//! `oxy seal --flow RUN_URL --job NAME [--reject]` (oxygenhub#235): sign an
//! approval of one job of one run with your key, so the hub can show, and
//! anyone can check, who released it. The hub says what the job is (its
//! hash with its sandbox, the state, the plan it takes, the environment);
//! the signature covers exactly that and nothing else.

use super::{open, ui};
use anyhow::{anyhow, bail, Context, Result};
use oxy_core::approval::{SignedApproval, Statement};
use oxy_core::hash::ObjectRef;
use serde_json::Value;

/// `https://hub/OWNER/NAME/flow/N` to the hub's base, `OWNER/NAME`, N and
/// the repository's URL.
fn run_url(url: &str) -> Result<(String, String, i64, String)> {
    let url = url.trim_end_matches('/');
    let (repo_url, n) = url
        .rsplit_once("/flow/")
        .ok_or_else(|| anyhow!("{url} is not a run URL (…/OWNER/NAME/flow/N)"))?;
    let number: i64 = n
        .parse()
        .map_err(|_| anyhow!("{url} is not a run URL (…/OWNER/NAME/flow/N)"))?;
    let (rest, name) = repo_url
        .rsplit_once('/')
        .ok_or_else(|| anyhow!("{url} is not a run URL"))?;
    let (base, owner) = rest
        .rsplit_once('/')
        .ok_or_else(|| anyhow!("{url} is not a run URL"))?;
    Ok((
        base.to_string(),
        format!("{owner}/{name}"),
        number,
        repo_url.to_string(),
    ))
}

fn to_hex(b: &[u8]) -> String {
    b.iter().map(|x| format!("{x:02x}")).collect()
}

fn oref(v: &Value, key: &str) -> Result<ObjectRef> {
    v.get(key)
        .and_then(Value::as_str)
        .and_then(ObjectRef::from_hex)
        .ok_or_else(|| anyhow!("the hub's statement has no valid {key}"))
}

pub fn seal(url: &str, job: &str, reject: bool, as_json: bool) -> Result<i32> {
    let repo = open()?;
    let (base, slug, number, repo_url) = run_url(url)?;
    let options = repo.options_for_url(&repo_url);
    let api = format!("{base}/api/v1/repos/{slug}/flow/runs/{number}/jobs/{job}/approval");
    let body = oxy_core::protocol::http_get(&api, &options).map_err(|e| anyhow!("{e}"))?;
    let v: Value = serde_json::from_slice(&body).context("the hub did not answer with JSON")?;
    let repo_hex = v.get("repo").and_then(Value::as_str).unwrap_or("");
    let mine = to_hex(&repo.id()?);
    if repo_hex != mine {
        bail!("run #{number} belongs to repository {repo_hex}, not this checkout's ({mine}): run oxy seal --flow from a checkout of {slug}");
    }
    let mut repo_id = [0u8; 16];
    for (i, b) in repo_id.iter_mut().enumerate() {
        *b = u8::from_str_radix(&repo_hex[i * 2..i * 2 + 2], 16)?;
    }
    let inputs = v
        .get("inputs")
        .and_then(Value::as_array)
        .map(|a| {
            a.iter()
                .filter_map(|x| x.as_str().and_then(ObjectRef::from_hex))
                .collect::<Vec<_>>()
        })
        .unwrap_or_default();
    let statement = Statement {
        repo: repo_id,
        run: v
            .get("run")
            .and_then(Value::as_str)
            .unwrap_or(url)
            .to_string(),
        job: job.to_string(),
        job_hash: oref(&v, "job_hash")?,
        state: oref(&v, "state")?,
        inputs,
        environment: v
            .get("environment")
            .and_then(Value::as_str)
            .unwrap_or("")
            .to_string(),
        approve: !reject,
    };
    let (key, sk) = repo
        .secret_key()?
        .ok_or_else(|| anyhow!("no signing key: create one with `oxy identity new`"))?;
    let me = repo.identity(&key)?;
    let signed = SignedApproval::sign(&statement, &me, &sk);
    let post = format!("{base}/api/v1/repos/{slug}/flow/runs/{number}/jobs/{job}/seal");
    let payload = serde_json::json!({ "signed": to_hex(&signed.encode()) }).to_string();
    let (code, answer) = oxy_core::protocol::http_json("POST", &post, Some(&payload), &options)
        .map_err(|e| anyhow!("{e}"))?;
    if !(200..300).contains(&code) {
        let why = serde_json::from_str::<Value>(&answer)
            .ok()
            .and_then(|v| v.get("error").and_then(Value::as_str).map(String::from));
        bail!(
            "the hub refused the seal (HTTP {code}): {}",
            why.unwrap_or(answer)
        );
    }
    if as_json {
        println!("{answer}");
    } else {
        let verb = if reject { "Rejected" } else { "Approved" };
        println!(
            "{} {job} of run #{number} with key {}",
            ui::done(verb),
            &key.to_hex()[..12]
        );
        println!(
            "  state {} · job {}",
            &statement.state.to_hex()[..12],
            &statement.job_hash.to_hex()[..12]
        );
        for i in &statement.inputs {
            println!("  takes {}", &i.to_hex()[..12]);
        }
        if !statement.environment.is_empty() {
            println!("  for environment {}", statement.environment);
        }
    }
    Ok(0)
}

#[cfg(test)]
mod tests {
    #[test]
    fn run_urls_are_read() {
        let (base, slug, n, repo) =
            super::run_url("https://oxygenhub.io/andymccall/oxygenhub-gcp/flow/8/").unwrap();
        assert_eq!(
            (base.as_str(), slug.as_str(), n, repo.as_str()),
            (
                "https://oxygenhub.io",
                "andymccall/oxygenhub-gcp",
                8,
                "https://oxygenhub.io/andymccall/oxygenhub-gcp"
            )
        );
        assert!(super::run_url("https://oxygenhub.io/andymccall/x/proposal/3").is_err());
        assert!(super::run_url("https://oxygenhub.io/andymccall/x/flow/abc").is_err());
    }
}