package httpapp

import (
	"encoding/json"
	"fmt"
	"log"
	"net/http"
	"net/url"
	"os/exec"
	"strconv"
	"strings"
	"time"

	"gitea.avt.data-center.id/othman.suseno/atlas/internal/auth"
	"gitea.avt.data-center.id/othman.suseno/atlas/internal/errors"
	"gitea.avt.data-center.id/othman.suseno/atlas/internal/models"
	"gitea.avt.data-center.id/othman.suseno/atlas/internal/storage"
	"gitea.avt.data-center.id/othman.suseno/atlas/internal/validation"
)

// pathParam is now in router_helpers.go

// Disk Handlers
func (a *App) handleListDisks(w http.ResponseWriter, r *http.Request) {
	disks, err := a.zfs.ListDisks()
	if err != nil {
		log.Printf("list disks error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}
	writeJSON(w, http.StatusOK, disks)
}

// ZFS Pool Handlers
func (a *App) handleListPools(w http.ResponseWriter, r *http.Request) {
	pools, err := a.zfs.ListPools()
	if err != nil {
		log.Printf("list pools error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}
	// Ensure we always return an array, not null
	if pools == nil {
		pools = []models.Pool{}
	}

	// Set cache-control headers to prevent caching - pools list changes frequently
	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
	w.Header().Set("Pragma", "no-cache")
	w.Header().Set("Expires", "0")

	writeJSON(w, http.StatusOK, pools)
}

func (a *App) handleCreatePool(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Name    string            `json:"name"`
		VDEVs   []string          `json:"vdevs"`
		Options map[string]string `json:"options,omitempty"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeError(w, errors.ErrBadRequest("invalid request body"))
		return
	}

	// Validate pool name
	if err := validation.ValidateZFSName(req.Name); err != nil {
		writeError(w, errors.ErrValidation(err.Error()))
		return
	}

	if len(req.VDEVs) == 0 {
		writeError(w, errors.ErrValidation("at least one vdev is required"))
		return
	}

	if req.Options == nil {
		req.Options = make(map[string]string)
	}

	log.Printf("creating pool: name=%s, vdevs=%v, options=%v", req.Name, req.VDEVs, req.Options)

	err := a.zfs.CreatePool(req.Name, req.VDEVs, req.Options)

	// CRITICAL: Always check if pool exists, regardless of reported error
	// ZFS often reports mountpoint errors but pool is still created
	// The CreatePool function already does retries, but we double-check here
	// Wait a brief moment for pool to be fully registered
	time.Sleep(300 * time.Millisecond)

	pool, getErr := a.zfs.GetPool(req.Name)
	if getErr == nil {
		// Pool exists - this is success!
		if err != nil {
			log.Printf("info: pool %s created successfully despite CreatePool reporting error: %v", req.Name, err)
		} else {
			log.Printf("info: pool %s created successfully", req.Name)
		}
		// Set cache-control headers
		w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
		w.Header().Set("Pragma", "no-cache")
		w.Header().Set("Expires", "0")
		writeJSON(w, http.StatusCreated, pool)
		return
	}

	// Pool doesn't exist - return the error with detailed context
	if err != nil {
		log.Printf("error: pool %s creation failed - CreatePool error: %v, GetPool error: %v", req.Name, err, getErr)
		writeError(w, errors.ErrInternal("failed to create pool").WithDetails(fmt.Sprintf("Pool '%s' was not created: %v. Check logs for zpool command output.", req.Name, err)))
		return
	}

	// No error but pool doesn't exist (shouldn't happen, but handle it)
	log.Printf("warning: pool %s creation reported no error but pool was not found", req.Name)
	writeError(w, errors.ErrInternal(fmt.Sprintf("Pool '%s' creation reported success but pool was not found", req.Name)))
}

func (a *App) handleGetPool(w http.ResponseWriter, r *http.Request) {
	name := pathParam(r, "/api/v1/pools/")
	if name == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "pool name required"})
		return
	}

	pool, err := a.zfs.GetPool(name)
	if err != nil {
		writeJSON(w, http.StatusNotFound, map[string]string{"error": err.Error()})
		return
	}

	writeJSON(w, http.StatusOK, pool)
}

func (a *App) handleDeletePool(w http.ResponseWriter, r *http.Request) {
	name := pathParam(r, "/api/v1/pools/")
	if name == "" {
		writeError(w, errors.ErrBadRequest("pool name required"))
		return
	}

	if err := a.zfs.DestroyPool(name); err != nil {
		log.Printf("destroy pool error: %v", err)
		writeError(w, errors.ErrInternal("failed to destroy pool").WithDetails(err.Error()))
		return
	}

	// Set cache-control headers to prevent caching of this response
	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
	w.Header().Set("Pragma", "no-cache")
	w.Header().Set("Expires", "0")

	writeJSON(w, http.StatusOK, map[string]string{"message": "pool destroyed", "name": name})
}

func (a *App) handleImportPool(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Name    string            `json:"name"`
		Options map[string]string `json:"options,omitempty"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeError(w, errors.ErrBadRequest("invalid request body").WithDetails(err.Error()))
		return
	}

	if req.Name == "" {
		writeError(w, errors.ErrBadRequest("pool name required"))
		return
	}

	if err := a.zfs.ImportPool(req.Name, req.Options); err != nil {
		log.Printf("import pool error: %v", err)
		writeError(w, errors.ErrInternal("failed to import pool").WithDetails(err.Error()))
		return
	}

	writeJSON(w, http.StatusOK, map[string]string{"message": "pool imported", "name": req.Name})
}

func (a *App) handleExportPool(w http.ResponseWriter, r *http.Request) {
	name := pathParam(r, "/api/v1/pools/")
	if name == "" {
		writeError(w, errors.ErrBadRequest("pool name required"))
		return
	}

	var req struct {
		Force bool `json:"force,omitempty"`
	}
	// Force is optional, decode if body exists
	_ = json.NewDecoder(r.Body).Decode(&req)

	if err := a.zfs.ExportPool(name, req.Force); err != nil {
		log.Printf("export pool error: %v", err)
		writeError(w, errors.ErrInternal("failed to export pool").WithDetails(err.Error()))
		return
	}

	writeJSON(w, http.StatusOK, map[string]string{"message": "pool exported", "name": name})
}

func (a *App) handleListAvailablePools(w http.ResponseWriter, r *http.Request) {
	pools, err := a.zfs.ListAvailablePools()
	if err != nil {
		log.Printf("list available pools error: %v", err)
		writeError(w, errors.ErrInternal("failed to list available pools").WithDetails(err.Error()))
		return
	}

	writeJSON(w, http.StatusOK, map[string]interface{}{
		"pools": pools,
	})
}

func (a *App) handleScrubPool(w http.ResponseWriter, r *http.Request) {
	name := pathParam(r, "/api/v1/pools/")
	if name == "" {
		writeError(w, errors.ErrBadRequest("pool name required"))
		return
	}

	if err := a.zfs.ScrubPool(name); err != nil {
		log.Printf("scrub pool error: %v", err)
		writeError(w, errors.ErrInternal("failed to start scrub").WithDetails(err.Error()))
		return
	}

	writeJSON(w, http.StatusOK, map[string]string{"message": "scrub started", "pool": name})
}

func (a *App) handleGetScrubStatus(w http.ResponseWriter, r *http.Request) {
	name := pathParam(r, "/api/v1/pools/")
	if name == "" {
		writeError(w, errors.ErrBadRequest("pool name required"))
		return
	}

	status, err := a.zfs.GetScrubStatus(name)
	if err != nil {
		log.Printf("get scrub status error: %v", err)
		writeError(w, errors.ErrInternal("failed to get scrub status").WithDetails(err.Error()))
		return
	}

	writeJSON(w, http.StatusOK, status)
}

// Dataset Handlers
func (a *App) handleListDatasets(w http.ResponseWriter, r *http.Request) {
	pool := r.URL.Query().Get("pool")
	datasets, err := a.zfs.ListDatasets(pool)
	if err != nil {
		log.Printf("list datasets error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}
	// Ensure we always return an array, not null
	if datasets == nil {
		datasets = []models.Dataset{}
	}
	writeJSON(w, http.StatusOK, datasets)
}

func (a *App) handleCreateDataset(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Name    string            `json:"name"`
		Options map[string]string `json:"options,omitempty"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
		return
	}

	if req.Name == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "dataset name is required"})
		return
	}

	if req.Options == nil {
		req.Options = make(map[string]string)
	}

	err := a.zfs.CreateDataset(req.Name, req.Options)

	// CRITICAL: Always check if dataset exists, regardless of reported error
	// ZFS often reports mountpoint errors but dataset is still created
	// The CreateDataset function already does retries, but we double-check here
	// Wait a brief moment for dataset to be fully registered
	time.Sleep(300 * time.Millisecond)

	datasets, getErr := a.zfs.ListDatasets("")
	var datasetExists bool
	if getErr == nil {
		for _, ds := range datasets {
			if ds.Name == req.Name {
				datasetExists = true
				break
			}
		}
	}

	if datasetExists {
		// Dataset exists - this is success!
		if err != nil {
			log.Printf("info: dataset %s created successfully despite CreateDataset reporting error: %v", req.Name, err)
		} else {
			log.Printf("info: dataset %s created successfully", req.Name)
		}
		// Set cache-control headers
		w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
		w.Header().Set("Pragma", "no-cache")
		w.Header().Set("Expires", "0")
		writeJSON(w, http.StatusCreated, map[string]string{"message": "dataset created", "name": req.Name})
		return
	}

	// Dataset doesn't exist - return the error with detailed context
	if err != nil {
		log.Printf("error: dataset %s creation failed - CreateDataset error: %v, ListDatasets error: %v", req.Name, err, getErr)
		writeError(w, errors.ErrInternal("failed to create dataset").WithDetails(err.Error()))
		return
	}

	// No error but dataset doesn't exist (shouldn't happen, but handle it)
	log.Printf("warning: dataset %s creation reported no error but dataset was not found", req.Name)
	writeError(w, errors.ErrInternal(fmt.Sprintf("Dataset '%s' creation reported success but dataset was not found", req.Name)))
}

func (a *App) handleGetDataset(w http.ResponseWriter, r *http.Request) {
	name := pathParamFull(r, "/api/v1/datasets/")
	if name == "" {
		writeError(w, errors.ErrBadRequest("dataset name required"))
		return
	}

	datasets, err := a.zfs.ListDatasets("")
	if err != nil {
		writeError(w, errors.ErrInternal("failed to list datasets").WithDetails(err.Error()))
		return
	}

	for _, ds := range datasets {
		if ds.Name == name {
			writeJSON(w, http.StatusOK, ds)
			return
		}
	}

	writeError(w, errors.ErrNotFound("dataset"))
}

func (a *App) handleUpdateDataset(w http.ResponseWriter, r *http.Request) {
	name := pathParamFull(r, "/api/v1/datasets/")
	if name == "" {
		writeError(w, errors.ErrBadRequest("dataset name required"))
		return
	}

	var req struct {
		Quota       string            `json:"quota"`       // e.g., "10G", "1T", or "none" to remove
		Compression string            `json:"compression"` // e.g., "lz4", "gzip", "off"
		Options     map[string]string `json:"options"`     // other ZFS properties
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeError(w, errors.ErrBadRequest("invalid request body"))
		return
	}

	// Validate dataset exists
	datasets, err := a.zfs.ListDatasets("")
	if err != nil {
		writeError(w, errors.ErrInternal("failed to validate dataset").WithDetails(err.Error()))
		return
	}

	datasetExists := false
	for _, ds := range datasets {
		if ds.Name == name {
			datasetExists = true
			break
		}
	}

	if !datasetExists {
		writeError(w, errors.ErrNotFound(fmt.Sprintf("dataset '%s' not found", name)))
		return
	}

	// Update dataset properties
	if err := a.zfs.UpdateDataset(name, req.Quota, req.Compression, req.Options); err != nil {
		log.Printf("update dataset error: %v", err)
		writeError(w, errors.ErrInternal("failed to update dataset").WithDetails(err.Error()))
		return
	}

	// Get updated dataset info
	datasets, _ = a.zfs.ListDatasets("")
	for _, ds := range datasets {
		if ds.Name == name {
			writeJSON(w, http.StatusOK, ds)
			return
		}
	}

	writeJSON(w, http.StatusOK, map[string]string{"message": "dataset updated", "name": name})
}

func (a *App) handleDeleteDataset(w http.ResponseWriter, r *http.Request) {
	name := pathParamFull(r, "/api/v1/datasets/")
	if name == "" {
		writeError(w, errors.ErrBadRequest("dataset name required"))
		return
	}

	recursive := r.URL.Query().Get("recursive") == "true"

	if err := a.zfs.DestroyDataset(name, recursive); err != nil {
		log.Printf("destroy dataset error: %v", err)
		writeError(w, errors.ErrInternal("failed to destroy dataset").WithDetails(err.Error()))
		return
	}

	writeJSON(w, http.StatusOK, map[string]string{"message": "dataset destroyed", "name": name})
}

// ZVOL Handlers
func (a *App) handleListZVOLs(w http.ResponseWriter, r *http.Request) {
	pool := r.URL.Query().Get("pool")
	zvols, err := a.zfs.ListZVOLs(pool)
	if err != nil {
		log.Printf("list zvols error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}
	writeJSON(w, http.StatusOK, zvols)
}

func (a *App) handleCreateZVOL(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Name    string            `json:"name"`
		Size    string            `json:"size"` // human-readable format (e.g., "10G")
		Options map[string]string `json:"options,omitempty"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeError(w, errors.ErrBadRequest("invalid request body"))
		return
	}

	// Validate ZVOL name
	if err := validation.ValidateZFSName(req.Name); err != nil {
		writeError(w, errors.ErrValidation(err.Error()))
		return
	}

	// Validate size format
	if err := validation.ValidateSize(req.Size); err != nil {
		writeError(w, errors.ErrValidation(err.Error()))
		return
	}

	// Parse size to bytes
	sizeBytes, err := a.parseSizeString(req.Size)
	if err != nil {
		writeError(w, errors.ErrValidation(fmt.Sprintf("invalid size: %v", err)))
		return
	}

	if req.Options == nil {
		req.Options = make(map[string]string)
	}

	if err := a.zfs.CreateZVOL(req.Name, sizeBytes, req.Options); err != nil {
		log.Printf("create zvol error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	writeJSON(w, http.StatusCreated, map[string]string{"message": "zvol created", "name": req.Name})
}

func (a *App) handleGetZVOL(w http.ResponseWriter, r *http.Request) {
	name := pathParamFull(r, "/api/v1/zvols/")
	if name == "" {
		writeError(w, errors.ErrBadRequest("zvol name required"))
		return
	}

	zvols, err := a.zfs.ListZVOLs("")
	if err != nil {
		writeError(w, errors.ErrInternal("failed to list zvols").WithDetails(err.Error()))
		return
	}

	for _, zvol := range zvols {
		if zvol.Name == name {
			writeJSON(w, http.StatusOK, zvol)
			return
		}
	}

	writeError(w, errors.ErrNotFound("zvol"))
}

func (a *App) handleDeleteZVOL(w http.ResponseWriter, r *http.Request) {
	name := pathParamFull(r, "/api/v1/zvols/")
	if name == "" {
		writeError(w, errors.ErrBadRequest("zvol name required"))
		return
	}

	if err := a.zfs.DestroyZVOL(name); err != nil {
		log.Printf("destroy zvol error: %v", err)
		writeError(w, errors.ErrInternal("failed to destroy zvol").WithDetails(err.Error()))
		return
	}

	writeJSON(w, http.StatusOK, map[string]string{"message": "zvol destroyed", "name": name})
}

// Snapshot Handlers
func (a *App) handleListSnapshots(w http.ResponseWriter, r *http.Request) {
	dataset := r.URL.Query().Get("dataset")
	snapshots, err := a.zfs.ListSnapshots(dataset)
	if err != nil {
		log.Printf("list snapshots error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}
	// Ensure we always return an array, not null
	if snapshots == nil {
		snapshots = []models.Snapshot{}
	}
	writeJSON(w, http.StatusOK, snapshots)
}

func (a *App) handleCreateSnapshot(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Dataset   string `json:"dataset"`
		Name      string `json:"name"`
		Recursive bool   `json:"recursive,omitempty"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
		return
	}

	// Validate dataset name
	if err := validation.ValidateZFSName(req.Dataset); err != nil {
		writeError(w, errors.ErrValidation(err.Error()))
		return
	}

	// Validate snapshot name (can contain @ but we'll validate the base name)
	snapshotBaseName := strings.ReplaceAll(req.Name, "@", "")
	if err := validation.ValidateZFSName(snapshotBaseName); err != nil {
		writeError(w, errors.ErrValidation("invalid snapshot name"))
		return
	}

	if err := a.zfs.CreateSnapshot(req.Dataset, req.Name, req.Recursive); err != nil {
		log.Printf("create snapshot error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	fullSnapshotName := fmt.Sprintf("%s@%s", req.Dataset, req.Name)
	snap, err := a.zfs.GetSnapshot(fullSnapshotName)
	if err != nil {
		writeJSON(w, http.StatusCreated, map[string]string{"message": "snapshot created", "name": fullSnapshotName})
		return
	}

	writeJSON(w, http.StatusCreated, snap)
}

func (a *App) handleGetSnapshot(w http.ResponseWriter, r *http.Request) {
	name := pathParam(r, "/api/v1/snapshots/")
	if name == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "snapshot name required"})
		return
	}

	snap, err := a.zfs.GetSnapshot(name)
	if err != nil {
		writeJSON(w, http.StatusNotFound, map[string]string{"error": err.Error()})
		return
	}

	writeJSON(w, http.StatusOK, snap)
}

func (a *App) handleDeleteSnapshot(w http.ResponseWriter, r *http.Request) {
	name := pathParam(r, "/api/v1/snapshots/")
	if name == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "snapshot name required"})
		return
	}

	recursive := r.URL.Query().Get("recursive") == "true"

	if err := a.zfs.DestroySnapshot(name, recursive); err != nil {
		log.Printf("destroy snapshot error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	writeJSON(w, http.StatusOK, map[string]string{"message": "snapshot destroyed", "name": name})
}

func (a *App) handleRestoreSnapshot(w http.ResponseWriter, r *http.Request) {
	// Extract snapshot name from path like /api/v1/snapshots/pool@snapshot/restore
	path := strings.TrimPrefix(r.URL.Path, "/api/v1/snapshots/")
	path = strings.TrimSuffix(path, "/restore")

	// URL decode the snapshot name
	snapshotName, err := url.QueryUnescape(path)
	if err != nil {
		writeError(w, errors.ErrBadRequest("invalid snapshot name"))
		return
	}

	if snapshotName == "" {
		writeError(w, errors.ErrBadRequest("snapshot name required"))
		return
	}

	var req struct {
		Force bool `json:"force,omitempty"` // Force rollback (recursive for child datasets)
	}

	if r.Body != nil {
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			// If body is empty or invalid, use defaults
			req.Force = false
		}
	}

	// Validate snapshot exists
	_, err = a.zfs.GetSnapshot(snapshotName)
	if err != nil {
		writeError(w, errors.ErrNotFound(fmt.Sprintf("snapshot '%s' not found", snapshotName)))
		return
	}

	// Restore snapshot
	if err := a.zfs.RestoreSnapshot(snapshotName, req.Force); err != nil {
		log.Printf("restore snapshot error: %v", err)
		writeError(w, errors.ErrInternal("failed to restore snapshot").WithDetails(err.Error()))
		return
	}

	writeJSON(w, http.StatusOK, map[string]string{
		"message": "snapshot restored successfully",
		"name":    snapshotName,
	})
}

// Snapshot Policy Handlers
func (a *App) handleListSnapshotPolicies(w http.ResponseWriter, r *http.Request) {
	dataset := r.URL.Query().Get("dataset")
	var policies []models.SnapshotPolicy
	if dataset != "" {
		policies = a.snapshotPolicy.ListForDataset(dataset)
	} else {
		policies = a.snapshotPolicy.List()
	}
	// Ensure we always return an array, not null
	if policies == nil {
		policies = []models.SnapshotPolicy{}
	}
	writeJSON(w, http.StatusOK, policies)
}

func (a *App) handleCreateSnapshotPolicy(w http.ResponseWriter, r *http.Request) {
	var policy models.SnapshotPolicy

	if err := json.NewDecoder(r.Body).Decode(&policy); err != nil {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
		return
	}

	if policy.Dataset == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "dataset is required"})
		return
	}

	a.snapshotPolicy.Set(&policy)
	writeJSON(w, http.StatusCreated, policy)
}

func (a *App) handleGetSnapshotPolicy(w http.ResponseWriter, r *http.Request) {
	dataset := pathParam(r, "/api/v1/snapshot-policies/")
	if dataset == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "dataset name required"})
		return
	}

	policy, err := a.snapshotPolicy.Get(dataset)
	if err != nil {
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	if policy == nil {
		writeJSON(w, http.StatusNotFound, map[string]string{"error": "policy not found"})
		return
	}

	writeJSON(w, http.StatusOK, policy)
}

func (a *App) handleUpdateSnapshotPolicy(w http.ResponseWriter, r *http.Request) {
	dataset := pathParam(r, "/api/v1/snapshot-policies/")
	if dataset == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "dataset name required"})
		return
	}

	var policy models.SnapshotPolicy
	if err := json.NewDecoder(r.Body).Decode(&policy); err != nil {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
		return
	}

	// Ensure dataset matches URL parameter
	policy.Dataset = dataset

	a.snapshotPolicy.Set(&policy)
	writeJSON(w, http.StatusOK, policy)
}

func (a *App) handleDeleteSnapshotPolicy(w http.ResponseWriter, r *http.Request) {
	dataset := pathParam(r, "/api/v1/snapshot-policies/")
	if dataset == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "dataset name required"})
		return
	}

	if err := a.snapshotPolicy.Delete(dataset); err != nil {
		log.Printf("delete snapshot policy error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	writeJSON(w, http.StatusOK, map[string]string{"message": "policy deleted", "dataset": dataset})
}

// SMB Share Handlers
func (a *App) handleListSMBShares(w http.ResponseWriter, r *http.Request) {
	shares := a.smbStore.List()
	writeJSON(w, http.StatusOK, shares)
}

func (a *App) handleCreateSMBShare(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Name        string   `json:"name"`
		Path        string   `json:"path"`
		Dataset     string   `json:"dataset"`
		Description string   `json:"description"`
		ReadOnly    bool     `json:"read_only"`
		GuestOK     bool     `json:"guest_ok"`
		ValidUsers  []string `json:"valid_users"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
		return
	}

	// Validate share name
	if err := validation.ValidateShareName(req.Name); err != nil {
		writeError(w, errors.ErrValidation(err.Error()))
		return
	}

	// Validate dataset name
	if err := validation.ValidateZFSName(req.Dataset); err != nil {
		writeError(w, errors.ErrValidation(err.Error()))
		return
	}

	// Sanitize path if provided
	if req.Path != "" {
		req.Path = validation.SanitizePath(req.Path)
		if err := validation.ValidatePath(req.Path); err != nil {
			writeError(w, errors.ErrValidation(err.Error()))
			return
		}
	}

	// Validate dataset exists
	datasets, err := a.zfs.ListDatasets("")
	if err != nil {
		log.Printf("list datasets error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to validate dataset"})
		return
	}

	datasetExists := false
	for _, ds := range datasets {
		if ds.Name == req.Dataset {
			datasetExists = true
			if req.Path == "" {
				req.Path = ds.Mountpoint
			}
			break
		}
	}

	if !datasetExists {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "dataset not found"})
		return
	}

	share, err := a.smbStore.Create(req.Name, req.Path, req.Dataset, req.Description, req.ReadOnly, req.GuestOK, req.ValidUsers)
	if err != nil {
		if err == storage.ErrSMBShareExists {
			writeError(w, errors.ErrConflict("share name already exists"))
			return
		}
		log.Printf("create SMB share error: %v", err)
		writeError(w, errors.ErrInternal("failed to create SMB share").WithDetails(err.Error()))
		return
	}

	// Apply configuration to Samba service (with graceful degradation)
	shares := a.smbStore.List()
	if err := a.smbService.ApplyConfiguration(shares); err != nil {
		// Log but don't fail the request - desired state is stored
		// Service configuration can be retried later
		if svcErr := a.handleServiceError("SMB", err); svcErr != nil {
			log.Printf("SMB service configuration failed (non-fatal): %v", err)
		}
	}

	writeJSON(w, http.StatusCreated, share)
}

func (a *App) handleGetSMBShare(w http.ResponseWriter, r *http.Request) {
	id := pathParam(r, "/api/v1/shares/smb/")
	if id == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "share id required"})
		return
	}

	share, err := a.smbStore.Get(id)
	if err != nil {
		if err == storage.ErrSMBShareNotFound {
			writeJSON(w, http.StatusNotFound, map[string]string{"error": err.Error()})
			return
		}
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	writeJSON(w, http.StatusOK, share)
}

func (a *App) handleUpdateSMBShare(w http.ResponseWriter, r *http.Request) {
	id := pathParam(r, "/api/v1/shares/smb/")
	if id == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "share id required"})
		return
	}

	var req struct {
		Description string   `json:"description"`
		ReadOnly    bool     `json:"read_only"`
		GuestOK     bool     `json:"guest_ok"`
		ValidUsers  []string `json:"valid_users"`
		Enabled     bool     `json:"enabled"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
		return
	}

	if err := a.smbStore.Update(id, req.Description, req.ReadOnly, req.GuestOK, req.Enabled, req.ValidUsers); err != nil {
		if err == storage.ErrSMBShareNotFound {
			writeJSON(w, http.StatusNotFound, map[string]string{"error": err.Error()})
			return
		}
		log.Printf("update SMB share error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	share, _ := a.smbStore.Get(id)

	// Apply configuration to Samba service
	shares := a.smbStore.List()
	if err := a.smbService.ApplyConfiguration(shares); err != nil {
		log.Printf("apply SMB configuration error: %v", err)
	}

	writeJSON(w, http.StatusOK, share)
}

func (a *App) handleDeleteSMBShare(w http.ResponseWriter, r *http.Request) {
	id := pathParam(r, "/api/v1/shares/smb/")
	if id == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "share id required"})
		return
	}

	if err := a.smbStore.Delete(id); err != nil {
		if err == storage.ErrSMBShareNotFound {
			writeJSON(w, http.StatusNotFound, map[string]string{"error": err.Error()})
			return
		}
		log.Printf("delete SMB share error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	writeJSON(w, http.StatusOK, map[string]string{"message": "share deleted", "id": id})
}

// NFS Export Handlers
func (a *App) handleListNFSExports(w http.ResponseWriter, r *http.Request) {
	// Sync exports from OS (ZFS sharenfs) to store
	// This ensures exports created before service restart are visible
	if err := a.syncNFSExportsFromOS(); err != nil {
		log.Printf("warning: failed to sync NFS exports from OS: %v", err)
		// Continue anyway - return what's in store
	}

	exports := a.nfsStore.List()
	writeJSON(w, http.StatusOK, exports)
}

func (a *App) handleCreateNFSExport(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Path       string   `json:"path"`
		Dataset    string   `json:"dataset"`
		Clients    []string `json:"clients"`
		ReadOnly   bool     `json:"read_only"`
		RootSquash bool     `json:"root_squash"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeError(w, errors.ErrValidation("invalid request body"))
		return
	}

	// Validate clients first
	for i, client := range req.Clients {
		if err := validation.ValidateCIDR(client); err != nil {
			writeError(w, errors.ErrValidation(fmt.Sprintf("client[%d]: %s", i, err.Error())))
			return
		}
	}

	// Validate and sanitize path if provided
	if req.Path != "" {
		req.Path = validation.SanitizePath(req.Path)
		if err := validation.ValidatePath(req.Path); err != nil {
			writeError(w, errors.ErrValidation(err.Error()))
			return
		}
	}

	// Get all datasets to validate and find dataset
	datasets, err := a.zfs.ListDatasets("")
	if err != nil {
		log.Printf("list datasets error: %v", err)
		writeError(w, errors.ErrInternal("failed to validate dataset").WithDetails(err.Error()))
		return
	}

	// Check if req.Dataset is a filesystem path (starts with /) or a dataset name
	var datasetName string
	var datasetMountpoint string
	datasetExists := false

	if strings.HasPrefix(req.Dataset, "/") {
		// Input is a filesystem path (mountpoint), find dataset by mountpoint
		for _, ds := range datasets {
			if ds.Mountpoint == req.Dataset {
				datasetExists = true
				datasetName = ds.Name
				datasetMountpoint = ds.Mountpoint
				break
			}
		}
		if !datasetExists {
			writeError(w, errors.ErrNotFound(fmt.Sprintf("dataset with mountpoint '%s' not found", req.Dataset)))
			return
		}
	} else {
		// Input is a dataset name, validate it first
		if err := validation.ValidateZFSName(req.Dataset); err != nil {
			writeError(w, errors.ErrValidation(err.Error()))
			return
		}
		// Find dataset by name
		for _, ds := range datasets {
			if ds.Name == req.Dataset {
				datasetExists = true
				datasetName = ds.Name
				datasetMountpoint = ds.Mountpoint
				break
			}
		}
		if !datasetExists {
			writeError(w, errors.ErrNotFound(fmt.Sprintf("dataset '%s' not found", req.Dataset)))
			return
		}
	}

	// Set the correct dataset name and path
	req.Dataset = datasetName
	if req.Path == "" {
		req.Path = datasetMountpoint
	}

	// Default clients to "*" (all) if not specified
	if len(req.Clients) == 0 {
		req.Clients = []string{"*"}
	}

	export, err := a.nfsStore.Create(req.Path, req.Dataset, req.Clients, req.ReadOnly, req.RootSquash)
	if err != nil {
		if err == storage.ErrNFSExportExists {
			writeError(w, errors.ErrConflict(fmt.Sprintf("export for path '%s' already exists", req.Path)))
			return
		}
		log.Printf("create NFS export error: %v", err)
		writeError(w, errors.ErrInternal("failed to create NFS export").WithDetails(err.Error()))
		return
	}

	// Apply configuration to NFS service
	exports := a.nfsStore.List()
	if err := a.nfsService.ApplyConfiguration(exports); err != nil {
		log.Printf("apply NFS configuration error: %v", err)
		// Export was created in store but failed to apply to system
		// Try to remove from store to maintain consistency
		if delErr := a.nfsStore.Delete(export.ID); delErr != nil {
			log.Printf("warning: failed to rollback export creation after ApplyConfiguration failure: %v", delErr)
		}
		writeError(w, errors.ErrInternal("failed to apply NFS configuration").WithDetails(fmt.Sprintf("Export was created but failed to apply to NFS service: %v", err)))
		return
	}

	// Double-check export exists
	if _, getErr := a.nfsStore.Get(export.ID); getErr != nil {
		log.Printf("warning: export %s was created but not found in store: %v", export.ID, getErr)
		writeError(w, errors.ErrInternal("failed to verify export creation").WithDetails("Export may not have been created properly"))
		return
	}

	writeJSON(w, http.StatusCreated, export)
}

func (a *App) handleGetNFSExport(w http.ResponseWriter, r *http.Request) {
	id := pathParam(r, "/api/v1/exports/nfs/")
	if id == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "export id required"})
		return
	}

	export, err := a.nfsStore.Get(id)
	if err != nil {
		if err == storage.ErrNFSExportNotFound {
			writeJSON(w, http.StatusNotFound, map[string]string{"error": err.Error()})
			return
		}
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	writeJSON(w, http.StatusOK, export)
}

func (a *App) handleUpdateNFSExport(w http.ResponseWriter, r *http.Request) {
	id := pathParam(r, "/api/v1/exports/nfs/")
	if id == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "export id required"})
		return
	}

	var req struct {
		Clients    []string `json:"clients"`
		ReadOnly   bool     `json:"read_only"`
		RootSquash bool     `json:"root_squash"`
		Enabled    bool     `json:"enabled"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
		return
	}

	if err := a.nfsStore.Update(id, req.Clients, req.ReadOnly, req.RootSquash, req.Enabled); err != nil {
		if err == storage.ErrNFSExportNotFound {
			writeJSON(w, http.StatusNotFound, map[string]string{"error": err.Error()})
			return
		}
		log.Printf("update NFS export error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	export, _ := a.nfsStore.Get(id)

	// Apply configuration to NFS service
	exports := a.nfsStore.List()
	if err := a.nfsService.ApplyConfiguration(exports); err != nil {
		log.Printf("apply NFS configuration error: %v", err)
	}

	writeJSON(w, http.StatusOK, export)
}

func (a *App) handleDeleteNFSExport(w http.ResponseWriter, r *http.Request) {
	id := pathParam(r, "/api/v1/exports/nfs/")
	if id == "" {
		writeError(w, errors.ErrValidation("export id required"))
		return
	}

	if err := a.nfsStore.Delete(id); err != nil {
		if err == storage.ErrNFSExportNotFound {
			writeError(w, errors.ErrNotFound(fmt.Sprintf("NFS export '%s' not found", id)))
			return
		}
		log.Printf("delete NFS export error: %v", err)
		writeError(w, errors.ErrInternal("failed to delete NFS export").WithDetails(err.Error()))
		return
	}

	// Apply configuration to NFS service
	exports := a.nfsStore.List()
	if err := a.nfsService.ApplyConfiguration(exports); err != nil {
		log.Printf("apply NFS configuration error: %v", err)
		// Export was deleted from store but failed to apply to system
		// Log warning but don't fail the request since deletion succeeded
		log.Printf("warning: NFS export '%s' was deleted from store but failed to apply configuration: %v", id, err)
	}

	writeJSON(w, http.StatusOK, map[string]string{"message": "export deleted", "id": id})
}

// iSCSI Handlers
func (a *App) handleListISCSITargets(w http.ResponseWriter, r *http.Request) {
	targets := a.iscsiStore.List()
	writeJSON(w, http.StatusOK, targets)
}

func (a *App) handleCreateISCSITarget(w http.ResponseWriter, r *http.Request) {
	var req struct {
		IQN        string   `json:"iqn"`
		Initiators []string `json:"initiators"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
		return
	}

	// Validate IQN format
	if err := validation.ValidateIQN(req.IQN); err != nil {
		writeError(w, errors.ErrValidation(err.Error()))
		return
	}

	target, err := a.iscsiStore.Create(req.IQN, req.Initiators)
	if err != nil {
		if err == storage.ErrISCSITargetExists {
			writeJSON(w, http.StatusConflict, map[string]string{"error": "target with this IQN already exists"})
			return
		}
		log.Printf("create iSCSI target error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	// Apply configuration to iSCSI service
	targets := a.iscsiStore.List()
	if err := a.iscsiService.ApplyConfiguration(targets); err != nil {
		log.Printf("apply iSCSI configuration error: %v", err)
	}

	writeJSON(w, http.StatusCreated, target)
}

func (a *App) handleGetISCSITarget(w http.ResponseWriter, r *http.Request) {
	id := pathParam(r, "/api/v1/iscsi/targets/")
	if id == "" {
		writeError(w, errors.ErrBadRequest("target id required"))
		return
	}

	target, err := a.iscsiStore.Get(id)
	if err != nil {
		if err == storage.ErrISCSITargetNotFound {
			writeError(w, errors.ErrNotFound("iSCSI target"))
			return
		}
		writeError(w, errors.ErrInternal("failed to get iSCSI target").WithDetails(err.Error()))
		return
	}

	writeJSON(w, http.StatusOK, target)
}

func (a *App) handleGetISCSIConnectionInstructions(w http.ResponseWriter, r *http.Request) {
	id := pathParam(r, "/api/v1/iscsi/targets/")
	if id == "" {
		writeError(w, errors.ErrBadRequest("target id required"))
		return
	}

	target, err := a.iscsiStore.Get(id)
	if err != nil {
		if err == storage.ErrISCSITargetNotFound {
			writeError(w, errors.ErrNotFound("iSCSI target"))
			return
		}
		writeError(w, errors.ErrInternal("failed to get iSCSI target").WithDetails(err.Error()))
		return
	}

	// Get portal IP (with fallback)
	portalIP, err := a.iscsiService.GetPortalIP()
	if err != nil {
		log.Printf("get portal IP error: %v", err)
		portalIP = "127.0.0.1" // Fallback
	}

	// Get portal port from query parameter or use default
	portalPort := 3260
	if portStr := r.URL.Query().Get("port"); portStr != "" {
		if port, err := strconv.Atoi(portStr); err == nil && port > 0 && port < 65536 {
			portalPort = port
		}
	}

	// Generate connection instructions
	instructions := a.iscsiService.GetConnectionInstructions(*target, portalIP, portalPort)

	writeJSON(w, http.StatusOK, instructions)
}

func (a *App) handleUpdateISCSITarget(w http.ResponseWriter, r *http.Request) {
	id := pathParam(r, "/api/v1/iscsi/targets/")
	if id == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "target id required"})
		return
	}

	var req struct {
		Initiators []string `json:"initiators"`
		Enabled    bool     `json:"enabled"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
		return
	}

	if err := a.iscsiStore.Update(id, req.Initiators, req.Enabled); err != nil {
		if err == storage.ErrISCSITargetNotFound {
			writeJSON(w, http.StatusNotFound, map[string]string{"error": err.Error()})
			return
		}
		log.Printf("update iSCSI target error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	target, _ := a.iscsiStore.Get(id)

	// Apply configuration to iSCSI service
	targets := a.iscsiStore.List()
	if err := a.iscsiService.ApplyConfiguration(targets); err != nil {
		log.Printf("apply iSCSI configuration error: %v", err)
	}

	writeJSON(w, http.StatusOK, target)
}

func (a *App) handleDeleteISCSITarget(w http.ResponseWriter, r *http.Request) {
	id := pathParam(r, "/api/v1/iscsi/targets/")
	if id == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "target id required"})
		return
	}

	if err := a.iscsiStore.Delete(id); err != nil {
		if err == storage.ErrISCSITargetNotFound {
			writeJSON(w, http.StatusNotFound, map[string]string{"error": err.Error()})
			return
		}
		log.Printf("delete iSCSI target error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	// Apply configuration to iSCSI service
	targets := a.iscsiStore.List()
	if err := a.iscsiService.ApplyConfiguration(targets); err != nil {
		log.Printf("apply iSCSI configuration error: %v", err)
	}

	writeJSON(w, http.StatusOK, map[string]string{"message": "target deleted", "id": id})
}

func (a *App) handleAddLUN(w http.ResponseWriter, r *http.Request) {
	// Extract target ID from path like /api/v1/iscsi/targets/{id}/luns
	path := strings.TrimPrefix(r.URL.Path, "/api/v1/iscsi/targets/")
	parts := strings.Split(path, "/")
	if len(parts) == 0 || parts[0] == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "target id required"})
		return
	}
	id := parts[0]

	var req struct {
		ZVOL string `json:"zvol"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
		return
	}

	if req.ZVOL == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "zvol is required"})
		return
	}

	// Validate ZVOL exists
	zvols, err := a.zfs.ListZVOLs("")
	if err != nil {
		log.Printf("list zvols error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to validate zvol"})
		return
	}

	var zvolSize uint64
	zvolExists := false
	for _, zvol := range zvols {
		if zvol.Name == req.ZVOL {
			zvolExists = true
			zvolSize = zvol.Size
			break
		}
	}

	if !zvolExists {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "zvol not found"})
		return
	}

	lun, err := a.iscsiStore.AddLUN(id, req.ZVOL, zvolSize)
	if err != nil {
		if err == storage.ErrISCSITargetNotFound {
			writeJSON(w, http.StatusNotFound, map[string]string{"error": "target not found"})
			return
		}
		if err == storage.ErrLUNExists {
			writeJSON(w, http.StatusConflict, map[string]string{"error": "zvol already mapped to this target"})
			return
		}
		log.Printf("add LUN error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	// Apply configuration to iSCSI service
	targets := a.iscsiStore.List()
	if err := a.iscsiService.ApplyConfiguration(targets); err != nil {
		log.Printf("apply iSCSI configuration error: %v", err)
	}

	writeJSON(w, http.StatusCreated, lun)
}

func (a *App) handleRemoveLUN(w http.ResponseWriter, r *http.Request) {
	// Extract target ID from path like /api/v1/iscsi/targets/{id}/luns/remove
	path := strings.TrimPrefix(r.URL.Path, "/api/v1/iscsi/targets/")
	parts := strings.Split(path, "/")
	if len(parts) == 0 || parts[0] == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "target id required"})
		return
	}
	id := parts[0]

	var req struct {
		LUNID int `json:"lun_id"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
		return
	}

	if err := a.iscsiStore.RemoveLUN(id, req.LUNID); err != nil {
		if err == storage.ErrISCSITargetNotFound {
			writeJSON(w, http.StatusNotFound, map[string]string{"error": "target not found"})
			return
		}
		if err == storage.ErrLUNNotFound {
			writeJSON(w, http.StatusNotFound, map[string]string{"error": "LUN not found"})
			return
		}
		log.Printf("remove LUN error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	// Apply configuration to iSCSI service
	targets := a.iscsiStore.List()
	if err := a.iscsiService.ApplyConfiguration(targets); err != nil {
		log.Printf("apply iSCSI configuration error: %v", err)
	}

	writeJSON(w, http.StatusOK, map[string]string{"message": "LUN removed", "target_id": id, "lun_id": strconv.Itoa(req.LUNID)})
}

// Job Handlers
func (a *App) handleListJobs(w http.ResponseWriter, r *http.Request) {
	status := models.JobStatus(r.URL.Query().Get("status"))
	jobs := a.jobManager.List(status)
	writeJSON(w, http.StatusOK, jobs)
}

func (a *App) handleGetJob(w http.ResponseWriter, r *http.Request) {
	id := pathParam(r, "/api/v1/jobs/")
	if id == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "job id required"})
		return
	}

	job, err := a.jobManager.Get(id)
	if err != nil {
		writeJSON(w, http.StatusNotFound, map[string]string{"error": err.Error()})
		return
	}

	writeJSON(w, http.StatusOK, job)
}

func (a *App) handleCancelJob(w http.ResponseWriter, r *http.Request) {
	id := pathParam(r, "/api/v1/jobs/")
	if id == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "job id required"})
		return
	}

	if err := a.jobManager.Cancel(id); err != nil {
		log.Printf("cancel job error: %v", err)
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
		return
	}

	writeJSON(w, http.StatusOK, map[string]string{"message": "job cancelled", "id": id})
}

// Auth Handlers
func (a *App) handleLogin(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Username string `json:"username"`
		Password string `json:"password"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
		return
	}

	// Validate username (login is less strict - just check not empty)
	if req.Username == "" {
		writeError(w, errors.ErrValidation("username is required"))
		return
	}

	if req.Password == "" {
		writeError(w, errors.ErrValidation("password is required"))
		return
	}

	user, err := a.userStore.Authenticate(req.Username, req.Password)
	if err != nil {
		writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "invalid credentials"})
		return
	}

	token, err := a.authService.GenerateToken(user.ID, string(user.Role))
	if err != nil {
		log.Printf("generate token error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to generate token"})
		return
	}

	writeJSON(w, http.StatusOK, map[string]interface{}{
		"token":      token,
		"user":       user,
		"expires_in": 86400, // 24 hours in seconds
	})
}

func (a *App) handleLogout(w http.ResponseWriter, r *http.Request) {
	// JWT is stateless, so logout is just client-side token removal
	// In a stateful system, you'd invalidate the token here
	writeJSON(w, http.StatusOK, map[string]string{"message": "logged out"})
}

// User Handlers
func (a *App) handleListUsers(w http.ResponseWriter, r *http.Request) {
	// Only administrators can list users
	users := a.userStore.List()
	writeJSON(w, http.StatusOK, users)
}

func (a *App) handleCreateUser(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Username string      `json:"username"`
		Email    string      `json:"email"`
		Password string      `json:"password"`
		Role     models.Role `json:"role"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
		return
	}

	// Validate username
	if err := validation.ValidateUsername(req.Username); err != nil {
		writeError(w, errors.ErrValidation(err.Error()))
		return
	}

	// Validate password
	if err := validation.ValidatePassword(req.Password); err != nil {
		writeError(w, errors.ErrValidation(err.Error()))
		return
	}

	// Validate email if provided
	if req.Email != "" {
		if err := validation.ValidateEmail(req.Email); err != nil {
			writeError(w, errors.ErrValidation(err.Error()))
			return
		}
	}

	if req.Role == "" {
		req.Role = models.RoleViewer // Default role
	}

	// Normalize role to lowercase for comparison
	roleStr := strings.ToLower(string(req.Role))
	req.Role = models.Role(roleStr)

	// Validate role
	if req.Role != models.RoleAdministrator && req.Role != models.RoleOperator && req.Role != models.RoleViewer {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid role"})
		return
	}

	user, err := a.userStore.Create(req.Username, req.Email, req.Password, req.Role)
	if err != nil {
		if err == auth.ErrUserExists {
			writeJSON(w, http.StatusConflict, map[string]string{"error": "username already exists"})
			return
		}
		log.Printf("create user error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	writeJSON(w, http.StatusCreated, user)
}

func (a *App) handleGetUser(w http.ResponseWriter, r *http.Request) {
	id := pathParam(r, "/api/v1/users/")
	if id == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "user id required"})
		return
	}

	user, err := a.userStore.GetByID(id)
	if err != nil {
		writeJSON(w, http.StatusNotFound, map[string]string{"error": err.Error()})
		return
	}

	writeJSON(w, http.StatusOK, user)
}

func (a *App) handleUpdateUser(w http.ResponseWriter, r *http.Request) {
	id := pathParam(r, "/api/v1/users/")
	if id == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "user id required"})
		return
	}

	var req struct {
		Email  string      `json:"email"`
		Role   models.Role `json:"role"`
		Active bool        `json:"active"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
		return
	}

	// Normalize role to lowercase if provided
	if req.Role != "" {
		roleStr := strings.ToLower(string(req.Role))
		req.Role = models.Role(roleStr)
	}

	// Validate role if provided
	if req.Role != "" && req.Role != models.RoleAdministrator && req.Role != models.RoleOperator && req.Role != models.RoleViewer {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid role"})
		return
	}

	// Use existing role if not provided
	if req.Role == "" {
		existingUser, err := a.userStore.GetByID(id)
		if err != nil {
			writeJSON(w, http.StatusNotFound, map[string]string{"error": err.Error()})
			return
		}
		req.Role = existingUser.Role
	}

	if err := a.userStore.Update(id, req.Email, req.Role, req.Active); err != nil {
		log.Printf("update user error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	user, _ := a.userStore.GetByID(id)
	writeJSON(w, http.StatusOK, user)
}

func (a *App) handleDeleteUser(w http.ResponseWriter, r *http.Request) {
	id := pathParam(r, "/api/v1/users/")
	if id == "" {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "user id required"})
		return
	}

	// Prevent deleting yourself
	currentUser, ok := getUserFromContext(r)
	if ok && currentUser.ID == id {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "cannot delete your own account"})
		return
	}

	if err := a.userStore.Delete(id); err != nil {
		log.Printf("delete user error: %v", err)
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	writeJSON(w, http.StatusOK, map[string]string{"message": "user deleted", "id": id})
}

// Audit Log Handlers
func (a *App) handleListAuditLogs(w http.ResponseWriter, r *http.Request) {
	// Get query parameters
	actor := r.URL.Query().Get("actor")
	action := r.URL.Query().Get("action")
	resource := r.URL.Query().Get("resource")
	limitStr := r.URL.Query().Get("limit")

	limit := 0
	if limitStr != "" {
		if l, err := strconv.Atoi(limitStr); err == nil && l > 0 {
			limit = l
		}
	}

	// Default limit to 100 if not specified
	if limit == 0 {
		limit = 100
	}

	logs := a.auditStore.List(actor, action, resource, limit)
	writeJSON(w, http.StatusOK, logs)
}

// syncNFSExportsFromOS syncs NFS exports from ZFS sharenfs properties to the store
func (a *App) syncNFSExportsFromOS() error {
	// Get all datasets
	datasets, err := a.zfs.ListDatasets("")
	if err != nil {
		return fmt.Errorf("list datasets: %w", err)
	}

	// Find datasets with sharenfs property set
	for _, ds := range datasets {
		// Get sharenfs property
		zfsPath := "zfs"
		if path, err := exec.LookPath("zfs"); err == nil {
			zfsPath = path
		}

		cmd := exec.Command("sudo", "-n", zfsPath, "get", "-H", "-o", "value", "sharenfs", ds.Name)
		output, err := cmd.Output()
		if err != nil {
			continue // Skip if can't get property
		}

		sharenfsValue := strings.TrimSpace(string(output))
		if sharenfsValue == "off" || sharenfsValue == "-" || sharenfsValue == "" {
			continue // Not shared
		}

		// Check if export already exists in store
		existingExports := a.nfsStore.List()
		exists := false
		for _, exp := range existingExports {
			if exp.Dataset == ds.Name || exp.Path == ds.Mountpoint {
				exists = true
				break
			}
		}

		if exists {
			continue // Already in store
		}

		// Parse sharenfs value to extract configuration
		// Format examples:
		// - "rw=*,no_root_squash"
		// - "ro=*,root_squash"
		// - "rw=10.0.0.0/8,ro=192.168.1.0/24,root_squash"
		readOnly := false
		rootSquash := true       // Default
		clients := []string{"*"} // Default to all

		// Parse sharenfs value
		parts := strings.Split(sharenfsValue, ",")
		clientSpecs := []string{}
		for _, part := range parts {
			part = strings.TrimSpace(part)
			if part == "root_squash" {
				rootSquash = true
			} else if part == "no_root_squash" {
				rootSquash = false
			} else if strings.HasPrefix(part, "ro=") {
				client := strings.TrimPrefix(part, "ro=")
				if client == "*" {
					readOnly = true
					clients = []string{"*"}
				} else {
					clientSpecs = append(clientSpecs, client)
					readOnly = true // At least one client is read-only
				}
			} else if strings.HasPrefix(part, "rw=") {
				client := strings.TrimPrefix(part, "rw=")
				if client == "*" {
					readOnly = false
					clients = []string{"*"}
				} else {
					clientSpecs = append(clientSpecs, client)
				}
			} else if part == "ro" {
				readOnly = true
				clients = []string{"*"}
			} else if part == "rw" {
				readOnly = false
				clients = []string{"*"}
			}
		}

		// If we found specific clients, use them
		if len(clientSpecs) > 0 {
			clients = clientSpecs
		}

		// Use mountpoint as path, or default path
		path := ds.Mountpoint
		if path == "" || path == "none" {
			// Generate default path
			parts := strings.Split(ds.Name, "/")
			datasetName := parts[len(parts)-1]
			path = "/storage/datasets/" + datasetName
		}

		// Create export in store (ignore error if already exists)
		_, err = a.nfsStore.Create(path, ds.Name, clients, readOnly, rootSquash)
		if err != nil && err != storage.ErrNFSExportExists {
			log.Printf("warning: failed to sync export for dataset %s: %v", ds.Name, err)
		}
	}

	return nil
}