//! Identity, verification, and configuration commands.

use super::format::{short_id, signature_line, when};

use super::json;

use super::open;

use super::ui;

use anyhow::Result;

use oxy_core::hash::ChangeHash;

use oxy_core::hash::KeyId;

use oxy_core::identity::{Delegate, Identity, Scope};

use oxy_core::objects::Hlc;

use oxy_core::protocol::SignedPolicy;

use oxy_core::repo::{self, IdentityScope, PolicyUpdate, Repo, Rotation, SignatureStatus};

use std::path::{Path, PathBuf};

const DAY_MS: u64 = 24 * 60 * 60 * 1000;

fn expiry_from_days(days: u64) -> Option<u64> {

    (days > 0).then(|| Hlc::now().wall_ms + days * DAY_MS)

}

/// `30m`, `8h`, `7d`, or a bare number of days, as a wall time from now.

fn expiry_from_duration(s: &str) -> Result<u64> {

    let s = s.trim();

    let (n, unit) = match s.char_indices().find(|(_, c)| !c.is_ascii_digit()) {

        Some((i, _)) => (&s[..i], &s[i..]),

        None => (s, "d"),

    };

    let n: u64 = n.parse().map_err(|_| {

        anyhow::anyhow!("--expires takes 30m, 8h, 7d or a number of days, not {s:?}")

    })?;

    let ms = match unit {

        "m" => 60_000,

        "h" => 3_600_000,

        "d" => DAY_MS,

        _ => anyhow::bail!("--expires takes 30m, 8h, 7d or a number of days, not {s:?}"),

    };

    if n == 0 {

        anyhow::bail!("--expires needs a length of time; leave it out for no expiry");

    }

    Ok(Hlc::now().wall_ms + n * ms)

}

/// Print the delegates, one per line: who, their key, what they may do

/// and until when, so an agent's name is seen, not only its key.

fn print_delegates(repo: &Repo, delegates: &[Delegate]) {

    if delegates.is_empty() {

        return;

    }

    println!("{}", ui::kv("delegates", delegates.len().to_string()));

    let now = Hlc::now().wall_ms;

    for d in delegates {

        let who = repo

            .identity(&d.key)

            .map(|i| format!("{} <{}>", i.name, i.email))

            .unwrap_or_else(|_| "(unknown identity)".into());

        let until = match d.expires {

            Some(e) if now > e => ui::err(format!("expired {}", ui::ago(e))),

            Some(e) => ui::dim(format!("until {}", when(e))),

            None => String::new(),

        };

        println!(

            "    {}  {}  {} {}",

            ui::author(who),

            ui::hash(d.key.short(12)),

            ui::dim(d.scope.to_string()),

            until

        );

    }

}

/// Resolve a KeyId prefix among the identities the repository knows.

fn resolve_key(repo: &Repo, prefix: &str) -> Result<KeyId> {

    if let Some(k) = KeyId::from_hex(prefix) {

        return Ok(k);

    }

    let mut candidates: Vec<KeyId> = Vec::new();

    if let Some((_, sp)) = repo.current_policy()? {

        candidates.extend(sp.policy.identities.iter().map(|i| i.hash()));

        candidates.extend(sp.policy.revoked.iter().copied());

    }

    if let Some(own) = repo.config.author_key {

        candidates.push(own);

        if let Ok(id) = repo.identity(&own) {

            candidates.extend(id.delegates.iter().map(|d| d.key));

        }

    }

    candidates.sort();

    candidates.dedup();

    let matches: Vec<_> = candidates

        .into_iter()

        .filter(|k| k.starts_with_hex(prefix))

        .collect();

    match matches.len() {

        1 => Ok(matches[0]),

        0 => anyhow::bail!("no known key starts with {prefix:?}"),

        _ => anyhow::bail!("{prefix:?} is ambiguous"),

    }

}

/// Report a policy update: applied, or written out as a proposal that

/// other root holders sign with `oxy policy sign`.

fn report_update(u: &PolicyUpdate, out: Option<PathBuf>) -> Result<()> {

    if u.applied {

        println!(

            "{} policy serial {} {}",

            ui::done("Applied"),

            u.policy.serial,

            ui::dim("(push to publish it)")

        );

        return Ok(());

    }

    let path = out.unwrap_or_else(|| PathBuf::from(format!("policy-{}.proposal", u.policy.serial)));

    std::fs::write(&path, u.signed().encode())?;

    println!(

        "{} policy serial {} needs {} of {} root signatures; has {}. Wrote {} for another root to run {}",

        ui::caution(),

        u.policy.serial,

        u.policy.root_threshold,

        u.policy.roots.len(),

        u.sigs.len(),

        ui::path(path.display()),

        ui::dim(format!("oxy policy sign {}", path.display()))

    );

    Ok(())

}

fn report_rotation(repo: &Repo, r: &Rotation, verb: &str) -> Result<()> {

    println!(

        "{} identity {} <{}>",

        ui::done(verb),

        ui::author(&r.identity.name),

        r.identity.email

    );

    // Which key it started from, and where that came from (oxygen#163).

    let from = if repo.config.is_repo_set("author.key") {

        "this repository's author.key"

    } else {

        "the user config's author.key"

    };

    println!(

        "{}",

        ui::kv(

            "old key",

            format!(

                "{} {}",

                ui::dim(r.old.to_hex()),

                ui::dim(format!("(from {from})"))

            )

        )

    );

    println!("{}", ui::kv("new key", r.new.to_hex()));

    print_delegates(repo, &r.identity.delegates);

    if let Some(e) = r.identity.expires {

        println!("{}", ui::kv("expires", when(e)));

    }

    match &r.policy {

        Some(u) => report_update(u, None)?,

        None => println!(

            "  {} {}",

            ui::note(),

            ui::dim("no policy names the old key; export the new identity for policy holders")

        ),

    }

    Ok(())

}

pub fn create(

    name: Option<String>,

    email: Option<String>,

    local: bool,

    expires: Option<u64>,

) -> Result<i32> {

    // A first identity comes before any repository (oxygen#144): only

    // --local needs one; inside one, it is kept there too.

    let mut repo = match open() {

        Ok(r) => r,

        Err(e) if local => return Err(e),

        Err(_) => {

            let (key, id) = repo::create_user_identity(

                name.as_deref(),

                email.as_deref(),

                expires.and_then(expiry_from_days),

            )?;

            println!(

                "{} identity {} <{}>",

                ui::done("Created"),

                ui::author(&id.name),

                id.email

            );

            println!("{}", ui::kv("key", key));

            println!(

                "{}",

                ui::kv("secret", ui::path(repo::default_keys_dir().display()))

            );

            println!(

                "{}",

                ui::kv(

                    "scope",

                    format!(

                        "default author in {}",

                        ui::path(repo::default_user_config().display())

                    )

                )

            );

            println!("  {} {}", ui::note(), ui::dim("changes in every repository carry this author; run oxy config --user core.sign change to sign each commit"));

            return Ok(0);

        }

    };

    let name = name.unwrap_or_else(|| repo.config.author_name.clone());

    let email = email.unwrap_or_else(|| repo.config.author_email.clone());

    let scope = if local {

        IdentityScope::Repo

    } else {

        IdentityScope::User

    };

    let (key, _) =

        repo.create_identity_with(&name, &email, scope, expires.and_then(expiry_from_days))?;

    println!(

        "{} identity {} <{email}>",

        ui::done("Created"),

        ui::author(&name)

    );

    println!("{}", ui::kv("key", key));

    println!(

        "{}",

        ui::kv("secret", ui::path(repo::default_keys_dir().display()))

    );

    match scope {

        IdentityScope::User => println!(

            "{}",

            ui::kv(

                "scope",

                format!(

                    "default author in {}",

                    ui::path(repo.user_config_path().display())

                )

            )

        ),

        IdentityScope::Repo => {

            println!("{}", ui::kv("scope", "this repository's .oxy/config only"))

        }

    }

    if !repo.config.sign_changes {

        println!("  {} {}", ui::note(), ui::dim("changes will carry this author; run oxy config --user core.sign change to sign each commit"));

    }

    Ok(0)

}

pub fn show() -> Result<i32> {

    let repo = open()?;

    let Some(key) = repo.config.author_key else {

        println!("No identity configured; run `oxy identity create`.");

        return Ok(0);

    };

    let id = repo.identity(&key)?;

    println!(

        "{} {} <{}>",

        ui::section("identity"),

        ui::author(&id.name),

        id.email

    );

    println!("{}", ui::kv("key", key));

    println!(

        "{}",

        ui::kv(

            "created",

            format!(

                "{} {}",

                when(id.created),

                ui::dim(format!("({})", ui::ago(id.created)))

            )

        )

    );

    if let Some(e) = id.expires {

        let expired = id.is_expired_at(Hlc::now().wall_ms);

        println!(

            "{}",

            ui::kv(

                "expires",

                if expired {

                    ui::err(format!("{} EXPIRED", when(e)))

                } else {

                    when(e)

                }

            )

        );

    }

    if let Some(p) = id.previous {

        println!("{}", ui::kv("previous", ui::dim(p.short(12))));

    }

    // A repository that pins one key while the user file names another is

    // how checkouts drift apart after a rotation (oxygen#69).

    if let Some(pinned) = repo

        .config

        .repo_layer()

        .get("author.key")

        .and_then(|k| oxy_core::hash::KeyId::from_hex(k))

    {

        let user_key = repo::read_config_file(&repo::default_user_config())

            .ok()

            .and_then(|m| {

                m.get("author.key")

                    .and_then(|k| oxy_core::hash::KeyId::from_hex(k))

            });

        if let Some(u) = user_key.filter(|u| *u != pinned) {

            let related = |from: oxy_core::hash::KeyId, to: oxy_core::hash::KeyId| {

                let mut cur = Some(from);

                for _ in 0..64 {

                    match cur {

                        Some(k) if k == to => return true,

                        Some(k) => cur = repo.identity(&k).ok().and_then(|i| i.previous),

                        None => break,

                    }

                }

                false

            };

            let how = if related(pinned, u) {

                "an older key of this identity"

            } else if related(u, pinned) {

                "a newer key of this identity"

            } else {

                "another key"

            };

            println!(

                "  {} {}",

                ui::caution(),

                ui::dim(format!(

                    "this repository pins author.key {}; your user config names {how}, {}. Other checkouts follow the user config: `oxy config --unset author.key` here, or `oxy config --user author.key {}`",

                    pinned.short(12),

                    u.short(12),

                    pinned.to_hex()

                ))

            );

        }

    }

    // A key with a successor is stale, and a key with two is a fork: both

    // are how an identity splits without anyone noticing (oxygen#163).

    let next = repo.successors(&key)?;

    if let Some(n) = next.first() {

        println!(

            "  {} {}",

            ui::caution(),

            ui::warn(format!(

                "this key is not your identity's newest: {} succeeds it, {} is the newest. Rotating or delegating from it would fork the identity; point author.key at the newest",

                n.short(12),

                repo.newest(n)?.short(12)

            ))

        );

    }

    let mut cur = Some(key);

    for _ in 0..256 {

        let Some(k) = cur else { break };

        let after = repo.successors(&k)?;

        if after.len() > 1 {

            println!(

                "  {} {}",

                ui::caution(),

                ui::err(format!(

                    "the identity forks at {}: {} each succeed it. Keep one branch: revoke the others' keys (oxy identity revoke KEY) and point every home's author.key at the one you keep",

                    k.short(12),

                    after.iter().map(|a| a.short(12)).collect::<Vec<_>>().join(" and ")

                ))

            );

            break;

        }

        cur = repo.identity(&k).ok().and_then(|i| i.previous);

    }

    print_delegates(&repo, &id.delegates);

    if repo.is_revoked(&key)? {

        println!(

            "{}",

            ui::kv(

                "status",

                ui::err(format!("{} REVOKED", ui::glyph("✖", "x")))

            )

        );

    }

    println!(

        "{}",

        ui::kv(

            "secret",

            if repo.secret_key()?.is_some() {

                ui::ok(format!("{} available", ui::glyph("✔", "*")))

            } else {

                ui::err(format!(

                    "{} not found in the key directory",

                    ui::glyph("✖", "x")

                ))

            }

        )

    );

    println!(

        "{}",

        ui::kv(

            "signing",

            if repo.config.sign_changes {

                "every change (core.sign = change)"

            } else {

                "at push via seals (core.sign = seal)"

            }

        )

    );

    Ok(0)

}

pub fn verify(change: Option<&str>, revset: Option<&str>, as_json: bool) -> Result<i32> {

    let repo = open()?;

    let hashes: Vec<ChangeHash> = match (change, revset) {

        (_, Some(r)) => {

            let wc = repo.working_copy().ok().map(|(h, _)| h);

            repo.revset(r)?

                .hashes

                .into_iter()

                .filter(|h| Some(*h) != wc)

                .collect()

        }

        (Some(c), None) => vec![repo.resolve_change(c)?],

        (None, None) => repo

            .log()?

            .into_iter()

            .filter(|e| !e.is_working_copy)

            .map(|e| e.hash)

            .collect(),

    };

    let mut bad = 0;

    if as_json {

        let mut items = Vec::new();

        for h in &hashes {

            let Ok(c) = repo.store().get_change(h) else {

                continue;

            };

            let (status, key, name, revoked, reason) = match repo.authenticate_change(h)? {

                SignatureStatus::Unsigned => ("unsigned", None, None, false, None),

                SignatureStatus::Valid {

                    key,

                    name,

                    sealed,

                    revoked,

                    ..

                } => (

                    if sealed { "sealed" } else { "signed" },

                    Some(key.to_hex()),

                    Some(name),

                    revoked,

                    None,

                ),

                SignatureStatus::Invalid(why) => {

                    bad += 1;

                    ("invalid", None, None, false, Some(why))

                }

            };

            items.push(json::obj([

                ("hash", json::s(&h.to_hex())),

                ("change_id", json::s(&c.change_id.to_hex())),

                ("status", json::s(status)),

                ("key", json::opt(key.as_deref(), json::s)),

                ("name", json::opt(name.as_deref(), json::s)),

                ("revoked", json::b(revoked)),

                ("reason", json::opt(reason.as_deref(), json::s)),