//

//  ClientCertificateManager.swift

//  Titan

//

//  Manages client certificates for Gemini authentication

//

import Foundation

import Security

import CommonCrypto

// MARK: - Data Models

struct ClientCertificate: Identifiable, Codable, Equatable {

    let id: UUID

    let name: String

    let fingerprint: String

    let createdAt: Date

    let expiresAt: Date

    init(id: UUID = UUID(), name: String, fingerprint: String, createdAt: Date = Date(), expiresAt: Date) {

        self.id = id

        self.name = name

        self.fingerprint = fingerprint

        self.createdAt = createdAt

        self.expiresAt = expiresAt

    }

    var isExpired: Bool {

        Date() > expiresAt

    }

    var daysUntilExpiry: Int {

        Calendar.current.dateComponents([.day], from: Date(), to: expiresAt).day ?? 0

    }

}

struct CertificateHostAssociation: Codable, Equatable, Identifiable {

    var id: String { "\(host):\(port)\(pathPrefix)" }

    let certificateId: UUID

    let host: String

    let port: Int

    let pathPrefix: String

    let createdAt: Date

    init(certificateId: UUID, host: String, port: Int = 1965, pathPrefix: String = "/", createdAt: Date = Date()) {

        self.certificateId = certificateId

        self.host = host

        self.port = port

        self.pathPrefix = pathPrefix

        self.createdAt = createdAt

    }

}

// MARK: - Errors

enum ClientCertificateError: LocalizedError {

    case generationFailed(Error)

    case keychainStoreFailed(OSStatus)

    case keychainDeleteFailed(OSStatus)

    case identityNotFound

    case certificateCreationFailed

    var errorDescription: String? {

        switch self {

        case .generationFailed(let error):

            return "Certificate generation failed: \(error.localizedDescription)"

        case .keychainStoreFailed(let status):

            return "Failed to store in Keychain (status: \(status))"

        case .keychainDeleteFailed(let status):

            return "Failed to delete from Keychain (status: \(status))"

        case .identityNotFound:

            return "Certificate identity not found in Keychain"

        case .certificateCreationFailed:

            return "Failed to create certificate from data"

        }

    }

}

// MARK: - Manager

@Observable

class ClientCertificateManager {

    private let certificatesStorageKey = "titan_client_certificates"

    private let associationsStorageKey = "titan_client_cert_associations"

    private let keychainTagPrefix = "com.titan.clientcert"

    var certificates: [ClientCertificate] = []

    var associations: [CertificateHostAssociation] = []

    init() {

        loadData()

        cleanupOrphanedAssociations()

    }

    // MARK: - Certificate Lifecycle

    /// Creates a new client certificate with the given friendly name

    func createCertificate(name: String, validityDays: Int = 365) throws -> ClientCertificate {

        // Generate the certificate

        let (certificateData, privateKey) = try X509Generator.generateSelfSignedCertificate(

            commonName: name,

            validityDays: validityDays

        )

        // Create SecCertificate from data

        guard let secCertificate = SecCertificateCreateWithData(nil, certificateData as CFData) else {

            throw ClientCertificateError.certificateCreationFailed

        }

        let id = UUID()

        let fingerprint = CertificateManager.sha256Fingerprint(certificateData)

        let expiresAt = Calendar.current.date(byAdding: .day, value: validityDays, to: Date())!

        // Store in Keychain

        try storeInKeychain(

            id: id,

            certificate: secCertificate,

            privateKey: privateKey

        )

        // Create metadata

        let certificate = ClientCertificate(

            id: id,

            name: name,

            fingerprint: fingerprint,

            createdAt: Date(),

            expiresAt: expiresAt

        )

        certificates.append(certificate)

        saveData()

        print("🔐 Created client certificate: \(name)")

        return certificate

    }

    /// Deletes a certificate and all its associations

    func deleteCertificate(id: UUID) throws {

        // Remove from Keychain

        try deleteFromKeychain(id: id)

        // Remove metadata

        certificates.removeAll { $0.id == id }

        // Remove all associations

        associations.removeAll { $0.certificateId == id }

        saveData()

        print("🗑️ Deleted client certificate: \(id)")

    }

    /// Gets a certificate by ID

    func getCertificate(id: UUID) -> ClientCertificate? {

        certificates.first { $0.id == id }

    }

    // MARK: - Host Associations

    /// Associates a certificate with a URL (host + port + path prefix)

    func associateCertificate(certificateId: UUID, with url: URL) {

        let host = url.host ?? ""

        let port = url.port ?? 1965

        let pathPrefix = normalizePathPrefix(url.path)

        // Remove any existing association for this exact path

        associations.removeAll { $0.host == host && $0.port == port && $0.pathPrefix == pathPrefix }

        let association = CertificateHostAssociation(

            certificateId: certificateId,

            host: host,

            port: port,

            pathPrefix: pathPrefix

        )

        associations.append(association)

        saveData()

        print("🔗 Associated certificate with \(host):\(port)\(pathPrefix)")

    }

    /// Removes a specific association

    func removeAssociation(host: String, port: Int, pathPrefix: String) {

        associations.removeAll { $0.host == host && $0.port == port && $0.pathPrefix == pathPrefix }

        saveData()

    }

    /// Gets all associations for a certificate

    func getAssociationsForCertificate(id: UUID) -> [CertificateHostAssociation] {

        associations.filter { $0.certificateId == id }

    }

    /// Finds the best matching certificate for a URL

    /// Returns the SecIdentity if found, nil otherwise

    func findIdentity(for url: URL) -> SecIdentity? {

        guard let certificateId = findCertificateId(for: url) else {

            return nil

        }

        return getSecIdentity(for: certificateId)

    }

    /// Finds the certificate ID for a URL (longest path prefix match)

    func findCertificateId(for url: URL) -> UUID? {

        let host = url.host ?? ""

        let port = url.port ?? 1965

        let path = url.path.isEmpty ? "/" : url.path

        // Find all matching associations

        let matching = associations

            .filter { $0.host == host && $0.port == port }

            .filter { path.hasPrefix($0.pathPrefix) }

            .sorted { $0.pathPrefix.count > $1.pathPrefix.count }

        return matching.first?.certificateId

    }

    /// Checks if a URL has an associated certificate

    func hasAssociation(for url: URL) -> Bool {

        findCertificateId(for: url) != nil

    }

    // MARK: - Keychain Operations

    /// Retrieves SecIdentity from Keychain

    func getSecIdentity(for certificateId: UUID) -> SecIdentity? {

        let tag = keychainTag(for: certificateId)

        // First get the certificate

        let certQuery: [String: Any] = [

            kSecClass as String: kSecClassCertificate,

            kSecAttrLabel as String: tag,

            kSecReturnRef as String: true

        ]

        var certRef: CFTypeRef?

        let certStatus = SecItemCopyMatching(certQuery as CFDictionary, &certRef)

        guard certStatus == errSecSuccess, let certificate = certRef else {

            print("❌ Certificate not found in Keychain for \(certificateId)")

            return nil

        }

        // Then get the private key

        let keyQuery: [String: Any] = [

            kSecClass as String: kSecClassKey,

            kSecAttrApplicationTag as String: tag.data(using: .utf8)!,

            kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,

            kSecReturnRef as String: true

        ]

        var keyRef: CFTypeRef?

        let keyStatus = SecItemCopyMatching(keyQuery as CFDictionary, &keyRef)

        guard keyStatus == errSecSuccess, let privateKey = keyRef else {

            print("❌ Private key not found in Keychain for \(certificateId)")

            return nil

        }

        // Create identity from certificate and key

        // Note: SecIdentityCreateWithCertificate is not available on iOS

        // We need to use a different approach - store as identity directly

        // or use SecPKCS12Import approach

        // For iOS, we'll return a constructed identity using our stored items

        // The Network framework's sec_identity_create can work with (cert, key) pairs

        // But we need SecIdentity for that API

        // Alternative: Query for identity directly (requires items to be stored as identity)

        let identityQuery: [String: Any] = [

            kSecClass as String: kSecClassIdentity,

            kSecAttrLabel as String: tag,

            kSecReturnRef as String: true

        ]

        var identityRef: CFTypeRef?

        let identityStatus = SecItemCopyMatching(identityQuery as CFDictionary, &identityRef)

        if identityStatus == errSecSuccess, let identity = identityRef {

            return (identity as! SecIdentity)

        }

        print("❌ Identity not found in Keychain for \(certificateId)")

        return nil

    }

    private func storeInKeychain(id: UUID, certificate: SecCertificate, privateKey: SecKey) throws {

        let tag = keychainTag(for: id)

        let tagData = tag.data(using: .utf8)!

        // First, store the private key

        let keyQuery: [String: Any] = [

            kSecClass as String: kSecClassKey,

            kSecAttrApplicationTag as String: tagData,

            kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,

            kSecValueRef as String: privateKey,

            kSecAttrIsPermanent as String: true,

            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly,

            kSecAttrLabel as String: tag

        ]

        var keyStatus = SecItemAdd(keyQuery as CFDictionary, nil)

        if keyStatus == errSecDuplicateItem {

            // Delete and retry

            SecItemDelete(keyQuery as CFDictionary)

            keyStatus = SecItemAdd(keyQuery as CFDictionary, nil)

        }

        if keyStatus != errSecSuccess {

            throw ClientCertificateError.keychainStoreFailed(keyStatus)

        }

        // Then store the certificate

        let certQuery: [String: Any] = [

            kSecClass as String: kSecClassCertificate,

            kSecValueRef as String: certificate,

            kSecAttrLabel as String: tag,

            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly

        ]

        var certStatus = SecItemAdd(certQuery as CFDictionary, nil)

        if certStatus == errSecDuplicateItem {

            SecItemDelete(certQuery as CFDictionary)

            certStatus = SecItemAdd(certQuery as CFDictionary, nil)

        }

        if certStatus != errSecSuccess {

            // Clean up the key we just added

            SecItemDelete(keyQuery as CFDictionary)

            throw ClientCertificateError.keychainStoreFailed(certStatus)

        }

        // The identity should be automatically created by the Keychain

        // when a certificate and its matching private key are both stored

        print("✅ Stored certificate and key in Keychain with tag: \(tag)")

    }

    private func deleteFromKeychain(id: UUID) throws {

        let tag = keychainTag(for: id)

        let tagData = tag.data(using: .utf8)!

        // Delete certificate

        let certQuery: [String: Any] = [

            kSecClass as String: kSecClassCertificate,

            kSecAttrLabel as String: tag

        ]

        SecItemDelete(certQuery as CFDictionary)

        // Delete private key

        let keyQuery: [String: Any] = [

            kSecClass as String: kSecClassKey,

            kSecAttrApplicationTag as String: tagData

        ]

        SecItemDelete(keyQuery as CFDictionary)

        // Delete identity (if exists)

        let identityQuery: [String: Any] = [

            kSecClass as String: kSecClassIdentity,

            kSecAttrLabel as String: tag

        ]

        SecItemDelete(identityQuery as CFDictionary)

    }

    private func keychainTag(for id: UUID) -> String {

        "\(keychainTagPrefix).\(id.uuidString)"

    }

    // MARK: - Persistence

    private func saveData() {

        if let certData = try? JSONEncoder().encode(certificates) {

            UserDefaults.standard.set(certData, forKey: certificatesStorageKey)

        }

        if let assocData = try? JSONEncoder().encode(associations) {

            UserDefaults.standard.set(assocData, forKey: associationsStorageKey)

        }

    }

    private func loadData() {

        if let data = UserDefaults.standard.data(forKey: certificatesStorageKey),

           let decoded = try? JSONDecoder().decode([ClientCertificate].self, from: data) {

            certificates = decoded

        }

        if let data = UserDefaults.standard.data(forKey: associationsStorageKey),

           let decoded = try? JSONDecoder().decode([CertificateHostAssociation].self, from: data) {

            associations = decoded

        }

    }

    private func cleanupOrphanedAssociations() {

        let validIds = Set(certificates.map { $0.id })

        let before = associations.count

        associations.removeAll { !validIds.contains($0.certificateId) }

        if associations.count != before {

            saveData()

            print("🧹 Cleaned up \(before - associations.count) orphaned associations")

        }

    }

    // MARK: - Helpers

    private func normalizePathPrefix(_ path: String) -> String {

        var normalized = path.isEmpty ? "/" : path

        // Remove trailing slash unless it's the root

        if normalized.count > 1 && normalized.hasSuffix("/") {

            normalized.removeLast()

        }

        return normalized

    }

}

        urlString: String,

        clientIdentity: SecIdentity? = nil

        // Set client certificate identity if provided

        if let identity = clientIdentity {

            if let secIdentity = sec_identity_create(identity) {

                sec_protocol_options_set_local_identity(

                    tlsOptions.securityProtocolOptions,

                    secIdentity

                )

                print("🔐 Using client certificate for authentication")

            }

        }

//

//  X509Generator.swift

//  Titan

//

//  Self-signed X.509 certificate generation using Security framework

//

import Foundation

import Security

enum X509GeneratorError: LocalizedError {

    case keyGenerationFailed(OSStatus)

    case publicKeyExtractionFailed

    case signingFailed

    case invalidKeyData

    var errorDescription: String? {

        switch self {

        case .keyGenerationFailed(let status):

            return "Key generation failed with status: \(status)"

        case .publicKeyExtractionFailed:

            return "Failed to extract public key data"

        case .signingFailed:

            return "Failed to sign certificate"

        case .invalidKeyData:

            return "Invalid key data format"

        }

    }

}

struct X509Generator {

    /// Generates a self-signed X.509 certificate with EC P-256 key

    /// - Parameters:

    ///   - commonName: The CN field for the certificate (typically the user's friendly name)

    ///   - validityDays: Number of days the certificate is valid (default 365)

    /// - Returns: Tuple of (DER-encoded certificate data, private key)

    static func generateSelfSignedCertificate(

        commonName: String,

        validityDays: Int = 365

    ) throws -> (certificateData: Data, privateKey: SecKey) {

        // Generate EC P-256 key pair

        let privateKey = try generateECKeyPair()

        guard let publicKey = SecKeyCopyPublicKey(privateKey) else {

            throw X509GeneratorError.publicKeyExtractionFailed

        }

        // Build the TBS (to-be-signed) certificate

        let tbsCertificate = try buildTBSCertificate(

            commonName: commonName,

            publicKey: publicKey,

            validityDays: validityDays

        )

        // Sign the TBS certificate

        let signature = try signData(tbsCertificate, with: privateKey)

        // Build the complete certificate

        let certificate = buildCertificate(

            tbsCertificate: tbsCertificate,

            signature: signature

        )

        return (certificate, privateKey)

    }

    // MARK: - Key Generation

    private static func generateECKeyPair() throws -> SecKey {

        let attributes: [String: Any] = [

            kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,

            kSecAttrKeySizeInBits as String: 256,

            kSecAttrIsPermanent as String: false

        ]

        var error: Unmanaged<CFError>?

        guard let privateKey = SecKeyCreateRandomKey(attributes as CFDictionary, &error) else {

            throw X509GeneratorError.keyGenerationFailed(-1)

        }

        return privateKey

    }

    // MARK: - Certificate Building

    private static func buildTBSCertificate(

        commonName: String,

        publicKey: SecKey,

        validityDays: Int

    ) throws -> Data {

        var tbs = Data()

        // Version: [0] EXPLICIT INTEGER { 2 } (v3)

        tbs.append(contentsOf: DER.contextTag(0, explicit: true, contents: DER.integer(2)))

        // Serial Number: Random positive integer

        let serialNumber = generateSerialNumber()

        tbs.append(contentsOf: DER.integer(serialNumber))

        // Signature Algorithm: ecdsa-with-SHA256 (1.2.840.10045.4.3.2)

        tbs.append(contentsOf: DER.sequence([

            DER.oid([1, 2, 840, 10045, 4, 3, 2])

        ]))

        // Issuer: CN=commonName

        let issuer = DER.rdnSequence(commonName: commonName)

        tbs.append(contentsOf: issuer)

        // Validity

        let now = Date()

        let expiry = Calendar.current.date(byAdding: .day, value: validityDays, to: now)!

        tbs.append(contentsOf: DER.sequence([

            DER.utcTime(now),

            DER.utcTime(expiry)

        ]))

        // Subject: Same as issuer (self-signed)

        tbs.append(contentsOf: issuer)

        // Subject Public Key Info

        let publicKeyInfo = try buildSubjectPublicKeyInfo(publicKey: publicKey)

        tbs.append(contentsOf: publicKeyInfo)

        return DER.sequence(tbs)

    }

    private static func buildSubjectPublicKeyInfo(publicKey: SecKey) throws -> Data {

        guard let publicKeyData = SecKeyCopyExternalRepresentation(publicKey, nil) as Data? else {

            throw X509GeneratorError.publicKeyExtractionFailed

        }

        // Algorithm: id-ecPublicKey (1.2.840.10045.2.1) with prime256v1 (1.2.840.10045.3.1.7)

        let algorithm = DER.sequence([

            DER.oid([1, 2, 840, 10045, 2, 1]),  // id-ecPublicKey

            DER.oid([1, 2, 840, 10045, 3, 1, 7]) // prime256v1 (P-256)

        ])

        // Public key is already in uncompressed point format (0x04 || x || y)

        let publicKeyBitString = DER.bitString(publicKeyData)

        return DER.sequence([algorithm, publicKeyBitString])

    }

    private static func buildCertificate(tbsCertificate: Data, signature: Data) -> Data {

        // Signature Algorithm: ecdsa-with-SHA256

        let signatureAlgorithm = DER.sequence([

            DER.oid([1, 2, 840, 10045, 4, 3, 2])

        ])

        // Signature Value (BIT STRING)

        let signatureValue = DER.bitString(signature)

        return DER.sequence([tbsCertificate, signatureAlgorithm, signatureValue])

    }

    // MARK: - Signing

    private static func signData(_ data: Data, with privateKey: SecKey) throws -> Data {

        var error: Unmanaged<CFError>?

        guard let signature = SecKeyCreateSignature(

            privateKey,

            .ecdsaSignatureMessageX962SHA256,

            data as CFData,

            &error

        ) as Data? else {

            throw X509GeneratorError.signingFailed

        }

        return signature

    }

    // MARK: - Helpers

    private static func generateSerialNumber() -> [UInt8] {

        // Generate a 16-byte random serial number

        var bytes = [UInt8](repeating: 0, count: 16)

        _ = SecRandomCopyBytes(kSecRandomDefault, bytes.count, &bytes)

        // Ensure it's positive by clearing the high bit

        bytes[0] &= 0x7F

        // Ensure it's non-zero

        if bytes.allSatisfy({ $0 == 0 }) {

            bytes[15] = 1

        }

        return bytes

    }

}

// MARK: - DER Encoding

private enum DER {

    // ASN.1 tag constants

    static let tagInteger: UInt8 = 0x02

    static let tagBitString: UInt8 = 0x03

    static let tagOctetString: UInt8 = 0x04

    static let tagNull: UInt8 = 0x05

    static let tagOID: UInt8 = 0x06

    static let tagUTF8String: UInt8 = 0x0C

    static let tagSequence: UInt8 = 0x30

    static let tagSet: UInt8 = 0x31

    static let tagUTCTime: UInt8 = 0x17

    static let tagGeneralizedTime: UInt8 = 0x18

    static func sequence(_ contents: Data) -> Data {

        return encode(tag: tagSequence, contents: contents)

    }

    static func sequence(_ elements: [Data]) -> Data {

        let contents = elements.reduce(Data()) { $0 + $1 }

        return encode(tag: tagSequence, contents: contents)

    }

    static func set(_ elements: [Data]) -> Data {

        let contents = elements.reduce(Data()) { $0 + $1 }

        return encode(tag: tagSet, contents: contents)

    }

    static func integer(_ value: Int) -> Data {

        var bytes = [UInt8]()

        var v = value

        if v == 0 {

            bytes = [0]

        } else {

            while v > 0 {

                bytes.insert(UInt8(v & 0xFF), at: 0)

                v >>= 8

            }

            // Add leading zero if high bit is set (to keep it positive)

            if bytes[0] & 0x80 != 0 {

                bytes.insert(0, at: 0)

            }

        }

        return encode(tag: tagInteger, contents: Data(bytes))

    }

    static func integer(_ bytes: [UInt8]) -> Data {

        var adjusted = bytes

        // Remove leading zeros but keep at least one byte

        while adjusted.count > 1 && adjusted[0] == 0 && adjusted[1] & 0x80 == 0 {

            adjusted.removeFirst()

        }

        // Add leading zero if high bit is set

        if adjusted[0] & 0x80 != 0 {

            adjusted.insert(0, at: 0)

        }

        return encode(tag: tagInteger, contents: Data(adjusted))

    }

    static func bitString(_ data: Data) -> Data {

        // Prepend unused bits count (0)

        var contents = Data([0x00])

        contents.append(data)

        return encode(tag: tagBitString, contents: contents)

    }

    static func octetString(_ data: Data) -> Data {

        return encode(tag: tagOctetString, contents: data)

    }

    static func utf8String(_ string: String) -> Data {

        return encode(tag: tagUTF8String, contents: Data(string.utf8))

    }

    static func oid(_ components: [Int]) -> Data {

        guard components.count >= 2 else { return Data() }

        var bytes = [UInt8]()

        // First two components are encoded as: first * 40 + second

        bytes.append(UInt8(components[0] * 40 + components[1]))

        // Remaining components use base-128 encoding

        for i in 2..<components.count {

            var value = components[i]

            var encoded = [UInt8]()

            encoded.append(UInt8(value & 0x7F))

            value >>= 7

            while value > 0 {

                encoded.insert(UInt8((value & 0x7F) | 0x80), at: 0)

                value >>= 7

            }

            bytes.append(contentsOf: encoded)

        }

        return encode(tag: tagOID, contents: Data(bytes))

    }

    static func utcTime(_ date: Date) -> Data {

        let formatter = DateFormatter()

        formatter.dateFormat = "yyMMddHHmmss'Z'"

        formatter.timeZone = TimeZone(identifier: "UTC")

        let string = formatter.string(from: date)

        return encode(tag: tagUTCTime, contents: Data(string.utf8))

    }

    static func contextTag(_ tag: Int, explicit: Bool, contents: Data) -> Data {

        let tagByte: UInt8

        if explicit {

            tagByte = UInt8(0xA0 | (tag & 0x1F))

        } else {

            tagByte = UInt8(0x80 | (tag & 0x1F))

        }

        return encode(tag: tagByte, contents: contents)

    }

    static func rdnSequence(commonName: String) -> Data {

        // RDNSequence is a SEQUENCE of RelativeDistinguishedName (SET)

        // Each RDN contains AttributeTypeAndValue (SEQUENCE of OID and value)

        // OID for commonName: 2.5.4.3

        let cnOID = oid([2, 5, 4, 3])

        let cnValue = utf8String(commonName)

        let cnATV = sequence([cnOID, cnValue])

        let cnRDN = set([cnATV])

        return sequence([cnRDN])

    }

    private static func encode(tag: UInt8, contents: Data) -> Data {

        var result = Data([tag])

        result.append(contentsOf: encodeLength(contents.count))

        result.append(contents)

        return result

    }

    private static func encodeLength(_ length: Int) -> [UInt8] {

        if length < 128 {

            return [UInt8(length)]

        } else if length < 256 {

            return [0x81, UInt8(length)]

        } else if length < 65536 {

            return [0x82, UInt8(length >> 8), UInt8(length & 0xFF)]

        } else {

            // For larger lengths (unlikely for certificates)

            return [0x83, UInt8(length >> 16), UInt8((length >> 8) & 0xFF), UInt8(length & 0xFF)]

        }

    }

}

//

//  ClientCertificatesView.swift

//  Titan

//

//  UI for managing client certificates

//

import SwiftUI

struct ClientCertificatesView: View {

    @Bindable var manager: ClientCertificateManager

    @Environment(\.dismiss) private var dismiss

    @State private var showCreateSheet = false

    @State private var showDeleteConfirmation = false

    @State private var certificateToDelete: ClientCertificate?

    @State private var errorMessage: String?

    @State private var showError = false

    var body: some View {

        List {

            if manager.certificates.isEmpty {

                Section {

                    VStack(spacing: 12) {

                        Image(systemName: "person.badge.key")

                            .font(.system(size: 40))

                            .foregroundStyle(.secondary)

                        Text("No Client Certificates")

                            .font(.headline)

                        Text("Client certificates are used to authenticate with Gemini capsules that require identity verification.")

                            .font(.subheadline)

                            .foregroundStyle(.secondary)

                            .multilineTextAlignment(.center)

                    }

                    .frame(maxWidth: .infinity)

                    .padding(.vertical, 20)

                }

            } else {

                Section {

                    ForEach(manager.certificates) { certificate in

                        NavigationLink {

                            ClientCertificateDetailView(

                                certificate: certificate,

                                manager: manager

                            )

                        } label: {

                            CertificateRow(certificate: certificate)

                        }

                    }

                    .onDelete(perform: confirmDelete)

                } header: {

                    Text("Certificates")

                } footer: {

                    Text("Swipe left to delete a certificate.")

                }

            }

            Section {

                Button {

                    showCreateSheet = true

                } label: {

                    Label("Create New Certificate", systemImage: "plus.circle")

                }

            }

        }

        .navigationTitle("Client Certificates")

        .navigationBarTitleDisplayMode(.inline)

        .sheet(isPresented: $showCreateSheet) {

            CreateClientCertificateView(manager: manager)

        }

        .alert("Error", isPresented: $showError) {

            Button("OK", role: .cancel) {}

        } message: {

            Text(errorMessage ?? "An unknown error occurred")

        }

        .alert("Delete Certificate?", isPresented: $showDeleteConfirmation) {

            Button("Cancel", role: .cancel) {

                certificateToDelete = nil

            }

            Button("Delete", role: .destructive) {

                if let cert = certificateToDelete {

                    deleteCertificate(cert)

                }

            }

        } message: {

            if let cert = certificateToDelete {

                Text("This will delete \"\(cert.name)\" and remove all its site associations. This cannot be undone.")

            }

        }

    }

    private func confirmDelete(at offsets: IndexSet) {

        if let index = offsets.first {

            certificateToDelete = manager.certificates[index]

            showDeleteConfirmation = true

        }

    }

    private func deleteCertificate(_ certificate: ClientCertificate) {

        do {

            try manager.deleteCertificate(id: certificate.id)

        } catch {

            errorMessage = error.localizedDescription

            showError = true

        }

        certificateToDelete = nil

    }

}

struct CertificateRow: View {

    let certificate: ClientCertificate

    var body: some View {

        VStack(alignment: .leading, spacing: 4) {

            HStack {

                Text(certificate.name)

                    .font(.headline)

                if certificate.isExpired {

                    Text("Expired")

                        .font(.caption)

                        .foregroundStyle(.white)

                        .padding(.horizontal, 6)

                        .padding(.vertical, 2)

                        .background(.red)

                        .cornerRadius(4)

                } else if certificate.daysUntilExpiry < 30 {

                    Text("\(certificate.daysUntilExpiry)d")

                        .font(.caption)

                        .foregroundStyle(.white)

                        .padding(.horizontal, 6)

                        .padding(.vertical, 2)

                        .background(.orange)

                        .cornerRadius(4)

                }

            }

            Text(truncatedFingerprint(certificate.fingerprint))

                .font(.caption)

                .foregroundStyle(.secondary)

                .fontDesign(.monospaced)

        }

        .padding(.vertical, 2)

    }

    private func truncatedFingerprint(_ fingerprint: String) -> String {

        let parts = fingerprint.split(separator: ":")

        if parts.count > 8 {

            return parts.prefix(4).joined(separator: ":") + "..." + parts.suffix(4).joined(separator: ":")

        }

        return fingerprint

    }

}

struct ClientCertificateDetailView: View {

    let certificate: ClientCertificate

    @Bindable var manager: ClientCertificateManager

    @Environment(\.dismiss) private var dismiss

    @State private var showDeleteConfirmation = false

    @State private var errorMessage: String?

    @State private var showError = false

    var associations: [CertificateHostAssociation] {

        manager.getAssociationsForCertificate(id: certificate.id)

    }

    var body: some View {

        List {

            Section {

                LabeledContent("Name", value: certificate.name)

                LabeledContent("Created", value: certificate.createdAt.formatted(date: .abbreviated, time: .shortened))

                LabeledContent("Expires", value: certificate.expiresAt.formatted(date: .abbreviated, time: .shortened))

                if certificate.isExpired {

                    HStack {

                        Image(systemName: "exclamationmark.triangle.fill")

                            .foregroundStyle(.red)

                        Text("This certificate has expired")

                            .foregroundStyle(.red)

                    }

                } else if certificate.daysUntilExpiry < 30 {

                    HStack {

                        Image(systemName: "exclamationmark.triangle.fill")

                            .foregroundStyle(.orange)

                        Text("Expires in \(certificate.daysUntilExpiry) days")

                            .foregroundStyle(.orange)

                    }

                }

            } header: {

                Text("Certificate Info")

            }

            Section {

                Text(certificate.fingerprint)

                    .font(.system(.caption, design: .monospaced))

                    .foregroundStyle(.secondary)

                    .textSelection(.enabled)

            } header: {

                Text("SHA-256 Fingerprint")

            } footer: {

                Text("This fingerprint uniquely identifies your certificate.")

            }

            Section {

                if associations.isEmpty {

                    Text("No sites are using this certificate")

                        .foregroundStyle(.secondary)

                } else {

                    ForEach(associations) { assoc in

                        VStack(alignment: .leading, spacing: 2) {

                            Text("\(assoc.host):\(assoc.port)")

                                .font(.body)

                            Text(assoc.pathPrefix)

                                .font(.caption)

                                .foregroundStyle(.secondary)

                        }

                    }

                    .onDelete(perform: deleteAssociation)

                }

            } header: {

                Text("Associated Sites")

            } footer: {

                if !associations.isEmpty {

                    Text("Swipe left to remove a site association.")

                }

            }

            Section {

                Button(role: .destructive) {

                    showDeleteConfirmation = true

                } label: {

                    Label("Delete Certificate", systemImage: "trash")

                }

            }

        }

        .navigationTitle(certificate.name)

        .navigationBarTitleDisplayMode(.inline)

        .alert("Delete Certificate?", isPresented: $showDeleteConfirmation) {

            Button("Cancel", role: .cancel) {}

            Button("Delete", role: .destructive) {

                deleteCertificate()

            }

        } message: {

            Text("This will delete \"\(certificate.name)\" and remove all its site associations. This cannot be undone.")

        }

        .alert("Error", isPresented: $showError) {

            Button("OK", role: .cancel) {}

        } message: {

            Text(errorMessage ?? "An unknown error occurred")

        }

    }

    private func deleteAssociation(at offsets: IndexSet) {

        for index in offsets {

            let assoc = associations[index]

            manager.removeAssociation(host: assoc.host, port: assoc.port, pathPrefix: assoc.pathPrefix)

        }

    }

    private func deleteCertificate() {

        do {

            try manager.deleteCertificate(id: certificate.id)

            dismiss()

        } catch {

            errorMessage = error.localizedDescription

            showError = true

        }

    }

}

struct CreateClientCertificateView: View {

    @Bindable var manager: ClientCertificateManager

    @Environment(\.dismiss) private var dismiss

    @State private var name = ""

    @State private var isCreating = false

    @State private var errorMessage: String?

    @State private var showError = false

    var isValid: Bool {

        !name.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty

    }

    var body: some View {

        NavigationStack {

            Form {

                Section {

                    TextField("Certificate Name", text: $name)

                        .autocapitalization(.words)

                        .disabled(isCreating)

                } header: {

                    Text("Name")

                } footer: {

                    Text("Choose a name to identify this certificate (e.g., \"Personal\", \"BBS Account\").")

                }

                Section {

                    VStack(alignment: .leading, spacing: 8) {

                        Label("EC P-256 Key", systemImage: "key")

                        Label("SHA-256 Signatures", systemImage: "signature")

                        Label("Valid for 1 year", systemImage: "calendar")

                        Label("Stored in Keychain", systemImage: "lock.shield")

                    }

                    .font(.subheadline)

                    .foregroundStyle(.secondary)

                } header: {

                    Text("Certificate Details")

                }

            }

            .navigationTitle("New Certificate")

            .navigationBarTitleDisplayMode(.inline)

            .toolbar {

                ToolbarItem(placement: .cancellationAction) {

                    Button("Cancel") {

                        dismiss()

                    }

                    .disabled(isCreating)

                }

                ToolbarItem(placement: .confirmationAction) {

                    if isCreating {

                        ProgressView()

                    } else {

                        Button("Create") {

                            createCertificate()

                        }

                        .disabled(!isValid)

                    }

                }

            }

            .alert("Error", isPresented: $showError) {

                Button("OK", role: .cancel) {}

            } message: {

                Text(errorMessage ?? "An unknown error occurred")

            }

        }

    }

    private func createCertificate() {

        let trimmedName = name.trimmingCharacters(in: .whitespacesAndNewlines)

        guard !trimmedName.isEmpty else { return }

        isCreating = true

        Task {

            do {

                _ = try manager.createCertificate(name: trimmedName)

                await MainActor.run {

                    dismiss()

                }

            } catch {

                await MainActor.run {

                    errorMessage = error.localizedDescription

                    showError = true

                    isCreating = false

                }

            }

        }

    }

}

// MARK: - Certificate Selection View (for status 60 prompts)

struct CertificateSelectionView: View {

    @Bindable var manager: ClientCertificateManager

    let url: String

    let serverMessage: String

    let onSelect: (UUID) -> Void

    let onCancel: () -> Void

    @State private var showCreateSheet = false

    @State private var selectedCertificateId: UUID?

    var body: some View {

        NavigationStack {

            VStack(spacing: 0) {

                // Header info

                VStack(spacing: 8) {

                    Image(systemName: "lock.shield")

                        .font(.system(size: 40))

                        .foregroundStyle(.purple)

                    Text("Certificate Required")

                        .font(.headline)

                    if !serverMessage.isEmpty {

                        Text(serverMessage)

                            .font(.subheadline)

                            .foregroundStyle(.secondary)

                            .multilineTextAlignment(.center)

                    }

                    if let urlHost = URL(string: url)?.host {

                        Text(urlHost)

                            .font(.caption)

                            .foregroundStyle(.secondary)

                            .padding(.horizontal, 12)

                            .padding(.vertical, 4)

                            .background(Color.secondary.opacity(0.15))

                            .cornerRadius(8)

                    }

                }

                .padding()

                Divider()

                // Certificate list

                List {

                    if manager.certificates.isEmpty {

                        Section {

                            Text("No certificates available. Create one to continue.")

                                .foregroundStyle(.secondary)

                        }

                    } else {

                        Section {

                            ForEach(manager.certificates) { cert in

                                Button {

                                    selectedCertificateId = cert.id

                                } label: {

                                    HStack {

                                        VStack(alignment: .leading, spacing: 2) {

                                            Text(cert.name)

                                                .foregroundStyle(.primary)

                                            Text(truncatedFingerprint(cert.fingerprint))

                                                .font(.caption)

                                                .foregroundStyle(.secondary)

                                                .fontDesign(.monospaced)

                                        }

                                        Spacer()

                                        if selectedCertificateId == cert.id {

                                            Image(systemName: "checkmark.circle.fill")

                                                .foregroundStyle(.blue)

                                        }

                                    }

                                }

                                .disabled(cert.isExpired)

                                .opacity(cert.isExpired ? 0.5 : 1.0)

                            }

                        } header: {

                            Text("Select Certificate")

                        }

                    }

                    Section {

                        Button {

                            showCreateSheet = true

                        } label: {

                            Label("Create New Certificate", systemImage: "plus.circle")

                        }

                    }

                }

                .listStyle(.insetGrouped)

            }

            .navigationBarTitleDisplayMode(.inline)

            .toolbar {

                ToolbarItem(placement: .cancellationAction) {

                    Button("Cancel") {

                        onCancel()

                    }

                }

                ToolbarItem(placement: .confirmationAction) {

                    Button("Use Certificate") {

                        if let id = selectedCertificateId {

                            onSelect(id)

                        }

                    }

                    .disabled(selectedCertificateId == nil)

                }

            }

            .sheet(isPresented: $showCreateSheet) {

                CreateClientCertificateView(manager: manager)

            }

        }

    }

    private func truncatedFingerprint(_ fingerprint: String) -> String {

        let parts = fingerprint.split(separator: ":")

        if parts.count > 8 {

            return parts.prefix(4).joined(separator: ":") + "..." + parts.suffix(4).joined(separator: ":")

        }

        return fingerprint

    }

}

#Preview("Certificate List") {

    NavigationStack {

        ClientCertificatesView(manager: ClientCertificateManager())

    }

}

#Preview("Create Certificate") {

    CreateClientCertificateView(manager: ClientCertificateManager())

}

    // Server certificate management (TOFU)

    @State private var pendingServerCertificateURL: String?

    // Client certificate management

    @State private var clientCertificateManager = ClientCertificateManager()

    @State private var showClientCertificatePrompt = false

    @State private var pendingClientCertificateURL: String?

    @State private var pendingClientCertificateMeta: String?

            SettingsView(clientCertificateManager: clientCertificateManager)

        }

        .sheet(isPresented: $showClientCertificatePrompt) {

            CertificateSelectionView(

                manager: clientCertificateManager,

                url: pendingClientCertificateURL ?? "",

                serverMessage: pendingClientCertificateMeta ?? "",

                onSelect: { certificateId in

                    // Associate certificate with URL and retry

                    if let urlString = pendingClientCertificateURL,

                       let url = URL(string: urlString) {

                        clientCertificateManager.associateCertificate(certificateId: certificateId, with: url)

                        showClientCertificatePrompt = false

                        pendingClientCertificateURL = nil

                        pendingClientCertificateMeta = nil

                        currentError = nil

                        navigateTo(urlString)

                    }

                },

                onCancel: {

                    showClientCertificatePrompt = false

                    // Keep the error displayed

                }

            )