main.py

"""
OpenSentry Command – Discovery
"""
from __future__ import annotations

import os
import json
import time
import socket
import threading
import ipaddress
import subprocess
import base64
import hashlib
import hmac
import secrets
from typing import Any, Dict, List, Optional, Set

from flask import Flask, Response, jsonify, render_template, request, session, redirect, url_for

# Reuse discovery helpers from discover.py
from discover import DEFAULT_SERVICE, browse, to_result, fetch_status
 
from probe import (
    DEFAULT_PROBE_PORT,
    DEFAULT_TCP_TIMEOUT,
    DEFAULT_HTTP_TIMEOUT,
    DEFAULT_CONCURRENCY,
    detect_local_networks,
    iter_hosts,
    port_open,
    verify_opensentry,
    scan_ips,
)

app = Flask(__name__)
app.secret_key = os.environ.get("SECRET_KEY", "dev-secret-change-me")
# Configure session to work properly with OAuth redirects
app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
app.config['SESSION_COOKIE_HTTPONLY'] = True
app.config['SESSION_COOKIE_SECURE'] = False  # Set to True in production with HTTPS
app.config['PERMANENT_SESSION_LIFETIME'] = 3600  # 1 hour

@app.get('/favicon.ico')
def favicon():
    # Silence browser favicon requests; keep UI minimal
    return ('', 204)

@app.before_request
def require_login():
    # Allow login/logout, favicon, and static assets without auth
    path = request.path or "/"
    if path in ("/login", "/logout", "/favicon.ico", "/oauth2/login", "/oauth2/callback", "/oauth2/fallback", "/health") or path.startswith("/static/"):
        return None
    # If not logged in, protect all endpoints
    if not session.get("user"):
        cfg = _load_config()
        # If OAuth2 mode, redirect to OAuth2 login instead of local
        if cfg.get("auth_mode") == "oauth2" and not path.startswith("/api/"):
            # preserve next
            session['next'] = request.full_path if request.query_string else request.path
            # If user opted into temporary local-login fallback, route to local login
            if session.get("oauth2_fallback"):
                return redirect(url_for("login_page", next=session.get('next'), fallback=1))
            return redirect(url_for("oauth2_login"))
        # APIs return JSON 401 instead of a redirect
        if path.startswith("/api/"):
            return jsonify({"error": "unauthorized"}), 401
        # Otherwise redirect to login, preserving next
        nxt = request.full_path if request.query_string else request.path
        return redirect(url_for("login_page", next=nxt))

@app.route('/login', methods=['GET', 'POST'])
def login_page():
    # If OAuth2 mode is active, redirect to OAuth2 login
    cfg = _load_config()
    allow_fallback = bool(request.args.get('fallback')) or bool(session.get('oauth2_fallback'))
    # If user explicitly requested fallback, enable it for this session
    if request.method == 'GET' and request.args.get('fallback'):
        session['oauth2_fallback'] = True
    if cfg.get("auth_mode") == "oauth2" and not allow_fallback:
        return redirect(url_for("oauth2_login"))
    error = None
    if request.method == 'POST':
        username = (request.form.get('username') or '').strip()
        password = (request.form.get('password') or '').strip()
        if username == 'admin' and password == 'admin':
            session['user'] = 'admin'
            dest = request.args.get('next') or url_for('index')
            return redirect(dest)
        error = 'Invalid credentials'
    return render_template('login.html', error=error)

@app.get('/logout')
def logout_page():
    session.clear()
    return redirect(url_for('login_page'))

@app.get('/oauth2/fallback')
def oauth2_fallback():
    """Enable a one-time local-login fallback for this session and redirect to login."""
    session['oauth2_fallback'] = True
    dest = request.args.get('next') or session.get('next') or url_for('index')
    return redirect(url_for('login_page', next=dest, fallback=1))

@app.get('/health')
def health():
    return Response("ok", mimetype="text/plain")

# ---------- OAuth2 login flow ----------
@app.get('/oauth2/login')
def oauth2_login():
    cfg = _load_config()
    if cfg.get('auth_mode') != 'oauth2':
        return redirect(url_for('login_page'))
    ok, info = _probe_oauth2(cfg.get('oauth2_base_url') or '')
    if not ok:
        nxt = session.get('next') or request.args.get('next') or url_for('index')
        return render_template('oauth2_down.html', base_url=(cfg.get('oauth2_base_url') or ''), error=info, next=nxt), 503
    meta = info
    client_id = (cfg.get('oauth2_client_id') or '').strip()
    if not client_id:
        return ("Missing oauth2_client_id in settings", 400)
    scope = (cfg.get('oauth2_scope') or 'openid').strip()
    import urllib.parse
    # Make session permanent to survive OAuth redirects
    session.permanent = True
    # Generate PKCE values
    code_verifier, code_challenge = _gen_pkce()
    # Embed code_verifier in the signed state so we can retrieve it even if session is lost
    state = _make_state(extra={'v': code_verifier})
    session['oauth2_state'] = state
    session['code_verifier'] = code_verifier
    redirect_uri = urllib.parse.urljoin(request.host_url, 'oauth2/callback')
    auth_url = meta.get('authorization_endpoint')
    params = {
        'response_type': 'code',
        'client_id': client_id,
        'redirect_uri': redirect_uri,
        'scope': scope,
        'state': state,
        'code_challenge_method': 'S256',
        'code_challenge': code_challenge,
    }
    try:
        print(f"OAuth2 login: state={state[:16]}..., redirect_uri={redirect_uri}, code_verifier={code_verifier[:16]}...")
    except Exception:
        pass
    return redirect(auth_url + '?' + urllib.parse.urlencode(params))

@app.get('/oauth2/callback')
def oauth2_callback():
    cfg = _load_config()
    if cfg.get('auth_mode') != 'oauth2':
        return redirect(url_for('login_page'))
    import urllib.parse, requests
    state = request.args.get('state')
    code = request.args.get('code')
    expected = session.get('oauth2_state')
    code_verifier_in_session = session.get('code_verifier')

    # Debug logging
    try:
        cookie_present = bool(request.cookies.get(app.session_cookie_name))
        state_verified = _verify_state(state) if state else None
        print(f"OAuth2 callback: got_state={(state or '')[:16]}..., expected={(expected or '')[:16]}..., cookie_present={cookie_present}, code_verifier_present={bool(code_verifier_in_session)}, state_verified={bool(state_verified)}")
    except Exception as e:
        print(f"OAuth2 callback debug error: {e}")

    valid_state = (expected and state == expected) or (state and _verify_state(state) is not None)
    if not code or not state or not valid_state:
        print(f"OAuth2 callback validation failed: code={bool(code)}, state={bool(state)}, valid_state={valid_state}")
        return ("Invalid OAuth2 callback", 400)
    ok, info = _probe_oauth2(cfg.get('oauth2_base_url') or '')
    if not ok:
        nxt = session.get('next') or url_for('index')
        return render_template('oauth2_down.html', base_url=(cfg.get('oauth2_base_url') or ''), error=info, next=nxt), 503
    # Retrieve code_verifier from session for PKCE, or extract from verified state
    code_verifier = session.get('code_verifier')
    if not code_verifier:
        # Session was lost; try to recover code_verifier from the signed state
        state_data = _verify_state(state)
        if state_data and 'v' in state_data:
            code_verifier = state_data['v']
            print(f"OAuth2 callback: recovered code_verifier from state")
        else:
            return ("Missing PKCE verifier in session. Please try logging in again.", 400)

    meta = info
    token_url = meta.get('token_endpoint')
    redirect_uri = urllib.parse.urljoin(request.host_url, 'oauth2/callback')
    data = {
        'grant_type': 'authorization_code',
        'code': code,
        'redirect_uri': redirect_uri,
        'client_id': cfg.get('oauth2_client_id') or '',
        'code_verifier': code_verifier,
    }
    # If a client secret is configured (confidential client), send it via POST (client_secret_post)
    cs = (cfg.get('oauth2_client_secret') or '').strip()
    if cs:
        data['client_secret'] = cs

    # Debug logging
    print(f"Token exchange: url={token_url}, client_id={data.get('client_id')}, redirect_uri={redirect_uri}, code={code[:20]}..., verifier={code_verifier[:20]}..., has_secret={bool(cs)}")

    try:
        r = requests.post(token_url, data=data, timeout=5)
        if r.status_code != 200:
            print(f"Token exchange failed: {r.status_code}, response={r.text[:200]}")
            return (f"Token exchange failed: {r.status_code}", 502)
        tok = r.json()
    except Exception as e:
        print(f"Token exchange exception: {e}")
        return (f"Token exchange error: {e}", 502)
    # Minimal session establishment; in a full impl we would validate id_token
    session.pop('oauth2_state', None)
    session.pop('code_verifier', None)
    session['user'] = 'oauth2'
    session['oauth2_tokens'] = {k: tok.get(k) for k in ('access_token','refresh_token','id_token','expires_in','token_type')}
    dest = session.pop('next', None) or url_for('index')
    return redirect(dest)

# Persisted pinned devices store
DEVICES_STORE_PATH = os.path.join(os.path.dirname(__file__), "devices_store.json")
_devices_lock = threading.Lock()

# Persisted config store
CONFIG_STORE_PATH = os.path.join(os.path.dirname(__file__), "config_store.json")
_config_lock = threading.Lock()


def _load_devices() -> List[Dict[str, Any]]:
    if not os.path.exists(DEVICES_STORE_PATH):
        return []
    try:
        with open(DEVICES_STORE_PATH, "r", encoding="utf-8") as f:
            data = json.load(f)
        if isinstance(data, list):
            return data
    except Exception:
        pass
    return []


def _save_devices(devs: List[Dict[str, Any]]) -> None:
    tmp = DEVICES_STORE_PATH + ".tmp"
    with open(tmp, "w", encoding="utf-8") as f:
        json.dump(devs, f, indent=2)
    os.replace(tmp, DEVICES_STORE_PATH)


# ---------- Settings config ----------
def _default_config() -> Dict[str, Any]:
    return {
        "auth_mode": "local",  # 'local' or 'oauth2'
        "oauth2_base_url": "",
        "oauth2_client_id": "",
        "oauth2_client_secret": "",
        "oauth2_scope": "openid profile email offline_access",
    }


def _load_config() -> Dict[str, Any]:
    cfg = _default_config()
    if not os.path.exists(CONFIG_STORE_PATH):
        return cfg
    try:
        with open(CONFIG_STORE_PATH, "r", encoding="utf-8") as f:
            data = json.load(f)
        if isinstance(data, dict):
            cfg.update({k: v for k, v in data.items() if k in cfg})
    except Exception:
        pass
    return cfg


def _save_config(cfg: Dict[str, Any]) -> None:
    tmp = CONFIG_STORE_PATH + ".tmp"
    with open(tmp, "w", encoding="utf-8") as f:
        json.dump(cfg, f, indent=2)
    os.replace(tmp, CONFIG_STORE_PATH)


# Track last-seen timestamps (epoch seconds) for discovered devices
LAST_SEEN: Dict[str, float] = {}

# Local host IPs to exclude from discovery lists
LOCAL_IPS: Set[str] = set()

# The port this app is listening on (set in main()) so we can avoid listing ourselves
APP_PORT: Optional[int] = None


# ---------- OAuth2 helpers ----------
def _gen_pkce() -> tuple[str, str]:
    """Generate PKCE code_verifier and code_challenge for OAuth2 flow."""
    verifier = base64.urlsafe_b64encode(os.urandom(40)).decode().rstrip("=")
    challenge = base64.urlsafe_b64encode(
        hashlib.sha256(verifier.encode()).digest()
    ).decode().rstrip("=")
    return verifier, challenge

def _b64url(b: bytes) -> str:
    return base64.urlsafe_b64encode(b).decode().rstrip('=')

def _b64urldecode(s: str) -> bytes:
    pad = '=' * (-len(s) % 4)
    return base64.urlsafe_b64decode(s + pad)

def _make_state(extra: Optional[Dict[str, Any]] = None) -> str:
    payload: Dict[str, Any] = {"t": int(time.time()), "n": secrets.token_urlsafe(16)}
    if extra:
        payload.update(extra)
    raw = json.dumps(payload, separators=(',', ':'), sort_keys=True).encode()
    key = app.secret_key.encode() if isinstance(app.secret_key, str) else app.secret_key
    sig = hmac.new(key, raw, hashlib.sha256).digest()
    return f"{_b64url(raw)}.{_b64url(sig)}"

def _verify_state(state: str, max_age_sec: int = 600) -> Optional[Dict[str, Any]]:
    try:
        raw_b64, sig_b64 = state.split('.', 1)
        raw = _b64urldecode(raw_b64)
        sig = _b64urldecode(sig_b64)
        key = app.secret_key.encode() if isinstance(app.secret_key, str) else app.secret_key
        expected = hmac.new(key, raw, hashlib.sha256).digest()
        if not hmac.compare_digest(sig, expected):
            return None
        data = json.loads(raw.decode())
        t = int(data.get('t') or 0)
        if not t or (int(time.time()) - t) > max_age_sec:
            return None
        return data
    except Exception:
        return None
def _probe_oauth2(base_url: str):
    """Validate OAuth2 base URL by fetching OIDC well-known metadata.
    Returns (ok, info) where info is metadata dict on success or error string on failure.
    """
    import requests  # local import to avoid global dependency when unused

    def _fetch(url: str):
        try:
            r = requests.get(url, timeout=3)
            if r.status_code != 200:
                return False, f"status {r.status_code}"
            data = r.json()
            return True, data
        except Exception as e:
            return False, str(e)

    base = base_url.rstrip("/")
    # Try OIDC discovery first
    ok, info = _fetch(f"{base}/.well-known/openid-configuration")
    if not ok:
        # Fallback to RFC8414 location
        ok, info = _fetch(f"{base}/.well-known/oauth-authorization-server")
        if not ok:
            return False, info
    # Minimal validation
    if not isinstance(info, dict):
        return False, "invalid metadata"
    required = ("issuer", "authorization_endpoint", "token_endpoint")
    if not all(k in info and isinstance(info[k], str) and info[k] for k in required):
        return False, "missing required fields"
    return True, info


# Probe helpers are imported from probe.py

def _find_free_port_near(base: int = 5000, limit: int = 50) -> int:
    """Find the nearest available TCP port starting at `base`.
    Scans up to `base + limit`.
    """
    for p in range(base, base + max(1, limit) + 1):
        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
            s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
            try:
                s.bind(("0.0.0.0", p))
                return p
            except OSError:
                continue
    # Fallback to an ephemeral port if everything else failed
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.bind(("0.0.0.0", 0))
        return s.getsockname()[1]


def _get_local_ipv4s() -> Set[str]:
    """Collect local IPv4 addresses for this host to avoid listing ourselves."""
    ips: Set[str] = {"127.0.0.1"}
    try:
        out = subprocess.check_output(["ip", "-o", "-f", "inet", "addr", "show"], text=True)
        for line in out.splitlines():
            parts = line.split()
            if len(parts) >= 4 and parts[2] == "inet":
                addr_cidr = parts[3]
                ip_str = addr_cidr.split("/")[0]
                try:
                    # Only add private IPv4 addresses
                    obj = ipaddress.ip_address(ip_str)
                    if isinstance(obj, ipaddress.IPv4Address) and obj.is_private:
                        ips.add(ip_str)
                except Exception:
                    pass
    except Exception:
        pass
    return ips


def _extract_ip(entry: Dict[str, Any]) -> Optional[str]:
    """Return the first non-local IPv4 for a discovery entry, or None."""
    cand = entry.get("ip")
    if cand and cand not in LOCAL_IPS:
        return cand
    ips = entry.get("ips") or []
    if isinstance(ips, list):
        for x in ips:
            if isinstance(x, str) and x not in LOCAL_IPS:
                return x
    return None

def _canonical_key(entry: Dict[str, Any]) -> Optional[str]:
    """Stable key for deduplication. Prefer device id from TXT or status, else ip:port."""
    txt = entry.get("txt") or {}
    dev_id = txt.get("id") if isinstance(txt, dict) else None
    if not dev_id:
        st = entry.get("status") or {}
        if isinstance(st, dict):
            dev_id = st.get("id")
    ip = _extract_ip(entry)
    port_val = entry.get("port")
    try:
        port_int = int(port_val) if port_val is not None else 0
    except Exception:
        port_int = 0
    if dev_id:
        return f"id:{dev_id}"
    if ip and port_int:
        return f"ip:{ip}:{port_int}"
    return None

def _device_id(entry: Dict[str, Any]) -> Optional[str]:
    """Extract a stable device identifier from status or TXT."""
    st = entry.get("status")
    if isinstance(st, dict):
        d = st.get("id")
        if d:
            return str(d)
    txt = entry.get("txt")
    if isinstance(txt, dict):
        d = txt.get("id")
        if d:
            return str(d)
    return None

@app.get("/")
def index():
    return render_template('index.html')
 
@app.get("/api/discover")
def api_discover():
    timeout = float(request.args.get("timeout", 3.0))
    service = request.args.get("service", DEFAULT_SERVICE)
    with_status = request.args.get("status") is not None
    token = request.args.get("token") or None
    use_probe = request.args.get("probe") is not None
    probe_port = int(request.args.get("port", DEFAULT_PROBE_PORT))
    cidr_arg = (request.args.get("cidr") or "").strip()
    verify_only = request.args.get("verify") is not None

    # mDNS discovery first
    infos = browse(service, timeout)
    results: List[Dict[str, Any]] = [to_result(i, with_status, token) for i in infos]

    # Deduplicate mDNS results by device id (TXT id) when available, else by ip:port
    unique: Dict[str, Dict[str, Any]] = {}
    for r in results:
        # Normalize ip/url for UI consistency
        ip = _extract_ip(r)
        if ip:
            r["ip"] = ip
            if r.get("port"):
                r["url"] = f"http://{ip}:{r['port']}/"
        # Skip entries that point to this host or invalid ports
        port_val = r.get("port")
        try:
            port_int = int(port_val) if port_val is not None else 0
        except Exception:
            port_int = 0
        if not ip or not port_int:
            continue
        if ip in LOCAL_IPS and (APP_PORT is None or port_int == APP_PORT):
            continue
        key = _canonical_key(r)
        if not key:
            continue
        existing = unique.get(key)
        if existing is None or (("status" in r) and ("status" not in existing)):
            unique[key] = r
    results = list(unique.values())

    # Optionally verify reachability of mDNS-discovered devices
    if verify_only and results:
        verified: List[Dict[str, Any]] = []
        for r in results:
            ip = _extract_ip(r)
            port_val = r.get("port")
            try:
                port_int = int(port_val) if port_val is not None else 0
            except Exception:
                port_int = 0
            if not ip or not port_int:
                continue
            if ip in LOCAL_IPS and (APP_PORT is None or port_int == APP_PORT):
                continue
            if verify_opensentry(ip, port_int, DEFAULT_HTTP_TIMEOUT):
                if "status" not in r:
                    st = fetch_status(ip, port_int, token)
                    if st is not None and isinstance(st, dict) and "version" in st:
                        r["status"] = st
                # Accept only if we now have a valid status payload
                if isinstance(r.get("status"), dict) and "version" in r["status"]:
                    verified.append(r)
        results = verified

    seen = set()
    seen_ip_ports = set()
    for r in results:
        ip = _extract_ip(r)
        port = r.get("port")
        if ip and port:
            seen.add(_canonical_key(r) or f"ip:{ip}:{port}")
            seen_ip_ports.add(f"{ip}:{port}")
            LAST_SEEN[f"{ip}:{port}"] = time.time()

    # Optional fallback probe
    if use_probe or not results:
        nets: List[ipaddress.IPv4Network] = []
        if cidr_arg:
            for part in cidr_arg.split(","):
                p = part.strip()
                if not p:
                    continue
                try:
                    n = ipaddress.ip_network(p, strict=False)
                    if isinstance(n, ipaddress.IPv4Network):
                        nets.append(n)
                except Exception:
                    pass
        if not nets:
            nets = detect_local_networks(limit_to_class_c=True)
        ips = list(iter_hosts(nets))
        probed = scan_ips(ips, probe_port, DEFAULT_TCP_TIMEOUT, DEFAULT_HTTP_TIMEOUT, DEFAULT_CONCURRENCY)
        for item in probed:
            # Normalize and skip self
            key = _canonical_key(item) or f"ip:{item['ip']}:{item['port']}"
            if item['ip'] in LOCAL_IPS and (APP_PORT is None or int(item['port']) == APP_PORT):
                continue
            if key in seen or f"{item['ip']}:{item['port']}" in seen_ip_ports:
                continue
            if with_status:
                st = fetch_status(item['ip'], int(item['port']), token)
                if st is not None:
                    item['status'] = st
                else:
                    item['status_error'] = 'unreachable or unauthorized'
            LAST_SEEN[f"{item['ip']}:{item['port']}"] = time.time()
            results.append(item)

    # Attach last_seen
    # Final de-duplication in case of races between mDNS and probe (by ip:port)
    unique2_ip: Dict[str, Dict[str, Any]] = {}
    for r in results:
        ip_key = _extract_ip(r)
        port_val = r.get("port")
        try:
            port_int = int(port_val) if port_val is not None else 0
        except Exception:
            port_int = 0
        if not ip_key or not port_int:
            continue
        k = f"{ip_key}:{port_int}"
        existing = unique2_ip.get(k)
        if existing is None or (("status" in r) and ("status" not in existing)):
            unique2_ip[k] = r
    results = list(unique2_ip.values())

    for r in results:
        ip = _extract_ip(r)
        port = r.get("port")
        if ip and port:
            r["last_seen"] = LAST_SEEN.get(f"{ip}:{port}")
    # Final reachability filter (applies to both mDNS and probed entries)
    if verify_only and results:
        filtered: List[Dict[str, Any]] = []
        for r in results:
            ip = _extract_ip(r)
            port_val = r.get("port")
            try:
                port_int = int(port_val) if port_val is not None else 0
            except Exception:
                port_int = 0
            if not ip or not port_int:
                continue
            if ip in LOCAL_IPS and (APP_PORT is None or port_int == APP_PORT):
                continue
            if verify_opensentry(ip, port_int, DEFAULT_HTTP_TIMEOUT):
                if "status" not in r:
                    st = fetch_status(ip, port_int, token)
                    if st is not None and isinstance(st, dict) and "version" in st:
                        r["status"] = st
                # Accept only if we now have a valid status payload
                if isinstance(r.get("status"), dict) and "version" in r["status"]:
                    filtered.append(r)
        results = filtered

    # Device-level dedup: if multiple entries share the same device id, keep the best one
    dev_map: Dict[str, Dict[str, Any]] = {}
    no_id: List[Dict[str, Any]] = []
    def _best(a: Dict[str, Any], b: Dict[str, Any]) -> Dict[str, Any]:
        # Prefer entry with status
        a_has = 'status' in a
        b_has = 'status' in b
        if a_has != b_has:
            return a if a_has else b
        # Prefer port equal to user-specified probe_port (or DEFAULT_PROBE_PORT)
        try:
            a_port = int(a.get('port') or 0)
            b_port = int(b.get('port') or 0)
        except Exception:
            a_port = int(a.get('port') or 0)
            b_port = int(b.get('port') or 0)
        preferred = probe_port or DEFAULT_PROBE_PORT
        if (a_port == preferred) != (b_port == preferred):
            return a if a_port == preferred else b
        # Prefer most recent last_seen
        try:
            a_ls = float(a.get('last_seen') or 0)
            b_ls = float(b.get('last_seen') or 0)
        except Exception:
            a_ls = float(a.get('last_seen') or 0)
            b_ls = float(b.get('last_seen') or 0)
        if a_ls != b_ls:
            return a if a_ls > b_ls else b
        # Otherwise, lowest port
        return a if a_port <= b_port else b

    for r in results:
        did = _device_id(r)
        if not did:
            no_id.append(r)
            continue
        prev = dev_map.get(did)
        if prev is None:
            dev_map[did] = r
        else:
            dev_map[did] = _best(prev, r)
    results = list(dev_map.values()) + no_id

    # Extra safety: unique by IP; choose best candidate per IP
    def _better(a: Dict[str, Any], b: Dict[str, Any]) -> Dict[str, Any]:
        # Prefer one with status
        a_has = 'status' in a
        b_has = 'status' in b
        if a_has != b_has:
            return a if a_has else b
        # Prefer port equal to probe_port (user-specified) or DEFAULT_PROBE_PORT
        try:
            a_port = int(a.get('port') or 0)
            b_port = int(b.get('port') or 0)
        except Exception:
            a_port = int(a.get('port') or 0)
            b_port = int(b.get('port') or 0)
        preferred = probe_port or DEFAULT_PROBE_PORT
        if (a_port == preferred) != (b_port == preferred):
            return a if a_port == preferred else b
        # Otherwise, lowest port
        return a if a_port <= b_port else b

    unique_ip_only: Dict[str, Dict[str, Any]] = {}
    for r in results:
        ip_key = _extract_ip(r)
        if not ip_key:
            continue
        existing = unique_ip_only.get(ip_key)
        if existing is None:
            unique_ip_only[ip_key] = r
        else:
            unique_ip_only[ip_key] = _better(existing, r)
    results = list(unique_ip_only.values())

    # If user requested verification, only include entries where /status succeeded
    if verify_only:
        results = [r for r in results if isinstance(r.get('status'), dict) and 'version' in r['status']]

    return jsonify(results)

@app.get("/api/devices")
def list_devices():
    with _devices_lock:
        return jsonify(_load_devices())

@app.post("/api/devices")
def add_device():
    data = request.get_json(silent=True) or {}
    ip = (data.get("ip") or "").strip()
    port = int(data.get("port") or 0)
    name = (data.get("name") or "").strip()
    token = (data.get("token") or "").strip()
    if not ip or not port:
        return jsonify({"error": "ip and port required"}), 400
    entry = {"ip": ip, "port": port, "name": name, "token": token}
    with _devices_lock:
        devs = _load_devices()
        devs = [d for d in devs if not (d.get("ip") == ip and int(d.get("port") or 0) == port)]
        devs.append(entry)
        _save_devices(devs)
        return jsonify(devs), 201

@app.delete("/api/devices")
def remove_device():
    data = request.get_json(silent=True) or {}
    ip = (data.get("ip") or "").strip()
    port = int(data.get("port") or 0)
    if not ip or not port:
        return jsonify({"error": "ip and port required"}), 400
    with _devices_lock:
        devs = _load_devices()
        devs = [d for d in devs if not (d.get("ip") == ip and int(d.get("port") or 0) == port)]
        _save_devices(devs)
        return jsonify(devs)

@app.patch("/api/devices")
def update_device():
    data = request.get_json(silent=True) or {}
    ip = (data.get("ip") or "").strip()
    port = int(data.get("port") or 0)
    name = data.get("name", None)
    token = data.get("token", None)
    if not ip or not port:
        return jsonify({"error": "ip and port required"}), 400
    if name is None and token is None:
        return jsonify({"error": "nothing to update"}), 400
    with _devices_lock:
        devs = _load_devices()
        found = False
        for d in devs:
            if d.get("ip") == ip and int(d.get("port") or 0) == port:
                if name is not None:
                    d["name"] = (name or "").strip()
                if token is not None:
                    d["token"] = (token or "").strip()
                found = True
                break
        if not found:
            return jsonify({"error": "device not found"}), 404
        _save_devices(devs)
        return jsonify(devs)

@app.get("/api/status")
def proxy_status():
    ip = (request.args.get("ip") or "").strip()
    port_s = (request.args.get("port") or "").strip()
    token = (request.args.get("token") or "").strip() or None
    timeout = float(request.args.get("timeout", 1.5))
    try:
        port = int(port_s)
    except Exception:
        port = 0
    if not ip or not port:
        return jsonify({"error": "ip and port required"}), 400
    st = fetch_status(ip, port, token, timeout)
    if st is None:
        return jsonify({"error": "unreachable or unauthorized"}), 502
    return jsonify({"status": st})

@app.get("/device")
def device_page():
    ip = (request.args.get("ip") or "").strip()
    port = (request.args.get("port") or "").strip()
    token = (request.args.get("token") or "").strip()
    if not ip or not port:
        return ("Missing ip/port", 400)
    return render_template('device.html', ip=ip, port=port, token=token)

@app.get("/settings")
def settings_page():
    return render_template('settings.html')

@app.get("/api/settings")
def get_settings():
    with _config_lock:
        return jsonify(_load_config())

@app.post("/api/settings")
def set_settings():
    data = request.get_json(silent=True) or {}
    auth_mode = (data.get("auth_mode") or "").strip().lower()
    oauth2_base_url = (data.get("oauth2_base_url") or "").strip()
    oauth2_client_id = (data.get("oauth2_client_id") or "").strip()
    oauth2_client_secret = (data.get("oauth2_client_secret") or "").strip()
    oauth2_scope = (data.get("oauth2_scope") or "openid profile email offline_access").strip()
    if auth_mode not in ("local", "oauth2"):
        return jsonify({"error": "invalid auth_mode"}), 400
    # If selecting oauth2, validate base_url via well-known fetch
    if auth_mode == "oauth2":
        ok, info = _probe_oauth2(oauth2_base_url)
        if not ok:
            return jsonify({"error": "oauth2 validation failed", "detail": info}), 400
        if not oauth2_client_id:
            return jsonify({"error": "oauth2_client_id required"}), 400
    with _config_lock:
        cfg = _load_config()
        cfg["auth_mode"] = auth_mode
        if auth_mode == "oauth2":
            cfg["oauth2_base_url"] = oauth2_base_url
            cfg["oauth2_client_id"] = oauth2_client_id
            cfg["oauth2_client_secret"] = oauth2_client_secret
            cfg["oauth2_scope"] = oauth2_scope or "openid profile email offline_access"
        else:
            cfg["oauth2_base_url"] = ""
            cfg["oauth2_client_id"] = ""
            cfg["oauth2_client_secret"] = ""
            cfg["oauth2_scope"] = "openid profile email offline_access"
        _save_config(cfg)
        return jsonify(cfg)

@app.get("/api/oauth2/test")
def api_oauth2_test():
    base = (request.args.get("base_url") or "").strip()
    if not base:
        return jsonify({"ok": False, "error": "base_url required"}), 400
    ok, info = _probe_oauth2(base)
    if ok:
        return jsonify({"ok": True, "issuer": info.get("issuer"), "authorization_endpoint": info.get("authorization_endpoint"), "token_endpoint": info.get("token_endpoint")})
    return jsonify({"ok": False, "error": info}), 502

@app.get("/api/device_status")
def api_device_status():
    ip = (request.args.get("ip") or "").strip()
    port = int(request.args.get("port") or 0)
    token = (request.args.get("token") or "").strip() or None
    if not ip or not port:
        return jsonify({"error": "ip and port required"}), 400
    st = fetch_status(ip, port, token)
    if st is None:
        return jsonify({"error": "unreachable or unauthorized"}), 502
    return jsonify(st)

@app.get("/stream_proxy")
def stream_proxy():
    import requests

    ip = (request.args.get("ip") or "").strip()
    port = int(request.args.get("port") or 0)
    path = (request.args.get("path") or "/video_feed").strip() or "/video_feed"
    token = (request.args.get("token") or "").strip()
    if not ip or not port:
        return ("Missing ip/port", 400)
    url = f"http://{ip}:{port}{path}"
    headers = {}
    if token:
        headers["Authorization"] = f"Bearer {token}"
    try:
        r = requests.get(url, headers=headers, stream=True, timeout=10)
    except Exception as e:
        return (f"Upstream error: {e}", 502)
    if r.status_code != 200:
        return (f"Upstream status {r.status_code}", r.status_code)
    ctype = r.headers.get("Content-Type", "application/octet-stream")

    def generate():
        try:
            for chunk in r.iter_content(chunk_size=4096):
                if chunk:
                    yield chunk
        finally:
            try:
                r.close()
            except Exception:
                pass

    return Response(generate(), content_type=ctype)

@app.get("/api/test/tcp")
def api_test_tcp():
    ip = (request.args.get("ip") or "").strip()
    port = int(request.args.get("port") or 0)
    timeout = float(request.args.get("timeout", 1.5))
    if not ip or not port:
        return jsonify({"error": "ip and port required"}), 400
    t0 = time.time()
    try:
        ok = port_open(ip, port, timeout)
    except Exception:
        ok = False
    dt = int((time.time() - t0) * 1000)
    return jsonify({"ok": ok, "ip": ip, "port": port, "duration_ms": dt})

@app.get("/api/test/health")
def api_test_health():
    import requests
    ip = (request.args.get("ip") or "").strip()
    port = int(request.args.get("port") or 0)
    timeout = float(request.args.get("timeout", 1.5))
    if not ip or not port:
        return jsonify({"error": "ip and port required"}), 400
    url = f"http://{ip}:{port}/health"
    t0 = time.time()
    ok = False
    code = 0
    body = ""
    try:
        r = requests.get(url, timeout=timeout)
        code = r.status_code
        body = (r.text or "")[:200]
        ok = (r.status_code == 200 and (r.text or "").strip().lower() == "ok")
    except Exception as e:
        body = f"error: {e}"
    dt = int((time.time() - t0) * 1000)
    return jsonify({"ok": ok, "status_code": code, "body": body, "duration_ms": dt})


@app.get("/api/test/stream")
def api_test_stream():
    import requests
    ip = (request.args.get("ip") or "").strip()
    port = int(request.args.get("port") or 0)
    path = (request.args.get("path") or "/video_feed").strip() or "/video_feed"
    token = (request.args.get("token") or "").strip()
    timeout = float(request.args.get("timeout", 3.0))
    if not ip or not port:
        return jsonify({"error": "ip and port required"}), 400
    url = f"http://{ip}:{port}{path}"
    headers = {}
    if token:
        headers["Authorization"] = f"Bearer {token}"
    t0 = time.time()
    code = 0
    ctype = None
    ok = False
    try:
        r = requests.get(url, headers=headers, stream=True, timeout=timeout)
        code = r.status_code
        ctype = r.headers.get('Content-Type')
        ok = (code == 200)
        try:
            r.close()
        except Exception:
            pass
    except Exception:
        ok = False
    dt = int((time.time() - t0) * 1000)
    return jsonify({"ok": ok, "status_code": code, "content_type": ctype, "duration_ms": dt})

@app.get("/api/test/run_all")
def api_test_run_all():
    import requests
    ip = (request.args.get("ip") or "").strip()
    port = int(request.args.get("port") or 0)
    token = (request.args.get("token") or "").strip()
    timeout = float(request.args.get("timeout", 2.0))
    if not ip or not port:
        return jsonify({"error": "ip and port required"}), 400
    # TCP
    t0 = time.time()
    tcp_ok = port_open(ip, port, timeout)
    tcp_ms = int((time.time() - t0) * 1000)
    # Health
    health = {"ok": False, "status_code": 0, "body": "", "duration_ms": 0}
    try:
        t0 = time.time()
        rr = requests.get(f"http://{ip}:{port}/health", timeout=timeout)
        health["status_code"] = rr.status_code
        health["body"] = (rr.text or "")[:200]
        health["ok"] = (rr.status_code == 200 and (rr.text or "").strip().lower() == "ok")
        health["duration_ms"] = int((time.time() - t0) * 1000)
    except Exception as e:
        health["body"] = f"error: {e}"
        health["duration_ms"] = int((time.time() - t0) * 1000)
    # Status
    t0 = time.time()
    try:
        st = fetch_status(ip, port, token or None, timeout)
    except TypeError:
        st = fetch_status(ip, port, token or None)
    st_ms = int((time.time() - t0) * 1000)
    status = {"ok": bool(st), "status": st, "duration_ms": st_ms}
    # Stream
    stream = {"ok": False, "status_code": 0, "content_type": None, "duration_ms": 0}
    try:
        t0 = time.time()
        hdrs = {"Authorization": f"Bearer {token}"} if token else {}
        rs = requests.get(f"http://{ip}:{port}/video_feed", headers=hdrs, stream=True, timeout=max(timeout, 3.0))
        stream["status_code"] = rs.status_code
        stream["content_type"] = rs.headers.get('Content-Type')
        stream["ok"] = (rs.status_code == 200)
        stream["duration_ms"] = int((time.time() - t0) * 1000)
        try:
            rs.close()
        except Exception:
            pass
    except Exception:
        stream["duration_ms"] = int((time.time() - t0) * 1000)

    return jsonify({
        "tcp": {"ok": tcp_ok, "duration_ms": tcp_ms},
        "health": health,
        "status": status,
        "stream": stream,
    })

def main() -> None:
    # Select nearest available port to 5000 unless PORT is explicitly set
    port_env = os.environ.get("PORT")
    if port_env and port_env.isdigit():
        port = int(port_env)
    else:
        port = _find_free_port_near(5000, limit=50)
    host = os.environ.get("HOST", "0.0.0.0")
    # set globals used by discovery filters
    global APP_PORT, LOCAL_IPS
    APP_PORT = port
    if not LOCAL_IPS:
        LOCAL_IPS = _get_local_ipv4s()
    print(f"OpenSentry Command UI starting on http://127.0.0.1:{port} (host={host})")
    app.run(host=host, port=port, debug=False)

if __name__ == "__main__":
    main()