//! Identities, signing, and signature verification (spec §14).

use super::*;

/// Outcome of verifying the signatures on a change (spec §14.3, §14.4).

#[derive(Clone, Debug, PartialEq, Eq)]

pub enum SignatureStatus {

    Unsigned,

    /// `revoked` marks a signature that verifies but whose key has since

    /// been revoked by policy or by a revocation this repository recorded.

    Valid {

        key: KeyId,

        name: String,

        email: String,

        sealed: bool,

        revoked: bool,

    },

    Invalid(String),

}

/// The outcome of replacing the configured identity (spec §14.2).

#[derive(Clone, Debug)]

pub struct Rotation {

    pub old: KeyId,

    pub new: KeyId,

    pub identity: Identity,

    /// The policy update that moved the old key's grants to the new key,

    /// when the repository has a policy naming the old key.

    pub policy: Option<PolicyUpdate>,

}

impl Repo {

    // ------------------------------------------------------------ identity

    /// Generate a composite key pair, store its identity object, keep the

    /// secret in the key directory, and record the author at `scope`.

    pub fn create_identity(

        &mut self,

        name: &str,

        email: &str,

        scope: IdentityScope,

    ) -> Result<(KeyId, Identity)> {

        self.create_identity_with(name, email, scope, None)

    }

    /// `create_identity` with an expiry (milliseconds since the epoch).

    pub fn create_identity_with(

        &mut self,

        name: &str,

        email: &str,

        scope: IdentityScope,

        expires: Option<u64>,

    ) -> Result<(KeyId, Identity)> {

        let sk = SecretKey::generate();

        let mut id = sk.identity(name, email, Hlc::now().wall_ms);

        id.expires = expires;

        let key = self.install_key(&id, &sk)?;

        self.set_author(&id, &key, scope)?;

        Ok((key, id))

    }

    /// Store an identity and keep its secret (and a copy of the identity)

    /// in the key directory.

    fn install_key(&self, id: &Identity, sk: &SecretKey) -> Result<KeyId> {

        let key = self.store.put_identity(id)?;

        fs::create_dir_all(&self.keys_dir)?;

        let path = self.keys_dir.join(format!("{}.secret", key.to_hex()));

        crate::durable::write_atomic_private(&path, &sk.encode(&key))?;

        write_atomic(

            &self.keys_dir.join(format!("{}.identity", key.to_hex())),

            &id.encode(),

        )?;

        Ok(key)

    }

    fn set_author(&mut self, id: &Identity, key: &KeyId, scope: IdentityScope) -> Result<()> {

        match scope {

            IdentityScope::Repo => {

                self.config.set("author.name", &id.name)?;

                self.config.set("author.email", &id.email)?;

                self.config.set("author.key", &key.to_hex())?;

                self.save_config()?;

            }

            IdentityScope::User => {

                Config::set_user(&self.user_config, "author.name", &id.name)?;

                Config::set_user(&self.user_config, "author.email", &id.email)?;

                Config::set_user(&self.user_config, "author.key", &key.to_hex())?;

                self.config = Config::load(Some(&self.user_config), &self.oxy.join("config"))?;

            }

        }

        Ok(())

    }

    /// The scope that holds the configured author key.

    fn author_scope(&self) -> IdentityScope {

        if self.config.repo_layer().contains_key("author.key") {

            IdentityScope::Repo

        } else {

            IdentityScope::User

        }

    }

    /// Record a successor key everywhere the old one was named: the

    /// repository layer when it pins the old key, and the user file when

    /// it names the old key, so every checkout that followed the old key

    /// follows the new one (oxygen#69). A key named nowhere falls back to

    /// the scope that resolved it.

    fn record_successor(&mut self, id: &Identity, old: &KeyId, new_key: &KeyId) -> Result<()> {

        let names = |v: Option<&String>| v.and_then(|k| KeyId::from_hex(k)) == Some(*old);

        let repo_pins = names(self.config.repo_layer().get("author.key"));

        let user_entries = super::config::read_config_file(&self.user_config).unwrap_or_default();

        let user_names = names(user_entries.get("author.key"));

        if !repo_pins && !user_names {

            return self.set_author(id, new_key, self.author_scope());

        }

        if user_names {

            self.set_author(id, new_key, IdentityScope::User)?;

        }

        if repo_pins {

            self.set_author(id, new_key, IdentityScope::Repo)?;

        }

        Ok(())

    }

    /// Replace the configured identity by `new` signed with `sk`: store it,

    /// record a `rotate` attestation signed by the old key, move the old

    /// key's policy grants to the new key, and switch the author config.

    fn replace_identity(

        &mut self,

        new: Identity,

        sk: SecretKey,

        command: &str,

    ) -> Result<Rotation> {

        let Some((old, old_sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        if new.previous != Some(old) {

            return fail("the successor identity must name the current key as previous");

        }

        let new_key = self.install_key(&new, &sk)?;

        let attest = Attest {

            repo: self.id()?,

            hlc: Hlc::now(),

            body: AttestBody::Rotate { new: new_key },

        };

        let r = self.store.put_attest(&attest)?;

        self.store

            .put_signature(&r, &old_sk.sign(Domain::Attest, &old, &r))?;

        let policy = match self.current_policy()? {

            Some((_, sp)) if sp.policy.mentions(&old) => {

                let mut p = self.next_policy()?;

                p.substitute_key(&old, new.clone());

                Some(self.sign_policy_with(p, &[(old, &old_sk), (new_key, &sk)], command)?)

            }

            _ => None,

        };

        self.record_successor(&new, &old, &new_key)?;

        Ok(Rotation {

            old,

            new: new_key,

            identity: new,

            policy,

        })

    }

    /// Rotate to a fresh key pair; the new identity names the old one as

    /// `previous` and keeps its name, email, delegates, and expiry.

    pub fn rotate_identity(&mut self) -> Result<Rotation> {

        let Some((old, _)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let cur = self.identity(&old)?;

        let sk = SecretKey::generate();

        let mut id = sk.identity(&cur.name, &cur.email, Hlc::now().wall_ms);

        id.previous = Some(old);

        id.delegates = cur.delegates.clone();

        id.expires = cur.expires;

        self.replace_identity(id, sk, "oxy identity rotate")

    }

    /// Re-issue the identity with the same keys and a new expiry.

    pub fn renew_identity(&mut self, expires: Option<u64>) -> Result<Rotation> {

        let Some((old, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let cur = self.identity(&old)?;

        let id = cur.successor(cur.delegates.clone(), expires, Hlc::now().wall_ms);

        self.replace_identity(id, sk, "oxy identity renew")

    }

    /// Let `delegate` act on this identity's behalf within `scope` until

    /// `expires` (spec §14.2). Delegates are part of the identity object,

    /// so this re-issues it with the same keys.

    pub fn delegate_add(

        &mut self,

        delegate: Identity,

        scope: Scope,

        expires: Option<u64>,

    ) -> Result<Rotation> {

        self.delegate_add_many(vec![delegate], scope, expires)

    }

    /// As [`Repo::delegate_add`], for several delegates in one rotation.

    pub fn delegate_add_many(

        &mut self,

        new_delegates: Vec<Identity>,

        scope: Scope,

        expires: Option<u64>,

    ) -> Result<Rotation> {

        let Some((old, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        if scope.is_empty() {

            return fail("a delegate needs at least one scope: changes, refs or seal");

        }

        if new_delegates.is_empty() {

            return fail("name at least one identity file");

        }

        let cur = self.identity(&old)?;

        let mut delegates = cur.delegates.clone();

        let mut added = Vec::new();

        for delegate in new_delegates {

            let dk = self.store.put_identity(&delegate)?;

            added.push(dk);

            if dk == old {

                return fail("an identity cannot delegate to itself");

            }

            if cur.delegate(&dk).is_some()

                || delegates

                    .iter()

                    .skip(cur.delegates.len())

                    .any(|d| d.key == dk)

            {

                return fail(format!(

                    "{} is already a delegate; remove it first to change its scope or expiry",

                    dk.short(12)

                ));

            }

            delegates.push(Delegate {

                key: dk,

                scope,

                expires,

            });

        }

        let id = cur.successor(delegates, cur.expires, Hlc::now().wall_ms);

        self.replace_identity(

            id,

            sk,

            &format!(

                "oxy identity delegate add {} --scope {scope}",

                added

                    .iter()

                    .map(|k| k.short(12))

                    .collect::<Vec<_>>()

                    .join(" ")

            ),

        )

    }

    /// Withdraw a delegation; re-issues the identity with the same keys.

    pub fn delegate_remove(&mut self, delegate: &KeyId) -> Result<Rotation> {

        let Some((old, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let cur = self.identity(&old)?;

        if cur.delegate(delegate).is_none() {

            return fail(format!("{} is not a delegate", delegate.short(12)));

        }

        let delegates = cur

            .delegates

            .iter()

            .copied()

            .filter(|d| d.key != *delegate)

            .collect();

        let id = cur.successor(delegates, cur.expires, Hlc::now().wall_ms);

        self.replace_identity(

            id,

            sk,

            &format!("oxy identity delegate remove {}", delegate.short(12)),

        )

    }

    /// Revoke `key` (your own, one you delegated to, or any key when you

    /// hold a policy root): record a signed `revoke` attestation and a

    /// local marker, and drop the key from the policy where it has one.

    /// Revoking a delegate does not re-issue the identity; `delegate_remove`

    /// does that, and the CLI does both.

    pub fn revoke_identity(&self, key: &KeyId, reason: &str) -> Result<Option<PolicyUpdate>> {

        let Some((own, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let policy = self.current_policy()?.map(|(_, sp)| sp.policy);

        let is_root = policy.as_ref().is_some_and(|p| p.roots.contains(&own));

        let is_delegate = self.identity(&own)?.delegate(key).is_some();

        if *key != own && !is_root && !is_delegate {

            return fail("only the key's holder, the identity that delegated to it, or a policy root can revoke it");

        }

        let attest = Attest {

            repo: self.id()?,

            hlc: Hlc::now(),

            body: AttestBody::Revoke {

                key: *key,

                reason: reason.into(),

            },

        };

        let r = self.store.put_attest(&attest)?;

        self.store

            .put_signature(&r, &sk.sign(Domain::Attest, &own, &r))?;

        let dir = self.oxy.join("revoked");

        fs::create_dir_all(&dir)?;

        write_atomic(&dir.join(key.to_hex()), r.to_hex().as_bytes())?;

        match policy {

            Some(p) if p.mentions(key) => Ok(Some(self.policy_revoke(key)?)),

            _ => Ok(None),

        }

    }

    /// Whether `key` is revoked by the policy or by a recorded revocation.

    pub fn is_revoked(&self, key: &KeyId) -> Result<bool> {

        if self.oxy.join("revoked").join(key.to_hex()).exists() {

            return Ok(true);

        }

        Ok(self

            .current_policy()?

            .is_some_and(|(_, sp)| sp.policy.is_revoked(key)))

    }

    /// The key this repository signs with: `author.signer` when set (an

    /// agent's own key, acting for the author), else `author.key`.

    pub fn signing_key(&self) -> Option<KeyId> {

        self.config.signer_key.or(self.config.author_key)

    }

    /// The secret key for `author.signer`, else `author.key`, if configured

    /// and present on disk. The identity object is kept beside the secret

    /// so a repository that has never seen it (a fresh clone) can store it

    /// when it first signs.

    pub fn secret_key(&self) -> Result<Option<(KeyId, SecretKey)>> {

        let Some(key) = self.signing_key() else {

            return Ok(None);

        };

        let path = self.keys_dir.join(format!("{}.secret", key.to_hex()));

        match fs::read(&path) {

            Ok(b) => {

                let (k, sk) = SecretKey::decode(&b)?;

                if k != key {

                    return fail(format!(

                        "{} holds a different key than its name",

                        path.display()

                    ));

                }

                if !self.store.has(&key) {

                    let id_path = self.keys_dir.join(format!("{}.identity", key.to_hex()));

                    if let Ok(bytes) = fs::read(&id_path) {

                        let id = Identity::decode(&bytes)?;

                        if id.hash() == key {

                            self.store.put_identity(&id)?;

                        }

                    }

                }

                Ok(Some((k, sk)))

            }

            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),

            Err(e) => Err(e.into()),

        }

    }

    /// An identity: from this repository's store, or else from the key

    /// directory, where `oxy identity create` keeps the user's own (a new

    /// repository has not stored it yet). The file must hash to `key`.

    pub fn identity(&self, key: &KeyId) -> Result<Identity> {

        match self.store.get_identity(key) {

            Ok(id) => Ok(id),

            Err(e) => {

                let path = self.keys_dir.join(format!("{}.identity", key.to_hex()));

                match fs::read(&path) {

                    Ok(bytes) => {

                        let id = Identity::decode(&bytes)?;

                        if id.hash() != *key {

                            return fail(format!(

                                "{} does not hold identity {}",

                                path.display(),

                                key.short(12)

                            ));

                        }

                        Ok(id)

                    }

                    Err(_) => Err(e.into()),

                }

            }

        }

    }

    /// Sign a stored change with the configured secret key.

    pub fn sign_change(&self, hash: &ChangeHash) -> Result<Signature> {

        let Some((key, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let sig = sk.sign(Domain::Change, &key, hash);

        self.store.put_signature(hash, &sig)?;

        Ok(sig)

    }

    /// Check the signatures on a change against the author-or-delegate rule.

    pub fn verify_change(&self, hash: &ChangeHash) -> Result<SignatureStatus> {

        self.verify_change_known(hash, None)

    }

    /// `verify_change`, with the change's metadata when the caller has it

    /// (a change object can be as large as the tree it adds). Signatures

    /// are looked up first: an unsigned change needs no metadata.

    fn verify_change_known(

        &self,

        hash: &ChangeHash,

        known: Option<&crate::state::ChangeMeta>,

    ) -> Result<SignatureStatus> {

        let sigs = self.store.signatures(hash)?;

        if sigs.is_empty() {

            return Ok(SignatureStatus::Unsigned);

        }

        let read;

        let change = match known {

            Some(m) => m,

            None => {

                read = self.store.get_change_meta(hash)?;

                &read

            }

        };

        let mut last_err = String::new();

        for sig in &sigs {

            match self.check_signer(change, sig, Domain::Change, hash) {

                Ok(id) => {

                    return Ok(SignatureStatus::Valid {

                        key: sig.key,

                        name: id.name,

                        email: id.email,

                        sealed: false,

                        revoked: self.is_revoked(&sig.key)?,

                    })

                }

                Err(e) => last_err = e,

            }

        }

        Ok(SignatureStatus::Invalid(last_err))

    }

    /// Verify `sig` over `target` and check the author-or-delegate rule for `change`.

    fn check_signer(

        &self,

        change: &crate::state::ChangeMeta,

        sig: &Signature,