arrr-erp/app/modules/domain_management/services.py

from __future__ import annotations

import re
import secrets
import socket
import ssl
import subprocess
from dataclasses import dataclass
from datetime import datetime, timezone
from email.utils import parsedate_to_datetime

from sqlalchemy import Select, func, select
from sqlalchemy.orm import Session

from app.modules.consultants.models import ConsultantProfile
from app.modules.core.tenancy.models import Branch, Tenant
from app.modules.domain_management.models import DomainMapping

DOMAIN_TYPES: tuple[tuple[str, str], ...] = (
    ("marketplace", "Marketplace / SaaS platform"),
    ("audit_firm_domain", "Audit firm custom domain"),
    ("audit_firm_subdomain", "Audit firm platform subdomain"),
    ("consultant_custom_domain", "Consultant custom domain"),
    ("consultant_firm_domain", "Consultant under firm domain"),
    ("consultant_marketplace_subdomain", "Consultant platform subdomain"),
)

PLATFORM_SUBDOMAIN_BASE_DOMAINS: tuple[str, ...] = ("filingabc.com", "filingabc.local")
RESERVED_SUBDOMAIN_LABELS: set[str] = {"www", "mail", "smtp", "imap", "pop", "api", "admin", "app", "portal", "client", "clients", "staff", "system", "marketplace", "support", "billing"}

DOMAIN_STATUSES: tuple[tuple[str, str], ...] = (
    ("draft", "Draft"),
    ("pending_verification", "Pending verification"),
    ("active", "Active"),
    ("suspended", "Suspended"),
    ("inactive", "Inactive"),
)

SSL_MODES: tuple[tuple[str, str], ...] = (
    ("manual", "Manual / deployment managed"),
    ("coolify", "Coolify proxy"),
    ("caddy", "Caddy"),
    ("traefik", "Traefik"),
    ("cloudflare", "Cloudflare"),
)

SSL_STATUSES: tuple[tuple[str, str], ...] = (
    ("not_checked", "Not checked"),
    ("pending_dns", "Pending DNS/proxy"),
    ("pending_ssl", "Pending SSL"),
    ("active", "Active"),
    ("failed", "Failed"),
    ("manual", "Manual / external"),
)

_HOST_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$", re.IGNORECASE)


@dataclass(frozen=True)
class DomainSslCheckResult:
    ok: bool
    status: str
    message: str
    subject: str | None = None
    issuer: str | None = None
    not_after_utc: datetime | None = None


@dataclass(frozen=True)
class DomainSslProxySnippet:
    provider: str
    title: str
    body: str


@dataclass(frozen=True)
class DomainMappingPayload:
    domain_name: str
    domain_type: str
    tenant_id: int | None = None
    branch_id: int | None = None
    consultant_id: int | None = None
    parent_tenant_id: int | None = None
    is_primary: bool = False
    is_verified: bool = False
    status: str = "draft"
    ssl_mode: str = "manual"
    notes: str | None = None


def normalize_domain(domain_name: str) -> str:
    value = (domain_name or "").strip().lower()
    value = value.removeprefix("http://").removeprefix("https://")
    value = value.split("/", 1)[0]
    value = value.split(":", 1)[0]
    return value.rstrip(".")


def validate_domain_payload(db: Session, payload: DomainMappingPayload, mapping_id: int | None = None) -> list[str]:
    errors: list[str] = []
    domain_name = normalize_domain(payload.domain_name)

    if not domain_name:
        errors.append("Domain name is required.")
    elif not _HOST_RE.match(domain_name) and domain_name not in {"localhost"}:
        errors.append("Enter a valid domain name, for example filingabc.com or arrr.filingabc.com.")

    if payload.domain_type not in {code for code, _label in DOMAIN_TYPES}:
        errors.append("Invalid domain type selected.")

    if payload.status not in {code for code, _label in DOMAIN_STATUSES}:
        errors.append("Invalid status selected.")

    if payload.ssl_mode not in {code for code, _label in SSL_MODES}:
        errors.append("Invalid SSL mode selected.")

    existing_stmt = select(DomainMapping).where(DomainMapping.domain_name == domain_name)
    if mapping_id:
        existing_stmt = existing_stmt.where(DomainMapping.id != mapping_id)
    if db.execute(existing_stmt).scalar_one_or_none():
        errors.append("This domain is already mapped.")

    if payload.tenant_id and not db.get(Tenant, payload.tenant_id):
        errors.append("Selected audit firm was not found.")
    if payload.parent_tenant_id and not db.get(Tenant, payload.parent_tenant_id):
        errors.append("Selected parent audit firm was not found.")
    if payload.branch_id and not db.get(Branch, payload.branch_id):
        errors.append("Selected branch was not found.")
    if payload.consultant_id and not db.get(ConsultantProfile, payload.consultant_id):
        errors.append("Selected consultant was not found.")

    if payload.domain_type in {"audit_firm_domain", "audit_firm_subdomain"} and not payload.tenant_id:
        errors.append("Audit firm domains must be linked to an audit firm.")
    if payload.domain_type in {"consultant_custom_domain", "consultant_firm_domain", "consultant_marketplace_subdomain"} and not payload.consultant_id:
        errors.append("Consultant domains must be linked to a consultant profile.")
    if payload.domain_type == "consultant_firm_domain" and not payload.parent_tenant_id:
        errors.append("Consultant firm-domain mappings must have a parent audit firm.")

    if payload.domain_type == "audit_firm_subdomain" and domain_name:
        parts = domain_name.split(".")
        if len(parts) < 3:
            errors.append("Audit firm subdomain must be like auditfirm.filingabc.com.")
        subdomain_label = parts[0] if parts else ""
        if subdomain_label in RESERVED_SUBDOMAIN_LABELS:
            errors.append(f"'{subdomain_label}' is a reserved subdomain label. Please use another audit firm code.")
        if subdomain_label and not re.match(r"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$", subdomain_label):
            errors.append("Subdomain label may contain only lowercase letters, numbers and hyphen, and cannot start/end with hyphen.")

    return errors


def make_verification_token() -> str:
    return "af-domain-" + secrets.token_urlsafe(24).replace("-", "").replace("_", "")[:36]


def dns_txt_name_for(domain_name: str) -> str:
    return f"_audit-firm-verify.{normalize_domain(domain_name)}"


def list_domain_mappings(db: Session, *, q: str = "", status: str = "", domain_type: str = "") -> list[DomainMapping]:
    stmt: Select[tuple[DomainMapping]] = select(DomainMapping).order_by(DomainMapping.created_at_utc.desc(), DomainMapping.id.desc())
    q = (q or "").strip().lower()
    if q:
        like = f"%{q}%"
        stmt = stmt.where(func.lower(DomainMapping.domain_name).like(like))
    if status:
        stmt = stmt.where(DomainMapping.status == status)
    if domain_type:
        stmt = stmt.where(DomainMapping.domain_type == domain_type)
    return list(db.execute(stmt).scalars().all())


def create_domain_mapping(db: Session, payload: DomainMappingPayload, *, user_id: int | None) -> DomainMapping:
    domain_name = normalize_domain(payload.domain_name)
    token = make_verification_token()
    mapping = DomainMapping(
        domain_name=domain_name,
        domain_type=payload.domain_type,
        tenant_id=payload.tenant_id,
        branch_id=payload.branch_id,
        consultant_id=payload.consultant_id,
        parent_tenant_id=payload.parent_tenant_id,
        is_primary=payload.is_primary,
        is_verified=payload.is_verified,
        status="active" if payload.is_verified and payload.status == "active" else payload.status,
        verification_token=token,
        dns_txt_name=dns_txt_name_for(domain_name),
        dns_txt_value=token,
        ssl_mode=payload.ssl_mode or "manual",
        notes=(payload.notes or "").strip() or None,
        created_by_user_id=user_id,
        updated_by_user_id=user_id,
    )
    db.add(mapping)
    db.commit()
    db.refresh(mapping)
    return mapping


def update_domain_mapping(db: Session, mapping: DomainMapping, payload: DomainMappingPayload, *, user_id: int | None) -> DomainMapping:
    old_domain = mapping.domain_name
    mapping.domain_name = normalize_domain(payload.domain_name)
    mapping.domain_type = payload.domain_type
    mapping.tenant_id = payload.tenant_id
    mapping.branch_id = payload.branch_id
    mapping.consultant_id = payload.consultant_id
    mapping.parent_tenant_id = payload.parent_tenant_id
    mapping.is_primary = payload.is_primary
    mapping.is_verified = payload.is_verified
    mapping.status = payload.status
    mapping.ssl_mode = payload.ssl_mode or "manual"
    mapping.notes = (payload.notes or "").strip() or None
    mapping.updated_by_user_id = user_id
    mapping.updated_at_utc = datetime.now(timezone.utc)
    if old_domain != mapping.domain_name or not mapping.verification_token:
        mapping.verification_token = make_verification_token()
        mapping.dns_txt_name = dns_txt_name_for(mapping.domain_name)
        mapping.dns_txt_value = mapping.verification_token
        mapping.is_verified = False
        if mapping.status == "active":
            mapping.status = "pending_verification"
    db.commit()
    db.refresh(mapping)
    return mapping


def regenerate_verification_token(db: Session, mapping: DomainMapping, *, user_id: int | None) -> DomainMapping:
    mapping.verification_token = make_verification_token()
    mapping.dns_txt_name = dns_txt_name_for(mapping.domain_name)
    mapping.dns_txt_value = mapping.verification_token
    mapping.is_verified = False
    if mapping.status == "active":
        mapping.status = "pending_verification"
    mapping.updated_by_user_id = user_id
    mapping.updated_at_utc = datetime.now(timezone.utc)
    db.commit()
    db.refresh(mapping)
    return mapping


def mark_verified(db: Session, mapping: DomainMapping, *, user_id: int | None) -> DomainMapping:
    mapping.is_verified = True
    mapping.status = "active"
    mapping.updated_by_user_id = user_id
    mapping.updated_at_utc = datetime.now(timezone.utc)
    db.commit()
    db.refresh(mapping)
    return mapping



def slugify_subdomain_label(value: str) -> str:
    """Create a safe subdomain label from a tenant code/name."""
    raw = (value or "").strip().lower()
    raw = re.sub(r"[^a-z0-9-]+", "-", raw)
    raw = re.sub(r"-+", "-", raw).strip("-")
    if not raw:
        raw = "firm"
    if raw in RESERVED_SUBDOMAIN_LABELS:
        raw = f"{raw}-firm"
    return raw[:63].strip("-") or "firm"


def tenant_subdomain_label(tenant: Tenant) -> str:
    code = getattr(tenant, "code", None) or getattr(tenant, "name", None) or f"firm-{tenant.id}"
    return slugify_subdomain_label(str(code))


def build_tenant_subdomain(tenant: Tenant, base_domain: str = "filingabc.com") -> str:
    base = normalize_domain(base_domain or "filingabc.com")
    return f"{tenant_subdomain_label(tenant)}.{base}"


def list_tenant_subdomain_candidates(db: Session, *, base_domain: str = "filingabc.com") -> list[dict]:
    """Return all tenants with their suggested platform subdomain and existing mapping, if any."""
    base = normalize_domain(base_domain or "filingabc.com")
    tenants = db.execute(select(Tenant).order_by(Tenant.name.asc())).scalars().all()
    out: list[dict] = []
    for tenant in tenants:
        domain_name = build_tenant_subdomain(tenant, base)
        mapping = db.execute(select(DomainMapping).where(DomainMapping.domain_name == domain_name)).scalar_one_or_none()
        out.append({"tenant": tenant, "domain_name": domain_name, "mapping": mapping})
    return out


def create_or_get_tenant_subdomain_mapping(
    db: Session,
    *,
    tenant_id: int,
    base_domain: str = "filingabc.com",
    branch_id: int | None = None,
    mark_verified_active: bool = True,
    user_id: int | None = None,
) -> tuple[DomainMapping, bool]:
    """Create auditfirm.filingabc.com mapping for a tenant without duplicating existing rows.

    Returns (mapping, created). The platform owner normally verifies wildcard DNS/SSL once,
    so mark_verified_active=True is safe for the owned *.filingabc.com style domain.
    """
    tenant = db.get(Tenant, int(tenant_id))
    if not tenant:
        raise ValueError("Selected audit firm was not found.")
    domain_name = build_tenant_subdomain(tenant, base_domain)
    existing = db.execute(select(DomainMapping).where(DomainMapping.domain_name == domain_name)).scalar_one_or_none()
    if existing:
        return existing, False

    payload = DomainMappingPayload(
        domain_name=domain_name,
        domain_type="audit_firm_subdomain",
        tenant_id=tenant.id,
        branch_id=branch_id,
        is_primary=False,
        is_verified=bool(mark_verified_active),
        status="active" if mark_verified_active else "pending_verification",
        ssl_mode="coolify",
        notes="Auto-created platform tenant subdomain. Ensure wildcard DNS/SSL for *.filingabc.com is configured in deployment.",
    )
    errors = validate_domain_payload(db, payload)
    if errors:
        raise ValueError(" ".join(errors))
    mapping = create_domain_mapping(db, payload, user_id=user_id)
    return mapping, True



def create_or_get_firm_custom_domain_mapping(
    db: Session,
    *,
    tenant_id: int,
    domain_name: str = "arrr.associates",
    branch_id: int | None = None,
    mark_verified_active: bool = False,
    user_id: int | None = None,
) -> tuple[DomainMapping, bool]:
    """Create an audit-firm custom domain mapping such as arrr.associates.

    This is intentionally separate from tenant subdomains. Custom domains normally
    need DNS verification before activation, so mark_verified_active defaults to
    False. For a domain owned by the platform owner and already configured in DNS,
    an admin may tick mark_verified_active to make it active immediately.

    Returns (mapping, created).
    """
    tenant = db.get(Tenant, int(tenant_id))
    if not tenant:
        raise ValueError("Selected audit firm was not found.")

    normalized_domain = normalize_domain(domain_name or "arrr.associates")
    existing = db.execute(select(DomainMapping).where(DomainMapping.domain_name == normalized_domain)).scalar_one_or_none()
    if existing:
        return existing, False

    payload = DomainMappingPayload(
        domain_name=normalized_domain,
        domain_type="audit_firm_domain",
        tenant_id=tenant.id,
        branch_id=branch_id,
        is_primary=True,
        is_verified=bool(mark_verified_active),
        status="active" if mark_verified_active else "pending_verification",
        ssl_mode="coolify",
        notes=(
            "Custom audit firm domain created from Phase 7T.6. "
            "Ensure DNS points to the ERP server and SSL/proxy configuration is completed before live use."
        ),
    )
    errors = validate_domain_payload(db, payload)
    if errors:
        raise ValueError(" ".join(errors))
    mapping = create_domain_mapping(db, payload, user_id=user_id)
    return mapping, True


def consultant_subdomain_label(consultant: ConsultantProfile) -> str:
    """Create a safe domain label for consultant profile domains."""
    raw = (getattr(consultant, "firm_name", None) or getattr(consultant, "contact_person", None) or f"consultant-{consultant.id}")
    return slugify_subdomain_label(str(raw))


def build_consultant_platform_subdomain(consultant: ConsultantProfile, base_domain: str = "filingabc.com") -> str:
    base = normalize_domain(base_domain or "filingabc.com")
    return f"{consultant_subdomain_label(consultant)}.{base}"


def build_consultant_firm_domain(consultant: ConsultantProfile, firm_base_domain: str = "arrr.accountant") -> str:
    base = normalize_domain(firm_base_domain or "arrr.accountant")
    return f"{consultant_subdomain_label(consultant)}.{base}"


def list_consultant_domain_candidates(
    db: Session,
    *,
    base_domain: str = "filingabc.com",
    firm_base_domain: str = "arrr.accountant",
) -> list[dict]:
    """Return consultants with suggested marketplace and firm-linked profile domains."""
    consultants = db.execute(select(ConsultantProfile).order_by(ConsultantProfile.contact_person.asc())).scalars().all()
    out: list[dict] = []
    for consultant in consultants:
        platform_domain = build_consultant_platform_subdomain(consultant, base_domain)
        firm_domain = build_consultant_firm_domain(consultant, firm_base_domain)
        platform_mapping = db.execute(select(DomainMapping).where(DomainMapping.domain_name == platform_domain)).scalar_one_or_none()
        firm_mapping = db.execute(select(DomainMapping).where(DomainMapping.domain_name == firm_domain)).scalar_one_or_none()
        out.append({
            "consultant": consultant,
            "platform_domain": platform_domain,
            "platform_mapping": platform_mapping,
            "firm_domain": firm_domain,
            "firm_mapping": firm_mapping,
        })
    return out


def create_or_get_consultant_domain_mapping(
    db: Session,
    *,
    consultant_id: int,
    domain_type: str = "consultant_marketplace_subdomain",
    domain_name: str | None = None,
    base_domain: str = "filingabc.com",
    firm_base_domain: str = "arrr.accountant",
    parent_tenant_id: int | None = None,
    mark_verified_active: bool = False,
    user_id: int | None = None,
) -> tuple[DomainMapping, bool]:
    """Create consultant profile domain mapping without duplicating existing rows.

    Supported examples:
      consultant_marketplace_subdomain -> consultant.filingabc.com
      consultant_firm_domain           -> consultant.arrr.accountant
      consultant_custom_domain         -> abc.accountants
    """
    consultant = db.get(ConsultantProfile, int(consultant_id))
    if not consultant:
        raise ValueError("Selected consultant profile was not found.")

    if domain_type == "consultant_marketplace_subdomain":
        normalized_domain = normalize_domain(domain_name or build_consultant_platform_subdomain(consultant, base_domain))
        resolved_parent_tenant_id = parent_tenant_id
        ssl_mode = "coolify"
        default_notes = "Auto-created consultant marketplace profile subdomain. Ensure wildcard DNS/SSL for the platform base domain is configured."
        default_verified = True
    elif domain_type == "consultant_firm_domain":
        normalized_domain = normalize_domain(domain_name or build_consultant_firm_domain(consultant, firm_base_domain))
        resolved_parent_tenant_id = parent_tenant_id or consultant.tenant_id
        ssl_mode = "coolify"
        default_notes = "Consultant domain under an audit firm brand. Ensure DNS/SSL for the firm consultant domain is configured."
        default_verified = False
    elif domain_type == "consultant_custom_domain":
        if not domain_name:
            raise ValueError("Custom consultant domain is required.")
        normalized_domain = normalize_domain(domain_name)
        resolved_parent_tenant_id = parent_tenant_id
        ssl_mode = "coolify"
        default_notes = "Consultant custom domain. Verify DNS ownership before activation."
        default_verified = False
    else:
        raise ValueError("Invalid consultant domain type selected.")

    existing = db.execute(select(DomainMapping).where(DomainMapping.domain_name == normalized_domain)).scalar_one_or_none()
    if existing:
        return existing, False

    verified = bool(mark_verified_active or default_verified)
    payload = DomainMappingPayload(
        domain_name=normalized_domain,
        domain_type=domain_type,
        tenant_id=consultant.tenant_id,
        branch_id=consultant.branch_id,
        consultant_id=consultant.id,
        parent_tenant_id=resolved_parent_tenant_id,
        is_primary=False,
        is_verified=verified,
        status="active" if verified else "pending_verification",
        ssl_mode=ssl_mode,
        notes=default_notes,
    )
    errors = validate_domain_payload(db, payload)
    if errors:
        raise ValueError(" ".join(errors))
    mapping = create_domain_mapping(db, payload, user_id=user_id)
    return mapping, True

def reference_data(db: Session) -> dict:
    return {
        "tenants": db.execute(select(Tenant).order_by(Tenant.name.asc())).scalars().all(),
        "branches": db.execute(select(Branch).order_by(Branch.name.asc())).scalars().all(),
        "consultants": db.execute(select(ConsultantProfile).order_by(ConsultantProfile.contact_person.asc())).scalars().all(),
        "domain_types": DOMAIN_TYPES,
        "statuses": DOMAIN_STATUSES,
        "ssl_modes": SSL_MODES,
        "ssl_statuses": SSL_STATUSES,
    }


@dataclass(frozen=True)
class DomainResolution:
    """Resolved runtime domain context used by Phase 7T.2 middleware."""

    is_resolved: bool
    host: str
    mapping_id: int | None = None
    domain_name: str | None = None
    domain_type: str | None = None
    tenant_id: int | None = None
    tenant_code: str | None = None
    branch_id: int | None = None
    branch_code: str | None = None
    consultant_id: int | None = None
    parent_tenant_id: int | None = None
    is_verified: bool = False
    status: str | None = None


def normalize_request_host(host_header: str | None) -> str:
    """Normalise the HTTP Host / X-Forwarded-Host value for lookup.

    Handles values such as:
        localhost:8000
        arrr.associates
        arrr.associates:443
        arrr.associates, proxy-host
    """
    value = (host_header or "").strip().lower()
    if not value:
        return ""
    value = value.split(",", 1)[0].strip()
    value = value.removeprefix("http://").removeprefix("https://")
    value = value.split("/", 1)[0]
    if value.startswith("[") and "]" in value:
        # IPv6 literal; keep without brackets/port for safety.
        value = value.split("]", 1)[0].lstrip("[")
    else:
        value = value.split(":", 1)[0]
    return value.rstrip(".")


def resolve_domain_context(db: Session, host: str) -> DomainResolution:
    """Resolve an incoming host to an active domain mapping.

    Phase 7T.2 intentionally resolves only exact domain mappings. Wildcard/platform
    subdomain inference comes later in Phase 7T.5, and custom-domain DNS checks come
    in Phase 7T.8.
    """
    normalized = normalize_domain(host)
    if not normalized:
        return DomainResolution(is_resolved=False, host="")

    stmt = (
        select(DomainMapping, Tenant.code, Branch.code)
        .outerjoin(Tenant, Tenant.id == DomainMapping.tenant_id)
        .outerjoin(Branch, Branch.id == DomainMapping.branch_id)
        .where(DomainMapping.domain_name == normalized)
        .where(DomainMapping.status == "active")
        .where(DomainMapping.is_verified.is_(True))
        .limit(1)
    )
    row = db.execute(stmt).first()
    if not row:
        return DomainResolution(is_resolved=False, host=normalized)

    mapping, tenant_code, branch_code = row
    return DomainResolution(
        is_resolved=True,
        host=normalized,
        mapping_id=int(mapping.id),
        domain_name=mapping.domain_name,
        domain_type=mapping.domain_type,
        tenant_id=mapping.tenant_id,
        tenant_code=tenant_code,
        branch_id=mapping.branch_id,
        branch_code=branch_code,
        consultant_id=mapping.consultant_id,
        parent_tenant_id=mapping.parent_tenant_id,
        is_verified=bool(mapping.is_verified),
        status=mapping.status,
    )



@dataclass(frozen=True)
class DomainDnsVerificationResult:
    ok: bool
    message: str
    txt_name: str
    expected_value: str
    found_values: tuple[str, ...] = ()


def _normalise_txt_value(value: str) -> str:
    value = (value or "").strip()
    # TXT records may be returned with quotes and split chunks.
    if value.startswith('"') and value.endswith('"') and len(value) >= 2:
        value = value[1:-1]
    value = value.replace('" "', '').replace('"', '').strip()
    return value


def _resolve_txt_with_dnspython(txt_name: str) -> tuple[list[str], str | None]:
    try:
        import dns.resolver  # type: ignore
    except Exception:
        return [], "dnspython is not installed"
    try:
        answers = dns.resolver.resolve(txt_name, "TXT")
        values: list[str] = []
        for answer in answers:
            try:
                chunks = [part.decode("utf-8", errors="ignore") if isinstance(part, bytes) else str(part) for part in answer.strings]
                values.append("".join(chunks))
            except Exception:
                values.append(str(answer).strip())
        return values, None
    except Exception as exc:
        return [], str(exc)


def _resolve_txt_with_nslookup(txt_name: str) -> tuple[list[str], str | None]:
    try:
        completed = subprocess.run(
            ["nslookup", "-type=TXT", txt_name],
            capture_output=True,
            text=True,
            timeout=12,
            check=False,
        )
    except FileNotFoundError:
        return [], "nslookup command is not available on this machine"
    except Exception as exc:
        return [], str(exc)

    output = "\n".join([completed.stdout or "", completed.stderr or ""])
    if completed.returncode != 0 and not output.strip():
        return [], "DNS lookup failed"

    values: list[str] = []
    for line in output.splitlines():
        line = line.strip()
        if not line:
            continue
        # Windows/Linux nslookup generally prints TXT values inside quotes.
        quoted = re.findall(r'"([^"]+)"', line)
        if quoted:
            values.append("".join(quoted))
            continue
        if "text =" in line.lower():
            values.append(line.split("=", 1)[1].strip())
    if not values and output.strip():
        # Keep a short diagnostic without storing full command noise.
        return [], output.strip().splitlines()[-1][:240]
    return values, None


def lookup_dns_txt_values(txt_name: str) -> tuple[list[str], str | None]:
    """Return TXT records for a DNS name using dnspython when available, else nslookup.

    No new dependency is required. On Windows, nslookup is normally available by default.
    """
    txt_name = normalize_domain(txt_name)
    if not txt_name:
        return [], "TXT name is empty"

    values, error = _resolve_txt_with_dnspython(txt_name)
    if values:
        return [_normalise_txt_value(v) for v in values], None

    ns_values, ns_error = _resolve_txt_with_nslookup(txt_name)
    if ns_values:
        return [_normalise_txt_value(v) for v in ns_values], None

    return [], ns_error or error or "No TXT record found"


def verify_domain_dns_txt(db: Session, mapping: DomainMapping, *, user_id: int | None) -> DomainDnsVerificationResult:
    """Verify a custom/platform domain using its DNS TXT token.

    If the expected TXT value is found, the domain is marked verified and active. If not,
    the mapping remains unverified and is moved to pending_verification unless suspended.
    """
    txt_name = mapping.dns_txt_name or dns_txt_name_for(mapping.domain_name)
    expected = mapping.dns_txt_value or mapping.verification_token or ""
    if not expected:
        mapping.verification_token = make_verification_token()
        mapping.dns_txt_name = txt_name
        mapping.dns_txt_value = mapping.verification_token
        expected = mapping.dns_txt_value
        db.commit()
        db.refresh(mapping)

    found_values, error = lookup_dns_txt_values(txt_name)
    found_normalised = tuple(_normalise_txt_value(v) for v in found_values if _normalise_txt_value(v))
    expected_normalised = _normalise_txt_value(expected)
    matched = any(v == expected_normalised or expected_normalised in v for v in found_normalised)

    now = datetime.now(timezone.utc)
    if matched:
        mapping.is_verified = True
        mapping.status = "active"
        mapping.updated_by_user_id = user_id
        mapping.updated_at_utc = now
        db.commit()
        db.refresh(mapping)
        return DomainDnsVerificationResult(
            ok=True,
            message="DNS TXT verification successful. Domain is now active.",
            txt_name=txt_name,
            expected_value=expected_normalised,
            found_values=found_normalised,
        )

    if mapping.status not in {"suspended", "inactive"}:
        mapping.status = "pending_verification"
    mapping.is_verified = False
    mapping.updated_by_user_id = user_id
    mapping.updated_at_utc = now
    db.commit()
    db.refresh(mapping)
    msg = "DNS TXT record not found or value does not match."
    if error:
        msg = f"{msg} DNS response: {error}"
    return DomainDnsVerificationResult(
        ok=False,
        message=msg,
        txt_name=txt_name,
        expected_value=expected_normalised,
        found_values=found_normalised,
    )


def list_domains_requiring_verification(db: Session) -> list[DomainMapping]:
    stmt = (
        select(DomainMapping)
        .where(DomainMapping.is_verified.is_(False))
        .where(DomainMapping.status.in_(["draft", "pending_verification"]))
        .order_by(DomainMapping.updated_at_utc.desc(), DomainMapping.id.desc())
    )
    return list(db.execute(stmt).scalars().all())


def verify_all_pending_domains(db: Session, *, user_id: int | None, limit: int = 25) -> list[tuple[DomainMapping, DomainDnsVerificationResult]]:
    results: list[tuple[DomainMapping, DomainDnsVerificationResult]] = []
    for mapping in list_domains_requiring_verification(db)[: max(1, min(limit, 100))]:
        result = verify_domain_dns_txt(db, mapping, user_id=user_id)
        results.append((mapping, result))
    return results



def _name_tuple_to_text(name_tuple) -> str | None:
    try:
        parts: list[str] = []
        for section in name_tuple or []:
            for key, value in section:
                if value:
                    parts.append(f"{key}={value}")
        return ", ".join(parts) if parts else None
    except Exception:
        return None


def _parse_ssl_not_after(value: str | None) -> datetime | None:
    if not value:
        return None
    try:
        dt = parsedate_to_datetime(value)
        if dt.tzinfo is None:
            dt = dt.replace(tzinfo=timezone.utc)
        return dt.astimezone(timezone.utc)
    except Exception:
        return None


def check_domain_ssl_certificate(db: Session, mapping: DomainMapping, *, user_id: int | None = None, timeout: float = 5.0) -> DomainSslCheckResult:
    """Check whether the domain currently serves a valid TLS certificate on 443.

    This does not issue certificates. Certificate issuance is handled by Coolify/Caddy/
    Traefik/Cloudflare/Certbot. This function records readiness/status inside ERP.
    """
    domain = normalize_domain(mapping.domain_name)
    now = datetime.now(timezone.utc)
    if not domain or domain == "localhost":
        mapping.ssl_status = "manual"
        mapping.ssl_last_checked_at_utc = now
        mapping.ssl_last_error = "Localhost does not require public SSL certificate checking."
        db.commit()
        return DomainSslCheckResult(False, "manual", mapping.ssl_last_error)

    if not mapping.is_verified or mapping.status != "active":
        mapping.ssl_status = "pending_dns"
        mapping.ssl_last_checked_at_utc = now
        mapping.ssl_last_error = "Domain must be verified and active before SSL check."
        db.commit()
        return DomainSslCheckResult(False, "pending_dns", mapping.ssl_last_error)

    try:
        context = ssl.create_default_context()
        with socket.create_connection((domain, 443), timeout=timeout) as sock:
            with context.wrap_socket(sock, server_hostname=domain) as ssock:
                cert = ssock.getpeercert()
        subject = _name_tuple_to_text(cert.get("subject"))
        issuer = _name_tuple_to_text(cert.get("issuer"))
        not_after = _parse_ssl_not_after(cert.get("notAfter"))
        mapping.ssl_status = "active"
        mapping.ssl_last_checked_at_utc = now
        mapping.ssl_not_after_utc = not_after
        mapping.ssl_subject = subject
        mapping.ssl_issuer = issuer
        mapping.ssl_last_error = None
        db.commit()
        db.refresh(mapping)
        return DomainSslCheckResult(True, "active", "SSL certificate is active and trusted.", subject, issuer, not_after)
    except Exception as exc:
        mapping.ssl_status = "failed"
        mapping.ssl_last_checked_at_utc = now
        mapping.ssl_last_error = str(exc)[:1000]
        db.commit()
        db.refresh(mapping)
        return DomainSslCheckResult(False, "failed", f"SSL check failed: {mapping.ssl_last_error}")


def mark_ssl_managed(db: Session, mapping: DomainMapping, *, provider: str, user_id: int | None = None) -> DomainMapping:
    provider = (provider or mapping.ssl_mode or "manual").strip().lower()
    valid = {code for code, _label in SSL_MODES}
    if provider not in valid:
        provider = "manual"
    mapping.ssl_provider = provider
    mapping.ssl_mode = provider
    mapping.ssl_status = "manual" if provider in {"manual", "cloudflare"} else "pending_ssl"
    mapping.updated_by_user_id = user_id
    mapping.updated_at_utc = datetime.now(timezone.utc)
    db.commit()
    db.refresh(mapping)
    return mapping


def list_ssl_domains(db: Session) -> list[DomainMapping]:
    stmt = (
        select(DomainMapping)
        .where(DomainMapping.status.in_(["active", "pending_verification", "draft"]))
        .order_by(DomainMapping.domain_type.asc(), DomainMapping.domain_name.asc())
    )
    return list(db.execute(stmt).scalars().all())


def build_ssl_proxy_snippets(mapping: DomainMapping, *, app_upstream: str = "http://127.0.0.1:8000") -> list[DomainSslProxySnippet]:
    domain = normalize_domain(mapping.domain_name)
    if not domain or domain == "localhost":
        return []
    caddy = f"""{domain} {{
    encode gzip
    reverse_proxy {app_upstream}
}}"""
    nginx = f"""server {{
    listen 80;
    server_name {domain};

    location / {{
        proxy_pass {app_upstream};
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }}
}}

# After DNS points to this server:
# certbot --nginx -d {domain}"""
    coolify = f"""Coolify setup checklist for {domain}
1. Open the Audit ERP application in Coolify.
2. Add domain: https://{domain}
3. Ensure DNS A/CNAME points to the Coolify server.
4. Enable Force HTTPS after certificate is issued.
5. Keep Host header forwarding enabled.
6. In ERP, verify DNS TXT and then run SSL check."""
    return [
        DomainSslProxySnippet("coolify", "Coolify domain setup", coolify),
        DomainSslProxySnippet("caddy", "Caddy automatic HTTPS snippet", caddy),
        DomainSslProxySnippet("nginx", "Nginx + Certbot snippet", nginx),
    ]