ch-rds 0.1.8

//! Local BTCPay Server bootstrap helpers for development runners.

use std::collections::{BTreeMap, BTreeSet};
use std::env;
use std::fmt;
use std::fs;
use std::path::{Path, PathBuf};
use std::process::Command;
use std::time::{Duration, Instant};

use anyhow::{Context, Result, anyhow, bail, ensure};
use base64::Engine;
use reqwest::StatusCode;
use reqwest::blocking::{Client, RequestBuilder};
use serde::Deserialize;
use serde_json::{Value, json};
use uuid::Uuid;

const BTCPAY_LATEST_STABLE_RELEASE_URL: &str =
    "https://api.github.com/repos/btcpayserver/btcpayserver/releases/latest";
const BTCPAY_STABLE_FALLBACK_IMAGE: &str = "btcpayserver/btcpayserver:2.4.0";

#[derive(Deserialize)]
struct GithubRelease {
    tag_name: String,
    draft: bool,
    prerelease: bool,
}

/// Project-owned metadata used by the local BTCPay development adapter.
#[derive(Clone, Eq, PartialEq)]
pub struct BtcpayDevProfile {
    display_name: String,
    store_name: String,
    api_key_label: String,
    rate_source: String,
    webhook_path: String,
    default_admin_email: String,
    public_url: String,
    local_docker: LocalDockerConfig,
    default_admin_password: Option<String>,
    default_payment_signing_key: Option<String>,
}

impl BtcpayDevProfile {
    /// Creates a local BTCPay profile with conservative development defaults.
    pub fn new(
        display_name: impl Into<String>,
        default_admin_email: impl Into<String>,
        public_url: impl Into<String>,
    ) -> Self {
        let display_name = display_name.into();
        Self {
            store_name: display_name.clone(),
            api_key_label: format!("{display_name} local dev"),
            rate_source: "kraken".to_owned(),
            webhook_path: "/api/payments/webhooks/btcpay".to_owned(),
            default_admin_email: default_admin_email.into(),
            public_url: public_url.into(),
            local_docker: LocalDockerConfig::new(display_name.to_ascii_lowercase()),
            display_name,
            default_admin_password: None,
            default_payment_signing_key: None,
        }
    }

    /// Overrides the local reverse-proxy ports.
    pub fn with_local_ports(mut self, http: u16, https: u16) -> Self {
        self.local_docker.reverseproxy_http_port = http;
        self.local_docker.reverseproxy_https_port = https;
        self
    }

    /// Overrides the generated BTCPay Compose project name.
    pub fn with_compose_project_name(mut self, name: impl Into<String>) -> Self {
        self.local_docker.compose_project_name = name.into();
        self
    }

    /// Overrides the BTCPay webhook path used by the application.
    pub fn with_webhook_path(mut self, path: impl Into<String>) -> Self {
        self.webhook_path = path.into();
        self
    }

    pub(super) fn validate(&self) -> Result<()> {
        for (field, value) in [
            ("display_name", self.display_name.as_str()),
            ("store_name", self.store_name.as_str()),
            ("api_key_label", self.api_key_label.as_str()),
            ("rate_source", self.rate_source.as_str()),
            ("default_admin_email", self.default_admin_email.as_str()),
            ("public_url", self.public_url.as_str()),
        ] {
            ensure!(
                !value.is_empty() && value.trim() == value && !value.chars().any(char::is_control),
                "payment profile {field} must be a non-empty single-line value"
            );
        }
        ensure!(
            self.webhook_path.starts_with('/')
                && !self.webhook_path.chars().any(char::is_whitespace),
            "payment profile webhook_path must be an absolute path without whitespace"
        );
        let public_url = url::Url::parse(&self.public_url)
            .context("payment profile public_url must be an absolute URL")?;
        ensure!(
            matches!(public_url.scheme(), "http" | "https")
                && public_url.host_str().is_some()
                && public_url.username().is_empty()
                && public_url.password().is_none(),
            "payment profile public_url must be an HTTP(S) URL without credentials"
        );
        self.local_docker.validate()?;
        Ok(())
    }

    pub(super) fn display_name(&self) -> &str {
        &self.display_name
    }
}

#[derive(Clone, Debug)]
pub(super) struct LocalBtcpayBootstrapOptions {
    profile: BtcpayDevProfile,
    workspace_root: PathBuf,
    project_root: PathBuf,
    env_file: PathBuf,
}

impl LocalBtcpayBootstrapOptions {
    pub(super) fn new(
        profile: BtcpayDevProfile,
        workspace_root: impl Into<PathBuf>,
        project_root: impl Into<PathBuf>,
    ) -> Self {
        let workspace_root = workspace_root.into();
        let project_root = project_root.into();
        Self {
            profile,
            workspace_root,
            env_file: project_root.join(".env"),
            project_root,
        }
    }
}

impl fmt::Debug for BtcpayDevProfile {
    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
        formatter
            .debug_struct("BtcpayDevProfile")
            .field("display_name", &self.display_name)
            .field("store_name", &self.store_name)
            .field("api_key_label", &self.api_key_label)
            .field("rate_source", &self.rate_source)
            .field("webhook_path", &self.webhook_path)
            .field("default_admin_email", &self.default_admin_email)
            .field("public_url", &self.public_url)
            .field("local_docker", &self.local_docker)
            .field(
                "default_admin_password",
                &self.default_admin_password.as_ref().map(|_| "[REDACTED]"),
            )
            .field(
                "default_payment_signing_key",
                &self
                    .default_payment_signing_key
                    .as_ref()
                    .map(|_| "[REDACTED]"),
            )
            .finish()
    }
}

#[derive(Clone, Debug)]
pub(super) struct LocalBtcpayBootstrapSummary {
    /// Human-facing app name.
    pub app_display_name: String,
    /// Local BTCPay base URL.
    pub url: String,
    /// Store id written to the app `.env`.
    pub store_id: String,
    /// Masked API key for logs.
    pub api_key_masked: String,
    /// Masked webhook secret for logs.
    pub webhook_secret_masked: String,
    /// App `.env` path updated by the bootstrap.
    pub env_file: PathBuf,
}

pub(super) fn bootstrap_local_btcpay(
    options: &LocalBtcpayBootstrapOptions,
) -> Result<LocalBtcpayBootstrapSummary> {
    let profile = &options.profile;
    let btcpay_root = options.workspace_root.join("third-party").join("btcpay");
    ensure!(
        btcpay_root.is_dir(),
        "BTCPay checkout not found at {}",
        btcpay_root.display()
    );
    ensure!(
        options.project_root.join("Cargo.toml").is_file(),
        "app checkout not found at {}",
        options.project_root.display()
    );
    let mut app_env = EnvFile::read(&options.env_file)?;
    let public_url = app_env
        .effective_value("PUBLIC_URL")
        .filter(|value| !value.trim().is_empty())
        .unwrap_or_else(|| profile.public_url.clone());

    let docker_env = docker_env_values(&profile.local_docker, &app_env)?;
    write_btcpay_env(&btcpay_root.join(".env"), &docker_env)?;
    run_build_script(&btcpay_root, &docker_env)?;
    patch_local_btcpay_compose(&btcpay_root, &docker_env)?;
    docker_compose_up(&btcpay_root, &docker_env)?;

    let url = format!(
        "http://{}:{}",
        profile.local_docker.host, profile.local_docker.reverseproxy_http_port
    );
    let admin_email = app_env
        .effective_value("LOCAL_BTCPAY_ADMIN_EMAIL")
        .filter(|value| !value.trim().is_empty())
        .unwrap_or_else(|| profile.default_admin_email.to_string());
    let admin_password_key = "LOCAL_BTCPAY_ADMIN_PASSWORD";
    let admin_password = app_env
        .effective_value(admin_password_key)
        .filter(|value| !value.trim().is_empty())
        .or_else(|| {
            profile
                .default_admin_password
                .as_deref()
                .map(str::trim)
                .filter(|value| !value.is_empty())
                .map(ToOwned::to_owned)
        })
        .unwrap_or_else(generate_local_secret);
    app_env.set(admin_password_key, admin_password.as_str());
    app_env.write(&options.env_file)?;

    let client = BtcpayClient::new(profile.clone(), url.clone(), admin_email, admin_password)?;
    client.wait_until_ready()?;
    client.ensure_admin_user()?;
    let store_id = client.ensure_store(&public_url)?;
    let store_id_key = "BTCPAY_STORE_ID";
    let api_key_key = "BTCPAY_API_KEY";
    let webhook_secret_key = "BTCPAY_WEBHOOK_SECRET";
    let current_api_key = app_env.effective_value(api_key_key);
    let api_key = client.ensure_api_key(&store_id, current_api_key.as_deref())?;
    client.ensure_onchain_wallet(&store_id, &api_key)?;
    client.ensure_rate_settings(&store_id, &api_key)?;
    let current_webhook_secret = app_env.effective_value(webhook_secret_key);
    let webhook_secret = client.ensure_webhook(
        &store_id,
        &public_url,
        &api_key,
        current_webhook_secret.as_deref(),
    )?;

    app_env.set(store_id_key, store_id.as_str());
    app_env.set(api_key_key, api_key.as_str());
    app_env.set(webhook_secret_key, webhook_secret.as_str());
    let signing_key = app_env
        .effective_value("PAYMENT_SIGNING_KEY")
        .filter(|value| !value.trim().is_empty())
        .or_else(|| {
            profile
                .default_payment_signing_key
                .as_deref()
                .map(str::trim)
                .filter(|value| !value.is_empty())
                .map(ToOwned::to_owned)
        })
        .unwrap_or_else(generate_local_secret);
    app_env.set("PAYMENT_SIGNING_KEY", signing_key.as_str());
    app_env.write(&options.env_file)?;

    Ok(LocalBtcpayBootstrapSummary {
        app_display_name: profile.display_name().to_string(),
        url,
        store_id,
        api_key_masked: mask_secret(&api_key),
        webhook_secret_masked: mask_secret(&webhook_secret),
        env_file: options.env_file.clone(),
    })
}

fn generate_local_secret() -> String {
    format!("{}{}", Uuid::new_v4().simple(), Uuid::new_v4().simple())
}

#[derive(Clone, Debug, Eq, PartialEq)]
struct LocalDockerConfig {
    host: String,
    reverseproxy_http_port: u16,
    reverseproxy_https_port: u16,
    nbitcoin_network: String,
    btcpaygen_crypto1: String,
    btcpaygen_reverseproxy: String,
    btcpaygen_subname: String,
    compose_project_name: String,
}

impl LocalDockerConfig {
    fn new(compose_project_name: String) -> Self {
        Self {
            host: "127.0.0.1".to_owned(),
            reverseproxy_http_port: 23_005,
            reverseproxy_https_port: 23_006,
            nbitcoin_network: "regtest".to_owned(),
            btcpaygen_crypto1: "btc".to_owned(),
            btcpaygen_reverseproxy: "nginx".to_owned(),
            btcpaygen_subname: "btcpay".to_owned(),
            compose_project_name,
        }
    }

    fn validate(&self) -> Result<()> {
        for (field, value) in [
            ("host", self.host.as_str()),
            ("nbitcoin_network", self.nbitcoin_network.as_str()),
            ("btcpaygen_crypto1", self.btcpaygen_crypto1.as_str()),
            (
                "btcpaygen_reverseproxy",
                self.btcpaygen_reverseproxy.as_str(),
            ),
            ("btcpaygen_subname", self.btcpaygen_subname.as_str()),
            ("compose_project_name", self.compose_project_name.as_str()),
        ] {
            ensure!(
                !value.is_empty() && value.trim() == value && !value.chars().any(char::is_control),
                "payment profile local_docker.{field} must be a non-empty single-line value"
            );
        }
        ensure!(
            self.reverseproxy_http_port > 0,
            "payment profile local_docker.reverseproxy_http_port must be greater than zero"
        );
        ensure!(
            self.reverseproxy_https_port > 0,
            "payment profile local_docker.reverseproxy_https_port must be greater than zero"
        );
        Ok(())
    }
}

#[derive(Clone, Debug, Default)]
struct EnvFile {
    lines: Vec<String>,
    values: BTreeMap<String, String>,
}

impl EnvFile {
    fn read(path: &Path) -> Result<Self> {
        if !path.exists() {
            return Ok(Self {
                lines: vec![
                    "# Local payment secrets and machine-specific BTCPay values.".to_string(),
                    "# Local dev bootstrap is managed by ch-rds.".to_string(),
                    String::new(),
                ],
                values: BTreeMap::new(),
            });
        }

        let text = fs::read_to_string(path)
            .with_context(|| format!("failed to read {}", path.display()))?;
        let mut values = BTreeMap::new();
        let lines = text
            .lines()
            .map(|line| {
                if let Some((key, value)) = parse_env_line(line) {
                    values.insert(key.to_string(), value.to_string());
                }
                line.to_string()
            })
            .collect();
        Ok(Self { lines, values })
    }

    fn get(&self, key: &str) -> Option<&str> {
        self.values.get(key).map(String::as_str)
    }

    fn effective_value(&self, key: &str) -> Option<String> {
        env::var(key)
            .ok()
            .filter(|value| !value.trim().is_empty())
            .or_else(|| self.get(key).map(str::to_string))
    }

    fn set(&mut self, key: &str, value: &str) {
        self.values.insert(key.to_string(), value.to_string());
    }

    fn write(&self, path: &Path) -> Result<()> {
        let mut seen = BTreeSet::new();
        let mut output = Vec::new();
        for line in &self.lines {
            if let Some((key, _)) = parse_env_line(line)
                && let Some(value) = self.values.get(key)
            {
                output.push(format!("{key}={value}"));
                seen.insert(key.to_string());
                continue;
            }
            output.push(line.clone());
        }
        for (key, value) in &self.values {
            if seen.contains(key) {
                continue;
            }
            if output.last().is_some_and(|line| !line.is_empty()) {
                output.push(String::new());
            }
            output.push(format!("{key}={value}"));
        }
        if let Some(parent) = path.parent() {
            fs::create_dir_all(parent)
                .with_context(|| format!("failed to create {}", parent.display()))?;
        }
        fs::write(path, format!("{}\n", output.join("\n")))
            .with_context(|| format!("failed to write {}", path.display()))
    }
}

fn parse_env_line(line: &str) -> Option<(&str, &str)> {
    let trimmed = line.trim_start();
    if trimmed.is_empty() || trimmed.starts_with('#') {
        return None;
    }
    let (key, value) = line.split_once('=')?;
    let key = key.trim();
    if key.is_empty() {
        return None;
    }
    Some((key, value.trim()))
}

fn docker_env_values(
    config: &LocalDockerConfig,
    app_env: &EnvFile,
) -> Result<BTreeMap<String, String>> {
    let mut values = BTreeMap::new();
    values.insert("BTCPAY_IMAGE".to_string(), resolve_btcpay_image(app_env)?);
    values.insert("BTCPAY_HOST".to_string(), config.host.clone());
    values.insert(
        "REVERSEPROXY_HTTP_PORT".to_string(),
        config.reverseproxy_http_port.to_string(),
    );
    values.insert(
        "REVERSEPROXY_HTTPS_PORT".to_string(),
        config.reverseproxy_https_port.to_string(),
    );
    values.insert(
        "NBITCOIN_NETWORK".to_string(),
        config.nbitcoin_network.clone(),
    );
    values.insert(
        "BTCPAYGEN_CRYPTO1".to_string(),
        config.btcpaygen_crypto1.clone(),
    );
    values.insert(
        "BTCPAYGEN_REVERSEPROXY".to_string(),
        config.btcpaygen_reverseproxy.clone(),
    );
    values.insert(
        "BTCPAYGEN_SUBNAME".to_string(),
        config.btcpaygen_subname.clone(),
    );
    values.insert(
        "COMPOSE_PROJECT_NAME".to_string(),
        config.compose_project_name.clone(),
    );
    values.insert(
        "BTCPAY_ADDITIONAL_HOSTS".to_string(),
        local_btcpay_additional_hosts(
            config.host.as_str(),
            app_env
                .effective_value("BTCPAY_ADDITIONAL_HOSTS")
                .as_deref()
                .unwrap_or_default(),
        ),
    );
    for key in [
        "BTCPAY_SSHAUTHORIZEDKEYS",
        "BTCPAY_SSHTRUSTEDFINGERPRINTS",
        "BTCPAY_SSHKEYFILE",
    ] {
        values.insert(
            key.to_string(),
            app_env.effective_value(key).unwrap_or_default(),
        );
    }
    Ok(values)
}

fn resolve_btcpay_image(app_env: &EnvFile) -> Result<String> {
    if let Some(image) = app_env.effective_value("BTCPAY_IMAGE") {
        ensure!(
            stable_btcpay_version_from_image(&image).is_some(),
            "BTCPAY_IMAGE must use an official stable image such as btcpayserver/btcpayserver:2.4.0; release candidates are not allowed"
        );
        return Ok(image);
    }

    let client = Client::builder()
        .timeout(Duration::from_secs(10))
        .user_agent(concat!("ch-rds/", env!("CARGO_PKG_VERSION")))
        .build()
        .context("failed to create BTCPay release client")?;
    let resolved = client
        .get(BTCPAY_LATEST_STABLE_RELEASE_URL)
        .send()
        .and_then(reqwest::blocking::Response::error_for_status)
        .and_then(reqwest::blocking::Response::json::<GithubRelease>)
        .ok()
        .and_then(|release| stable_btcpay_image_from_release(&release));

    if let Some(image) = resolved {
        return Ok(image);
    }

    tracing::warn!(
        fallback_image = BTCPAY_STABLE_FALLBACK_IMAGE,
        "Could not resolve the latest stable BTCPay release; using the pinned stable fallback"
    );
    Ok(BTCPAY_STABLE_FALLBACK_IMAGE.to_string())
}

fn stable_btcpay_image_from_release(release: &GithubRelease) -> Option<String> {
    if release.draft || release.prerelease {
        return None;
    }
    let version = release.tag_name.strip_prefix('v')?;
    stable_btcpay_version(version).then(|| format!("btcpayserver/btcpayserver:{version}"))
}

fn stable_btcpay_version_from_image(image: &str) -> Option<&str> {
    let version = image.strip_prefix("btcpayserver/btcpayserver:")?;
    stable_btcpay_version(version).then_some(version)
}

fn stable_btcpay_version(version: &str) -> bool {
    let mut components = version.split('.');
    let valid_component = |component: &str| {
        !component.is_empty()
            && component.bytes().all(|byte| byte.is_ascii_digit())
            && (component == "0" || !component.starts_with('0'))
    };
    let Some(major) = components.next() else {
        return false;
    };
    let Some(minor) = components.next() else {
        return false;
    };
    let Some(patch) = components.next() else {
        return false;
    };
    components.next().is_none()
        && valid_component(major)
        && valid_component(minor)
        && valid_component(patch)
}

fn write_btcpay_env(path: &Path, values: &BTreeMap<String, String>) -> Result<()> {
    let mut lines = Vec::new();
    for key in [
        "BTCPAY_IMAGE",
        "BTCPAY_HOST",
        "REVERSEPROXY_HTTP_PORT",
        "REVERSEPROXY_HTTPS_PORT",
        "NBITCOIN_NETWORK",
        "BTCPAYGEN_CRYPTO1",
        "BTCPAYGEN_REVERSEPROXY",
        "BTCPAYGEN_SUBNAME",
        "COMPOSE_PROJECT_NAME",
        "BTCPAY_ADDITIONAL_HOSTS",
        "BTCPAY_SSHAUTHORIZEDKEYS",
        "BTCPAY_SSHTRUSTEDFINGERPRINTS",
        "BTCPAY_SSHKEYFILE",
    ] {
        lines.push(format!(
            "{key}={}",
            values.get(key).map(String::as_str).unwrap_or_default()
        ));
    }
    fs::write(path, format!("{}\n", lines.join("\n")))
        .with_context(|| format!("failed to write {}", path.display()))
}

fn run_build_script(btcpay_root: &Path, envs: &BTreeMap<String, String>) -> Result<()> {
    let (program, args): (&str, Vec<String>) = if cfg!(windows) {
        (
            "powershell",
            vec![
                "-NoProfile".to_string(),
                "-ExecutionPolicy".to_string(),
                "Bypass".to_string(),
                "-File".to_string(),
                btcpay_root.join("build.ps1").display().to_string(),
            ],
        )
    } else {
        (
            "bash",
            vec![btcpay_root.join("build.sh").display().to_string()],
        )
    };
    run_command("BTCPay build step", program, &args, btcpay_root, envs)
}

fn patch_local_btcpay_compose(btcpay_root: &Path, envs: &BTreeMap<String, String>) -> Result<()> {
    let subname = required_env_value(envs, "BTCPAYGEN_SUBNAME")?;
    let compose_file = btcpay_root
        .join("Generated")
        .join(format!("docker-compose.{subname}.yml"));
    let compose = fs::read_to_string(&compose_file)
        .with_context(|| format!("failed to read {}", compose_file.display()))?;
    let patched = compose.replace("\n        onion=tor:9050\n", "\n        onion=0\n");

    if patched != compose {
        fs::write(&compose_file, patched)
            .with_context(|| format!("failed to write {}", compose_file.display()))?;
    }

    Ok(())
}

fn docker_compose_up(btcpay_root: &Path, envs: &BTreeMap<String, String>) -> Result<()> {
    let subname = required_env_value(envs, "BTCPAYGEN_SUBNAME")?;
    let project_name = required_env_value(envs, "COMPOSE_PROJECT_NAME")?;
    let compose_file = btcpay_root
        .join("Generated")
        .join(format!("docker-compose.{subname}.yml"));
    ensure!(
        compose_file.is_file(),
        "generated BTCPay compose file is missing at {}",
        compose_file.display()
    );

    let args = vec![
        "compose".to_string(),
        "--project-name".to_string(),
        project_name.to_string(),
        "--env-file".to_string(),
        ".env".to_string(),
        "-f".to_string(),
        compose_file.display().to_string(),
        "up".to_string(),
        "-d".to_string(),
    ];
    run_command(
        "BTCPay docker compose up",
        "docker",
        &args,
        btcpay_root,
        envs,
    )
}

fn run_command(
    label: &str,
    program: &str,
    args: &[String],
    cwd: &Path,
    envs: &BTreeMap<String, String>,
) -> Result<()> {
    let mut command = Command::new(program);
    command.current_dir(cwd).args(args).envs(envs);
    command.env("COMPOSE_CONVERT_WINDOWS_PATHS", "1");
    let status = command
        .status()
        .with_context(|| format!("failed to start {label}"))?;
    ensure!(status.success(), "{label} exited with status {status}");
    Ok(())
}

struct BtcpayClient {
    profile: BtcpayDevProfile,
    base_url: String,
    admin_email: String,
    admin_password: String,
    client: Client,
}

impl BtcpayClient {
    fn new(
        profile: BtcpayDevProfile,
        base_url: String,
        admin_email: String,
        admin_password: String,
    ) -> Result<Self> {
        let client = Client::builder()
            .cookie_store(true)
            .timeout(Duration::from_secs(30))
            .build()
            .context("failed to create BTCPay HTTP client")?;
        Ok(Self {
            profile,
            base_url: base_url.trim_end_matches('/').to_string(),
            admin_email,
            admin_password,
            client,
        })
    }

    fn wait_until_ready(&self) -> Result<()> {
        let deadline = Instant::now() + Duration::from_secs(180);
        let mut last_error = None;
        while Instant::now() < deadline {
            match self.client.get(format!("{}/", self.base_url)).send() {
                Ok(response)
                    if response.status().is_success() || response.status().is_redirection() =>
                {
                    return Ok(());
                }
                Ok(response) => {
                    last_error = Some(anyhow!("BTCPay returned {}", response.status()));
                }
                Err(error) => {
                    last_error = Some(error.into());
                }
            }
            std::thread::sleep(Duration::from_secs(2));
        }
        Err(last_error.unwrap_or_else(|| anyhow!("BTCPay did not become ready in time")))
    }

    fn ensure_admin_user(&self) -> Result<()> {
        if self.has_valid_admin_credentials()? {
            return Ok(());
        }

        let response = self
            .client
            .post(format!("{}/api/v1/users", self.base_url))
            .json(&json!({
                "email": self.admin_email.as_str(),
                "name": self.profile.display_name(),
                "password": self.admin_password.as_str(),
                "isAdministrator": true,
                "sendInvitationEmail": false,
            }))
            .send()
            .context("failed to create the local BTCPay administrator")?;
        ensure!(
            response.status() == StatusCode::CREATED || response.status() == StatusCode::OK,
            "BTCPay administrator creation returned {}. The local BTCPay data may belong to different development credentials",
            response.status()
        );
        ensure!(
            self.has_valid_admin_credentials()?,
            "BTCPay local admin bootstrap did not produce valid API credentials"
        );
        Ok(())
    }

    fn has_valid_admin_credentials(&self) -> Result<bool> {
        let response = self
            .admin_auth(
                self.client
                    .get(format!("{}/api/v1/users/me", self.base_url)),
            )
            .send()
            .context("failed to check BTCPay admin credentials")?;
        match response.status() {
            StatusCode::OK => Ok(true),
            StatusCode::UNAUTHORIZED | StatusCode::NOT_FOUND => Ok(false),
            status => bail!("BTCPay admin credential check returned {status}"),
        }
    }

    fn ensure_store(&self, public_url: &str) -> Result<String> {
        let stores: Vec<Value> = self.admin_get_json("/api/v1/stores")?;
        for store in stores {
            if store.get("name").and_then(Value::as_str) == Some(self.profile.store_name.as_str())
                && let Some(id) = store.get("id").and_then(Value::as_str)
            {
                return Ok(id.to_string());
            }
        }

        let created: Value = self.admin_post_json(
            "/api/v1/stores",
            &json!({
                "name": self.profile.store_name.as_str(),
                "website": public_url,
                "defaultLang": "en",
                "speedPolicy": "MediumSpeed",
                "redirectAutomatically": false,
                "anyoneCanCreateInvoice": false,
            }),
        )?;
        created
            .get("id")
            .and_then(Value::as_str)
            .map(str::to_string)
            .ok_or_else(|| anyhow!("BTCPay store creation returned an unexpected response"))
    }

    fn ensure_onchain_wallet(&self, store_id: &str, api_key: &str) -> Result<()> {
        let has_wallet = |payload: &Value| {
            payload.get("enabled").and_then(Value::as_bool) == Some(true)
                && payload.get("paymentMethodId").and_then(Value::as_str) == Some("BTC-CHAIN")
                && payload
                    .pointer("/config/accountDerivation")
                    .and_then(Value::as_str)
                    .is_some_and(|derivation| !derivation.trim().is_empty())
        };
        match self.api_key_get_json::<Value>(
            api_key,
            &format!("/api/v1/stores/{store_id}/payment-methods/OnChain/BTC?includeConfig=true"),
        ) {
            Ok(payload) if has_wallet(&payload) => return Ok(()),
            Ok(_) => {}
            Err(error) if error.to_string().contains("404") => {}
            Err(error) => return Err(error),
        }

        let payload: Value = self.api_key_post_json(
            api_key,
            &format!("/api/v1/stores/{store_id}/payment-methods/OnChain/BTC/wallet/generate"),
            &json!({
                "label": self.profile.api_key_label.as_str(),
                "accountNumber": 0,
                "savePrivateKeys": false,
                "wordList": "English",
                "wordCount": 12,
                "scriptPubKeyType": "Segwit",
            }),
        )?;
        ensure!(
            has_wallet(&payload),
            "BTCPay on-chain wallet setup returned an unexpected response"
        );
        Ok(())
    }

    fn ensure_rate_settings(&self, store_id: &str, api_key: &str) -> Result<()> {
        let payload: Value = self.api_key_put_json(
            api_key,
            &format!("/api/v1/stores/{store_id}/rates/configuration/primary"),
            &json!({
                "spread": "0",
                "preferredSource": self.profile.rate_source.as_str(),
                "isCustomScript": false,
                "effectiveScript": "",
            }),
        )?;
        ensure!(
            payload.get("isCustomScript").and_then(Value::as_bool) == Some(false),
            "BTCPay rate configuration returned an unexpected response"
        );
        Ok(())
    }

    fn ensure_api_key(&self, store_id: &str, current_key: Option<&str>) -> Result<String> {
        let required_permissions = [
            format!("btcpay.store.cancreateinvoice:{store_id}"),
            format!("btcpay.store.canviewinvoices:{store_id}"),
            format!("btcpay.store.webhooks.canmodifywebhooks:{store_id}"),
            format!("btcpay.store.canviewstoresettings:{store_id}"),
            format!("btcpay.store.canmodifystoresettings:{store_id}"),
        ];
        if let Some(key) = current_key
            && !is_placeholder_value(key)
            && self.api_key_has_permissions(key, &required_permissions)?
        {
            return Ok(key.to_string());
        }

        let created: Value = self.admin_post_json(
            "/api/v1/api-keys",
            &json!({
                "label": self.profile.api_key_label.as_str(),
                "permissions": required_permissions,
            }),
        )?;
        created
            .get("apiKey")
            .and_then(Value::as_str)
            .map(str::to_string)
            .ok_or_else(|| anyhow!("BTCPay API key creation returned an unexpected response"))
    }

    fn ensure_webhook(
        &self,
        store_id: &str,
        public_url: &str,
        api_key: &str,
        current_secret: Option<&str>,
    ) -> Result<String> {
        let webhook_url = btcpay_webhook_url(public_url, self.profile.webhook_path.as_str())?;
        if let Some(secret) = current_secret
            && !is_placeholder_value(secret)
            && self.webhook_exists(store_id, api_key, webhook_url.as_str())?
        {
            return Ok(secret.to_string());
        }

        let secret = format!("{}_{}", Uuid::new_v4(), Uuid::new_v4());
        let created: Value = self.api_key_post_json(
            api_key,
            &format!("/api/v1/stores/{store_id}/webhooks"),
            &json!({
                "enabled": true,
                "automaticRedelivery": true,
                "url": webhook_url,
                "secret": secret,
                "authorizedEvents": {
                    "everything": false,
                    "specificEvents": [
                        "InvoiceCreated",
                        "InvoiceReceivedPayment",
                        "InvoiceProcessing",
                        "InvoiceSettled",
                        "InvoiceExpired",
                        "InvoiceInvalid"
                    ]
                }
            }),
        )?;
        Ok(created
            .get("secret")
            .and_then(Value::as_str)
            .unwrap_or(secret.as_str())
            .to_string())
    }

    fn api_key_has_permissions(&self, key: &str, required_permissions: &[String]) -> Result<bool> {
        let response = self
            .api_key_auth(
                key,
                self.client
                    .get(format!("{}/api/v1/api-keys/current", self.base_url)),
            )
            .send()
            .context("failed to check BTCPay API key")?;
        if response.status() == StatusCode::UNAUTHORIZED {
            return Ok(false);
        }
        let payload: Value = response_json(response, "BTCPay API key check")?;
        let Some(permissions) = payload.get("permissions").and_then(Value::as_array) else {
            return Ok(false);
        };
        let permissions = permissions
            .iter()
            .filter_map(Value::as_str)
            .collect::<BTreeSet<_>>();
        Ok(required_permissions
            .iter()
            .all(|permission| permissions.contains(permission.as_str())))
    }

    fn webhook_exists(&self, store_id: &str, api_key: &str, webhook_url: &str) -> Result<bool> {
        let webhooks: Vec<Value> =
            self.api_key_get_json(api_key, &format!("/api/v1/stores/{store_id}/webhooks"))?;
        Ok(webhooks
            .iter()
            .any(|webhook| webhook.get("url").and_then(Value::as_str) == Some(webhook_url)))
    }

    fn admin_get_json<T: for<'de> Deserialize<'de>>(&self, path: &str) -> Result<T> {
        let response = self
            .admin_auth(self.client.get(format!("{}{}", self.base_url, path)))
            .send()
            .with_context(|| format!("failed to request BTCPay {path}"))?;
        response_json(response, path)
    }

    fn admin_post_json<T: for<'de> Deserialize<'de>>(
        &self,
        path: &str,
        payload: &Value,
    ) -> Result<T> {
        let response = self
            .admin_auth(self.client.post(format!("{}{}", self.base_url, path)))
            .json(payload)
            .send()
            .with_context(|| format!("failed to request BTCPay {path}"))?;
        response_json(response, path)
    }

    fn api_key_get_json<T: for<'de> Deserialize<'de>>(
        &self,
        api_key: &str,
        path: &str,
    ) -> Result<T> {
        let response = self
            .api_key_auth(
                api_key,
                self.client.get(format!("{}{}", self.base_url, path)),
            )
            .send()
            .with_context(|| format!("failed to request BTCPay {path}"))?;
        response_json(response, path)
    }

    fn api_key_post_json<T: for<'de> Deserialize<'de>>(
        &self,
        api_key: &str,
        path: &str,
        payload: &Value,
    ) -> Result<T> {
        let response = self
            .api_key_auth(
                api_key,
                self.client.post(format!("{}{}", self.base_url, path)),
            )
            .json(payload)
            .send()
            .with_context(|| format!("failed to request BTCPay {path}"))?;
        response_json(response, path)
    }

    fn api_key_put_json<T: for<'de> Deserialize<'de>>(
        &self,
        api_key: &str,
        path: &str,
        payload: &Value,
    ) -> Result<T> {
        let response = self
            .api_key_auth(
                api_key,
                self.client.put(format!("{}{}", self.base_url, path)),
            )
            .json(payload)
            .send()
            .with_context(|| format!("failed to request BTCPay {path}"))?;
        response_json(response, path)
    }

    fn admin_auth(&self, request: RequestBuilder) -> RequestBuilder {
        let token = base64::engine::general_purpose::STANDARD
            .encode(format!("{}:{}", self.admin_email, self.admin_password));
        request.header(reqwest::header::AUTHORIZATION, format!("Basic {token}"))
    }

    fn api_key_auth(&self, api_key: &str, request: RequestBuilder) -> RequestBuilder {
        request.header(reqwest::header::AUTHORIZATION, format!("token {api_key}"))
    }
}

fn response_json<T: for<'de> Deserialize<'de>>(
    response: reqwest::blocking::Response,
    label: &str,
) -> Result<T> {
    let status = response.status();
    let text = response
        .text()
        .with_context(|| format!("failed to read {label} response"))?;
    ensure!(
        status.is_success(),
        "{label} returned {status}: {}",
        text.chars().take(500).collect::<String>()
    );
    serde_json::from_str(&text)
        .with_context(|| format!("{label} returned an unexpected JSON response"))
}

fn btcpay_webhook_url(public_url: &str, webhook_path: &str) -> Result<String> {
    let parsed = url::Url::parse(public_url)
        .with_context(|| format!("invalid public payment URL `{public_url}`"))?;
    let host = match parsed.host_str() {
        Some("127.0.0.1" | "localhost") => "host.docker.internal",
        Some(host) => host,
        None => "host.docker.internal",
    };
    let mut netloc = host.to_string();
    if let Some(port) = parsed.port() {
        netloc = format!("{netloc}:{port}");
    }
    let scheme = if parsed.scheme().is_empty() {
        "http"
    } else {
        parsed.scheme()
    };
    Ok(format!("{scheme}://{netloc}{webhook_path}"))
}

fn required_env_value<'a>(values: &'a BTreeMap<String, String>, key: &str) -> Result<&'a str> {
    values
        .get(key)
        .map(String::as_str)
        .filter(|value| !value.trim().is_empty())
        .ok_or_else(|| anyhow!("missing required BTCPay env value {key}"))
}

fn local_btcpay_additional_hosts(primary_host: &str, configured_hosts: &str) -> String {
    let mut hosts = configured_hosts
        .split(',')
        .map(str::trim)
        .filter(|host| !host.is_empty())
        .map(str::to_string)
        .collect::<Vec<_>>();
    if primary_host == "127.0.0.1" && !hosts.iter().any(|host| host == "localhost") {
        hosts.push("localhost".to_string());
    }
    if primary_host == "localhost" && !hosts.iter().any(|host| host == "127.0.0.1") {
        hosts.push("127.0.0.1".to_string());
    }
    hosts.join(",")
}

fn is_placeholder_value(value: &str) -> bool {
    matches!(
        value.trim(),
        "" | "__change_me__" | "BTCPAY_STORE_ID_FROM_UI"
    )
}

fn mask_secret(value: &str) -> String {
    if value.len() <= 8 {
        return "********".to_string();
    }
    format!("{}...{}", &value[..4], &value[value.len() - 4..])
}

#[cfg(test)]
mod tests {
    use super::{
        GithubRelease, stable_btcpay_image_from_release, stable_btcpay_version_from_image,
    };

    #[test]
    fn accepts_latest_stable_release() {
        let release = GithubRelease {
            tag_name: "v2.4.0".to_string(),
            draft: false,
            prerelease: false,
        };

        assert_eq!(
            stable_btcpay_image_from_release(&release).as_deref(),
            Some("btcpayserver/btcpayserver:2.4.0")
        );
    }

    #[test]
    fn rejects_release_candidates_and_drafts() {
        for release in [
            GithubRelease {
                tag_name: "v2.4.3-rc4".to_string(),
                draft: false,
                prerelease: true,
            },
            GithubRelease {
                tag_name: "v2.4.1".to_string(),
                draft: true,
                prerelease: false,
            },
        ] {
            assert!(stable_btcpay_image_from_release(&release).is_none());
        }
    }

    #[test]
    fn accepts_only_official_stable_image_overrides() {
        assert_eq!(
            stable_btcpay_version_from_image("btcpayserver/btcpayserver:2.4.0"),
            Some("2.4.0")
        );
        for image in [
            "btcpayserver/btcpayserver:2.4.3-rc4",
            "btcpayserver/btcpayserver:latest",
            "example.invalid/btcpay:2.4.0",
            "btcpayserver/btcpayserver:02.4.0",
        ] {
            assert!(stable_btcpay_version_from_image(image).is_none());
        }
    }
}