//! Identity, verification, and configuration commands.

use super::format::{short_id, signature_line, when};

use super::json;

use super::open;

use super::ui;

use anyhow::Result;

use oxy_core::hash::ChangeHash;

use oxy_core::hash::KeyId;

use oxy_core::identity::{Delegate, Identity, Scope};

use oxy_core::objects::Hlc;

use oxy_core::protocol::SignedPolicy;

use oxy_core::repo::{self, IdentityScope, PolicyUpdate, Repo, Rotation, SignatureStatus};

use std::path::{Path, PathBuf};

const DAY_MS: u64 = 24 * 60 * 60 * 1000;

fn expiry_from_days(days: u64) -> Option<u64> {

    (days > 0).then(|| Hlc::now().wall_ms + days * DAY_MS)

}

/// `30m`, `8h`, `7d`, or a bare number of days, as a wall time from now.

fn expiry_from_duration(s: &str) -> Result<u64> {

    let s = s.trim();

    let (n, unit) = match s.char_indices().find(|(_, c)| !c.is_ascii_digit()) {

        Some((i, _)) => (&s[..i], &s[i..]),

        None => (s, "d"),

    };

    let n: u64 = n.parse().map_err(|_| {

        anyhow::anyhow!("--expires takes 30m, 8h, 7d or a number of days, not {s:?}")

    })?;

    let ms = match unit {

        "m" => 60_000,

        "h" => 3_600_000,

        "d" => DAY_MS,

        _ => anyhow::bail!("--expires takes 30m, 8h, 7d or a number of days, not {s:?}"),

    };

    if n == 0 {

        anyhow::bail!("--expires needs a length of time; leave it out for no expiry");

    }

    Ok(Hlc::now().wall_ms + n * ms)

}

/// Print the delegates, one per line: who, their key, what they may do

/// and until when, so an agent's name is seen, not only its key.

fn print_delegates(repo: &Repo, delegates: &[Delegate]) {

    if delegates.is_empty() {

        return;

    }

    println!("{}", ui::kv("delegates", delegates.len().to_string()));

    let now = Hlc::now().wall_ms;

    for d in delegates {

        let who = repo

            .identity(&d.key)

            .map(|i| format!("{} <{}>", i.name, i.email))

            .unwrap_or_else(|_| "(unknown identity)".into());

        let until = match d.expires {

            Some(e) if now > e => ui::err(format!("expired {}", ui::ago(e))),

            Some(e) => ui::dim(format!("until {}", when(e))),

            None => String::new(),

        };

        println!(

            "    {}  {}  {} {}",

            ui::author(who),

            ui::hash(d.key.short(12)),

            ui::dim(d.scope.to_string()),

            until

        );

    }

}

/// Resolve a KeyId prefix among the identities the repository knows.

fn resolve_key(repo: &Repo, prefix: &str) -> Result<KeyId> {

    if let Some(k) = KeyId::from_hex(prefix) {

        return Ok(k);

    }

    let mut candidates: Vec<KeyId> = Vec::new();

    if let Some((_, sp)) = repo.current_policy()? {

        candidates.extend(sp.policy.identities.iter().map(|i| i.hash()));

        candidates.extend(sp.policy.revoked.iter().copied());

    }

    if let Some(own) = repo.config.author_key {

        candidates.push(own);

        if let Ok(id) = repo.identity(&own) {

            candidates.extend(id.delegates.iter().map(|d| d.key));

        }

    }

    candidates.sort();

    candidates.dedup();

    let matches: Vec<_> = candidates

        .into_iter()

        .filter(|k| k.starts_with_hex(prefix))

        .collect();

    match matches.len() {

        1 => Ok(matches[0]),

        0 => anyhow::bail!("no known key starts with {prefix:?}"),

        _ => anyhow::bail!("{prefix:?} is ambiguous"),

    }

}

/// Report a policy update: applied, or written out as a proposal that

/// other root holders sign with `oxy policy sign`.

fn report_update(u: &PolicyUpdate, out: Option<PathBuf>) -> Result<()> {

    if u.applied {

        println!(

            "{} policy serial {} {}",

            ui::done("Applied"),

            u.policy.serial,

            ui::dim("(push to publish it)")

        );

        return Ok(());

    }

    let path = out.unwrap_or_else(|| PathBuf::from(format!("policy-{}.proposal", u.policy.serial)));

    std::fs::write(&path, u.signed().encode())?;

    println!(

        "{} policy serial {} needs {} of {} root signatures; has {}. Wrote {} for another root to run {}",

        ui::caution(),

        u.policy.serial,

        u.policy.root_threshold,

        u.policy.roots.len(),

        u.sigs.len(),

        ui::path(path.display()),

        ui::dim(format!("oxy policy sign {}", path.display()))

    );

    Ok(())

}

fn report_rotation(repo: &Repo, r: &Rotation, verb: &str) -> Result<()> {

    println!(

        "{} identity {} <{}>",

        ui::done(verb),

        ui::author(&r.identity.name),

        r.identity.email

    );

    println!("{}", ui::kv("old key", ui::dim(r.old.to_hex())));

    println!("{}", ui::kv("new key", r.new.to_hex()));

    print_delegates(repo, &r.identity.delegates);

    if let Some(e) = r.identity.expires {

        println!("{}", ui::kv("expires", when(e)));

    }

    match &r.policy {

        Some(u) => report_update(u, None)?,

        None => println!(

            "  {} {}",

            ui::note(),

            ui::dim("no policy names the old key; export the new identity for policy holders")

        ),

    }

    Ok(())

}

pub fn create(

    name: Option<String>,

    email: Option<String>,

    local: bool,

    expires: Option<u64>,

) -> Result<i32> {

    let mut repo = open()?;

    let name = name.unwrap_or_else(|| repo.config.author_name.clone());

    let email = email.unwrap_or_else(|| repo.config.author_email.clone());

    let scope = if local {

        IdentityScope::Repo

    } else {

        IdentityScope::User

    };

    let (key, _) =

        repo.create_identity_with(&name, &email, scope, expires.and_then(expiry_from_days))?;

    println!(

        "{} identity {} <{email}>",

        ui::done("Created"),

        ui::author(&name)

    );

    println!("{}", ui::kv("key", key));

    println!(

        "{}",

        ui::kv("secret", ui::path(repo::default_keys_dir().display()))

    );

    match scope {

        IdentityScope::User => println!(

            "{}",

            ui::kv(

                "scope",

                format!(

                    "default author in {}",

                    ui::path(repo.user_config_path().display())

                )

            )

        ),

        IdentityScope::Repo => {

            println!("{}", ui::kv("scope", "this repository's .oxy/config only"))

        }

    }

    if !repo.config.sign_changes {

        println!("  {} {}", ui::note(), ui::dim("changes will carry this author; run oxy config --user core.sign change to sign each commit"));

    }

    Ok(0)

}

pub fn show() -> Result<i32> {

    let repo = open()?;

    let Some(key) = repo.config.author_key else {

        println!("No identity configured; run `oxy identity create`.");

        return Ok(0);

    };

    let id = repo.identity(&key)?;

    println!(

        "{} {} <{}>",

        ui::section("identity"),

        ui::author(&id.name),

        id.email

    );

    println!("{}", ui::kv("key", key));

    println!(

        "{}",

        ui::kv(

            "created",

            format!(

                "{} {}",

                when(id.created),

                ui::dim(format!("({})", ui::ago(id.created)))

            )

        )

    );

    if let Some(e) = id.expires {

        let expired = id.is_expired_at(Hlc::now().wall_ms);

        println!(

            "{}",

            ui::kv(

                "expires",

                if expired {

                    ui::err(format!("{} EXPIRED", when(e)))

                } else {

                    when(e)

                }

            )

        );

    }

    if let Some(p) = id.previous {

        println!("{}", ui::kv("previous", ui::dim(p.short(12))));

    }

    // A repository that pins one key while the user file names another is

    // how checkouts drift apart after a rotation (oxygen#69).

    if let Some(pinned) = repo

        .config

        .repo_layer()

        .get("author.key")

        .and_then(|k| oxy_core::hash::KeyId::from_hex(k))

    {

        let user_key = repo::read_config_file(&repo::default_user_config())

            .ok()

            .and_then(|m| {

                m.get("author.key")

                    .and_then(|k| oxy_core::hash::KeyId::from_hex(k))

            });

        if let Some(u) = user_key.filter(|u| *u != pinned) {

            let related = |from: oxy_core::hash::KeyId, to: oxy_core::hash::KeyId| {

                let mut cur = Some(from);

                for _ in 0..64 {

                    match cur {

                        Some(k) if k == to => return true,

                        Some(k) => cur = repo.identity(&k).ok().and_then(|i| i.previous),

                        None => break,

                    }

                }

                false

            };

            let how = if related(pinned, u) {

                "an older key of this identity"

            } else if related(u, pinned) {

                "a newer key of this identity"

            } else {

                "another key"

            };

            println!(

                "  {} {}",

                ui::caution(),

                ui::dim(format!(

                    "this repository pins author.key {}; your user config names {how}, {}. Other checkouts follow the user config: `oxy config --unset author.key` here, or `oxy config --user author.key {}`",

                    pinned.short(12),

                    u.short(12),

                    pinned.to_hex()

                ))

            );

        }

    }

    print_delegates(&repo, &id.delegates);

    if repo.is_revoked(&key)? {

        println!(

            "{}",

            ui::kv(

                "status",

                ui::err(format!("{} REVOKED", ui::glyph("✖", "x")))

            )

        );

    }

    println!(

        "{}",

        ui::kv(

            "secret",

            if repo.secret_key()?.is_some() {

                ui::ok(format!("{} available", ui::glyph("✔", "*")))

            } else {

                ui::err(format!(

                    "{} not found in the key directory",

                    ui::glyph("✖", "x")

                ))

            }

        )

    );

    println!(

        "{}",

        ui::kv(

            "signing",

            if repo.config.sign_changes {

                "every change (core.sign = change)"

            } else {

                "at push via seals (core.sign = seal)"

            }

        )

    );

    Ok(0)

}

pub fn verify(change: Option<&str>, revset: Option<&str>, as_json: bool) -> Result<i32> {

    let repo = open()?;

    let hashes: Vec<ChangeHash> = match (change, revset) {

        (_, Some(r)) => {

            let wc = repo.working_copy().ok().map(|(h, _)| h);

            repo.revset(r)?

                .hashes

                .into_iter()

                .filter(|h| Some(*h) != wc)

                .collect()

        }

        (Some(c), None) => vec![repo.resolve_change(c)?],

        (None, None) => repo

            .log()?

            .into_iter()

            .filter(|e| !e.is_working_copy)

            .map(|e| e.hash)

            .collect(),

    };

    let mut bad = 0;

    if as_json {

        let mut items = Vec::new();

        for h in &hashes {

            let Ok(c) = repo.store().get_change(h) else {

                continue;

            };

            let (status, key, name, revoked, reason) = match repo.authenticate_change(h)? {

                SignatureStatus::Unsigned => ("unsigned", None, None, false, None),

                SignatureStatus::Valid {

                    key,

                    name,

                    sealed,

                    revoked,

                    ..

                } => (

                    if sealed { "sealed" } else { "signed" },

                    Some(key.to_hex()),

                    Some(name),

                    revoked,

                    None,

                ),

                SignatureStatus::Invalid(why) => {

                    bad += 1;

                    ("invalid", None, None, false, Some(why))

                }

            };

            items.push(json::obj([

                ("hash", json::s(&h.to_hex())),

                ("change_id", json::s(&c.change_id.to_hex())),

                ("status", json::s(status)),

                ("key", json::opt(key.as_deref(), json::s)),

                ("name", json::opt(name.as_deref(), json::s)),

                ("revoked", json::b(revoked)),

                ("reason", json::opt(reason.as_deref(), json::s)),

            ]));

        }

        println!("{}", json::arr(items));

        return Ok(if bad > 0 { 1 } else { 0 });

    }

    for h in hashes {

        let Ok(c) = repo.store().get_change(&h) else {

            println!(

                "{}  {}",

                ui::hash(format!("#{}", h.short(12))),

                ui::dim("not present (shallow)")

            );

            continue;

        };

        let line = signature_line(&repo, &h)?;

        let styled = if line.starts_with("INVALID") {

            bad += 1;

            ui::err(format!("{} {line}", ui::glyph("✖", "x")))

        } else if line == "unsigned" {

            ui::dim(format!("{} {line}", ui::glyph("·", "-")))

        } else {

            ui::ok(format!("{} {line}", ui::glyph("✔", "v")))

        };

        println!(

            "{} {}  {styled}",

            ui::id(short_id(&c)),

            ui::hash(format!("#{}", h.short(12)))

        );

    }

    Ok(if bad > 0 { 1 } else { 0 })

}

/// Whether a configuration key holds a secret, never to be printed.

fn secret_key(key: &str) -> bool {

    let k = key.to_ascii_lowercase();

    k.ends_with(".token") || k.contains("secret") || k.contains("password")

}

/// A secret as a confirmation may show it (oxygen#113): enough of its start

/// to tell which one it is, never the rest.

fn mask(value: &str) -> String {

    let shown: String = value.chars().take(10).collect();

    let rest = value.chars().count().saturating_sub(10);

    if rest == 0 {

        "…".to_string()

    } else {

        format!("{shown}…({rest} more)")

    }

}

pub fn config(key: &str, value: &str, user: bool, unset: bool) -> Result<i32> {

    // An empty value removes the key, which is what --unset says plainly.

    // `-` reads the value from standard input, so a token never sits in

    // the shell's history (oxygen#113).

    let read;

    let value = if unset {

        ""

    } else if value == "-" {

        let mut line = String::new();

        std::io::stdin().read_line(&mut line)?;

        read = line.trim().to_string();

        read.as_str()

    } else {

        value

    };

    let said = if unset {

        format!("{} {key}", ui::done("Unset"))

    } else if secret_key(key) {

        format!("{} {key} = {}", ui::done("Set"), mask(value))

    } else {

        format!("{} {key} = {value}", ui::done("Set"))