Split repo.rs into repo/{config,snapshot,checkout,identity,sync,tests}; hermetic OXY_HOME in tests; identity recorded in user config 982864068a59

//! Moving the working copy to another state (spec §12.3, §7.7).

use super::*;

#[derive(Debug, Default, Clone, PartialEq, Eq)]

pub struct CheckoutReport {

    pub written: usize,

    pub removed: usize,

    pub conflicted: bool,

}

impl Repo {

    /// Move the working copy to the state whose heads are `heads` (spec §12.3):

    /// the working directory is rewritten to that state and a fresh

    /// working-copy change is started on it. The bookmark does not move.

    pub fn checkout(&self, heads: &[ChangeHash], discard: bool, command: &str) -> Result<CheckoutReport> {

        let snap = self.snapshot(command)?;

        if !discard && (!snap.wc.tree_ops.is_empty() || !snap.wc.edits.is_empty()) {

            return fail("the working copy has changes; commit them first or pass --discard");

        }

        let target_state = self.load_state(heads)?;

        let heads = target_state.maximal(heads);

        let target = target_state.materialize();

        let current = self.walk_working_copy()?;

        let mut report = CheckoutReport::default();

        // Remove tracked paths that the target does not have.

        let mut dirs_to_prune: BTreeSet<PathBuf> = BTreeSet::new();

        for path in current.keys() {

            if !target.files.contains_key(path) {

                let full = self.safe_path(path)?;

                fs::remove_file(&full)?;

                report.removed += 1;

                if let Some(parent) = full.parent() {

                    dirs_to_prune.insert(parent.to_path_buf());

                }

            }

        }

        // Write target files that differ.

        for (path, f) in &target.files {

            match &f.content {

                FileContent::Dir => continue,

                FileContent::Text { bytes, .. } => {

                    let same = current.get(path).is_some_and(|c| c.kind == NodeKind::File && &c.content == bytes && c.exec == f.mode.exec);

                    if !same {

                        self.write_file(path, bytes, f.mode.exec)?;

                        report.written += 1;

                    }

                }

                FileContent::Opaque { blobs } => {

                    let Some(blob) = blobs.first() else { continue };

                    let bytes = self.read_blob(blob)?;

                    if f.kind == NodeKind::Symlink {

                        let same = current.get(path).is_some_and(|c| c.kind == NodeKind::Symlink && c.content == bytes);

                        if !same {

                            self.write_symlink(path, &bytes)?;

                            report.written += 1;

                        }

                    } else {

                        let same = current.get(path).is_some_and(|c| c.kind == NodeKind::File && c.content == bytes && c.exec == f.mode.exec);

                        if !same {

                            self.write_file(path, &bytes, f.mode.exec)?;

                            report.written += 1;

                        }

                    }

                    if blobs.len() > 1 {

                        for (i, b) in blobs.iter().enumerate().skip(1) {

                            self.write_file(&format!("{path}.oxy-conflict-{}", i + 1), &self.read_blob(b)?, f.mode.exec)?;

                        }

                    }

                }

            }

        }

        // Prune directories left empty, deepest first.

        for d in dirs_to_prune.iter().rev() {

            let mut d = d.clone();

            while d != self.root && fs::read_dir(&d).map(|mut i| i.next().is_none()).unwrap_or(false) {

                fs::remove_dir(&d)?;

                let Some(p) = d.parent() else { break };

                d = p.to_path_buf();

            }

        }

        let (op_ref, op) = self.head_op()?;

        let wc = self.new_working_copy(heads, "");

        let wc_hash = self.store.put_change(&wc)?;

        let mut view = op.view.clone();

        view.workspaces.insert(self.workspace, wc_hash);

        self.record_op(&[op_ref], command, view)?;

        report.conflicted = target.is_conflicted();

        Ok(report)

    }

    /// The absolute path for a repository path, refusing anything that would

    /// escape the workspace or write through a symlink (spec §7.7).

    fn safe_path(&self, rel: &str) -> Result<PathBuf> {

        let mut full = self.root.clone();

        let comps: Vec<&str> = rel.split('/').collect();

        for (i, comp) in comps.iter().enumerate() {

            if comp.is_empty() || *comp == "." || *comp == ".." || comp.contains('\\') {

                return fail(format!("refusing unsafe path {rel:?}"));

            }

            if i == 0 && *comp == OXY_DIR {

                return fail(format!("refusing to write inside {OXY_DIR}: {rel:?}"));

            }

            if i + 1 < comps.len() {

                full.push(comp);

                if let Ok(m) = fs::symlink_metadata(&full) {

                    if m.file_type().is_symlink() {

                        return fail(format!("refusing to write through symlink {}", full.display()));

                    }

                }

            } else {

                full.push(comp);

            }

        }

        Ok(full)

    }

    fn write_file(&self, rel: &str, bytes: &[u8], exec: bool) -> Result<()> {

        let full = self.safe_path(rel)?;

        if let Some(parent) = full.parent() {

            fs::create_dir_all(parent)?;

        }

        if fs::symlink_metadata(&full).is_ok_and(|m| m.file_type().is_symlink() || m.is_dir()) {

            remove_any(&full)?;

        }

        fs::write(&full, bytes)?;

        set_executable(&full, exec)?;

        Ok(())

    }

    fn write_symlink(&self, rel: &str, target: &[u8]) -> Result<()> {

        let full = self.safe_path(rel)?;

        if let Some(parent) = full.parent() {

            fs::create_dir_all(parent)?;

        }

        if fs::symlink_metadata(&full).is_ok() {

            remove_any(&full)?;

        }

        #[cfg(unix)]

        {

            std::os::unix::fs::symlink(String::from_utf8_lossy(target).as_ref(), &full)?;

            Ok(())

        }

        #[cfg(not(unix))]

        {

            // Spec §7.7: without symlink support, write the target as a plain file.

            fs::write(&full, target)?;

            Ok(())

        }

    }

}

//! Layered configuration: defaults, the user file, the repository file.

use super::*;

/// Effective settings: defaults, then the user file (`~/.config/oxy/config.toml`,

/// spec §19), then the repository file (`.oxy/config`). Both files are

/// `key = "value"` lines. `save` writes only the repository layer.

#[derive(Clone, Debug, PartialEq, Eq)]

pub struct Config {

    /// Keys set in the repository file (or via `set`), written by `save`.

    repo_layer: BTreeMap<String, String>,

    pub author_name: String,

    pub author_email: String,

    /// The KeyId of the author's identity, once `create_identity` has run.

    pub author_key: Option<KeyId>,

    /// `core.sign`: sign every change at commit (`true`) or leave signing to

    /// push-time seals (`false`, the spec default).

    pub sign_changes: bool,

    pub bookmark: String,

    /// `remote.<name>.url`.

    pub remotes: BTreeMap<String, String>,

    /// `remote.<name>.token`: bearer token for HTTP pushes.

    pub remote_tokens: BTreeMap<String, String>,

}

impl Config {

    pub(super) fn default_for_user() -> Config {

        let user = std::env::var("USER").unwrap_or_else(|_| "unknown".into());

        Config {

            repo_layer: BTreeMap::new(),

            author_name: std::env::var("OXY_AUTHOR_NAME").unwrap_or_else(|_| user.clone()),

            author_email: std::env::var("OXY_AUTHOR_EMAIL").unwrap_or_else(|_| format!("{user}@localhost")),

            author_key: None,

            sign_changes: false,

            bookmark: "main".into(),

            remotes: BTreeMap::new(),

            remote_tokens: BTreeMap::new(),

        }

    }

    /// Set a key in the repository layer, as `oxy config` does.

    pub fn set(&mut self, key: &str, value: &str) -> Result<()> {

        self.apply(key, value)?;

        if value.is_empty() {

            self.repo_layer.remove(key);

        } else {

            self.repo_layer.insert(key.to_string(), value.to_string());

        }

        Ok(())

    }

    /// Set a key in the user file without touching any repository.

    pub fn set_user(user_path: &Path, key: &str, value: &str) -> Result<()> {

        Config::default_for_user().apply(key, value)?;

        let mut entries = read_config_file(user_path)?;

        if value.is_empty() {

            entries.remove(key);

        } else {

            entries.insert(key.to_string(), value.to_string());

        }

        if let Some(parent) = user_path.parent() {

            fs::create_dir_all(parent)?;

        }

        write_config_file(user_path, &entries)

    }

    /// Apply a key to the effective values.

    pub(super) fn apply(&mut self, key: &str, value: &str) -> Result<()> {

        match key {

            "author.name" => self.author_name = value.into(),

            "author.email" => self.author_email = value.into(),

            "author.key" => {

                self.author_key = if value.is_empty() {

                    None

                } else {

                    Some(KeyId::from_hex(value).ok_or_else(|| RepoError::Msg("author.key must be a 64-character hex KeyId".into()))?)

                }

            }

            "core.sign" => {

                self.sign_changes = match value {

                    "change" => true,

                    "seal" => false,

                    _ => return fail("core.sign must be \"change\" or \"seal\""),

                }

            }

            "workspace.bookmark" => self.bookmark = value.into(),

            k if k.starts_with("remote.") && (k.ends_with(".url") || k.ends_with(".token")) => {

                let (name, is_url) = match k.strip_suffix(".url") {

                    Some(n) => (&n["remote.".len()..], true),

                    None => (&k["remote.".len()..k.len() - ".token".len()], false),

                };

                if name.is_empty() || name.contains('/') {

                    return fail(format!("invalid remote name in {key:?}"));

                }

                let map = if is_url { &mut self.remotes } else { &mut self.remote_tokens };

                if value.is_empty() {

                    map.remove(name);

                    if is_url {

                        self.remote_tokens.remove(name);

                    }

                } else {

                    map.insert(name.to_string(), value.into());

                }

            }

            _ => return fail(format!("unknown configuration key {key:?}")),

        }

        Ok(())

    }

    /// Defaults, then the user file if it exists, then the repository file.

    pub(super) fn load(user_path: Option<&Path>, repo_path: &Path) -> Result<Config> {

        let mut c = Config::default_for_user();

        if let Some(u) = user_path {

            for (k, v) in read_config_file(u)? {

                let _ = c.apply(&k, &v);

            }

        }

        for (k, v) in read_config_file(repo_path)? {

            if c.apply(&k, &v).is_ok() {

                c.repo_layer.insert(k, v);

            }

        }

        Ok(c)

    }

    pub(super) fn save(&self, path: &Path) -> Result<()> {

        write_config_file(path, &self.repo_layer)

    }

    /// Keys explicitly set for this repository.

    pub fn repo_layer(&self) -> &BTreeMap<String, String> {

        &self.repo_layer

    }

}

/// Read `key = "value"` lines; a missing file is empty.

pub fn read_config_file(path: &Path) -> Result<BTreeMap<String, String>> {

    let text = match fs::read_to_string(path) {

        Ok(t) => t,

        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(BTreeMap::new()),

        Err(e) => return Err(e.into()),

    };

    let mut out = BTreeMap::new();

    for line in text.lines() {

        let line = line.trim();

        if line.is_empty() || line.starts_with('#') {

            continue;

        }

        let Some((k, v)) = line.split_once('=') else { continue };

        out.insert(k.trim().to_string(), v.trim().trim_matches('"').to_string());

    }

    Ok(out)

}

fn write_config_file(path: &Path, entries: &BTreeMap<String, String>) -> Result<()> {

    let text: String = entries.iter().map(|(k, v)| format!("{k} = \"{v}\"\n")).collect();

    write_atomic(path, text.as_bytes())

}

//! Identities, signing, and signature verification (spec §14).

use super::*;

/// Outcome of verifying the signatures on a change (spec §14.3, §14.4).

#[derive(Clone, Debug, PartialEq, Eq)]

pub enum SignatureStatus {

    Unsigned,

    Valid { key: KeyId, name: String, email: String, sealed: bool },

    Invalid(String),

}

impl Repo {

    // ------------------------------------------------------------ identity

    /// Generate a composite key pair, store its identity object, keep the

    /// secret in the key directory, and record the author at `scope`.

    pub fn create_identity(&mut self, name: &str, email: &str, scope: IdentityScope) -> Result<(KeyId, Identity)> {

        let sk = SecretKey::generate();

        let id = sk.identity(name, email, Hlc::now().wall_ms);

        let key = self.store.put_identity(&id)?;

        fs::create_dir_all(&self.keys_dir)?;

        let path = self.keys_dir.join(format!("{}.secret", key.to_hex()));

        write_atomic(&path, &sk.encode(&key))?;

        write_atomic(&self.keys_dir.join(format!("{}.identity", key.to_hex())), &id.encode())?;

        #[cfg(unix)]

        {

            use std::os::unix::fs::PermissionsExt;

            fs::set_permissions(&path, fs::Permissions::from_mode(0o600))?;

        }

        match scope {

            IdentityScope::Repo => {

                self.config.set("author.name", name)?;

                self.config.set("author.email", email)?;

                self.config.set("author.key", &key.to_hex())?;

                self.save_config()?;

            }

            IdentityScope::User => {

                Config::set_user(&self.user_config, "author.name", name)?;

                Config::set_user(&self.user_config, "author.email", email)?;

                Config::set_user(&self.user_config, "author.key", &key.to_hex())?;

                self.config = Config::load(Some(&self.user_config), &self.oxy.join("config"))?;

            }

        }

        Ok((key, id))

    }

    /// The secret key for `author.key`, if configured and present on disk.

    /// The identity object is kept beside the secret so a repository that has

    /// never seen it (a fresh clone) can store it when it first signs.

    pub fn secret_key(&self) -> Result<Option<(KeyId, SecretKey)>> {

        let Some(key) = self.config.author_key else { return Ok(None) };

        let path = self.keys_dir.join(format!("{}.secret", key.to_hex()));

        match fs::read(&path) {

            Ok(b) => {

                let (k, sk) = SecretKey::decode(&b)?;

                if k != key {

                    return fail(format!("{} holds a different key than its name", path.display()));

                }

                if !self.store.has(&key) {

                    let id_path = self.keys_dir.join(format!("{}.identity", key.to_hex()));

                    if let Ok(bytes) = fs::read(&id_path) {

                        let id = Identity::decode(&bytes)?;

                        if id.hash() == key {

                            self.store.put_identity(&id)?;

                        }

                    }

                }

                Ok(Some((k, sk)))

            }

            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),

            Err(e) => Err(e.into()),

        }

    }

    pub fn identity(&self, key: &KeyId) -> Result<Identity> {

        Ok(self.store.get_identity(key)?)

    }

    /// Sign a stored change with the configured secret key.

    pub fn sign_change(&self, hash: &ChangeHash) -> Result<Signature> {

        let Some((key, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let sig = sk.sign(Domain::Change, &key, hash);

        self.store.put_signature(hash, &sig)?;

        Ok(sig)

    }

    /// Check the signatures on a change against the author-or-delegate rule.

    pub fn verify_change(&self, hash: &ChangeHash) -> Result<SignatureStatus> {

        let change = self.store.get_change(hash)?;

        let sigs = self.store.signatures(hash)?;

        if sigs.is_empty() {

            return Ok(SignatureStatus::Unsigned);

        }

        let mut last_err = String::new();

        for sig in &sigs {

            match self.check_signer(&change, sig, Domain::Change, hash) {

                Ok(id) => return Ok(SignatureStatus::Valid { key: sig.key, name: id.name, email: id.email, sealed: false }),

                Err(e) => last_err = e,

            }

        }

        Ok(SignatureStatus::Invalid(last_err))

    }

    /// Verify `sig` over `target` and check the author-or-delegate rule for `change`.

    fn check_signer(&self, change: &Change, sig: &Signature, domain: Domain, target: &ObjectRef) -> std::result::Result<Identity, String> {

        let id = self.store.get_identity(&sig.key).map_err(|_| format!("unknown key {}", sig.key.short(12)))?;

        let authorised =

            sig.key == change.author || self.store.get_identity(&change.author).map(|a| a.delegates.contains(&sig.key)).unwrap_or(false);

        if !authorised {

            return Err(format!("key {} is neither the author nor a delegate", sig.key.short(12)));

        }

        verify_signature(&id, sig, domain, target).map_err(|e| e.to_string())?;

        Ok(id)

    }

    /// Like `verify_change`, but a change with no valid individual signature

    /// is also authenticated by a valid seal covering it (spec §14.4).

    pub fn authenticate_change(&self, hash: &ChangeHash) -> Result<SignatureStatus> {

        let direct = self.verify_change(hash)?;

        if matches!(direct, SignatureStatus::Valid { .. }) {

            return Ok(direct);

        }

        let change = self.store.get_change(hash)?;

        let mut last_err = match &direct {

            SignatureStatus::Invalid(e) => e.clone(),

            _ => String::new(),

        };

        for seal_ref in self.store.seals_for(hash)? {

            let attest = self.store.get_attest(&seal_ref)?;

            let AttestBody::Seal { hashes } = &attest.body else { continue };

            if !hashes.contains(hash) {

                continue;

            }

            for sig in self.store.signatures(&seal_ref)? {

                match self.check_signer(&change, &sig, Domain::Attest, &seal_ref) {

                    Ok(id) => return Ok(SignatureStatus::Valid { key: sig.key, name: id.name, email: id.email, sealed: true }),

                    Err(e) => last_err = e,

                }

            }

        }

        if last_err.is_empty() { Ok(SignatureStatus::Unsigned) } else { Ok(SignatureStatus::Invalid(last_err)) }

    }

    /// Store and sign an attestation with the configured key.

    pub(crate) fn sign_attest(&self, attest: &Attest) -> Result<SignedAttest> {

        let Some((key, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let r = self.store.put_attest(attest)?;

        let sig = sk.sign(Domain::Attest, &key, &r);

        self.store.put_signature(&r, &sig)?;

        if let AttestBody::Seal { hashes } = &attest.body {

            for h in hashes {

                self.store.index_seal(h, &r)?;

            }

        }

        Ok(SignedAttest { attest: attest.clone(), sigs: vec![sig] })

    }

}

//! A repository on disk: the `.oxy` directory, one workspace, the operation

//! log, and the working-copy change (spec §12, §13.1).

//!

//! Not yet implemented from the spec: trust policy (every remote is

//! "unverified", so unsigned pushes are accepted), packs, checkpoints,

//! multiple workspaces, and network transports (only local paths). Changes are signed individually when `core.sign` is

//! `change`; the default `seal` leaves them unsigned until push exists.

use crate::attest::{Attest, AttestBody};

use crate::diff::{ranges, split_lines, text_edits};

use crate::protocol::{open_remote, Bundle, RefResult, RefUpdate, RemoteRef, SignedAttest};

use crate::hash::{hash_object, ChangeHash, KeyId, ObjectRef, ObjectType};

use crate::identity::{verify as verify_signature, Domain, Identity, SecretKey, Signature};

use crate::ids::{ChangeId, NodeId, WorkspaceId};

use crate::objects::{Blob, Change, ChangeKind, Edit, Hlc, Mode, NodeKind, OpRef, StateObject, TreeOp};

use crate::oplog::{Format1Op, Op, View, SNAPSHOT_SUFFIX};

use crate::state::{FileContent, Snapshot, State};

use crate::store::{Store, StoreError};

use crate::tree::OpKey;

use rand::RngCore;

use std::collections::{BTreeMap, BTreeSet, HashMap};

use std::fs;

use std::io::Write;

use std::path::{Path, PathBuf};

pub const OXY_DIR: &str = ".oxy";

pub const FORMAT_LINE: &str = "oxy repository format 2\n";

const FORMAT1_LINE: &str = "oxy repository format 1\n";

const BINARY_SNIFF: usize = 8 * 1024;

#[derive(Debug, thiserror::Error)]

pub enum RepoError {

    #[error("io: {0}")]

    Io(#[from] std::io::Error),

    #[error(transparent)]

    Store(#[from] StoreError),

    #[error(transparent)]

    Object(#[from] crate::objects::ObjectError),

    #[error(transparent)]

    State(#[from] crate::state::StateError),

    #[error("{0}")]

    Msg(String),

}

pub type Result<T> = std::result::Result<T, RepoError>;

fn fail<T>(s: impl Into<String>) -> Result<T> {

    Err(RepoError::Msg(s.into()))

}

mod checkout;

mod config;

mod identity;

mod snapshot;

mod sync;

#[cfg(test)]

mod tests;

pub use checkout::CheckoutReport;

pub use config::{read_config_file, Config};

pub use identity::SignatureStatus;

pub use snapshot::{added_node_paths, has_conflict_markers, is_binary, referenced_changes, render_change, ChangeStatus, PathStatus, SnapshotResult};

pub use sync::PullReport;

fn write_atomic(path: &Path, data: &[u8]) -> Result<()> {

    let tmp = path.with_extension("tmp");

    {

        let mut f = fs::File::create(&tmp)?;

        f.write_all(data)?;

        f.sync_all()?;

    }

    fs::rename(&tmp, path)?;

    Ok(())

}

pub struct LogEntry {

    pub hash: ChangeHash,

    pub change: Change,

    pub is_working_copy: bool,

    pub is_head: bool,

}

struct FsEntry {

    kind: NodeKind,

    exec: bool,

    content: Vec<u8>,

}

pub struct Repo {

    root: PathBuf,

    oxy: PathBuf,

    store: Store,

    workspace: WorkspaceId,

    keys_dir: PathBuf,

    user_config: PathBuf,

    pub config: Config,

}

/// The user's oxy directory: `$OXY_HOME`, else `$XDG_CONFIG_HOME/oxy`, else

/// `~/.config/oxy`. It holds `config.toml` (spec §19) and `keys/`.

pub fn default_home() -> PathBuf {

    if let Ok(h) = std::env::var("OXY_HOME") {

        return PathBuf::from(h);

    }

    if let Ok(x) = std::env::var("XDG_CONFIG_HOME") {

        return PathBuf::from(x).join("oxy");

    }

    let home = std::env::var("HOME").unwrap_or_else(|_| ".".into());

    PathBuf::from(home).join(".config").join("oxy")

}

pub fn default_keys_dir() -> PathBuf {

    default_home().join("keys")

}

pub fn default_user_config() -> PathBuf {

    default_home().join("config.toml")

}

/// Where `create_identity` records the author.

#[derive(Clone, Copy, Debug, PartialEq, Eq)]

pub enum IdentityScope {

    /// The user file: every repository of this user signs with it.

    User,

    /// This repository only.

    Repo,

}

impl Repo {

    // ------------------------------------------------------------ lifecycle

    pub fn init(root: &Path) -> Result<Repo> {

        let mut id = [0u8; 16];

        rand::rngs::OsRng.fill_bytes(&mut id);

        Self::init_with_id(root, id)

    }

    /// Initialize a repository with a given repository ID (clones share the

    /// ID of their origin, spec §14.4).

    pub fn init_with_id(root: &Path, id: [u8; 16]) -> Result<Repo> {

        fs::create_dir_all(root)?;

        let root = root.canonicalize().unwrap_or_else(|_| root.to_path_buf());

        let oxy = root.join(OXY_DIR);

        if oxy.exists() {

            return fail(format!("{} is already an oxy repository", root.display()));

        }

        fs::create_dir_all(oxy.join("ops"))?;

        write_atomic(&oxy.join("format"), FORMAT_LINE.as_bytes())?;

        write_atomic(&oxy.join("id"), hex::encode(id).as_bytes())?;

        let config = Config::load(Some(&default_user_config()), &oxy.join("config"))?;

        config.save(&oxy.join("config"))?;

        let workspace = WorkspaceId::random();

        write_atomic(&oxy.join("workspace"), workspace.to_hex().as_bytes())?;

        let store = Store::open(oxy.join("objects"))?;

        let repo = Repo { root, oxy, store, workspace, keys_dir: default_keys_dir(), user_config: default_user_config(), config };

        let wc = repo.new_working_copy(vec![], "");

        let wc_hash = repo.store.put_change(&wc)?;

        let mut view = View::default();

        view.bookmarks.insert(repo.config.bookmark.clone(), repo.store.put_state(&StateObject::new(vec![]))?);

        view.workspaces.insert(workspace, wc_hash);

        repo.record_op(&[], "oxy init", view)?;

        Ok(repo)

    }

    /// Open the repository containing `start` (searching upwards).

    pub fn open(start: &Path) -> Result<Repo> {

        let start = start.canonicalize()?;

        let mut dir: Option<&Path> = Some(&start);

        while let Some(d) = dir {

            let oxy = d.join(OXY_DIR);

            if oxy.is_dir() {

                let format = fs::read_to_string(oxy.join("format"))?;

                let config = Config::load(Some(&default_user_config()), &oxy.join("config"))?;

                let workspace = WorkspaceId::from_hex(fs::read_to_string(oxy.join("workspace"))?.trim())

                    .ok_or_else(|| RepoError::Msg("corrupt .oxy/workspace".into()))?;

                let store = Store::open(oxy.join("objects"))?;

                let repo = Repo { root: d.to_path_buf(), oxy, store, workspace, keys_dir: default_keys_dir(), user_config: default_user_config(), config };

                if format == FORMAT1_LINE {

                    repo.migrate_format1()?;

                } else if format != FORMAT_LINE {

                    return fail(format!("unsupported repository format: {}", format.trim()));

                }

                return Ok(repo);

            }

            dir = d.parent();

        }

        fail(format!("no oxy repository found at or above {}", start.display()))

    }

    /// Rewrite a format-1 operation log, whose bookmarks were head lists,

    /// into format 2, where each bookmark names a `state` object.

    fn migrate_format1(&self) -> Result<()> {

        let hex = fs::read_to_string(self.oxy.join("ops").join("head"))?;

        let head = ObjectRef::from_hex(hex.trim()).ok_or_else(|| RepoError::Msg("corrupt .oxy/ops/head".into()))?;

        // Collect the chain root-first.

        let mut chain: Vec<Format1Op> = Vec::new();

        let mut cur = Some(head);

        while let Some(r) = cur {

            let op = Op::decode_format1(&self.store.get_typed(&r, ObjectType::Op)?)?;

            cur = op.parents.first().copied();

            chain.push(op);

        }

        chain.reverse();

        let mut new_parent: Option<ObjectRef> = None;

        for old in chain {

            let mut view = View::default();

            for (name, heads) in &old.view.bookmarks {

                view.bookmarks.insert(name.clone(), self.store.put_state(&StateObject::new(heads.clone()))?);

            }

            view.workspaces = old.view.workspaces.clone();

            let op = Op { parents: new_parent.into_iter().collect(), hlc: old.hlc, command: old.command, view };

            new_parent = Some(self.store.put(ObjectType::Op, &op.encode())?);

        }

        write_atomic(&self.oxy.join("ops").join("head"), new_parent.unwrap().to_hex().as_bytes())?;

        write_atomic(&self.oxy.join("format"), FORMAT_LINE.as_bytes())?;

        Ok(())

    }

    /// The repository ID (spec §14.4). Repositories made before IDs existed get one on first use.

    pub fn id(&self) -> Result<[u8; 16]> {

        let path = self.oxy.join("id");

        match fs::read_to_string(&path) {

            Ok(h) => hex::decode(h.trim()).ok().and_then(|v| v.try_into().ok()).ok_or_else(|| RepoError::Msg("corrupt .oxy/id".into())),

            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {

                let mut id = [0u8; 16];

                rand::rngs::OsRng.fill_bytes(&mut id);

                write_atomic(&path, hex::encode(id).as_bytes())?;

                Ok(id)

            }

            Err(e) => Err(e.into()),

        }

    }

    pub fn root(&self) -> &Path {

        &self.root

    }

    pub fn store(&self) -> &Store {

        &self.store

    }

    pub fn workspace(&self) -> WorkspaceId {

        self.workspace

    }

    /// Use a different user directory for keys and the user config file

    /// (tests, or `$OXY_HOME`). Reloads the effective configuration.

    pub fn with_home(mut self, dir: impl Into<PathBuf>) -> Repo {

        let dir = dir.into();

        self.keys_dir = dir.join("keys");

        self.user_config = dir.join("config.toml");

        if let Ok(c) = Config::load(Some(&self.user_config), &self.oxy.join("config")) {

            self.config = c;

        }

        self

    }

    pub fn user_config_path(&self) -> &Path {

        &self.user_config

    }

    /// Set a key in the user file and refresh the effective configuration.

    pub fn set_user_config(&mut self, key: &str, value: &str) -> Result<()> {

        Config::set_user(&self.user_config, key, value)?;

        self.config = Config::load(Some(&self.user_config), &self.oxy.join("config"))?;

        Ok(())

    }

    pub fn save_config(&self) -> Result<()> {

        self.config.save(&self.oxy.join("config"))

    }

    fn author(&self) -> KeyId {

        self.config.author_key.unwrap_or(ObjectRef::ZERO)

    }

}

impl Repo {

    fn new_working_copy(&self, deps: Vec<ChangeHash>, message: &str) -> Change {

        let mut c = Change {

            change_id: ChangeId::random(),

            deps,

            author: self.author(),

            hlc: Hlc::now(),

            message: message.into(),

            tree_ops: vec![],

            edits: vec![],

            kind: ChangeKind::WorkingCopy,

        };

        c.normalize();

        c

    }

    // ------------------------------------------------------------ operation log

    pub fn head_op(&self) -> Result<(ObjectRef, Op)> {

        let hex = fs::read_to_string(self.oxy.join("ops").join("head"))?;

        let r = ObjectRef::from_hex(hex.trim()).ok_or_else(|| RepoError::Msg("corrupt .oxy/ops/head".into()))?;

        let op = Op::decode(&self.store.get_typed(&r, ObjectType::Op)?)?;

        Ok((r, op))

    }

    pub fn view(&self) -> Result<View> {

        Ok(self.head_op()?.1.view)

    }

    fn record_op(&self, parents: &[ObjectRef], command: &str, view: View) -> Result<ObjectRef> {

        let op = Op { parents: parents.to_vec(), hlc: Hlc::now(), command: command.into(), view };

        let r = self.store.put(ObjectType::Op, &op.encode())?;

        write_atomic(&self.oxy.join("ops").join("head"), r.to_hex().as_bytes())?;

        Ok(r)

    }

    pub fn op_log(&self) -> Result<Vec<(ObjectRef, Op)>> {

        let mut out = Vec::new();

        let (mut r, mut op) = self.head_op()?;

        loop {

            let next = op.parents.first().copied();

            out.push((r, op));

            match next {

                Some(p) => {

                    r = p;

                    op = Op::decode(&self.store.get_typed(&r, ObjectType::Op)?)?;

                }

                None => break,

            }

        }

        Ok(out)

    }

    /// Undo the last user command (spec §12.1). Operations that only recorded

    /// a working-copy snapshot are skipped, since the files are still on disk

    /// and the next snapshot recreates them.

    pub fn undo(&self) -> Result<Op> {

        let (_, mut op) = self.head_op()?;

        while op.is_snapshot() {

            let Some(parent) = op.parents.first() else { break };

            op = Op::decode(&self.store.get_typed(parent, ObjectType::Op)?)?;

        }

        let Some(parent) = op.parents.first() else {

            return fail("nothing to undo");

        };

        let parent_op = Op::decode(&self.store.get_typed(parent, ObjectType::Op)?)?;

        write_atomic(&self.oxy.join("ops").join("head"), parent.to_hex().as_bytes())?;

        Ok(parent_op)

    }

    /// The last operation that was not a snapshot.

    pub fn last_command(&self) -> Result<Op> {

        let (_, mut op) = self.head_op()?;

        while op.is_snapshot() {

            let Some(parent) = op.parents.first() else { break };

            op = Op::decode(&self.store.get_typed(parent, ObjectType::Op)?)?;

        }

        Ok(op)

    }

    // ------------------------------------------------------------ states

    /// Load the dependency closure of `heads` from the store.

    pub fn load_state(&self, heads: &[ChangeHash]) -> Result<State> {

        let mut state = State::new();

        let mut stack: Vec<ChangeHash> = heads.to_vec();

        let mut seen: BTreeSet<ChangeHash> = BTreeSet::new();

        while let Some(h) = stack.pop() {

            if !seen.insert(h) {

                continue;

            }

            let c = self.store.get_change(&h)?;

            stack.extend(c.deps.iter().copied());

            state.add_unchecked(c);

        }

        state.validate()?;

        Ok(state)

    }

    pub fn working_copy(&self) -> Result<(ChangeHash, Change)> {

        let view = self.view()?;

        let h = *view

            .workspaces

            .get(&self.workspace)

            .ok_or_else(|| RepoError::Msg("this workspace is not in the current view".into()))?;

        Ok((h, self.store.get_change(&h)?))

    }

    /// Heads of a bookmark's state (spec §10.1).

    pub fn heads_of(&self, view: &View, bookmark: &str) -> Result<Vec<ChangeHash>> {

        match view.bookmarks.get(bookmark) {

            Some(st) => Ok(self.store.get_state(st)?.heads),

            None => Ok(vec![]),

        }

    }

    pub fn bookmark_heads(&self) -> Result<Vec<ChangeHash>> {

        self.heads_of(&self.view()?, &self.config.bookmark)

    }

    // ------------------------------------------------------------ blobs

    fn blob_for(content: &[u8]) -> Blob {

        Blob {

            length: content.len() as u64,

            chunks: crate::chunk::chunks(content).into_iter().map(|c| hash_object(ObjectType::Chunk, c)).collect(),

        }

    }

    pub fn blob_ref(content: &[u8]) -> ObjectRef {

        Self::blob_for(content).hash()

    }

    pub fn store_blob(&self, content: &[u8]) -> Result<ObjectRef> {

        for c in crate::chunk::chunks(content) {

            self.store.put_chunk(c)?;

        }

        Ok(self.store.put(ObjectType::Blob, &Self::blob_for(content).encode())?)

    }

    pub fn read_blob(&self, r: &ObjectRef) -> Result<Vec<u8>> {

        let blob = Blob::decode(&self.store.get_typed(r, ObjectType::Blob)?)?;

        let mut out = Vec::with_capacity(blob.length as usize);

        for c in &blob.chunks {

            out.extend(self.store.get_typed(c, ObjectType::Chunk)?);

        }

        Ok(out)

    }

    // ------------------------------------------------------------ working copy

    fn walk_working_copy(&self) -> Result<BTreeMap<String, FsEntry>> {

        let mut wb = ignore::WalkBuilder::new(&self.root);

        wb.hidden(false)

            .git_ignore(false)

            .git_global(false)

            .git_exclude(false)

            .require_git(false)

            .follow_links(false)

            .add_custom_ignore_filename(".oxyignore");

        wb.filter_entry(|e| e.file_name() != OXY_DIR);

        let mut out = BTreeMap::new();

        for entry in wb.build() {

            let entry = entry.map_err(|e| RepoError::Msg(e.to_string()))?;

            let path = entry.path();

            if path == self.root {

                continue;

            }

            let rel = path.strip_prefix(&self.root).unwrap();

            let rel: String = rel.components().map(|c| c.as_os_str().to_string_lossy().to_string()).collect::<Vec<_>>().join("/");

            let Some(ft) = entry.file_type() else { continue };

            if ft.is_dir() {

                continue;

            }

            if ft.is_symlink() {

                let target = fs::read_link(path)?;

                out.insert(rel, FsEntry { kind: NodeKind::Symlink, exec: false, content: target.to_string_lossy().as_bytes().to_vec() });

            } else if ft.is_file() {

                let exec = is_executable(&entry.metadata().map_err(|e| RepoError::Msg(e.to_string()))?);

                out.insert(rel, FsEntry { kind: NodeKind::File, exec, content: fs::read(path)? });

            }

        }

        Ok(out)

    }

}

impl Repo {

    /// Changes reachable from the bookmark and the working copy, newest first.

    pub fn log(&self) -> Result<Vec<LogEntry>> {

        let (wc_hash, _) = self.working_copy()?;

        let mut heads = self.bookmark_heads()?;

        heads.push(wc_hash);

        let state = self.load_state(&heads)?;

        let head_set: BTreeSet<ChangeHash> = self.bookmark_heads()?.into_iter().collect();

        let mut entries: Vec<LogEntry> = state

            .changes()

            .map(|(h, c)| LogEntry { hash: *h, change: c.clone(), is_working_copy: *h == wc_hash, is_head: head_set.contains(h) })

            .collect();

        entries.sort_by(|a, b| b.is_working_copy.cmp(&a.is_working_copy).then(b.change.hlc.cmp(&a.change.hlc)).then(b.hash.cmp(&a.hash)));

        Ok(entries)

    }

    /// Resolve a change by ChangeId prefix, `#hash` prefix, `@` (working copy), or bookmark.

    pub fn resolve_change(&self, spec: &str) -> Result<ChangeHash> {

        if spec == "@" {

            return Ok(self.working_copy()?.0);

        }

        if spec.is_empty() || spec == "#" {

            return fail("empty change specifier");

        }

        let entries = self.log()?;

        let matches: Vec<&LogEntry> = if let Some(hp) = spec.strip_prefix('#') {

            entries.iter().filter(|e| e.hash.starts_with_hex(hp)).collect()

        } else {

            entries.iter().filter(|e| e.change.change_id.starts_with_hex(spec)).collect()

        };

        match matches.len() {

            1 => Ok(matches[0].hash),

            0 => fail(format!("no change matches {spec:?}")),

            _ => {

                let ids: BTreeSet<ChangeId> = matches.iter().map(|e| e.change.change_id).collect();

                if ids.len() == 1 {

                    fail(format!("change {spec} is divergent: {} variants", matches.len()))

                } else {

                    fail(format!("{spec:?} is ambiguous"))

                }

            }

        }

    }

    /// Human-readable description of what a change does, with line content.

    pub fn describe_change(&self, hash: &ChangeHash) -> Result<String> {

        let change = self.store.get_change(hash)?;

        let base = self.load_state(&change.deps)?;

        let base_snapshot = base.materialize();

        Ok(render_change(&change, &base, &base_snapshot))

    }

}

fn remove_any(path: &Path) -> std::io::Result<()> {

    let m = fs::symlink_metadata(path)?;

    if m.is_dir() { fs::remove_dir_all(path) } else { fs::remove_file(path) }

}

#[cfg(unix)]

fn set_executable(path: &Path, exec: bool) -> std::io::Result<()> {

    use std::os::unix::fs::PermissionsExt;

    let mut perms = fs::metadata(path)?.permissions();

    let mode = perms.mode();

    let want = if exec { mode | 0o111 } else { mode & !0o111 };

    if want != mode {

        perms.set_mode(want);

        fs::set_permissions(path, perms)?;

    }

    Ok(())

}

#[cfg(not(unix))]

fn set_executable(_path: &Path, _exec: bool) -> std::io::Result<()> {

    Ok(())

}

#[cfg(unix)]

fn is_executable(m: &fs::Metadata) -> bool {

    use std::os::unix::fs::PermissionsExt;

    m.permissions().mode() & 0o111 != 0

}

#[cfg(not(unix))]

fn is_executable(_m: &fs::Metadata) -> bool {

    false

}

fn op_ref(k: OpKey) -> OpRef {

    OpRef { change: k.0, index: k.1 }

}

fn split_path(path: &str) -> (&str, &str) {

    match path.rfind('/') {

        Some(i) => (&path[..i], &path[i + 1..]),

        None => ("", path),

    }

}

//! Working-copy snapshots, commits, and the change builder (spec §12.3).

use super::*;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]

pub enum ChangeStatus {

    Added,

    Modified,

    Removed,

    ModeChanged,

    /// The file is conflicted in the base state and still contains conflict markers.

    ConflictEdited,

    /// The file was conflicted in the base state and the working copy resolves it.

    Resolved,

}

/// Lines that mark a conflict region in a materialized file (spec §9.5).

pub fn has_conflict_markers(content: &[u8]) -> bool {

    split_lines(content).iter().any(|l| {

        l.starts_with(b"<<<<<<< oxy conflict") || l.starts_with(b"======= oxy conflict") || l.starts_with(b">>>>>>> oxy conflict")

    })

}

#[derive(Clone, Debug, PartialEq, Eq)]

pub struct PathStatus {

    pub path: String,

    pub status: ChangeStatus,

}

/// Result of snapshotting the working copy.

pub struct SnapshotResult {

    pub wc_hash: ChangeHash,

    pub wc: Change,

    /// The base state (closure of the working-copy change's dependencies).

    pub base: State,

    pub base_snapshot: Snapshot,

    pub statuses: Vec<PathStatus>,

    /// Whether the snapshot rewrote the working-copy change.

    pub changed: bool,

    /// Whether the working copy resolves conflicts of its base (spec §9.6).

    pub resolves: bool,

    /// Changes that contributed to the conflicts being resolved.

    pub contributors: Vec<ChangeHash>,

}

pub fn is_binary(content: &[u8]) -> bool {

    content[..content.len().min(BINARY_SNIFF)].contains(&0)

}

impl Repo {

    /// Snapshot the working copy into the working-copy change (spec §12.3).

    pub fn snapshot(&self, command: &str) -> Result<SnapshotResult> {

        let (op_ref, op) = self.head_op()?;

        let (old_hash, old_wc) = self.working_copy()?;

        let base = self.load_state(&old_wc.deps)?;

        let base_snapshot = base.materialize();

        let fs_entries = self.walk_working_copy()?;

        // Reuse the NodeIds the previous working-copy version assigned to new

        // paths, so an unchanged working copy hashes identically (spec §12.3).

        let reuse = added_node_paths(&old_wc, &base_snapshot);

        let mut b = ChangeBuilder::new(&base, &base_snapshot, reuse);

        for (path, fs_entry) in &fs_entries {

            match base_snapshot.files.get(path) {

                None => b.add_path(self, path, fs_entry)?,

                Some(expected) => b.update_path(self, path, fs_entry, expected)?,

            }

        }

        for (path, expected) in &base_snapshot.files {

            if fs_entries.contains_key(path) {

                continue;

            }

            let still_needed = expected.kind == NodeKind::Dir && fs_entries.keys().any(|p| p.starts_with(&format!("{path}/")));

            if !still_needed {

                b.remove_path(path, expected);

            }

        }

        let mut wc = Change {

            change_id: old_wc.change_id,

            deps: vec![],

            author: self.author(),

            hlc: old_wc.hlc,

            message: old_wc.message.clone(),

            tree_ops: b.tree_ops,

            edits: b.edits,

            kind: ChangeKind::WorkingCopy,

        };

        let base_heads = base.maximal(&old_wc.deps);

        let mut deps: BTreeSet<ChangeHash> = base_heads.into_iter().collect();

        deps.extend(referenced_changes(&wc, &base));

        deps.extend(b.contributors.iter().copied());

        wc.deps = deps.into_iter().collect();

        wc.normalize();

        let resolves = b.resolves;

        let contributors: Vec<ChangeHash> = b.contributors.iter().copied().collect();

        let mut statuses = b.statuses;

        statuses.sort_by(|a, b| a.path.cmp(&b.path));

        // Empty snapshot: hash the candidate before storing; only record an op on change.

        let new_hash = wc.hash();

        let changed = new_hash != old_hash;

        if changed {

            self.store.put_change(&wc)?;

            let mut view = op.view.clone();

            view.workspaces.insert(self.workspace, new_hash);

            self.record_op(&[op_ref], &format!("{command}{SNAPSHOT_SUFFIX}"), view)?;

        }

        Ok(SnapshotResult { wc_hash: new_hash, wc, base, base_snapshot, statuses, changed, resolves, contributors })

    }

    /// Turn the working-copy change into a normal change on the bookmark (spec §12.3).

    pub fn commit(&self, message: &str, extra_deps: &[ChangeHash]) -> Result<ChangeHash> {

        let snap = self.snapshot("oxy commit")?;

        if snap.wc.tree_ops.is_empty() && snap.wc.edits.is_empty() {

            return fail("nothing to commit: the working copy matches its base");

        }

        if let Some(s) = snap.statuses.iter().find(|s| s.status == ChangeStatus::ConflictEdited) {

            return fail(format!("{} still contains conflict markers", s.path));

        }

        if message.trim().is_empty() {

            return fail("a commit message is required");

        }

        let (op_ref, op) = self.head_op()?;

        let mut deps: BTreeSet<ChangeHash> = referenced_changes(&snap.wc, &snap.base);

        // A resolution depends on every change that contributed to the

        // conflict (spec §8.1). Tree and opaque conflicts are resolved through

        // ordinary operations whose references already cover the contributors.

        deps.extend(snap.contributors.iter().copied());

        for d in extra_deps {

            if !snap.base.contains(d) {

                return fail(format!("--depends-on {d}: not in the working copy's base state"));

            }

            deps.insert(*d);

        }

        if self.config.sign_changes && self.secret_key()?.is_none() {

            return fail("core.sign is \"change\" but no secret key is available for author.key");

        }

        let mut change = Change {

            change_id: snap.wc.change_id,

            deps: deps.into_iter().collect(),

            author: self.author(),

            hlc: Hlc::now(),

            message: message.trim_end().to_string(),

            tree_ops: snap.wc.tree_ops.clone(),

            edits: snap.wc.edits.clone(),

            kind: if snap.resolves { ChangeKind::Resolution } else { ChangeKind::Normal },

        };

        change.normalize();

        let hash = self.store.put_change(&change)?;

        if self.config.sign_changes {

            self.sign_change(&hash)?;

        }

        // New bookmark heads: maximal elements of old heads plus the new change.

        // The working copy continues on its own base plus the new change, which

        // is exactly what the files on disk contain; the bookmark may hold

        // other heads (and conflicts) the working copy has not checked out.

        let old_heads = self.heads_of(&op.view, &self.config.bookmark)?;

        let old_base = snap.base.maximal(&snap.wc.deps);

        let mut all: Vec<ChangeHash> = old_heads.clone();

        all.extend(old_base.iter().copied());

        all.push(hash);

        let mut st = self.load_state(&all)?;

        st.add(change)?;

        let mut with_new = old_heads.clone();

        with_new.push(hash);

        let new_heads = st.maximal(&with_new);

        let mut wc_base = old_base.clone();

        wc_base.push(hash);

        let wc_base = st.maximal(&wc_base);

        let wc = self.new_working_copy(wc_base, "");

        let wc_hash = self.store.put_change(&wc)?;

        let mut view = op.view.clone();

        view.bookmarks.insert(self.config.bookmark.clone(), self.store.put_state(&StateObject::new(new_heads))?);

        view.workspaces.insert(self.workspace, wc_hash);

        self.record_op(&[op_ref], &format!("oxy commit -m {message:?}"), view)?;

        Ok(hash)

    }

}

/// Builds the tree ops and edits of a working-copy change against a base.

struct ChangeBuilder<'a> {

    base: &'a State,

    base_snapshot: &'a Snapshot,

    tree_ops: Vec<TreeOp>,

    edits: Vec<Edit>,

    statuses: Vec<PathStatus>,

    dir_nodes: HashMap<String, NodeId>,

    reuse: HashMap<String, (NodeId, NodeKind)>,

    /// Changes that contributed to conflicts this working copy resolves.

    contributors: BTreeSet<ChangeHash>,

    resolves: bool,

}

impl<'a> ChangeBuilder<'a> {

    fn new(base: &'a State, base_snapshot: &'a Snapshot, reuse: HashMap<String, (NodeId, NodeKind)>) -> Self {

        let mut dir_nodes: HashMap<String, NodeId> = HashMap::new();

        dir_nodes.insert(String::new(), NodeId::ROOT);

        for (p, f) in &base_snapshot.files {

            if f.kind == NodeKind::Dir {

                dir_nodes.insert(p.clone(), f.node);

            }

        }

        ChangeBuilder { base, base_snapshot, tree_ops: vec![], edits: vec![], statuses: vec![], dir_nodes, reuse, contributors: BTreeSet::new(), resolves: false }

    }

    fn reused_node(&self, path: &str, kind: NodeKind) -> Option<NodeId> {

        self.reuse.get(path).filter(|(_, k)| *k == kind).map(|(n, _)| *n)

    }

    fn ensure_dir(&mut self, path: &str) -> NodeId {

        if let Some(n) = self.dir_nodes.get(path) {

            return *n;

        }

        let mut parent = NodeId::ROOT;

        let mut prefix = String::new();

        for comp in path.split('/') {

            if !prefix.is_empty() {

                prefix.push('/');

            }

            prefix.push_str(comp);

            parent = match self.dir_nodes.get(&prefix) {

                Some(n) => *n,

                None => {

                    let node = self.reused_node(&prefix, NodeKind::Dir).unwrap_or_else(NodeId::random);

                    self.tree_ops.push(TreeOp::AddNode { node, kind: NodeKind::Dir, mode: Mode::default(), parent, name: comp.to_string() });

                    self.dir_nodes.insert(prefix.clone(), node);

                    node

                }

            };

        }

        parent

    }

    fn add_path(&mut self, repo: &Repo, path: &str, e: &FsEntry) -> Result<()> {

        let (dir, name) = split_path(path);

        let parent = self.ensure_dir(dir);

        let node = self.reused_node(path, e.kind).unwrap_or_else(NodeId::random);