//! Identity, verification, and configuration commands.

use super::format::{short_id, signature_line, when};
use super::open;
use super::ui;
use anyhow::Result;
use oxy_core::hash::ChangeHash;
use oxy_core::identity::Identity;
use oxy_core::repo::{self, IdentityScope};
use std::path::{Path, PathBuf};

pub fn create(name: Option<String>, email: Option<String>, local: bool) -> Result<i32> {
    let mut repo = open()?;
    let name = name.unwrap_or_else(|| repo.config.author_name.clone());
    let email = email.unwrap_or_else(|| repo.config.author_email.clone());
    let scope = if local { IdentityScope::Repo } else { IdentityScope::User };
    let (key, _) = repo.create_identity(&name, &email, scope)?;
    println!("Created identity {name} <{email}>");
    println!("KeyId: {key}");
    println!("Secret key stored under {}", repo::default_keys_dir().display());
    match scope {
        IdentityScope::User => println!("Recorded as your default author in {}", repo.user_config_path().display()),
        IdentityScope::Repo => println!("Recorded in this repository's .oxy/config only"),
    }
    if !repo.config.sign_changes {
        println!("Changes will carry this author; run `oxy config --user core.sign change` to sign each commit.");
    }
    Ok(0)
}

pub fn show() -> Result<i32> {
    let repo = open()?;
    let Some(key) = repo.config.author_key else {
        println!("No identity configured; run `oxy identity create`.");
        return Ok(0);
    };
    let id = repo.identity(&key)?;
    println!("{} <{}>", id.name, id.email);
    println!("KeyId:   {key}");
    println!("Created: {}", when(id.created));
    println!("Secret:  {}", if repo.secret_key()?.is_some() { "available" } else { "NOT FOUND in key directory" });
    println!("Signing: {}", if repo.config.sign_changes { "every change (core.sign = change)" } else { "at push via seals (core.sign = seal)" });
    Ok(0)
}

pub fn verify(change: Option<&str>) -> Result<i32> {
    let repo = open()?;
    let hashes: Vec<ChangeHash> = match change {
        Some(c) => vec![repo.resolve_change(c)?],
        None => repo.log()?.into_iter().filter(|e| !e.is_working_copy).map(|e| e.hash).collect(),
    };
    let mut bad = 0;
    for h in hashes {
        let Ok(c) = repo.store().get_change(&h) else {
            println!("{}  {}", ui::hash(format!("#{}", h.short(12))), ui::dim("not present (shallow)"));
            continue;
        };
        let line = signature_line(&repo, &h)?;
        let styled = if line.starts_with("INVALID") {
            bad += 1;
            ui::err(&line)
        } else if line == "unsigned" {
            ui::dim(&line)
        } else {
            ui::ok(&line)
        };
        println!("{} {}  {styled}", ui::id(short_id(&c)), ui::hash(format!("#{}", h.short(12))));
    }
    Ok(if bad > 0 { 1 } else { 0 })
}

pub fn config(key: &str, value: &str, user: bool) -> Result<i32> {
    if user {
        let path = repo::default_user_config();
        repo::Config::set_user(&path, key, value)?;
        println!("{key} = {value} (in {})", path.display());
    } else {
        let mut repo = open()?;
        repo.config.set(key, value)?;
        repo.save_config()?;
        println!("{key} = {value} (in this repository)");
    }
    Ok(0)
}

pub fn export(path: Option<PathBuf>) -> Result<i32> {
    let repo = open()?;
    let Some(key) = repo.config.author_key else {
        anyhow::bail!("no identity configured; run `oxy identity create`");
    };
    let id = repo.identity(&key)?;
    let path = path.unwrap_or_else(|| PathBuf::from(format!("{}.identity", key.short(16))));
    std::fs::write(&path, id.encode())?;
    println!("Wrote identity {} <{}> ({}) to {}", id.name, id.email, key.short(12), path.display());
    Ok(0)
}

pub fn policy_init() -> Result<i32> {
    let repo = open()?;
    let sp = repo.policy_init()?;
    println!("Created policy serial {} with root key {}; push to publish it.", sp.policy.serial, sp.policy.roots[0].short(12));
    Ok(0)
}

pub fn policy_show() -> Result<i32> {
    let repo = open()?;
    let Some((r, sp)) = repo.current_policy()? else {
        println!("No policy: this repository is unverified. Run `oxy policy init` to create one.");
        return Ok(0);
    };
    let p = &sp.policy;
    let name = |k: &oxy_core::hash::KeyId| p.identity(k).map(|i| format!("{} <{}>", i.name, i.email)).unwrap_or_else(|| "(unknown identity)".into());
    println!("policy #{} serial {} expires {}{}", r.short(12), p.serial, when(p.expires), if p.is_expired(oxy_core::objects::Hlc::now().wall_ms) { "  EXPIRED" } else { "" });
    println!("roots (threshold {}):", p.root_threshold);
    for k in &p.roots {
        println!("  {}  {}", k.short(12), name(k));
    }
    println!("rules:");
    for rule in &p.rules {
        println!("  {:12} threshold {} require {} conflicts {}", rule.pattern, rule.threshold, rule.require.name(), if rule.allow_conflicts { "allowed" } else { "refused" });
        for k in &rule.keys {
            println!("      {}  {}", k.short(12), name(k));
        }
    }
    if !p.revoked.is_empty() {
        println!("revoked:");
        for k in &p.revoked {
            println!("  {}  {}", k.short(12), name(k));
        }
    }
    Ok(0)
}

pub fn policy_grant(identity_file: &Path, pattern: Option<&str>) -> Result<i32> {
    let repo = open()?;
    let id = Identity::decode(&std::fs::read(identity_file)?)?;
    let key = id.hash();
    let sp = repo.policy_grant(id.clone(), pattern)?;
    println!("Granted {} <{}> ({}) on {}; policy serial {}. Push to publish.", id.name, id.email, key.short(12), pattern.unwrap_or("*"), sp.policy.serial);
    Ok(0)
}

pub fn policy_revoke(key: &str) -> Result<i32> {
    let repo = open()?;
    let Some((_, sp)) = repo.current_policy()? else {
        anyhow::bail!("this repository has no policy");
    };
    let matches: Vec<_> = sp.policy.identities.iter().map(|i| i.hash()).filter(|k| k.starts_with_hex(key)).collect();
    let full = match matches.len() {
        1 => matches[0],
        0 => anyhow::bail!("no key in the policy starts with {key:?}"),
        _ => anyhow::bail!("{key:?} is ambiguous"),
    };
    let sp = repo.policy_revoke(&full)?;
    println!("Revoked {}; policy serial {}. Push to publish.", full.short(12), sp.policy.serial);
    Ok(0)
}