package services

import (
	"context"
	"log"

	"gitea.hostxtra.co.uk/mrhid6/vantage/server/internal/db"
	"go.mongodb.org/mongo-driver/v2/bson"
	"go.mongodb.org/mongo-driver/v2/mongo"
	"go.mongodb.org/mongo-driver/v2/mongo/options"
)

// EnsureVulnIndexes declares the indexes for package inventory and findings.
//
// It warns rather than being fatal, matching EnsureSecretIndexes and
// EnsureWorkflowIndexes: a missing index degrades these queries to a collection
// scan, which is no reason to refuse to serve the fleet.
func EnsureVulnIndexes() error {
	ctx := context.Background()

	pkgIdx := []mongo.IndexModel{
		{
			Keys:    bson.D{{Key: "instance_id", Value: 1}, {Key: "server_id", Value: 1}},
			Options: options.Index().SetUnique(true),
		},
		// Multikey, for fleet-wide package search: "who runs openssl 3.0.2?"
		{Keys: bson.D{{Key: "instance_id", Value: 1}, {Key: "packages.name", Value: 1}}},
		// The scheduler's only query. Deliberately unscoped: it sweeps the whole
		// deployment on the leader, not one tenant.
		{Keys: bson.D{{Key: "scan_pending", Value: 1}}},
	}
	if _, err := db.Col("server_packages").Indexes().CreateMany(ctx, pkgIdx); err != nil {
		log.Printf("warning: server_packages indexes: %v", err)
	}

	findingIdx := []mongo.IndexModel{
		{
			// This key is what makes a rescan an idempotent upsert rather than a
			// duplicate factory, and what lets first_seen survive a rescan.
			Keys: bson.D{
				{Key: "instance_id", Value: 1},
				{Key: "server_id", Value: 1},
				{Key: "cve_id", Value: 1},
				{Key: "package_name", Value: 1},
			},
			Options: options.Index().SetUnique(true),
		},
		{Keys: bson.D{{Key: "instance_id", Value: 1}, {Key: "state", Value: 1}, {Key: "severity", Value: 1}}},
		{Keys: bson.D{{Key: "instance_id", Value: 1}, {Key: "cve_id", Value: 1}}},
	}
	if _, err := db.Col("vuln_findings").Indexes().CreateMany(ctx, findingIdx); err != nil {
		log.Printf("warning: vuln_findings indexes: %v", err)
	}

	if _, err := db.Col("vuln_alert_rules").Indexes().CreateOne(ctx, mongo.IndexModel{
		Keys: bson.D{{Key: "instance_id", Value: 1}},
	}); err != nil {
		log.Printf("warning: vuln_alert_rules indexes: %v", err)
	}

	return nil
}
