//! Google Cloud Storage: `gs://BUCKET/PREFIX`.

//!

//! Credentials, in Google's own order: a service account key file named

//! by `?credentials=PATH` or `GOOGLE_APPLICATION_CREDENTIALS` (which may

//! also hold application default credentials), the key or path in

//! `GOOGLE_SERVICE_ACCOUNT*`, then the application default credentials

//! `gcloud auth application-default login` wrote, then the instance's

//! service account. `?endpoint=URL` points at an emulator, and

//! `?anonymous=1` skips signing for one.

use crate::StoreUrl;

use object_store::gcp::{GoogleCloudStorage, GoogleCloudStorageBuilder};

use oxy_core::strata::{Error, Result};

pub const HINT: &str = "run `gcloud auth application-default login`, or set GOOGLE_APPLICATION_CREDENTIALS (or add ?credentials=PATH to the remote URL) to a service account key file";

/// Whether a credentials file is a service account key, as opposed to

/// application default credentials.

fn is_service_account_key(path: &str) -> bool {

    std::fs::read_to_string(path)

        .ok()

        .and_then(|t| serde_json::from_str::<serde_json::Value>(&t).ok())

        .and_then(|v| {

            v.get("type")

                .and_then(|t| t.as_str())

                .map(|t| t == "service_account")

        })

        .unwrap_or(false)

}

pub fn open(url: &StoreUrl) -> Result<GoogleCloudStorage> {

    let mut b = GoogleCloudStorageBuilder::from_env().with_bucket_name(&url.host);

    let file = url.param("credentials").map(str::to_string).or_else(|| {

        std::env::var("GOOGLE_APPLICATION_CREDENTIALS")

            .ok()

            .filter(|v| !v.is_empty())

    });

    if let Some(path) = file {

        if !std::path::Path::new(&path).is_file() {

            return Err(Error::Backend(format!(

                "{}: the credentials file {path} does not exist: {HINT}",

                url.plain()

            )));

        }

        b = if is_service_account_key(&path) {

            b.with_service_account_path(path)

        } else {

            b.with_application_credentials(path)

        };

    }

    if let Some(endpoint) = url.param("endpoint") {

        b = b.with_base_url(endpoint);

    }

    if url.param("anonymous").is_some_and(|v| v != "0") {

        // An emulator checks no token, but the client would still ask the

        // metadata server for one: give it a token to send.

        b = b.with_bearer_token("anonymous").with_skip_signature(true);

    }

    b.build()

        .map_err(|e| Error::Backend(format!("{}: {e}: {HINT}", url.plain())))

}