foxhunt/crates/config/src/manager.rs

//! Unified Configuration Manager
//!
//! This module provides the main ConfigManager that integrates:
//! - PostgreSQL configuration storage with hot-reload
//! - HashiCorp Vault for secure credential management
//! - Environment variable overrides
//! - File-based configuration fallbacks
//! - Unified caching and change notifications

use crate::schemas::{ConfigChangeNotification, ModelConfig, ModelVersion};
use crate::database::{DatabaseConfig, PostgresConfigLoader};
use crate::error::{ConfigError, ConfigResult};
use crate::{
    ConfigCategory, ConfigChange, ConfigHealth, ConfigSource, ConfigValue,
};
// Vault types will be used when initializing VaultSecrets
use chrono::Utc;
use serde::{Deserialize, Serialize};
use std::collections::HashMap;
use std::sync::Arc;
use std::time::Duration;
use tokio::sync::{mpsc, RwLock};
use tracing::{debug, info, warn};

/// Configuration manager settings
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ConfigManagerSettings {
    /// Default cache TTL
    pub cache_ttl_seconds: u64,
    /// Health check interval
    pub health_check_interval_seconds: u64,
    /// Environment name
    pub environment: String,
    /// Service name
    pub service_name: String,
    /// Whether to enable Vault integration
    pub enable_vault: bool,
    /// Whether to enable PostgreSQL integration
    pub enable_postgres: bool,
    /// Configuration sources priority (in order of preference)
    pub source_priority: Vec<ConfigSource>,
}

impl Default for ConfigManagerSettings {
    fn default() -> Self {
        Self {
            cache_ttl_seconds: 300,            // 5 minutes
            health_check_interval_seconds: 60, // 1 minute
            environment: std::env::var("FOXHUNT_ENV").unwrap_or_else(|_| "development".to_string()),
            service_name: std::env::var("FOXHUNT_SERVICE_NAME")
                .unwrap_or_else(|_| "foxhunt".to_string()),
            enable_vault: true,
            enable_postgres: true,
            source_priority: vec![
                ConfigSource::Environment,
                ConfigSource::Vault,
                ConfigSource::Database,
                ConfigSource::File,
                ConfigSource::Default,
            ],
        }
    }
}

/// Unified Configuration Manager
pub struct ConfigManager {
    /// PostgreSQL configuration loader
    postgres_loader: Option<Arc<PostgresConfigLoader>>,
    /// Vault secrets manager
    vault_secrets: Option<Arc<crate::vault::VaultSecrets>>,
    /// Manager settings
    settings: ConfigManagerSettings,
    /// Configuration change notifications
    change_tx: mpsc::UnboundedSender<ConfigChange>,
    /// Health status for components
    health_status: Arc<RwLock<HashMap<String, ConfigHealth>>>,
}

impl ConfigManager {
    /// Create new configuration manager with PostgreSQL and Vault
    pub async fn new(
        db_config: Option<DatabaseConfig>,
        vault_config: Option<crate::vault::VaultConfig>,
        settings: Option<ConfigManagerSettings>,
    ) -> ConfigResult<Self> {
        let settings = settings.unwrap_or_default();
        let cache_ttl = Duration::from_secs(settings.cache_ttl_seconds);

        // Initialize PostgreSQL loader if enabled and configured
        let postgres_loader = if settings.enable_postgres {
            if let Some(db_config) = db_config {
                match PostgresConfigLoader::new(db_config, cache_ttl).await {
                    Ok(loader) => {
                        info!("PostgreSQL configuration loader initialized");
                        Some(Arc::new(loader))
                    }
                    Err(e) => {
                        warn!("Failed to initialize PostgreSQL loader: {}", e);
                        None
                    }
                }
            } else {
                warn!("PostgreSQL enabled but no database config provided");
                None
            }
        } else {
            None
        };

        // Initialize Vault secrets manager if enabled and configured
        let vault_secrets = if settings.enable_vault {
            if let Some(vault_config) = vault_config {
                match crate::vault::VaultSecrets::new(vault_config).await {
                    Ok(vault) => {
                        info!("Vault secrets manager initialized");
                        Some(Arc::new(vault))
                    }
                    Err(e) => {
                        warn!("Failed to initialize Vault secrets: {}", e);
                        None
                    }
                }
            } else {
                warn!("Vault enabled but no vault config provided");
                None
            }
        } else {
            None
        };

        let (change_tx, _change_rx) = mpsc::unbounded_channel();

        let manager = Self {
            postgres_loader,
            vault_secrets,
            settings,
            change_tx,
            health_status: Arc::new(RwLock::new(HashMap::new())),
        };

        // Start health monitoring
        manager.start_health_monitoring().await;

        // Start configuration change monitoring
        manager.start_change_monitoring().await?;

        info!(
            "ConfigManager initialized for service '{}' in environment '{}'",
            manager.settings.service_name, manager.settings.environment
        );

        Ok(manager)
    }

    /// Create new configuration manager from environment
    pub async fn from_env() -> ConfigResult<Self> {
        let db_config = if std::env::var("DATABASE_URL").is_ok()
            || std::env::var("FOXHUNT_POSTGRES_URL").is_ok()
        {
            Some(DatabaseConfig::from_env()?)
        } else {
            None
        };

        let vault_config =
            if std::env::var("VAULT_ADDR").is_ok() && std::env::var("VAULT_ROLE_ID").is_ok() {
                Some(crate::vault::VaultConfig::from_env()?)
            } else {
                None
            };

        Self::new(db_config, vault_config, None).await
    }

    /// Get configuration value with source priority
    pub async fn get_config<T>(
        &self,
        category: ConfigCategory,
        key: &str,
    ) -> ConfigResult<Option<T>>
    where
        T: for<'de> Deserialize<'de>,
    {
        for source in &self.settings.source_priority {
            match self
                .get_config_from_source(source, category.clone(), key)
                .await?
            {
                Some(value) => {
                    debug!(
                        "Found config {}.{} from source {:?}",
                        category.table_name(),
                        key,
                        source
                    );
                    return Ok(Some(serde_json::from_value(value.value)?));
                }
                None => continue,
            }
        }

        debug!(
            "Config {}.{} not found in any source",
            category.table_name(),
            key
        );
        Ok(None)
    }

    /// Get configuration value from specific source
    async fn get_config_from_source(
        &self,
        source: &ConfigSource,
        category: ConfigCategory,
        key: &str,
    ) -> ConfigResult<Option<ConfigValue>> {
        match source {
            ConfigSource::Environment => self.get_config_from_env(category, key).await,
            ConfigSource::Vault => {
                if let Some(ref vault) = self.vault_secrets {
                    vault.get_config(category, key).await
                } else {
                    Ok(None)
                }
            }
            ConfigSource::Database => {
                if let Some(ref postgres) = self.postgres_loader {
                    match postgres
                        .get_config::<serde_json::Value>(category.clone(), key)
                        .await?
                    {
                        Some(value) => Ok(Some(ConfigValue {
                            key: key.to_string(),
                            value,
                            category,
                            environment: self.settings.environment.clone(),
                            updated_at: Utc::now(),
                            description: None,
                            is_active: true,
                            source: ConfigSource::Database,
                        })),
                        None => Ok(None),
                    }
                } else {
                    Ok(None)
                }
            }
            ConfigSource::File => {
                // TODO: Implement file-based configuration loading
                Ok(None)
            }
            ConfigSource::Default => {
                // TODO: Implement default configuration values
                Ok(None)
            }
        }
    }

    /// Get configuration from environment variables
    async fn get_config_from_env(
        &self,
        category: ConfigCategory,
        key: &str,
    ) -> ConfigResult<Option<ConfigValue>> {
        // Build environment variable name
        let env_key = format!(
            "FOXHUNT_{}_{}",
            category.table_name().to_uppercase(),
            key.to_uppercase()
        );

        if let Ok(env_value) = std::env::var(&env_key) {
            let json_value = if env_value.starts_with('{') || env_value.starts_with('[') {
                // Try to parse as JSON
                serde_json::from_str(&env_value)
                    .unwrap_or(serde_json::Value::String(env_value))
            } else {
                // Try to parse as number, boolean, or keep as string
                env_value
                    .parse::<f64>()
                    .map(serde_json::Value::from)
                    .or_else(|_| env_value.parse::<bool>().map(serde_json::Value::from))
                    .unwrap_or(serde_json::Value::String(env_value))
            };

            Ok(Some(ConfigValue {
                key: key.to_string(),
                value: json_value,
                category,
                environment: self.settings.environment.clone(),
                updated_at: Utc::now(),
                description: Some(format!("Loaded from environment variable {}", env_key)),
                is_active: true,
                source: ConfigSource::Environment,
            }))
        } else {
            Ok(None)
        }
    }

    /// Set configuration value (writes to all available backends)
    pub async fn set_config<T>(
        &self,
        category: ConfigCategory,
        key: &str,
        value: &T,
        description: Option<&str>,
    ) -> ConfigResult<()>
    where
        T: Serialize,
    {
        let mut errors = Vec::new();

        // Write to PostgreSQL if available
        if let Some(ref postgres) = self.postgres_loader {
            if let Err(e) = postgres
                .set_config(category.clone(), key, value, description)
                .await
            {
                errors.push(format!("PostgreSQL: {}", e));
            }
        }

        // Write to Vault if available
        if let Some(ref vault) = self.vault_secrets {
            if let Err(e) = vault.set_config(category.clone(), key, value).await {
                errors.push(format!("Vault: {}", e));
            }
        }

        if !errors.is_empty() && errors.len() == 2 {
            // Both backends failed
            return Err(ConfigError::WriteError {
                message: format!("Failed to write to all backends: {}", errors.join(", ")),
            });
        }

        // Send change notification
        let config_value = ConfigValue {
            key: key.to_string(),
            value: serde_json::to_value(value)?,
            category: category.clone(),
            environment: self.settings.environment.clone(),
            updated_at: Utc::now(),
            description: description.map(|s| s.to_string()),
            is_active: true,
            source: ConfigSource::Database, // Assuming database is primary
        };

        let change = ConfigChange {
            category,
            key: key.to_string(),
            new_value: config_value,
            old_value: None,
            changed_at: Utc::now(),
            changed_by: format!("ConfigManager[{}]", self.settings.service_name),
        };

        let _ = self.change_tx.send(change);

        if !errors.is_empty() {
            warn!(
                "Partial failure writing configuration: {}",
                errors.join(", ")
            );
        }

        Ok(())
    }

    /// Get all configurations for a category
    pub async fn get_category_configs(
        &self,
        category: ConfigCategory,
    ) -> ConfigResult<Vec<ConfigValue>> {
        let mut all_configs: HashMap<String, ConfigValue> = HashMap::new();

        // Collect configurations from all sources in reverse priority order
        for source in self.settings.source_priority.iter().rev() {
            let configs = match source {
                ConfigSource::Environment => {
                    // TODO: Scan environment variables for category
                    Vec::new()
                }
                ConfigSource::Vault => {
                    if let Some(ref vault) = self.vault_secrets {
                        vault
                            .get_category_configs(category.clone())
                            .await
                            .unwrap_or_default()
                    } else {
                        Vec::new()
                    }
                }
                ConfigSource::Database => {
                    if let Some(ref postgres) = self.postgres_loader {
                        postgres
                            .get_category_configs(category.clone())
                            .await
                            .unwrap_or_default()
                    } else {
                        Vec::new()
                    }
                }
                ConfigSource::File | ConfigSource::Default => Vec::new(),
            };

            // Add configs, but don't overwrite higher priority ones
            for config in configs {
                all_configs.entry(config.key.clone()).or_insert(config);
            }
        }

        Ok(all_configs.into_values().collect())
    }

    /// Subscribe to configuration changes
    pub async fn subscribe_to_changes(
        &self,
    ) -> ConfigResult<mpsc::UnboundedReceiver<ConfigChange>> {
        let (_tx, rx) = mpsc::unbounded_channel();
        // TODO: Implement proper change subscription multiplexing
        Ok(rx)
    }

    /// Get health status for all components
    pub async fn get_health_status(&self) -> HashMap<String, ConfigHealth> {
        let health = self.health_status.read().await;
        health.clone()
    }

    /// Start health monitoring for all components
    async fn start_health_monitoring(&self) {
        let health_status = self.health_status.clone();
        let postgres_loader = self.postgres_loader.clone();
        let vault_secrets = self.vault_secrets.clone();
        let interval_secs = self.settings.health_check_interval_seconds;

        tokio::spawn(async move {
            let mut interval = tokio::time::interval(Duration::from_secs(interval_secs));

            loop {
                interval.tick().await;

                let mut health = health_status.write().await;

                // Check PostgreSQL health
                if let Some(ref postgres) = postgres_loader {
                    let pg_health = match postgres.test_connection().await {
                        Ok(()) => ConfigHealth {
                            is_healthy: true,
                            message: "PostgreSQL connection healthy".to_string(),
                            last_success: Some(Utc::now()),
                            failure_count: 0,
                            metrics: HashMap::new(),
                        },
                        Err(e) => {
                            let current_failure_count = health
                                .get("postgresql")
                                .map(|h| h.failure_count)
                                .unwrap_or(0)
                                + 1;

                            ConfigHealth {
                                is_healthy: false,
                                message: format!("PostgreSQL connection failed: {}", e),
                                last_success: health.get("postgresql").and_then(|h| h.last_success),
                                failure_count: current_failure_count,
                                metrics: HashMap::new(),
                            }
                        }
                    };
                    health.insert("postgresql".to_string(), pg_health);
                }

                // Check Vault health
                if let Some(ref vault) = vault_secrets {
                    let vault_health = if vault.health_check().await {
                        ConfigHealth {
                            is_healthy: true,
                            message: "Vault connection healthy".to_string(),
                            last_success: Some(Utc::now()),
                            failure_count: 0,
                            metrics: HashMap::new(),
                        }
                    } else {
                        let current_failure_count =
                            health.get("vault").map(|h| h.failure_count).unwrap_or(0) + 1;

                        ConfigHealth {
                            is_healthy: false,
                            message: "Vault connection failed".to_string(),
                            last_success: health.get("vault").and_then(|h| h.last_success),
                            failure_count: current_failure_count,
                            metrics: HashMap::new(),
                        }
                    };
                    health.insert("vault".to_string(), vault_health);
                }

                // Overall health check
                let overall_healthy = health.values().all(|h| h.is_healthy);
                let overall_health = ConfigHealth {
                    is_healthy: overall_healthy,
                    message: if overall_healthy {
                        "All configuration components healthy".to_string()
                    } else {
                        "Some configuration components unhealthy".to_string()
                    },
                    last_success: if overall_healthy {
                        Some(Utc::now())
                    } else {
                        None
                    },
                    failure_count: if overall_healthy { 0 } else { 1 },
                    metrics: HashMap::new(),
                };
                health.insert("overall".to_string(), overall_health);
            }
        });
    }

    /// Start monitoring configuration changes from backends
    async fn start_change_monitoring(&self) -> ConfigResult<()> {
        // Monitor PostgreSQL changes
        if let Some(ref postgres) = self.postgres_loader {
            let change_tx = self.change_tx.clone();
            let postgres_clone = postgres.clone();

            tokio::spawn(async move {
                if let Ok(mut changes) = postgres_clone.subscribe_to_changes().await {
                    while let Some((category, key)) = changes.recv().await {
                        debug!(
                            "PostgreSQL configuration changed: {}.{}",
                            category.table_name(),
                            key
                        );

                        // Create change notification
                        let change = ConfigChange {
                            category,
                            key,
                            new_value: ConfigValue {
                                key: "unknown".to_string(),
                                value: serde_json::Value::Null,
                                category: ConfigCategory::Environment,
                                environment: "unknown".to_string(),
                                updated_at: Utc::now(),
                                description: None,
                                is_active: true,
                                source: ConfigSource::Database,
                            },
                            old_value: None,
                            changed_at: Utc::now(),
                            changed_by: "PostgreSQL NOTIFY".to_string(),
                        };

                        let _ = change_tx.send(change);
                    }
                }
            });
        }

        // TODO: Monitor Vault changes if it supports notifications

        Ok(())
    }

    /// Test all connections and configurations
    pub async fn test_all_connections(&self) -> ConfigResult<HashMap<String, bool>> {
        let mut results = HashMap::new();

        // Test PostgreSQL
        if let Some(ref postgres) = self.postgres_loader {
            results.insert(
                "postgresql".to_string(),
                postgres.test_connection().await.is_ok(),
            );
        }

        // Test Vault
        if let Some(ref vault) = self.vault_secrets {
            results.insert("vault".to_string(), vault.health_check().await);
        }

        Ok(results)
    }

    /// Get cache statistics for all components
    pub async fn get_cache_stats(&self) -> HashMap<String, (usize, usize)> {
        let mut stats = HashMap::new();

        if let Some(ref postgres) = self.postgres_loader {
            let (size, hit_count, _, _) = postgres.cache_stats().await;
            stats.insert("postgresql".to_string(), (size, hit_count));
        }

        if let Some(ref vault) = self.vault_secrets {
            stats.insert("vault".to_string(), vault.cache_stats().await);
        }

        stats
    }

    /// Clear all caches
    pub async fn clear_all_caches(&self) {
        if let Some(ref postgres) = self.postgres_loader {
            postgres.clear_cache().await;
        }

        if let Some(ref vault) = self.vault_secrets {
            vault.clear_cache().await;
        }

        info!("Cleared all configuration caches");
    }

    /// Get current environment
    pub fn environment(&self) -> &str {
        &self.settings.environment
    }

    /// Get service name
    pub fn service_name(&self) -> &str {
        &self.settings.service_name
    }
}

/// Convenience methods for common configuration types
impl ConfigManager {
    /// Get string configuration value
    pub async fn get_string(
        &self,
        category: ConfigCategory,
        key: &str,
    ) -> ConfigResult<Option<String>> {
        self.get_config(category, key).await
    }

    /// Get integer configuration value
    pub async fn get_int(&self, category: ConfigCategory, key: &str) -> ConfigResult<Option<i64>> {
        self.get_config(category, key).await
    }

    /// Get float configuration value
    pub async fn get_float(
        &self,
        category: ConfigCategory,
        key: &str,
    ) -> ConfigResult<Option<f64>> {
        self.get_config(category, key).await
    }

    /// Get boolean configuration value
    pub async fn get_bool(
        &self,
        category: ConfigCategory,
        key: &str,
    ) -> ConfigResult<Option<bool>> {
        self.get_config(category, key).await
    }

    /// Get configuration value with default
    pub async fn get_with_default<T>(
        &self,
        category: ConfigCategory,
        key: &str,
        default: T,
    ) -> ConfigResult<T>
    where
        T: for<'de> Deserialize<'de>,
    {
        Ok(self.get_config(category, key).await?.unwrap_or(default))
    }

    /// Get model configuration by name and optional version
    pub async fn get_model_config(
        &self,
        model_name: &str,
        version: Option<&str>,
    ) -> ConfigResult<Option<ModelConfig>> {
        if let Some(ref postgres) = self.postgres_loader {
            let query = if let Some(_version) = version {
                "SELECT id, name, version, s3_path, cache_path, metadata, is_active, created_at, updated_at 
                 FROM model_config WHERE name = $1 AND version = $2 AND is_active = true"
            } else {
                "SELECT id, name, version, s3_path, cache_path, metadata, is_active, created_at, updated_at 
                 FROM model_config WHERE name = $1 AND is_active = true ORDER BY created_at DESC LIMIT 1"
            };

            let pool = postgres.get_pool();
            let result = if let Some(version) = version {
                sqlx::query_as::<_, ModelConfig>(query)
                    .bind(model_name)
                    .bind(version)
                    .fetch_optional(pool)
                    .await
            } else {
                sqlx::query_as::<_, ModelConfig>(query)
                    .bind(model_name)
                    .fetch_optional(pool)
                    .await
            };

            match result {
                Ok(model_config) => {
                    debug!(
                        "Retrieved model config for {}{}",
                        model_name,
                        version.map(|v| format!(":{}", v)).unwrap_or_default()
                    );
                    Ok(model_config)
                }
                Err(e) => {
                    warn!("Failed to retrieve model config for {}: {}", model_name, e);
                    Err(ConfigError::DatabaseError {
                        message: e.to_string(),
                    })
                }
            }
        } else {
            warn!("PostgreSQL not available for model config retrieval");
            Ok(None)
        }
    }

    /// Get all model versions for a specific model
    pub async fn get_model_versions(&self, model_name: &str) -> ConfigResult<Vec<ModelVersion>> {
        if let Some(ref postgres) = self.postgres_loader {
            let query = "SELECT mv.id, mv.model_config_id, mv.version, mv.s3_path, mv.cache_path, 
                               mv.checksum, mv.size_bytes, mv.performance_metrics, mv.training_metadata, 
                               mv.is_current, mv.created_at, mv.updated_at
                         FROM model_versions mv
                         JOIN model_config mc ON mv.model_config_id = mc.id
                         WHERE mc.name = $1
                         ORDER BY mv.created_at DESC";

            let pool = postgres.get_pool();
            match sqlx::query_as::<_, ModelVersion>(query)
                .bind(model_name)
                .fetch_all(pool)
                .await
            {
                Ok(versions) => {
                    debug!(
                        "Retrieved {} versions for model {}",
                        versions.len(),
                        model_name
                    );
                    Ok(versions)
                }
                Err(e) => {
                    warn!(
                        "Failed to retrieve model versions for {}: {}",
                        model_name, e
                    );
                    Err(ConfigError::DatabaseError {
                        message: e.to_string(),
                    })
                }
            }
        } else {
            warn!("PostgreSQL not available for model versions retrieval");
            Ok(Vec::new())
        }
    }

    /// Set model configuration
    pub async fn set_model_config(&self, model_config: &ModelConfig) -> ConfigResult<()> {
        if let Some(ref postgres) = self.postgres_loader {
            let query = "INSERT INTO model_config (id, name, version, s3_path, cache_path, metadata, is_active)
                         VALUES ($1, $2, $3, $4, $5, $6, $7)
                         ON CONFLICT (name, version) DO UPDATE SET
                         s3_path = EXCLUDED.s3_path,
                         cache_path = EXCLUDED.cache_path,
                         metadata = EXCLUDED.metadata,
                         is_active = EXCLUDED.is_active,
                         updated_at = NOW()";

            let pool = postgres.get_pool();
            match sqlx::query(query)
                .bind(model_config.id)
                .bind(&model_config.name)
                .bind(&model_config.version)
                .bind(&model_config.s3_path)
                .bind(&model_config.cache_path)
                .bind(&model_config.metadata)
                .bind(model_config.is_active)
                .execute(pool)
                .await
            {
                Ok(_) => {
                    info!(
                        "Set model config for {}:{}",
                        model_config.name, model_config.version
                    );

                    // Send change notification for hot-reload
                    let notification = ConfigChangeNotification {
                        operation: "UPDATE".to_string(),
                        table: "model_config".to_string(),
                        id: model_config.id,
                        key: format!("{}:{}", model_config.name, model_config.version),
                        timestamp: Utc::now().timestamp() as f64,
                    };

                    // Trigger PostgreSQL NOTIFY for hot-reload
                    let notify_query = "SELECT pg_notify('config_change', $1)";
                    let notification_json =
                        serde_json::to_string(&notification).unwrap_or_else(|_| "{}".to_string());

                    let _ = sqlx::query(notify_query)
                        .bind(&notification_json)
                        .execute(pool)
                        .await;

                    Ok(())
                }
                Err(e) => {
                    warn!(
                        "Failed to set model config for {}:{}: {}",
                        model_config.name, model_config.version, e
                    );
                    Err(ConfigError::DatabaseError {
                        message: e.to_string(),
                    })
                }
            }
        } else {
            Err(ConfigError::ValidationError {
                message: "PostgreSQL not available for model config storage".to_string(),
            })
        }
    }

    /// Set model version
    pub async fn set_model_version(&self, model_version: &ModelVersion) -> ConfigResult<()> {
        if let Some(ref postgres) = self.postgres_loader {
            let query = "INSERT INTO model_versions (id, model_config_id, version, s3_path, cache_path, 
                                                    checksum, size_bytes, performance_metrics, training_metadata, is_current)
                         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
                         ON CONFLICT (model_config_id, version) DO UPDATE SET
                         s3_path = EXCLUDED.s3_path,
                         cache_path = EXCLUDED.cache_path,
                         checksum = EXCLUDED.checksum,
                         size_bytes = EXCLUDED.size_bytes,
                         performance_metrics = EXCLUDED.performance_metrics,
                         training_metadata = EXCLUDED.training_metadata,
                         is_current = EXCLUDED.is_current,
                         updated_at = NOW()";

            let pool = postgres.get_pool();
            match sqlx::query(query)
                .bind(model_version.id)
                .bind(model_version.model_config_id)
                .bind(&model_version.version)
                .bind(&model_version.s3_path)
                .bind(&model_version.cache_path)
                .bind(&model_version.checksum)
                .bind(model_version.size_bytes)
                .bind(&model_version.performance_metrics)
                .bind(&model_version.training_metadata)
                .bind(model_version.is_current)
                .execute(pool)
                .await
            {
                Ok(_) => {
                    info!(
                        "Set model version {} for config_id {}",
                        model_version.version, model_version.model_config_id
                    );

                    // Send change notification for hot-reload
                    let notification = ConfigChangeNotification {
                        operation: "UPDATE".to_string(),
                        table: "model_versions".to_string(),
                        id: model_version.id,
                        key: model_version.version.clone(),
                        timestamp: Utc::now().timestamp() as f64,
                    };

                    // Trigger PostgreSQL NOTIFY for hot-reload
                    let notify_query = "SELECT pg_notify('config_change', $1)";
                    let notification_json =
                        serde_json::to_string(&notification).unwrap_or_else(|_| "{}".to_string());

                    let _ = sqlx::query(notify_query)
                        .bind(&notification_json)
                        .execute(pool)
                        .await;

                    Ok(())
                }
                Err(e) => {
                    warn!(
                        "Failed to set model version {}: {}",
                        model_version.version, e
                    );
                    Err(ConfigError::DatabaseError {
                        message: e.to_string(),
                    })
                }
            }
        } else {
            Err(ConfigError::ValidationError {
                message: "PostgreSQL not available for model version storage".to_string(),
            })
        }
    }

    /// Get all active model configurations
    pub async fn get_active_models(&self) -> ConfigResult<Vec<ModelConfig>> {
        if let Some(ref postgres) = self.postgres_loader {
            let query = "SELECT id, name, version, s3_path, cache_path, metadata, is_active, created_at, updated_at
                         FROM model_config 
                         WHERE is_active = true 
                         ORDER BY name, created_at DESC";

            let pool = postgres.get_pool();
            match sqlx::query_as::<_, ModelConfig>(query)
                .fetch_all(pool)
                .await
            {
                Ok(models) => {
                    debug!("Retrieved {} active models", models.len());
                    Ok(models)
                }
                Err(e) => {
                    warn!("Failed to retrieve active models: {}", e);
                    Err(ConfigError::DatabaseError {
                        message: e.to_string(),
                    })
                }
            }
        } else {
            warn!("PostgreSQL not available for active models retrieval");
            Ok(Vec::new())
        }
    }

    /// Delete model configuration (soft delete by setting is_active = false)
    pub async fn deactivate_model_config(
        &self,
        model_name: &str,
        version: Option<&str>,
    ) -> ConfigResult<()> {
        if let Some(ref postgres) = self.postgres_loader {
            let (query, binds) = if let Some(version) = version {
                (
                    "UPDATE model_config SET is_active = false, updated_at = NOW() WHERE name = $1 AND version = $2",
                    vec![model_name, version],
                )
            } else {
                (
                    "UPDATE model_config SET is_active = false, updated_at = NOW() WHERE name = $1",
                    vec![model_name],
                )
            };

            let pool = postgres.get_pool();
            let mut query_builder = sqlx::query(query);
            for bind in binds {
                query_builder = query_builder.bind(bind);
            }

            match query_builder.execute(pool).await {
                Ok(result) => {
                    if result.rows_affected() > 0 {
                        info!(
                            "Deactivated model config for {}{}",
                            model_name,
                            version.map(|v| format!(":{}", v)).unwrap_or_default()
                        );
                    } else {
                        warn!(
                            "No model config found to deactivate for {}{}",
                            model_name,
                            version.map(|v| format!(":{}", v)).unwrap_or_default()
                        );
                    }
                    Ok(())
                }
                Err(e) => {
                    warn!(
                        "Failed to deactivate model config for {}: {}",
                        model_name, e
                    );
                    Err(ConfigError::DatabaseError {
                        message: e.to_string(),
                    })
                }
            }
        } else {
            Err(ConfigError::ValidationError {
                message: "PostgreSQL not available for model config deactivation".to_string(),
            })
        }
    }

    /// Get S3 configuration for storage operations
    pub async fn get_s3_config(&self) -> ConfigResult<crate::schemas::S3Config> {
        debug!("Retrieving S3 configuration from config system");

        // Try to get AWS credentials with fallback chain:
        // 1. Environment variables (highest priority)
        // 2. Vault secrets (secure storage)
        // 3. Default configuration (fallback)

        let access_key_id = self
            .get_env_with_vault_fallback(
                "AWS_ACCESS_KEY_ID",
                ConfigCategory::Security,
                "aws_access_key_id",
            )
            .await?
            .unwrap_or_default();

        let secret_access_key = self
            .get_env_with_vault_fallback(
                "AWS_SECRET_ACCESS_KEY",
                ConfigCategory::Security,
                "aws_secret_access_key",
            )
            .await?
            .unwrap_or_default();

        let region = self
            .get_env_with_vault_fallback(
                "AWS_DEFAULT_REGION",
                ConfigCategory::Environment,
                "aws_region",
            )
            .await?
            .unwrap_or_else(|| "us-east-1".to_string());

        let bucket_name = self
            .get_env_with_vault_fallback(
                "S3_MODEL_STORAGE_BUCKET",
                ConfigCategory::Environment,
                "s3_bucket",
            )
            .await?
            .unwrap_or_else(|| "foxhunt-models".to_string());

        let session_token = self
            .get_env_with_vault_fallback(
                "AWS_SESSION_TOKEN",
                ConfigCategory::Security,
                "aws_session_token",
            )
            .await?;

        let endpoint_url = self
            .get_env_with_vault_fallback(
                "S3_ENDPOINT_URL",
                ConfigCategory::Environment,
                "s3_endpoint_url",
            )
            .await?;

        let force_path_style = self
            .get_env_with_vault_fallback(
                "S3_FORCE_PATH_STYLE",
                ConfigCategory::Environment,
                "s3_force_path_style",
            )
            .await?
            .map(|v| v.to_lowercase() == "true")
            .unwrap_or(false);

        // Validate that we have credentials
        if access_key_id.is_empty() || secret_access_key.is_empty() {
            warn!("AWS credentials not found in environment or Vault - using empty credentials");
        } else {
            info!(
                "Successfully retrieved AWS credentials for bucket: {}",
                bucket_name
            );
        }

        let config = crate::schemas::S3Config {
            bucket_name,
            region,
            access_key_id,
            secret_access_key,
            session_token,
            endpoint_url,
            force_path_style,
        };

        // Validate the configuration before returning
        config
            .validate()
            .map_err(|e| ConfigError::ValidationError {
                message: format!("Invalid S3 configuration: {}", e),
            })?;

        Ok(config)
    }
    /// Get environment variable with Vault fallback
    ///
    /// This is a convenience method that tries environment variables first,
    /// then falls back to Vault if available.
    async fn get_env_with_vault_fallback(
        &self,
        env_key: &str,
        vault_category: ConfigCategory,
        vault_key: &str,
    ) -> ConfigResult<Option<String>> {
        // Try environment variable first
        if let Ok(env_value) = std::env::var(env_key) {
            debug!("Using environment variable {} for configuration", env_key);
            return Ok(Some(env_value));
        }

        // Try Vault if available
        if let Some(ref vault) = self.vault_secrets {
            match vault
                .get_env_with_vault_fallback(env_key, vault_category.clone(), vault_key)
                .await?
            {
                Some(vault_value) => {
                    debug!("Using Vault value for {} (key: {})", env_key, vault_key);
                    return Ok(Some(vault_value));
                }
                None => {
                    debug!(
                        "No value found in Vault for {} (key: {})",
                        env_key, vault_key
                    );
                }
            }
        }

        // Try direct configuration lookup as fallback
        match self.get_string(vault_category.clone(), vault_key).await? {
            Some(config_value) => {
                debug!(
                    "Using configuration value for {}.{}",
                    vault_category.table_name(),
                    vault_key
                );
                Ok(Some(config_value))
            }
            None => {
                debug!(
                    "No configuration found for {}.{}",
                    vault_category.table_name(),
                    vault_key
                );
                Ok(None)
            }
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_config_manager_settings_default() {
        let settings = ConfigManagerSettings::default();
        assert_eq!(settings.cache_ttl_seconds, 300);
        assert_eq!(settings.health_check_interval_seconds, 60);
        assert!(settings.enable_vault);
        assert!(settings.enable_postgres);
        assert!(!settings.source_priority.is_empty());
    }

    #[tokio::test]
    async fn test_config_manager_from_env_no_backends() {
        // This should succeed even without any backends configured
        let result = ConfigManager::from_env().await;
        assert!(result.is_ok());
    }
}