//! A repository on disk: the `.oxy` directory, one workspace, the operation

//! log, and the working-copy change (spec §12, §13.1).

//!

//! Not yet implemented from the spec: seals, attestations and trust policy,

//! packs, checkpoints, multiple workspaces, and remotes. Changes are signed individually when `core.sign` is

//! `change`; the default `seal` leaves them unsigned until push exists.

use crate::diff::{ranges, split_lines, text_edits};

use crate::hash::{hash_object, ChangeHash, KeyId, ObjectRef, ObjectType};

use crate::identity::{self, Domain, Identity, SecretKey, Signature};

use crate::ids::{ChangeId, NodeId, WorkspaceId};

use crate::objects::{Blob, Change, ChangeKind, Edit, Hlc, Mode, NodeKind, OpRef, TreeOp};

use crate::oplog::{Op, View, SNAPSHOT_SUFFIX};

use crate::state::{FileContent, Snapshot, State};

use crate::store::{Store, StoreError};

use crate::tree::OpKey;

use std::collections::{BTreeMap, BTreeSet, HashMap};

use std::fs;

use std::io::Write;

use std::path::{Path, PathBuf};

pub const OXY_DIR: &str = ".oxy";

pub const FORMAT_LINE: &str = "oxy repository format 1\n";

const BINARY_SNIFF: usize = 8 * 1024;

#[derive(Debug, thiserror::Error)]

pub enum RepoError {

    #[error("io: {0}")]

    Io(#[from] std::io::Error),

    #[error(transparent)]

    Store(#[from] StoreError),

    #[error(transparent)]

    Object(#[from] crate::objects::ObjectError),

    #[error(transparent)]

    State(#[from] crate::state::StateError),

    #[error("{0}")]

    Msg(String),

}

pub type Result<T> = std::result::Result<T, RepoError>;

fn fail<T>(s: impl Into<String>) -> Result<T> {

    Err(RepoError::Msg(s.into()))

}

/// Repository-local settings (`.oxy/config`, `key = value` lines).

#[derive(Clone, Debug, PartialEq, Eq)]

pub struct Config {

    pub author_name: String,

    pub author_email: String,

    /// The KeyId of the author's identity, once `create_identity` has run.

    pub author_key: Option<KeyId>,

    /// `core.sign`: sign every change at commit (`true`) or leave signing to

    /// push-time seals (`false`, the spec default).

    pub sign_changes: bool,

    pub bookmark: String,

}

impl Config {

    fn default_for_user() -> Config {

        let user = std::env::var("USER").unwrap_or_else(|_| "unknown".into());

        Config {

            author_name: std::env::var("OXY_AUTHOR_NAME").unwrap_or_else(|_| user.clone()),

            author_email: std::env::var("OXY_AUTHOR_EMAIL").unwrap_or_else(|_| format!("{user}@localhost")),

            author_key: None,

            sign_changes: false,

            bookmark: "main".into(),

        }

    }

    /// Set a key as `oxy config` does; returns false for unknown keys.

    pub fn set(&mut self, key: &str, value: &str) -> Result<()> {

        match key {

            "author.name" => self.author_name = value.into(),

            "author.email" => self.author_email = value.into(),

            "author.key" => {

                self.author_key = if value.is_empty() {

                    None

                } else {

                    Some(KeyId::from_hex(value).ok_or_else(|| RepoError::Msg("author.key must be a 64-character hex KeyId".into()))?)

                }

            }

            "core.sign" => {

                self.sign_changes = match value {

                    "change" => true,

                    "seal" => false,

                    _ => return fail("core.sign must be \"change\" or \"seal\""),

                }

            }

            "workspace.bookmark" => self.bookmark = value.into(),

            _ => return fail(format!("unknown configuration key {key:?}")),

        }

        Ok(())

    }

    fn load(path: &Path) -> Result<Config> {

        let mut c = Config::default_for_user();

        for line in fs::read_to_string(path)?.lines() {

            let line = line.trim();

            if line.is_empty() || line.starts_with('#') {

                continue;

            }

            let Some((k, v)) = line.split_once('=') else { continue };

            let v = v.trim().trim_matches('"').to_string();

            let _ = c.set(k.trim(), &v);

        }

        Ok(c)

    }

    fn save(&self, path: &Path) -> Result<()> {

        let text = format!(

            "author.name = \"{}\"\nauthor.email = \"{}\"\nauthor.key = \"{}\"\ncore.sign = \"{}\"\nworkspace.bookmark = \"{}\"\n",

            self.author_name,

            self.author_email,

            self.author_key.map(|k| k.to_hex()).unwrap_or_default(),

            if self.sign_changes { "change" } else { "seal" },

            self.bookmark

        );

        write_atomic(path, text.as_bytes())

    }

}

fn write_atomic(path: &Path, data: &[u8]) -> Result<()> {

    let tmp = path.with_extension("tmp");

    {

        let mut f = fs::File::create(&tmp)?;

        f.write_all(data)?;

        f.sync_all()?;

    }

    fs::rename(&tmp, path)?;

    Ok(())

}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]

pub enum ChangeStatus {

    Added,

    Modified,

    Removed,

    ModeChanged,

    /// The file is conflicted in the base state and still contains conflict markers.

    ConflictEdited,

    /// The file was conflicted in the base state and the working copy resolves it.

    Resolved,

}

/// Lines that mark a conflict region in a materialized file (spec §9.5).

pub fn has_conflict_markers(content: &[u8]) -> bool {

    split_lines(content).iter().any(|l| {

        l.starts_with(b"<<<<<<< oxy conflict") || l.starts_with(b"======= oxy conflict") || l.starts_with(b">>>>>>> oxy conflict")

    })

}

#[derive(Clone, Debug, PartialEq, Eq)]

pub struct PathStatus {

    pub path: String,

    pub status: ChangeStatus,

}

/// Result of snapshotting the working copy.

pub struct SnapshotResult {

    pub wc_hash: ChangeHash,

    pub wc: Change,

    /// The base state (closure of the working-copy change's dependencies).

    pub base: State,

    pub base_snapshot: Snapshot,

    pub statuses: Vec<PathStatus>,

    /// Whether the snapshot rewrote the working-copy change.

    pub changed: bool,

    /// Whether the working copy resolves conflicts of its base (spec §9.6).

    pub resolves: bool,

}

pub struct LogEntry {

    pub hash: ChangeHash,

    pub change: Change,

    pub is_working_copy: bool,

    pub is_head: bool,

}

struct FsEntry {

    kind: NodeKind,

    exec: bool,

    content: Vec<u8>,

}

pub struct Repo {

    root: PathBuf,

    oxy: PathBuf,

    store: Store,

    workspace: WorkspaceId,

    keys_dir: PathBuf,

    pub config: Config,

}

/// Where secret keys live: `$OXY_HOME/keys`, else `$XDG_CONFIG_HOME/oxy/keys`,

/// else `~/.config/oxy/keys`.

pub fn default_keys_dir() -> PathBuf {

    if let Ok(h) = std::env::var("OXY_HOME") {

        return PathBuf::from(h).join("keys");

    }

    if let Ok(x) = std::env::var("XDG_CONFIG_HOME") {

        return PathBuf::from(x).join("oxy").join("keys");

    }

    let home = std::env::var("HOME").unwrap_or_else(|_| ".".into());

    PathBuf::from(home).join(".config").join("oxy").join("keys")

}

/// Outcome of verifying the signatures on a change (spec §14.3, §14.4).

#[derive(Clone, Debug, PartialEq, Eq)]

pub enum SignatureStatus {

    Unsigned,

    Valid { key: KeyId, name: String, email: String },

    Invalid(String),

}

pub fn is_binary(content: &[u8]) -> bool {

    content[..content.len().min(BINARY_SNIFF)].contains(&0)

}

impl Repo {

    // ------------------------------------------------------------ lifecycle

    pub fn init(root: &Path) -> Result<Repo> {

        let root = root.canonicalize().unwrap_or_else(|_| root.to_path_buf());

        let oxy = root.join(OXY_DIR);

        if oxy.exists() {

            return fail(format!("{} is already an oxy repository", root.display()));

        }

        fs::create_dir_all(oxy.join("ops"))?;

        write_atomic(&oxy.join("format"), FORMAT_LINE.as_bytes())?;

        let config = Config::default_for_user();

        config.save(&oxy.join("config"))?;

        let workspace = WorkspaceId::random();

        write_atomic(&oxy.join("workspace"), workspace.to_hex().as_bytes())?;

        let store = Store::open(oxy.join("objects"))?;

        let repo = Repo { root, oxy, store, workspace, keys_dir: default_keys_dir(), config };

        let wc = repo.new_working_copy(vec![], "");

        let wc_hash = repo.store.put_change(&wc)?;

        let mut view = View::default();

        view.bookmarks.insert(repo.config.bookmark.clone(), vec![]);

        view.workspaces.insert(workspace, wc_hash);

        repo.record_op(&[], "oxy init", view)?;

        Ok(repo)

    }

    /// Open the repository containing `start` (searching upwards).

    pub fn open(start: &Path) -> Result<Repo> {

        let start = start.canonicalize()?;

        let mut dir: Option<&Path> = Some(&start);

        while let Some(d) = dir {

            let oxy = d.join(OXY_DIR);

            if oxy.is_dir() {

                let format = fs::read_to_string(oxy.join("format"))?;

                if format != FORMAT_LINE {

                    return fail(format!("unsupported repository format: {}", format.trim()));

                }

                let config = Config::load(&oxy.join("config"))?;

                let workspace = WorkspaceId::from_hex(fs::read_to_string(oxy.join("workspace"))?.trim())

                    .ok_or_else(|| RepoError::Msg("corrupt .oxy/workspace".into()))?;

                let store = Store::open(oxy.join("objects"))?;

                return Ok(Repo { root: d.to_path_buf(), oxy, store, workspace, keys_dir: default_keys_dir(), config });

            }

            dir = d.parent();

        }

        fail(format!("no oxy repository found at or above {}", start.display()))

    }

    pub fn root(&self) -> &Path {

        &self.root

    }

    pub fn store(&self) -> &Store {

        &self.store

    }

    pub fn workspace(&self) -> WorkspaceId {

        self.workspace

    }

    /// Use a different secret key directory (tests, or `--keys-dir`).

    pub fn with_keys_dir(mut self, dir: impl Into<PathBuf>) -> Repo {

        self.keys_dir = dir.into();

        self

    }

    pub fn save_config(&self) -> Result<()> {

        self.config.save(&self.oxy.join("config"))

    }

    fn author(&self) -> KeyId {

        self.config.author_key.unwrap_or(ObjectRef::ZERO)

    }

    // ------------------------------------------------------------ identity

    /// Generate a composite key pair, store its identity object, keep the

    /// secret in the key directory, and make it this repository's author.

    pub fn create_identity(&mut self, name: &str, email: &str) -> Result<(KeyId, Identity)> {

        let sk = SecretKey::generate();

        let id = sk.identity(name, email, Hlc::now().wall_ms);

        let key = self.store.put_identity(&id)?;

        fs::create_dir_all(&self.keys_dir)?;

        let path = self.keys_dir.join(format!("{}.secret", key.to_hex()));

        write_atomic(&path, &sk.encode(&key))?;

        #[cfg(unix)]

        {

            use std::os::unix::fs::PermissionsExt;

            fs::set_permissions(&path, fs::Permissions::from_mode(0o600))?;

        }

        self.config.author_name = name.into();

        self.config.author_email = email.into();

        self.config.author_key = Some(key);

        self.save_config()?;

        Ok((key, id))

    }

    /// The secret key for `author.key`, if configured and present on disk.

    pub fn secret_key(&self) -> Result<Option<(KeyId, SecretKey)>> {

        let Some(key) = self.config.author_key else { return Ok(None) };

        let path = self.keys_dir.join(format!("{}.secret", key.to_hex()));

        match fs::read(&path) {

            Ok(b) => {

                let (k, sk) = SecretKey::decode(&b)?;

                if k != key {

                    return fail(format!("{} holds a different key than its name", path.display()));

                }

                Ok(Some((k, sk)))

            }

            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),

            Err(e) => Err(e.into()),

        }

    }

    pub fn identity(&self, key: &KeyId) -> Result<Identity> {

        Ok(self.store.get_identity(key)?)

    }

    /// Sign a stored change with the configured secret key.

    pub fn sign_change(&self, hash: &ChangeHash) -> Result<Signature> {

        let Some((key, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let sig = sk.sign(Domain::Change, &key, hash);

        self.store.put_signature(hash, &sig)?;

        Ok(sig)

    }

    /// Check the signatures on a change against the author-or-delegate rule.

    pub fn verify_change(&self, hash: &ChangeHash) -> Result<SignatureStatus> {

        let change = self.store.get_change(hash)?;

        let sigs = self.store.signatures(hash)?;

        if sigs.is_empty() {

            return Ok(SignatureStatus::Unsigned);

        }

        let mut last_err = String::new();

        for sig in &sigs {

            let id = match self.store.get_identity(&sig.key) {

                Ok(id) => id,

                Err(_) => {

                    last_err = format!("unknown key {}", sig.key.short(12));

                    continue;

                }

            };

            let authorised = sig.key == change.author

                || self.store.get_identity(&change.author).map(|a| a.delegates.contains(&sig.key)).unwrap_or(false);

            if !authorised {

                last_err = format!("key {} is neither the author nor a delegate", sig.key.short(12));

                continue;

            }

            match identity::verify(&id, sig, Domain::Change, hash) {

                Ok(()) => return Ok(SignatureStatus::Valid { key: sig.key, name: id.name, email: id.email }),

                Err(e) => last_err = e.to_string(),

            }

        }

        Ok(SignatureStatus::Invalid(last_err))

    }

    fn new_working_copy(&self, deps: Vec<ChangeHash>, message: &str) -> Change {

        let mut c = Change {

            change_id: ChangeId::random(),

            deps,

            author: self.author(),

            hlc: Hlc::now(),

            message: message.into(),

            tree_ops: vec![],

            edits: vec![],

            kind: ChangeKind::WorkingCopy,

        };

        c.normalize();

        c

    }

    // ------------------------------------------------------------ operation log

    pub fn head_op(&self) -> Result<(ObjectRef, Op)> {

        let hex = fs::read_to_string(self.oxy.join("ops").join("head"))?;

        let r = ObjectRef::from_hex(hex.trim()).ok_or_else(|| RepoError::Msg("corrupt .oxy/ops/head".into()))?;

        let op = Op::decode(&self.store.get_typed(&r, ObjectType::Op)?)?;

        Ok((r, op))

    }

    pub fn view(&self) -> Result<View> {

        Ok(self.head_op()?.1.view)

    }

    fn record_op(&self, parents: &[ObjectRef], command: &str, view: View) -> Result<ObjectRef> {

        let op = Op { parents: parents.to_vec(), hlc: Hlc::now(), command: command.into(), view };

        let r = self.store.put(ObjectType::Op, &op.encode())?;

        write_atomic(&self.oxy.join("ops").join("head"), r.to_hex().as_bytes())?;

        Ok(r)

    }

    pub fn op_log(&self) -> Result<Vec<(ObjectRef, Op)>> {

        let mut out = Vec::new();

        let (mut r, mut op) = self.head_op()?;

        loop {

            let next = op.parents.first().copied();

            out.push((r, op));

            match next {

                Some(p) => {

                    r = p;

                    op = Op::decode(&self.store.get_typed(&r, ObjectType::Op)?)?;

                }

                None => break,

            }

        }

        Ok(out)

    }

    /// Undo the last user command (spec §12.1). Operations that only recorded

    /// a working-copy snapshot are skipped, since the files are still on disk

    /// and the next snapshot recreates them.

    pub fn undo(&self) -> Result<Op> {

        let (_, mut op) = self.head_op()?;

        while op.is_snapshot() {

            let Some(parent) = op.parents.first() else { break };

            op = Op::decode(&self.store.get_typed(parent, ObjectType::Op)?)?;

        }

        let Some(parent) = op.parents.first() else {

            return fail("nothing to undo");

        };

        let parent_op = Op::decode(&self.store.get_typed(parent, ObjectType::Op)?)?;

        write_atomic(&self.oxy.join("ops").join("head"), parent.to_hex().as_bytes())?;

        Ok(parent_op)

    }

    /// The last operation that was not a snapshot.

    pub fn last_command(&self) -> Result<Op> {

        let (_, mut op) = self.head_op()?;

        while op.is_snapshot() {

            let Some(parent) = op.parents.first() else { break };

            op = Op::decode(&self.store.get_typed(parent, ObjectType::Op)?)?;

        }

        Ok(op)

    }

    // ------------------------------------------------------------ states

    /// Load the dependency closure of `heads` from the store.

    pub fn load_state(&self, heads: &[ChangeHash]) -> Result<State> {

        let mut state = State::new();

        let mut stack: Vec<ChangeHash> = heads.to_vec();

        let mut seen: BTreeSet<ChangeHash> = BTreeSet::new();