//! Identities, signing, and signature verification (spec §14).

use super::*;

/// Outcome of verifying the signatures on a change (spec §14.3, §14.4).

#[derive(Clone, Debug, PartialEq, Eq)]

pub enum SignatureStatus {

    Unsigned,

    /// `revoked` marks a signature that verifies but whose key has since

    /// been revoked by policy or by a revocation this repository recorded.

    Valid {

        key: KeyId,

        name: String,

        email: String,

        sealed: bool,

        revoked: bool,

    },

    Invalid(String),

}

/// The outcome of replacing the configured identity (spec §14.2).

#[derive(Clone, Debug)]

pub struct Rotation {

    pub old: KeyId,

    pub new: KeyId,

    pub identity: Identity,

    /// The policy update that moved the old key's grants to the new key,

    /// when the repository has a policy naming the old key.

    pub policy: Option<PolicyUpdate>,

}

impl Repo {

    // ------------------------------------------------------------ identity

    /// Generate a composite key pair, store its identity object, keep the

    /// secret in the key directory, and record the author at `scope`.

    pub fn create_identity(

        &mut self,

        name: &str,

        email: &str,

        scope: IdentityScope,

    ) -> Result<(KeyId, Identity)> {

        self.create_identity_with(name, email, scope, None)

    }

    /// `create_identity` with an expiry (milliseconds since the epoch).

    pub fn create_identity_with(

        &mut self,

        name: &str,

        email: &str,

        scope: IdentityScope,

        expires: Option<u64>,

    ) -> Result<(KeyId, Identity)> {

        let sk = SecretKey::generate();

        let mut id = sk.identity(name, email, Hlc::now().wall_ms);

        id.expires = expires;

        let key = self.install_key(&id, &sk)?;

        self.set_author(&id, &key, scope)?;

        Ok((key, id))

    }

    /// Store an identity and keep its secret (and a copy of the identity)

    /// in the key directory.

    fn install_key(&self, id: &Identity, sk: &SecretKey) -> Result<KeyId> {

        let key = self.store.put_identity(id)?;

        fs::create_dir_all(&self.keys_dir)?;

        let path = self.keys_dir.join(format!("{}.secret", key.to_hex()));

        write_atomic(&path, &sk.encode(&key))?;

        write_atomic(

            &self.keys_dir.join(format!("{}.identity", key.to_hex())),

            &id.encode(),

        )?;

        #[cfg(unix)]

        {

            use std::os::unix::fs::PermissionsExt;

            fs::set_permissions(&path, fs::Permissions::from_mode(0o600))?;

        }

        Ok(key)

    }

    fn set_author(&mut self, id: &Identity, key: &KeyId, scope: IdentityScope) -> Result<()> {

        match scope {

            IdentityScope::Repo => {

                self.config.set("author.name", &id.name)?;

                self.config.set("author.email", &id.email)?;

                self.config.set("author.key", &key.to_hex())?;

                self.save_config()?;

            }

            IdentityScope::User => {

                Config::set_user(&self.user_config, "author.name", &id.name)?;

                Config::set_user(&self.user_config, "author.email", &id.email)?;

                Config::set_user(&self.user_config, "author.key", &key.to_hex())?;

                self.config = Config::load(Some(&self.user_config), &self.oxy.join("config"))?;

            }

        }

        Ok(())

    }

    /// The scope that holds the configured author key.

    fn author_scope(&self) -> IdentityScope {

        if self.config.repo_layer().contains_key("author.key") {

            IdentityScope::Repo

        } else {

            IdentityScope::User

        }

    }

    /// Replace the configured identity by `new` signed with `sk`: store it,

    /// record a `rotate` attestation signed by the old key, move the old

    /// key's policy grants to the new key, and switch the author config.

    fn replace_identity(

        &mut self,

        new: Identity,

        sk: SecretKey,

        command: &str,

    ) -> Result<Rotation> {

        let Some((old, old_sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        if new.previous != Some(old) {

            return fail("the successor identity must name the current key as previous");

        }

        let new_key = self.install_key(&new, &sk)?;

        let attest = Attest {

            repo: self.id()?,

            hlc: Hlc::now(),

            body: AttestBody::Rotate { new: new_key },

        };

        let r = self.store.put_attest(&attest)?;

        self.store

            .put_signature(&r, &old_sk.sign(Domain::Attest, &old, &r))?;

        let policy = match self.current_policy()? {

            Some((_, sp)) if sp.policy.mentions(&old) => {

                let mut p = self.next_policy()?;

                p.substitute_key(&old, new.clone());

                Some(self.sign_policy_with(p, &[(old, &old_sk), (new_key, &sk)], command)?)

            }

            _ => None,

        };

        self.set_author(&new, &new_key, self.author_scope())?;

        Ok(Rotation {

            old,

            new: new_key,

            identity: new,

            policy,

        })

    }

    /// Rotate to a fresh key pair; the new identity names the old one as

    /// `previous` and keeps its name, email, delegates, and expiry.

    pub fn rotate_identity(&mut self) -> Result<Rotation> {

        let Some((old, _)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let cur = self.identity(&old)?;

        let sk = SecretKey::generate();

        let mut id = sk.identity(&cur.name, &cur.email, Hlc::now().wall_ms);

        id.previous = Some(old);

        id.delegates = cur.delegates.clone();

        id.expires = cur.expires;

        self.replace_identity(id, sk, "oxy identity rotate")

    }

    /// Re-issue the identity with the same keys and a new expiry.

    pub fn renew_identity(&mut self, expires: Option<u64>) -> Result<Rotation> {

        let Some((old, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let cur = self.identity(&old)?;

        let id = cur.successor(cur.delegates.clone(), expires, Hlc::now().wall_ms);

        self.replace_identity(id, sk, "oxy identity renew")

    }

    /// Let `delegate` sign or seal on this identity's behalf. Delegates are

    /// part of the identity object, so this re-issues it with the same keys.

    pub fn delegate_add(&mut self, delegate: Identity) -> Result<Rotation> {

        let Some((old, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let dk = self.store.put_identity(&delegate)?;

        if dk == old {

            return fail("an identity cannot delegate to itself");

        }

        let cur = self.identity(&old)?;

        if cur.delegates.contains(&dk) {

            return fail(format!("{} is already a delegate", dk.short(12)));

        }

        let mut delegates = cur.delegates.clone();

        delegates.push(dk);

        let id = cur.successor(delegates, cur.expires, Hlc::now().wall_ms);

        self.replace_identity(

            id,

            sk,

            &format!("oxy identity delegate add {}", dk.short(12)),

        )

    }

    /// Withdraw a delegation; re-issues the identity with the same keys.

    pub fn delegate_remove(&mut self, delegate: &KeyId) -> Result<Rotation> {

        let Some((old, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let cur = self.identity(&old)?;

        if !cur.delegates.contains(delegate) {

            return fail(format!("{} is not a delegate", delegate.short(12)));

        }

        let delegates = cur

            .delegates

            .iter()

            .copied()

            .filter(|d| d != delegate)

            .collect();

        let id = cur.successor(delegates, cur.expires, Hlc::now().wall_ms);

        self.replace_identity(

            id,

            sk,

            &format!("oxy identity delegate remove {}", delegate.short(12)),

        )

    }

    /// Revoke `key` (your own, or any key when you hold a policy root):

    /// record a signed `revoke` attestation and a local marker, and drop

    /// the key from the policy where it has one.

    pub fn revoke_identity(&self, key: &KeyId, reason: &str) -> Result<Option<PolicyUpdate>> {

        let Some((own, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let policy = self.current_policy()?.map(|(_, sp)| sp.policy);

        let is_root = policy.as_ref().is_some_and(|p| p.roots.contains(&own));

        if *key != own && !is_root {

            return fail("only the key's holder or a policy root can revoke it");

        }

        let attest = Attest {

            repo: self.id()?,

            hlc: Hlc::now(),

            body: AttestBody::Revoke {

                key: *key,

                reason: reason.into(),

            },

        };

        let r = self.store.put_attest(&attest)?;

        self.store

            .put_signature(&r, &sk.sign(Domain::Attest, &own, &r))?;

        let dir = self.oxy.join("revoked");

        fs::create_dir_all(&dir)?;

        write_atomic(&dir.join(key.to_hex()), r.to_hex().as_bytes())?;

        match policy {

            Some(p) if p.mentions(key) => Ok(Some(self.policy_revoke(key)?)),

            _ => Ok(None),

        }

    }

    /// Whether `key` is revoked by the policy or by a recorded revocation.

    pub fn is_revoked(&self, key: &KeyId) -> Result<bool> {

        if self.oxy.join("revoked").join(key.to_hex()).exists() {

            return Ok(true);

        }

        Ok(self

            .current_policy()?

            .is_some_and(|(_, sp)| sp.policy.is_revoked(key)))

    }

    /// The secret key for `author.key`, if configured and present on disk.

    /// The identity object is kept beside the secret so a repository that has

    /// never seen it (a fresh clone) can store it when it first signs.

    pub fn secret_key(&self) -> Result<Option<(KeyId, SecretKey)>> {

        let Some(key) = self.config.author_key else {

            return Ok(None);

        };

        let path = self.keys_dir.join(format!("{}.secret", key.to_hex()));

        match fs::read(&path) {

            Ok(b) => {

                let (k, sk) = SecretKey::decode(&b)?;

                if k != key {

                    return fail(format!(

                        "{} holds a different key than its name",

                        path.display()

                    ));

                }

                if !self.store.has(&key) {

                    let id_path = self.keys_dir.join(format!("{}.identity", key.to_hex()));

                    if let Ok(bytes) = fs::read(&id_path) {

                        let id = Identity::decode(&bytes)?;

                        if id.hash() == key {

                            self.store.put_identity(&id)?;

                        }

                    }

                }

                Ok(Some((k, sk)))

            }

            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),

            Err(e) => Err(e.into()),

        }

    }

    /// An identity: from this repository's store, or else from the key

    /// directory, where `oxy identity create` keeps the user's own (a new

    /// repository has not stored it yet). The file must hash to `key`.

    pub fn identity(&self, key: &KeyId) -> Result<Identity> {

        match self.store.get_identity(key) {

            Ok(id) => Ok(id),

            Err(e) => {

                let path = self.keys_dir.join(format!("{}.identity", key.to_hex()));

                match fs::read(&path) {

                    Ok(bytes) => {

                        let id = Identity::decode(&bytes)?;

                        if id.hash() != *key {

                            return fail(format!(

                                "{} does not hold identity {}",

                                path.display(),

                                key.short(12)

                            ));

                        }

                        Ok(id)

                    }

                    Err(_) => Err(e.into()),

                }

            }

        }

    }

    /// Sign a stored change with the configured secret key.

    pub fn sign_change(&self, hash: &ChangeHash) -> Result<Signature> {

        let Some((key, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let sig = sk.sign(Domain::Change, &key, hash);

        self.store.put_signature(hash, &sig)?;

        Ok(sig)

    }

    /// Check the signatures on a change against the author-or-delegate rule.

    pub fn verify_change(&self, hash: &ChangeHash) -> Result<SignatureStatus> {

        let change = self.store.get_change_meta(hash)?;

        let sigs = self.store.signatures(hash)?;

        if sigs.is_empty() {

            return Ok(SignatureStatus::Unsigned);

        }

        let mut last_err = String::new();

        for sig in &sigs {

            match self.check_signer(&change, sig, Domain::Change, hash) {

                Ok(id) => {

                    return Ok(SignatureStatus::Valid {

                        key: sig.key,

                        name: id.name,

                        email: id.email,

                        sealed: false,

                        revoked: self.is_revoked(&sig.key)?,

                    })

                }

                Err(e) => last_err = e,

            }

        }

        Ok(SignatureStatus::Invalid(last_err))

    }

    /// Verify `sig` over `target` and check the author-or-delegate rule for `change`.

    fn check_signer(

        &self,

        change: &crate::state::ChangeMeta,

        sig: &Signature,

        domain: Domain,

        target: &ObjectRef,

    ) -> std::result::Result<Identity, String> {

        let id = self

            .store

            .get_identity(&sig.key)

            .map_err(|_| format!("unknown key {}", sig.key.short(12)))?;

        // The author-or-delegate rule (spec §14.4). A change whose author is

        // the zero key names nobody (Git imports, history from before an

        // identity existed), so any key may adopt it with a seal; policy

        // then authorises that key for the reference as usual.

        let authorised = change.author.is_zero()

            || sig.key == change.author

            || self

                .store

                .get_identity(&change.author)

                .map(|a| a.delegates.contains(&sig.key))

                .unwrap_or(false);

        if !authorised {

            return Err(format!(

                "key {} is neither the author nor a delegate",

                sig.key.short(12)

            ));

        }

        if id.is_expired_at(change.hlc.wall_ms) {

            return Err(format!(

                "key {} had expired when the change was made",

                sig.key.short(12)

            ));

        }

        verify_signature(&id, sig, domain, target).map_err(|e| e.to_string())?;

        Ok(id)

    }

    /// Like `verify_change`, but a change with no valid individual signature

    /// is also authenticated by a valid seal covering it (spec §14.4).

    pub fn authenticate_change(&self, hash: &ChangeHash) -> Result<SignatureStatus> {

        let direct = self.verify_change(hash)?;

        if matches!(direct, SignatureStatus::Valid { .. }) {

            return Ok(direct);

        }

        let change = self.store.get_change_meta(hash)?;

        let mut last_err = match &direct {

            SignatureStatus::Invalid(e) => e.clone(),

            _ => String::new(),

        };

        for seal_ref in self.store.seals_for(hash)? {

            let attest = self.store.get_attest(&seal_ref)?;

            let AttestBody::Seal { hashes } = &attest.body else {

                continue;

            };

            if !hashes.contains(hash) {

                continue;

            }

            for sig in self.store.signatures(&seal_ref)? {

                match self.check_signer(&change, &sig, Domain::Attest, &seal_ref) {

                    Ok(id) => {

                        return Ok(SignatureStatus::Valid {

                            key: sig.key,

                            name: id.name,

                            email: id.email,

                            sealed: true,

                            revoked: self.is_revoked(&sig.key)?,

                        })

                    }

                    Err(e) => last_err = e,

                }

            }

        }

        if last_err.is_empty() {

            Ok(SignatureStatus::Unsigned)

        } else {

            Ok(SignatureStatus::Invalid(last_err))

        }

    }

    /// Store and sign an attestation with the configured key.

    /// Seal changes with the identity key (spec §14.4): a stored, indexed

    /// seal attestation over `hashes`, pushed with the next push. Returns

    /// the attestation's reference.

    pub fn seal(&self, hashes: &[ChangeHash]) -> Result<ObjectRef> {

        if hashes.is_empty() {

            return fail("nothing to seal");

        }

        if hashes.len() > crate::attest::MAX_SEAL_HASHES {

            return fail(format!(

                "a seal covers at most {} changes",

                crate::attest::MAX_SEAL_HASHES

            ));

        }

        for h in hashes {

            if !self.store.has(h) {

                return fail(format!("unknown change {}", h.short(12)));

            }

        }

        let mut sorted = hashes.to_vec();

        sorted.sort();

        sorted.dedup();

        let sa = self.sign_attest(&Attest::seal(self.id()?, sorted.clone()))?;

        let r = self.store.put_attest(&sa.attest)?;

        for sig in &sa.sigs {

            self.store.put_signature(&r, sig)?;

        }

        for h in &sorted {

            self.store.index_seal(h, &r)?;