#!/usr/bin/env python3
"""
Envguard — .env file validator, inspector, and security auditor.

Analyze your .env files for missing keys, formatting issues,
security concerns (hardcoded secrets, whitespace in values),
and compare against a template.

Usage:
  envguard check [.env]                    # validate a .env file
  envguard inspect [.env]                  # show key info (length, chars)
  envguard diff <template> <actual>        # compare against template
  envguard audit [.env]                    # security audit
  envguard mask [.env]                     # print masked values (safe for screenshots)
  envguard templates init <name>           # create a template from current .env
"""

import argparse
import os
import re
import sys
import textwrap
from pathlib import Path

VERSION = "1.0.0"

# ─── Constants ──────────────────────────────────────────────────────────────

SENSITIVE_KEYS = [
    "KEY", "SECRET", "TOKEN", "PASSWORD", "PASS", "API_KEY",
    "APIKEY", "AUTH", "CREDENTIAL", "PRIVATE", "SIGNING",
    "SALT", "SECURE", "CERT", "SSH",
]

ENVGUARD_DIR = Path.home() / ".envguard"
TEMPLATES_DIR = ENVGUARD_DIR / "templates"

# ─── Color helpers ──────────────────────────────────────────────────────────


def _green(t: str) -> str:
    return f"\033[92m{t}\033[0m"


def _yellow(t: str) -> str:
    return f"\033[93m{t}\033[0m"


def _red(t: str) -> str:
    return f"\033[91m{t}\033[0m"


def _cyan(t: str) -> str:
    return f"\033[96m{t}\033[0m"


def _bold(t: str) -> str:
    return f"\033[1m{t}\033[0m"


def _dim(t: str) -> str:
    return f"\033[2m{t}\033[0m"


# ─── Parsing ────────────────────────────────────────────────────────────────


def parse_env(content: str) -> list:
    entries = []
    for i, line in enumerate(content.split("\n"), start=1):
        stripped = line.strip()

        # Skip empty lines and comments
        if not stripped or stripped.startswith("#"):
            entries.append({
                "type": "comment" if stripped.startswith("#") else "blank",
                "line_number": i,
                "raw": line,
            })
            continue

        # Check for "export " prefix
        export_prefix = False
        check_line = stripped
        if check_line.startswith("export "):
            export_prefix = True
            check_line = check_line[7:].lstrip()

        # Match KEY=VALUE
        match = re.match(r'^([a-zA-Z_][a-zA-Z0-9_]*)=(.*)$', check_line)
        if not match:
            entries.append({
                "type": "invalid",
                "line_number": i,
                "raw": line,
                "error": "Malformed line (not KEY=VALUE format)",
            })
            continue

        key = match.group(1)
        value_str = match.group(2)

        # Check for quotes
        has_quotes = False
        unquoted = value_str
        if len(value_str) >= 2:
            if (value_str.startswith('"') and value_str.endswith('"')) or \
               (value_str.startswith("'") and value_str.endswith("'")):
                has_quotes = True
                unquoted = value_str[1:-1]

        entries.append({
            "type": "var",
            "key": key,
            "value": unquoted,
            "raw_value": value_str,
            "line_number": i,
            "raw": line,
            "has_quotes": has_quotes,
            "export_prefix": export_prefix,
        })

    return entries


def load_env_file(path: str = ".env") -> tuple:
    env_path = Path(path).expanduser().resolve()
    if not env_path.exists():
        print(f"  {_red(f'File not found: {env_path}')}")
        sys.exit(1)
    content = env_path.read_text()
    entries = parse_env(content)
    return content, entries, env_path


# ─── Commands ────────────────────────────────────────────────────────────────


def cmd_check(path: str) -> None:
    content, entries, env_path = load_env_file(path)
    vars_only = [e for e in entries if e["type"] == "var"]

    issues = []

    for e in vars_only:
        # Check for trailing whitespace in value
        if e["raw_value"] != e["raw_value"].rstrip():
            issues.append((e["line_number"], "Trailing whitespace in value for " + _bold(e["key"])))

        # Check for unquoted values with spaces
        if " " in e["raw_value"].strip() and not e["has_quotes"]:
            issues.append((e["line_number"], "Value for " + _bold(e["key"]) + " contains spaces but is not quoted"))

        # Check empty values
        if not e["value"] and not e["raw_value"]:
            issues.append((e["line_number"], _yellow(e["key"]) + " has empty value"))

    print(f"\n  {_bold('Envguard Check')}")
    print(f"  File: {_cyan(str(env_path))}")
    print(f"  {_bold(f'  {len(vars_only)} variables')}, {len(entries) - len(vars_only)} comments/blanks\n")

    for e in entries:
        if e["type"] in ("comment", "blank"):
            continue
        if e["type"] == "invalid":
            ln = e["line_number"]
            print(f"  {_red('✗')} Line {ln}: {_red(e.get('error', 'Parse error'))}")
            print(f"    {_dim(e['raw'])}")
        elif e["type"] == "var":
            icon = _green("✓")
            val_display = "= " + e["value"][:40] + ("…" if len(e["value"]) > 40 else "")
            ln = e["line_number"]
            print(f"  {icon} {_bold(e['key']):30s} {_dim(val_display)}  [{_dim('L' + str(ln))}]")

    if issues:
        print(f"\n  {_yellow(f'{len(issues)} issue(s) found')}")
        for line_num, msg in issues:
            print(f"    L{line_num}: {msg}")
    else:
        print(f"\n  {_green('✓ No issues found')}")
    print()


def cmd_inspect(path: str) -> None:
    content, entries, env_path = load_env_file(path)
    vars_only = [e for e in entries if e["type"] == "var"]

    print(f"\n  {_bold('Envguard Inspection')}")
    print(f"  File: {_cyan(str(env_path))}\n")

    for e in vars_only:
        val_len = len(e["value"])
        alpha_cnt = sum(c.isalpha() for c in e["value"])
        digit_cnt = sum(c.isdigit() for c in e["value"])
        special_cnt = val_len - alpha_cnt - digit_cnt
        has_newline = "\n" in e["value"]
        is_sensitive = any(sk in e["key"].upper() for sk in SENSITIVE_KEYS)

        status = _yellow("⚠") if is_sensitive else _green("✓")

        print(f"  {status} {_bold(e['key'])}")
        print(f"      Length:   {_cyan(str(val_len))} chars")
        print(f"      Alpha:    {alpha_cnt}  Digit: {digit_cnt}  Special: {special_cnt}")
        print(f"      Quoted:   {_green('yes') if e['has_quotes'] else _red('no')}")
        print(f"      Export:   {_green('yes') if e['export_prefix'] else _dim('no')}")
        if has_newline:
            print(f"      {_red('⚠ Contains newline characters — may cause issues')}")
        print()


def cmd_diff(template_path: str, actual_path: str) -> None:
    tmpl_content, tmpl_entries, tmpl_path = load_env_file(template_path)
    act_content, act_entries, act_path = load_env_file(actual_path)

    tmpl_vars = {e["key"]: e for e in tmpl_entries if e["type"] == "var"}
    act_vars = {e["key"]: e for e in act_entries if e["type"] == "var"}

    tmpl_keys = set(tmpl_vars.keys())
    act_keys = set(act_vars.keys())

    missing = tmpl_keys - act_keys
    extra = act_keys - tmpl_keys
    common = tmpl_keys & act_keys

    print(f"\n  {_bold('Envguard Diff')}")
    print(f"  Template: {_cyan(str(tmpl_path))}")
    print(f"  Actual:   {_cyan(str(act_path))}\n")

    print(f"  Template has {_bold(str(len(tmpl_keys)))} keys, actual has {_bold(str(len(act_keys)))} keys\n")

    if missing:
        print(f"  {_red(f'{len(missing)} key(s) missing from actual')}")
        for k in sorted(missing):
            print(f"    - {_bold(k)}")
        print()

    if extra:
        print(f"  {_yellow(f'{len(extra)} key(s) extra in actual')}")
        for k in sorted(extra):
            print(f"    + {_bold(k)}")
        print()

    if common:
        conflicts = 0
        for k in sorted(common):
            tv = tmpl_vars[k].get("value", "")
            av = act_vars[k].get("value", "")
            if tv and av and tv != av:
                conflicts += 1
                print(f"  {_yellow('~')} {_bold(k)} differs:")
                print(f"      template: {_dim(tv[:40])}")
                print(f"      actual:   {av[:40]}")
        if conflicts == 0:
            print(f"  {_green(f'✓ All {len(common)} shared keys match (values not compared for blanks)')}")
        print()


def cmd_audit(path: str) -> None:
    content, entries, env_path = load_env_file(path)
    vars_only = [e for e in entries if e["type"] == "var"]

    findings = []

    for e in vars_only:
        key_upper = e["key"].upper()
        ln = e["line_number"]

        # 1. Sensitive key with short value (placeholder risk)
        if any(sk in key_upper for sk in SENSITIVE_KEYS):
            if len(e["value"]) < 8 and e["value"]:
                findings.append((_yellow("MED"), ln, _bold(e["key"]) + " looks like a placeholder (short value)"))
            elif not e["value"]:
                findings.append((_red("HIGH"), ln, _bold(e["key"]) + " is sensitive but EMPTY"))

        # 2. Hardcoded paths that may expose system structure
        if "/home/" in e["value"] or "/Users/" in e["value"]:
            findings.append((_yellow("LOW"), ln, _bold(e["key"]) + " contains a filesystem path"))

        # 3. No quotes on values with special chars
        special_chars = set("!@#$%^&*()[]{}|;:'\",.<>?/`~")
        if not e["has_quotes"] and any(c in e["value"] for c in special_chars):
            findings.append((_yellow("LOW"), ln, _bold(e["key"]) + " has special characters but is not quoted"))

        # 4. Exposed ports
        if "PORT" in key_upper.upper():
            try:
                port = int(e["value"])
                if port < 1024:
                    findings.append((_yellow("LOW"), ln, _bold(e["key"]) + " uses privileged port " + str(port)))
            except ValueError:
                pass

        # 5. Stale-looking tokens
        if e["value"].startswith("sk-") and len(e["value"]) > 10:
            findings.append((_red("HIGH"), ln, _bold(e["key"]) + " contains what looks like a live API key (sk-*)"))

    print(f"\n  {_bold('Envguard Security Audit')}")
    print(f"  File: {_cyan(str(env_path))}\n")

    if not findings:
        print(f"  {_green('✓ No security concerns found')}\n")
        return

    severities = {"HIGH": 0, "MED": 0, "LOW": 0}
    print(f"  {'Severity':12s} {'Line':6s} Finding")
    print(f"  {'─' * 60}")
    for severity, line_no, msg in findings:
        sev_key = severity.replace("\033", "").replace("[91m", "").replace("[93m", "").replace("[92m", "").replace("[0m", "")
        sev_key = "HIGH" if "\033[91m" in severity else ("MED" if "\033[93m" in severity else "LOW")
        severities[sev_key] = severities.get(sev_key, 0) + 1
        print(f"  {severity:12s} L{line_no:<4d} {msg}")

    print(f"\n  {_bold('Summary')}")
    print(f"    {_red(f'{severities.get('HIGH', 0)} high')} · "
          f"{_yellow(f'{severities.get('MED', 0)} medium')} · "
          f"{severities.get('LOW', 0)} low")
    print()


def cmd_mask(path: str) -> None:
    content, entries, env_path = load_env_file(path)

    print(f"\n  {_bold('Envguard — Masked View')}")
    print(f"  File: {_cyan(str(env_path))}")
    print(f"  {_dim('Sensitive keys are masked. Safe for screenshots.')}\n")

    for e in entries:
        if e["type"] in ("comment", "blank"):
            print(f"  {_dim(e['raw'])}")
        elif e["type"] == "invalid":
            print(f"  {_red('✗')} {e['raw']}")
        elif e["type"] == "var":
            is_sensitive = any(sk in e["key"].upper() for sk in SENSITIVE_KEYS)
            if is_sensitive and e["value"]:
                val = "**** MASKED ****"
            else:
                val = e["raw_value"]
            prefix = "export " if e["export_prefix"] else ""
            print(f"  {_bold(e['key'])}={prefix}{val}")
    print()


def cmd_templates(action: str, name: str) -> None:
    TEMPLATES_DIR.mkdir(parents=True, exist_ok=True)

    if action == "init":
        content, entries, env_path = load_env_file(".env")
        vars_only = [e for e in entries if e["type"] == "var"]

        tmpl_path = TEMPLATES_DIR / f"{name}.env"
        lines = ["# Envguard template: " + name, "# Generated from " + str(env_path), ""]
        for e in vars_only:
            lines.append(e["key"] + "=")
        lines.append("")

        tmpl_path.write_text("\n".join(lines))
        print(f"  {_green('✓')} Template '{_bold(name)}' created: {_cyan(str(tmpl_path))}")
        print(f"  {_dim(f'({len(vars_only)} keys)')}")
        return

    if action == "list":
        templates = sorted(TEMPLATES_DIR.glob("*.env"))
        if not templates:
            print(f"  {_yellow('No templates saved.')}")
            print(f"  Try: {_cyan('envguard templates init myproject')}")
            return
        print(f"\n  {_bold('Templates')}\n")
        for t in templates:
            size = len(t.read_text().split("\n"))
            print(f"    {_cyan(t.stem):20s} {_dim(f'({size} lines)')}")
        print()
        return

    if action == "show":
        tmpl_path = TEMPLATES_DIR / f"{name}.env"
        if not tmpl_path.exists():
            print(f"  {_red(f'Template \"{name}\" not found')}")
            sys.exit(1)
        content = tmpl_path.read_text()
        print()
        for line in content.split("\n"):
            print(f"  {line}")
        print()
        return

    print(f"  {_red(f'Unknown template action: {action}')}")
    sys.exit(1)


def cmd_update():
    """Check for updates and update the tool."""
    import json
    import urllib.request

    manifest_url = "https://neuralmint.github.io/tools/versions.json"
    script_name = "envguard"

    try:
        with urllib.request.urlopen(manifest_url, timeout=10) as resp:
            manifest = json.loads(resp.read().decode())
    except Exception as e:
        print(f"\033[91mError fetching update manifest: {e}\033[0m")
        sys.exit(1)

    if script_name not in manifest:
        print(f"\033[91mNo update info found for {script_name}\033[0m")
        sys.exit(1)

    info = manifest[script_name]
    remote_version = info["version"]
    current_version = VERSION

    print(f"Current version: {current_version}")
    print(f"Available version: {remote_version}")

    if tuple(map(int, remote_version.split("."))) <= tuple(map(int, current_version.split("."))):
        print(f"\033[92mAlready up to date.\033[0m")
        return

    print(f"\033[93mUpdating from {current_version} to {remote_version}...\033[0m")

    download_url = info["download_url"]
    try:
        with urllib.request.urlopen(download_url, timeout=30) as resp:
            new_code = resp.read().decode()
        with open(__file__, "w") as f:
            f.write(new_code)
        print(f"\033[92mUpdated successfully to v{remote_version}! Please restart the tool.\033[0m")
    except Exception as e:
        print(f"\033[91mError downloading update: {e}\033[0m")
        sys.exit(1)


# ─── Main ────────────────────────────────────────────────────────────────────


def main():
    parser = argparse.ArgumentParser(
        description="Envguard — .env file validator, inspector, and security auditor.",
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog=textwrap.dedent("""\
            Examples:
              envguard check .env                      # validate
              envguard inspect .env                    # detailed inspection
              envguard diff .env.example .env           # compare with template
              envguard audit .env                       # security audit
              envguard mask .env                        # safe-for-screenshots view
              envguard templates init myproject          # create template
              envguard templates list                    # list saved templates
        """),
    )
    parser.add_argument('--version', action='version', version=f'envguard v{VERSION}')
    subparsers = parser.add_subparsers(dest="command")

    for cmd_name in ("check", "inspect", "audit", "mask"):
        p = subparsers.add_parser(cmd_name, help=cmd_name.capitalize() + " a .env file")
        p.add_argument("path", nargs="?", default=".env", help="Path to .env file")

    p_diff = subparsers.add_parser("diff", help="Compare actual .env against a template")
    p_diff.add_argument("template", help="Template .env file path")
    p_diff.add_argument("actual", nargs="?", default=".env", help="Actual .env file path")

    p_templates = subparsers.add_parser("templates", help="Manage templates")
    tmpl_sub = p_templates.add_subparsers(dest="template_action")
    p_init = tmpl_sub.add_parser("init", help="Create a template from current .env")
    p_init.add_argument("name", help="Template name")
    tmpl_sub.add_parser("list", help="List all templates")
    p_show = tmpl_sub.add_parser("show", help="Show a template")
    p_show.add_argument("name", help="Template name")

    subparsers.add_parser("update", help="Check for updates and update the tool.")

    args = parser.parse_args()

    if not args.command:
        parser.print_help()
        sys.exit(1)

    if args.command == "templates":
        if not args.template_action:
            p_templates.print_help()
            sys.exit(1)
        cmd_templates(args.template_action, args.name if hasattr(args, 'name') else "")
    elif args.command == "diff":
        cmd_diff(args.template, args.actual)
    elif args.command in ("check", "inspect", "audit", "mask"):
        {
            "check": cmd_check,
            "inspect": cmd_inspect,
            "audit": cmd_audit,
            "mask": cmd_mask,
        }[args.command](args.path)
    elif args.command == "update":
        cmd_update()
    else:
        parser.print_help()


if __name__ == "__main__":
    main()