--[[
sandbox.lua - Rewritten with global context storage
]]--

__http_response = {}
__module_paths = {}
__module_bytecode = {}
__ready_modules = {}
__EXIT_SENTINEL = {}  -- Unique object for exit identification

-- Global context storage for reliable access
local _current_ctx = nil

-- ======================================================================
-- CORE SANDBOX FUNCTIONALITY
-- ======================================================================

function exit()
	error(__EXIT_SENTINEL)
end

-- Create environment inheriting from _G
function __create_env(ctx)
	local env = setmetatable({}, {__index = _G})

	if ctx then
		env.ctx = ctx

		if ctx._env then
			env._env = ctx._env
		end
	end

	if __setup_require then
		__setup_require(env)
	end

	return env
end

-- Execute script with clean environment
function __execute_script(fn, ctx)
	__http_response = nil
	_current_ctx = ctx  -- Store globally for function access

	local env = __create_env(ctx)
	env.exit = exit
	setfenv(fn, env)

	local ok, result = pcall(fn)
	
	_current_ctx = nil  -- Clean up after execution
	
	if not ok then
		if result == __EXIT_SENTINEL then
			return
		end
		error(result, 0)
	end

	return result
end

-- Ensure __http_response exists, then return it
function __ensure_response()
	if not __http_response then
		__http_response = {}
	end
	return __http_response
end

-- ======================================================================
-- HTTP FUNCTIONS
-- ======================================================================

-- Set HTTP status code
function http_set_status(code)
	if type(code) ~= "number" then
		error("http_set_status: status code must be a number", 2)
	end

	local resp = __ensure_response()
	resp.status = code
end

-- Set HTTP header
function http_set_header(name, value)
	if type(name) ~= "string" or type(value) ~= "string" then
		error("http_set_header: name and value must be strings", 2)
	end

	local resp = __ensure_response()
	resp.headers = resp.headers or {}
	resp.headers[name] = value
end

-- Set content type; http_set_header helper
function http_set_content_type(content_type)
	http_set_header("Content-Type", content_type)
end

-- Set metadata (arbitrary data to be returned with response)
function http_set_metadata(key, value)
	if type(key) ~= "string" then
		error("http_set_metadata: key must be a string", 2)
	end

	local resp = __ensure_response()
	resp.metadata = resp.metadata or {}
	resp.metadata[key] = value
end

-- Generic HTTP request function
function http_request(method, url, body, options)
	if type(method) ~= "string" then
		error("http_request: method must be a string", 2)
	end
	if type(url) ~= "string" then
		error("http_request: url must be a string", 2)
	end

	-- Call native implementation
	local result = __http_request(method, url, body, options)
	return result
end

-- Shorthand function to directly get JSON
function http_get_json(url, options)
	options = options or {}
	local response = http_get(url, options)
	if response.ok and response.json then
		return response.json
	end
	return nil, response
end

-- Utility to build a URL with query parameters
function http_build_url(base_url, params)
	if not params or type(params) ~= "table" then
		return base_url
	end

	local query = {}
	for k, v in pairs(params) do
		if type(v) == "table" then
			for _, item in ipairs(v) do
				table.insert(query, url_encode(k) .. "=" .. url_encode(tostring(item)))
			end
		else
			table.insert(query, url_encode(k) .. "=" .. url_encode(tostring(v)))
		end
	end

	if #query > 0 then
		if string.contains(base_url, "?") then
			return base_url .. "&" .. table.concat(query, "&")
		else
			return base_url .. "?" .. table.concat(query, "&")
		end
	end

	return base_url
end

local function make_method(method, needs_body)
	return function(url, body_or_options, options)
		if needs_body then
			options = options or {}
			return http_request(method, url, body_or_options, options)
		else
			body_or_options = body_or_options or {}
			return http_request(method, url, nil, body_or_options)
		end
	end
end

http_get = make_method("GET", false)
http_delete = make_method("DELETE", false)
http_head = make_method("HEAD", false)
http_options = make_method("OPTIONS", false)
http_post = make_method("POST", true)
http_put = make_method("PUT", true)
http_patch = make_method("PATCH", true)

function http_redirect(url, status)
	if type(url) ~= "string" then
		error("http_redirect: url must be a string", 2)
	end

	status = status or 302  -- Default to temporary redirect

	local resp = __ensure_response()
	resp.status = status

	resp.headers = resp.headers or {}
	resp.headers["Location"] = url

	exit()
end

-- ======================================================================
-- COOKIE FUNCTIONS
-- ======================================================================

-- Set a cookie
function cookie_set(name, value, options)
	if type(name) ~= "string" then
		error("cookie_set: name must be a string", 2)
	end

	local resp = __ensure_response()
	resp.cookies = resp.cookies or {}

	local opts = options or {}
	local cookie = {
		name = name,
		value = value or "",
		path = opts.path or "/",
		domain = opts.domain
	}

	if opts.expires then
		if type(opts.expires) == "number" then
			if opts.expires > 0 then
				cookie.max_age = opts.expires
				local now = os.time()
				cookie.expires = now + opts.expires
			elseif opts.expires < 0 then
				cookie.expires = 1
				cookie.max_age = 0
			end
			-- opts.expires == 0: Session cookie (omitting both expires and max-age)
		end
	end

	cookie.secure = (opts.secure ~= false)
	cookie.http_only = (opts.http_only ~= false)

	if opts.same_site then
		local same_site = string.trim(opts.same_site):lower()
		local valid_values = {none = true, lax = true, strict = true}

		if not valid_values[same_site] then
			error("cookie_set: same_site must be one of 'None', 'Lax', or 'Strict'", 2)
		end

		-- If SameSite=None, the cookie must be secure
		if same_site == "none" and not cookie.secure then
			cookie.secure = true
		end

		cookie.same_site = opts.same_site
	else
		cookie.same_site = "Lax"
	end

	table.insert(resp.cookies, cookie)
	return true
end

-- Get a cookie value
function cookie_get(name)
	if type(name) ~= "string" then
		error("cookie_get: name must be a string", 2)
	end

	if _current_ctx then
		if _current_ctx.cookies then
			return _current_ctx.cookies[name]
		end
		if _current_ctx._request_cookies then
			return _current_ctx._request_cookies[name]
		end
	end

	return nil
end

-- Remove a cookie
function cookie_remove(name, path, domain)
	if type(name) ~= "string" then
		error("cookie_remove: name must be a string", 2)
	end

	return cookie_set(name, "", {expires = 0, path = path or "/", domain = domain})
end

-- ======================================================================
-- SESSION FUNCTIONS
-- ======================================================================

function session_get(key)
	if type(key) ~= "string" then
		error("session_get: key must be a string", 2)
	end

	if _current_ctx and _current_ctx.session and _current_ctx.session.data then
		return _current_ctx.session.data[key]
	end

	return nil
end

function session_set(key, value)
	if type(key) ~= "string" then
		error("session_set: key must be a string", 2)
	end
	if value == nil then
		error("session_set: value cannot be nil", 2)
	end

	local resp = __ensure_response()
	resp.session = resp.session or {}
	resp.session[key] = value

	-- Update current context session data
	if _current_ctx and _current_ctx.session and _current_ctx.session.data then
		_current_ctx.session.data[key] = value
	end
end

function session_id()
	if _current_ctx and _current_ctx.session then
		return _current_ctx.session.id
	end
	return nil
end

function session_get_all()
	if _current_ctx and _current_ctx.session and _current_ctx.session.data then
		-- Return a copy to prevent modification
		local copy = {}
		for k, v in pairs(_current_ctx.session.data) do
			copy[k] = v
		end
		return copy
	end
	return {}
end

function session_delete(key)
	if type(key) ~= "string" then
		error("session_delete: key must be a string", 2)
	end

	local resp = __ensure_response()
	resp.session = resp.session or {}
	resp.session[key] = "__SESSION_DELETE_MARKER__"

	-- Update current context
	if _current_ctx and _current_ctx.session and _current_ctx.session.data then
		_current_ctx.session.data[key] = nil
	end
end

function session_clear()
	if _current_ctx and _current_ctx.session and _current_ctx.session.data then
		for k, _ in pairs(_current_ctx.session.data) do
			_current_ctx.session.data[k] = nil
		end
	end

	local resp = __ensure_response()
	resp.session = {}
	resp.session["__clear_all"] = true
end

-- ======================================================================
-- CSRF FUNCTIONS
-- ======================================================================

function csrf_generate()
	local token = generate_token(32)
	session_set("_csrf_token", token)
	return token
end

function csrf_field()
	local token = session_get("_csrf_token")
	if not token then
		token = csrf_generate()
	end
	return string.format('<input type="hidden" name="_csrf_token" value="%s" />',
		html_special_chars(token))
end

function csrf_validate()
	local token = session_get("_csrf_token")

	if not token then
		http_set_status(403)
		__http_response.body = "CSRF validation failed"
		exit()
	end

	local request_token = nil
	if _current_ctx and _current_ctx.form then
		request_token = _current_ctx.form._csrf_token
	end

	if not request_token and _current_ctx and _current_ctx._request_headers then
		request_token = _current_ctx._request_headers["x-csrf-token"] or
		               _current_ctx._request_headers["csrf-token"]
	end

	if not request_token or request_token ~= token then
		http_set_status(403)
		__http_response.body = "CSRF validation failed"
		exit()
	end

	return true
end

-- ======================================================================
-- TEMPLATE RENDER FUNCTIONS
-- ======================================================================

-- Template processing with code execution
_G.render = function(template_str, env)
	local function get_line(s, ln)
		for line in s:gmatch("([^\n]*)\n?") do
			if ln == 1 then return line end
			ln = ln - 1
		end
	end

	local function pos_to_line(s, pos)
		local line = 1
		for _ in s:sub(1, pos):gmatch("\n") do line = line + 1 end
		return line
	end

	local pos, chunks = 1, {}
	while pos <= #template_str do
		local unescaped_start = template_str:find("{{{", pos, true)
		local escaped_start = template_str:find("{{", pos, true)

		local start, tag_type, open_len
		if unescaped_start and (not escaped_start or unescaped_start <= escaped_start) then
			start, tag_type, open_len = unescaped_start, "-", 3
		elseif escaped_start then
			start, tag_type, open_len = escaped_start, "=", 2
		else
			table.insert(chunks, template_str:sub(pos))
			break
		end

		if start > pos then
			table.insert(chunks, template_str:sub(pos, start-1))
		end

		pos = start + open_len
		local close_tag = tag_type == "-" and "}}}" or "}}"
		local close_start, close_stop = template_str:find(close_tag, pos, true)
		if not close_start then
			error("Failed to find closing tag at position " .. pos)
		end

		local code = template_str:sub(pos, close_start-1):match("^%s*(.-)%s*$")

		-- Check if it's a simple variable name for escaped output
		local is_simple_var = tag_type == "=" and code:match("^[%w_]+$")

		table.insert(chunks, {tag_type, code, pos, is_simple_var})
		pos = close_stop + 1
	end

	local buffer = {"local _tostring, _escape, _b, _b_i = ...\n"}
	for _, chunk in ipairs(chunks) do
		local t = type(chunk)
		if t == "string" then
			table.insert(buffer, "_b_i = _b_i + 1\n")
			table.insert(buffer, "_b[_b_i] = " .. string.format("%q", chunk) .. "\n")
		else
			t = chunk[1]
			if t == "=" then
				if chunk[4] then -- is_simple_var
					table.insert(buffer, "_b_i = _b_i + 1\n")
					table.insert(buffer, "--[[" .. chunk[3] .. "]] _b[_b_i] = _escape(_tostring(" .. chunk[2] .. "))\n")
				else
					table.insert(buffer, "--[[" .. chunk[3] .. "]] " .. chunk[2] .. "\n")
				end
			elseif t == "-" then
				table.insert(buffer, "_b_i = _b_i + 1\n")
				table.insert(buffer, "--[[" .. chunk[3] .. "]] _b[_b_i] = _tostring(" .. chunk[2] .. ")\n")
			end
		end
	end
	table.insert(buffer, "return _b")

	local fn, err = loadstring(table.concat(buffer))
	if not fn then error(err) end

	env = env or {}
	local runtime_env = setmetatable({}, {__index = function(_, k) return env[k] or _G[k] end})
	setfenv(fn, runtime_env)

	local output_buffer = {}
	fn(tostring, html_special_chars, output_buffer, 0)
	return table.concat(output_buffer)
end

-- Named placeholder processing
_G.parse = function(template_str, env)
	local pos, output = 1, {}
	env = env or {}

	while pos <= #template_str do
		local unescaped_start, unescaped_end, unescaped_name = template_str:find("{{{%s*([%w_]+)%s*}}}", pos)
		local escaped_start, escaped_end, escaped_name = template_str:find("{{%s*([%w_]+)%s*}}", pos)

		local next_pos, placeholder_end, name, escaped
		if unescaped_start and (not escaped_start or unescaped_start <= escaped_start) then
			next_pos, placeholder_end, name, escaped = unescaped_start, unescaped_end, unescaped_name, false
		elseif escaped_start then
			next_pos, placeholder_end, name, escaped = escaped_start, escaped_end, escaped_name, true
		else
			local text = template_str:sub(pos)
			if text and #text > 0 then
				table.insert(output, text)
			end
			break
		end

		local text = template_str:sub(pos, next_pos - 1)
		if text and #text > 0 then
			table.insert(output, text)
		end

		local value = env[name]
		local str = tostring(value or "")
		if escaped then
			str = html_special_chars(str)
		end
		table.insert(output, str)

		pos = placeholder_end + 1
	end

	return table.concat(output)
end

-- Indexed placeholder processing
_G.iparse = function(template_str, values)
	local pos, output, value_index = 1, {}, 1
	values = values or {}

	while pos <= #template_str do
		local unescaped_start, unescaped_end = template_str:find("{{{}}}", pos, true)
		local escaped_start, escaped_end = template_str:find("{{}}", pos, true)

		local next_pos, placeholder_end, escaped
		if unescaped_start and (not escaped_start or unescaped_start <= escaped_start) then
			next_pos, placeholder_end, escaped = unescaped_start, unescaped_end, false
		elseif escaped_start then
			next_pos, placeholder_end, escaped = escaped_start, escaped_end, true
		else
			local text = template_str:sub(pos)
			if text and #text > 0 then
				table.insert(output, text)
			end
			break
		end

		local text = template_str:sub(pos, next_pos - 1)
		if text and #text > 0 then
			table.insert(output, text)
		end

		local value = values[value_index]
		local str = tostring(value or "")
		if escaped then
			str = html_special_chars(str)
		end
		table.insert(output, str)

		pos = placeholder_end + 1
		value_index = value_index + 1
	end

	return table.concat(output)
end

-- ======================================================================
-- PASSWORD FUNCTIONS
-- ======================================================================

-- Hash a password using Argon2id
-- Options:
-- memory: Amount of memory to use in KB (default: 128MB)
-- iterations: Number of iterations (default: 4)
-- parallelism: Number of threads (default: 4)
-- salt_length: Length of salt in bytes (default: 16)
-- key_length: Length of the derived key in bytes (default: 32)
function password_hash(plain_password, options)
	if type(plain_password) ~= "string" then
		error("password_hash: expected string password", 2)
	end

	return __password_hash(plain_password, options)
end

-- Verify a password against a hash
function password_verify(plain_password, hash_string)
	if type(plain_password) ~= "string" then
		error("password_verify: expected string password", 2)
	end

	if type(hash_string) ~= "string" then
		error("password_verify: expected string hash", 2)
	end

	return __password_verify(plain_password, hash_string)
end

-- ======================================================================
-- SEND FUNCTIONS
-- ======================================================================

function send_html(content)
	http_set_content_type("text/html")
	return content
end

function send_json(content)
	http_set_content_type("application/json")
	return content
end

function send_text(content)
	http_set_content_type("text/plain")
	return content
end

function send_xml(content)
	http_set_content_type("application/xml")
	return content
end

function send_javascript(content)
	http_set_content_type("application/javascript")
	return content
end

function send_css(content)
	http_set_content_type("text/css")
	return content
end

function send_svg(content)
	http_set_content_type("image/svg+xml")
	return content
end

function send_csv(content)
	http_set_content_type("text/csv")
	return content
end

function send_binary(content, mime_type)
	http_set_content_type(mime_type or "application/octet-stream")
	return content
end