//! Google Cloud Storage: `gs://BUCKET/PREFIX`.

//!

//! Credentials, in Google's own order: a service account key file named

//! by `?credentials=PATH` or `GOOGLE_APPLICATION_CREDENTIALS` (which may

//! also hold application default credentials), the key or path in

//! `GOOGLE_SERVICE_ACCOUNT*`, then the application default credentials

//! `gcloud auth application-default login` wrote, then the instance's

//! service account. `?endpoint=URL` points at an emulator, and

//! `?anonymous=1` skips signing for one.

use crate::StoreUrl;

use object_store::gcp::{GoogleCloudStorage, GoogleCloudStorageBuilder};

use oxy_core::strata::{Error, Result};

pub const HINT: &str = "run `gcloud auth application-default login`, or set GOOGLE_APPLICATION_CREDENTIALS (or add ?credentials=PATH to the remote URL) to a service account key file";

/// Whether a credentials file is a service account key, as opposed to

/// application default credentials.

fn is_service_account_key(path: &str) -> bool {

    std::fs::read_to_string(path)

        .ok()

        .and_then(|t| serde_json::from_str::<serde_json::Value>(&t).ok())

        .and_then(|v| {

            v.get("type")

                .and_then(|t| t.as_str())

                .map(|t| t == "service_account")

        })

        .unwrap_or(false)

}

/// With `key` (a service account key's JSON) given, only it is used.

pub fn open(url: &StoreUrl, key: Option<&str>) -> Result<GoogleCloudStorage> {

    if let Some(key) = key {

        let mut b = GoogleCloudStorageBuilder::new()

            .with_bucket_name(&url.host)

            .with_http_connector(crate::http::UreqConnector)

            .with_service_account_key(key);

        if let Some(endpoint) = url.param("endpoint") {

            b = b.with_base_url(endpoint);

        }

        return b

            .build()

            .map_err(|e| Error::Backend(format!("{}: {e}", url.plain())));

    }

    let mut b = GoogleCloudStorageBuilder::from_env()

        .with_bucket_name(&url.host)

        .with_http_connector(crate::http::UreqConnector);

    let file = url.param("credentials").map(str::to_string).or_else(|| {

        std::env::var("GOOGLE_APPLICATION_CREDENTIALS")

            .ok()

            .filter(|v| !v.is_empty())

    });

    if let Some(path) = file {

        if !std::path::Path::new(&path).is_file() {

            return Err(Error::Backend(format!(

                "{}: the credentials file {path} does not exist: {HINT}",

                url.plain()

            )));

        }

        b = if is_service_account_key(&path) {

            b.with_service_account_path(path)

        } else {

            b.with_application_credentials(path)

        };

    }

    if let Some(endpoint) = url.param("endpoint") {

        b = b.with_base_url(endpoint);

    }

    b.build()

        .map_err(|e| Error::Backend(format!("{}: {e}: {HINT}", url.plain())))

}