted: p.actionsExecuted
          })),
          context
        });
      }

      return result;
    } catch (error) {
      logger.error('[AlertSystem] Response protocol execution failed:', error);
      
      // Log execution failure (CWE-778)
      logAggregator.aggregate('alert_system', 'error', 'security', 'Response protocol execution failed', {
        triggerType,
        error: error.message,
        context
      });
    }
  }

  /**
   * Trigger alert based on threshold
   */
  async triggerThresholdAlert(metric, value) {
    for (const [ruleId, rule] of this.alertRules.entries()) {
      if (rule.rule_type !== 'threshold' || rule.condition.metric !== metric) {
        continue;
      }

      // Evaluate condition
      const passed = this.evaluateCondition(rule.condition, value);
      if (!passed) continue;

      // Check cooldown
      if (await this.isInCooldown(rule.rule_id, metric)) {
        continue;
      }

      const alertId = await this.createAlert({
        rule_id: rule.rule_id,
        severity: rule.severity,
        title: rule.name,
        description: `${rule.description}: ${metric} = ${value}`,
        affected_entity: metric,
        source_data: JSON.stringify({ metric, value, threshold: rule.condition.value })
      });

      await this.sendNotifications(alertId, rule.notification_channels);
    }
  }

  /**
   * Evaluate threshold condition
   */
  evaluateCondition(condition, value) {
    const { operator, value: threshold } = condition;

    switch (operator) {
      case '>=': return value >= threshold;
      case '>': return value > threshold;
      case '<=': return value <= threshold;
      case '<': return value < threshold;
      case '==': return value == threshold;
      case '!=': return value != threshold;
      default: return false;
    }
  }

  /**
   * Check if alert is in cooldown period
   */
  async isInCooldown(ruleId, affectedEntity) {
    const rule = this.alertRules.get(ruleId);
    if (!rule) return false;

    const cooldownMinutes = rule.cooldown_minutes || 10;
    const cooldownTime = new Date(Date.now() - cooldownMinutes * 60 * 1000).toISOString();

    return new Promise((resolve, reject) => {
      db.get(
        `SELECT COUNT(*) as count FROM security_alerts
         WHERE rule_id = ?
           AND affected_entity = ?
           AND created_at >= ?`,
        [ruleId, affectedEntity, cooldownTime],
        (err, row) => {
          if (err) reject(err);
          else resolve(row.count > 0);
        }
      );
    });
  }

  /**
   * Create alert
   */
  async createAlert(details) {
    const alertId = `ALERT-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;

    return new Promise((resolve, reject) => {
      db.run(
        `INSERT INTO security_alerts
         (alert_id, rule_id, severity, title, description, affected_entity, source_data)
         VALUES (?, ?, ?, ?, ?, ?, ?)`,
        [
          alertId,
          details.rule_id,
          details.severity,
          details.title,
          details.description,
          details.affected_entity,
          details.source_data
        ],
        (err) => {
          if (err) {
            reject(err);
          } else {
            logger.warn(`[AlertSystem] Alert triggered: ${alertId} - ${details.title} (${details.severity})`);
            
            // Log to aggregated logs
            logAggregator.aggregate('alert_system', 'warn', 'security', details.title, {
              alertId,
              ruleId: details.rule_id,
              severity: details.severity,
              affectedEntity: details.affected_entity
            });

            // Emit event for real-time notifications
            this.emit('alert', {
              alertId,
              ...details,
              timestamp: new Date().toISOString()
            });

            this.activeAlerts.set(alertId, details);
            resolve(alertId);
          }
        }
      );
    });
  }

  /**
   * Send notifications through configured channels
   */
  async sendNotifications(alertId, channels) {
    for (const channel of channels) {
      try {
        switch (channel) {
          case 'in_app':
            await this.sendInAppNotification(alertId);
            break;
          case 'email':
            await this.sendEmailNotification(alertId);
            break;
          case 'webhook':
            await this.sendWebhookNotification(alertId);
            break;
          default:
            logger.debug(`[AlertSystem] Unknown notification channel: ${channel}`);
        }
      } catch (error) {
        logger.error(`[AlertSystem] Failed to send ${channel} notification:`, error);
      }
    }

    // Mark notification as sent
    await new Promise((resolve) => {
      db.run(
        'UPDATE security_alerts SET notification_sent = 1 WHERE alert_id = ?',
        [alertId],
        () => resolve()
      );
    });
  }

  /**
   * Send in-app notification (emit event)
   */
  async sendInAppNotification(alertId) {
    const alert = await this.getAlert(alertId);
    if (!alert) return;

    this.emit('notification', {
      type: 'security_alert',
      alertId: alert.alert_id,
      severity: alert.severity,
      title: alert.title,
      description: alert.description,
      timestamp: alert.created_at
    });

    logger.debug(`[AlertSystem] In-app notification sent: ${alertId}`);
  }

  /**
   * Send email notification (placeholder)
   */
  async sendEmailNotification(alertId) {
    const alert = await this.getAlert(alertId);
    if (!alert) return;

    // TODO: Implement email sending (nodemailer)
    logger.info(`[AlertSystem] Email notification (stub): ${alertId}`);
    
    // For now, just log it
    logger.info(`[AlertSystem] Email would be sent for alert ${alertId}: ${alert.title}`);
  }

  /**
   * Send webhook notification (placeholder)
   */
  async sendWebhookNotification(alertId) {
    const alert = await this.getAlert(alertId);
    if (!alert) return;

    // TODO: Implement webhook HTTP POST
    logger.info(`[AlertSystem] Webhook notification (stub): ${alertId}`);
  }

  /**
   * Get alert by ID
   */
  async getAlert(alertId) {
    return new Promise((resolve, reject) => {
      db.get(
        'SELECT * FROM security_alerts WHERE alert_id = ?',
        [alertId],
        (err, row) => {
          if (err) reject(err);
          else resolve(row);
        }
      );
    });
  }

  /**
   * Get active alerts
   */
  async getAlerts(filters = {}) {
    const {
      status = 'active',
      severity,
      limit = 100,
      offset = 0
    } = filters;

    let whereClause = ['status = ?'];
    let params = [status];

    if (severity) {
      whereClause.push('severity = ?');
      params.push(severity);
    }

    params.push(limit, offset);

    return new Promise((resolve, reject) => {
      db.all(
        `SELECT * FROM security_alerts
         WHERE ${whereClause.join(' AND ')}
         ORDER BY created_at DESC
         LIMIT ? OFFSET ?`,
        params,
        (err, rows) => {
          if (err) reject(err);
          else resolve(rows);
        }
      );
    });
  }

  /**
   * Acknowledge alert
   */
  async acknowledgeAlert(alertId, userId, notes = '') {
    return new Promise((resolve, reject) => {
      db.run(
        `UPDATE security_alerts
         SET status = 'acknowledged',
             acknowledged_at = CURRENT_TIMESTAMP,
             acknowledged_by = ?
         WHERE alert_id = ?`,
        [userId, alertId],
        (err) => {
          if (err) {
            reject(err);
          } else {
            logger.info(`[AlertSystem] Alert acknowledged: ${alertId} by user ${userId}`);
            
            logAggregator.aggregate('alert_system', 'info', 'security', 'Alert acknowledged', {
              alertId,
              userId,
              notes
            });

            this.emit('alert_acknowledged', { alertId, userId });
            resolve();
          }
        }
      );
    });
  }

  /**
   * Resolve alert
   */
  async resolveAlert(alertId, userId, notes) {
    return new Promise((resolve, reject) => {
      db.run(
        `UPDATE security_alerts
         SET status = 'resolved',
             resolved_at = CURRENT_TIMESTAMP,
             resolved_by = ?,
             resolution_notes = ?
         WHERE alert_id = ?`,
        [userId, notes, alertId],
        (err) => {
          if (err) {
            reject(err);
          } else {
            logger.info(`[AlertSystem] Alert resolved: ${alertId} by user ${userId}`);
            
            logAggregator.aggregate('alert_system', 'info', 'security', 'Alert resolved', {
              alertId,
              userId,
              notes
            });

            this.activeAlerts.delete(alertId);
            this.emit('alert_resolved', { alertId, userId });
            resolve();
          }
        }
      );
    });
  }

  /**
   * Get alert statistics
   */
  async getStatistics() {
    return new Promise((resolve, reject) => {
      db.all(
        `SELECT 
          status,
          severity,
          COUNT(*) as count
         FROM security_alerts
         WHERE created_at >= datetime('now', '-24 hours')
         GROUP BY status, severity`,
        [],
        (err, rows) => {
          if (err) {
            reject(err);
            return;
          }

          const stats = {
            total: 0,
            byStatus: {},
            bySeverity: {}
          };

          for (const row of rows) {
            stats.total += row.count;
            
            if (!stats.byStatus[row.status]) {
              stats.byStatus[row.status] = 0;
            }
            stats.byStatus[row.status] += row.count;

            if (!stats.bySeverity[row.severity]) {
              stats.bySeverity[row.severity] = 0;
            }
            stats.bySeverity[row.severity] += row.count;
          }

          resolve(stats);
        }
      );
    });
  }
}

// Create singleton instance
const alertSystem = new AlertSystem();

// Connect security intelligence to alert system
const securityIntelligence = require('./securityIntelligence');

// Listen for anomalies and trigger alerts
setInterval(async () => {
  try {
    const anomalies = await securityIntelligence.getAnomalies({ status: 'open', limit: 50 });
    for (const anomaly of anomalies) {
      await alertSystem.triggerAnomalyAlert(anomaly);
    }

    // Check threat score
    const threatScore = securityIntelligence.threatScore;
    if (threatScore >= 80) {
      await alertSystem.triggerThresholdAlert('threat_score', threatScore);
    }
  } catch (error) {
    logger.error('[AlertSystem] Error checking for alerts:', error);
  }
}, 60000); // Check every minute

module.exports = alertSystem;