//! A repository on disk: the `.oxy` directory, one workspace, the operation

//! log, and the working-copy change (spec §12, §13.1).

//!

//! Not yet implemented from the spec: packs, checkpoints, multiple

//! workspaces, multi-signer policy updates, and the `objects`/`checkpoint`

//! endpoints. A repository without a policy is unverified and accepts

//! unsigned pushes; with one, everything received is checked (spec §14.5). Changes are signed individually when `core.sign` is

//! `change`; the default `seal` leaves them unsigned until push exists.

use crate::attest::{Attest, AttestBody};

use crate::diff::{ranges, split_lines, text_edits};

use crate::hash::{hash_object, ChangeHash, KeyId, ObjectRef, ObjectType};

use crate::identity::{

    verify as verify_signature, Delegate, Domain, Identity, Scope, SecretKey, Signature,

};

use crate::ids::{ChangeId, NodeId, WorkspaceId};

use crate::objects::{

    Blob, Change, ChangeKind, Edit, Hlc, Mode, NodeKind, OpRef, StateObject, TreeOp,

};

use crate::oplog::{Format1Op, Op, View, SNAPSHOT_SUFFIX};

use crate::protocol::{

    open_remote, Bundle, RefResult, RefUpdate, RefsResponse, RemoteOptions, RemoteRef,

    SignedAttest, SignedPolicy,

};

use crate::state::{FileContent, Snapshot, State};

use crate::store::{Store, StoreError};

#[allow(unused_imports)]

use crate::subrepo::Pin;

use crate::tree::OpKey;

use rand::RngCore;

use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};

use std::fs;

use std::io::Write;

use std::path::{Path, PathBuf};

pub const OXY_DIR: &str = ".oxy";

pub const FORMAT_LINE: &str = "oxy repository format 2\n";

const FORMAT1_LINE: &str = "oxy repository format 1\n";

const BINARY_SNIFF: usize = 8 * 1024;

/// Loose objects tolerated before a commit packs them (spec §13.4).

pub const AUTOPACK_THRESHOLD: usize = 4096;

#[derive(Debug, thiserror::Error)]

pub enum RepoError {

    #[error("io: {0}")]

    Io(#[from] std::io::Error),

    #[error(transparent)]

    Store(#[from] StoreError),

    #[error(transparent)]

    Object(#[from] crate::objects::ObjectError),

    #[error(transparent)]

    State(#[from] crate::state::StateError),

    #[error("{0}")]

    Msg(String),

    /// The operation would leave a conflict where none may be (a rebased

    /// change cannot hold one); the caller may offer another way.

    #[error("{0}")]

    Conflicted(String),

}

pub type Result<T> = std::result::Result<T, RepoError>;

/// The operation head's reference record on a store that is not this

/// disk's directory (oxygen#68).

pub const HEAD_RECORD: &str = "ops/head";

/// How often recording an operation reads the head again when other

/// processes keep moving it.

const HEAD_TRIES: usize = 8;

/// The object store of the repository directory `oxy`: `.oxy/objects`,

/// or the store `storage.url` names behind a cache of `storage.cache`

/// bytes in `.oxy/cache` (oxygen#68). `.oxy/objects` is then only

/// scratch space: packs being written, and derived caches.

fn open_objects(oxy: &Path, config: &Config) -> Result<Store> {

    let Some(url) = &config.storage_url else {

        return Ok(Store::open(oxy.join("objects"))?);

    };

    let options = crate::protocol::RemoteOptions {

        cache_dir: Some(oxy.join("cache")),

        ..Default::default()

    };

    let remote = crate::protocol::open_store(url, &options)

        .ok_or_else(|| {

            RepoError::Msg(format!(

                "storage.url {url}: this oxy cannot open that kind of store (dir://, or s3://, gs:// and az:// in builds with cloud stores)"

            ))

        })?

        .map_err(|e| RepoError::Msg(format!("open the repository's store {url}: {e}")))?;

    let cached = crate::strata::CachingStore::open(

        std::sync::Arc::from(remote),

        oxy.join("cache"),

        config.storage_cache,

    )

    .map_err(|e| RepoError::Msg(format!("open the cache for {url}: {e}")))?;

    Ok(Store::open_on(

        std::sync::Arc::new(cached),

        oxy.join("objects"),

    )?)

}

fn fail<T>(s: impl Into<String>) -> Result<T> {

    Err(RepoError::Msg(s.into()))

}

mod bookmarks;

mod checkout;

mod checkpoint;

mod config;

mod doctor;

mod fsck;

mod gc;

mod git;

mod history;

mod hooks;

mod hosted;

mod identity;

mod inspect;

mod keyless;

mod ops;

mod policy;

mod prompt;

mod receipts;

mod revset;

mod snapshot;

pub mod strata;

mod subrepos;

mod sync;

mod tags;

#[cfg(test)]

mod tests;

mod touched;

mod transparency;

mod walk;

mod workspace;

pub use bookmarks::{remote_bookmark, BookmarkInfo, MergeReport, RemoteOnlyBookmark, StateGap};

pub use checkout::CheckoutReport;

pub use config::{parse_size, read_config_file, Config};

pub use doctor::{Check, DoctorReport, Health};

pub use fsck::{FsckReport, Problem, Severity};

pub use gc::GcReport;

pub use git::{GitExportReport, GitImportReport, GitVerifyReport};

pub use hooks::{json_array, json_str, HookOutcome};

pub use hosted::FileEdit;

pub use identity::{create_user_identity, Rotation, SignatureStatus};

pub use inspect::{BisectStep, BlameLine, Description};

pub use keyless::home_key;

pub use ops::{RestoreReport, RevertReport, Undone, ViewChange};

pub use policy::PolicyUpdate;

pub use prompt::{PromptInfo, DEFAULT_PROMPT_FORMAT, GLYPH_PROMPT_FORMAT};

pub use receipts::ReceiptInfo;

pub use revset::{Revset, REVSET_BUDGET};

pub use snapshot::{

    added_node_paths, diff_files_of, has_conflict_markers, is_binary, referenced_changes,

    render_change, render_hunks, similarity, ChangeStatus, DiffHunk, FileDiff, Hunk, KeptBoth,

    PathStatus, Selection, SnapshotResult,

};

pub use subrepos::{SubrepoInfo, SubrepoSync};

pub use sync::{FetchReport, PullReport, PushReport, RefUpdated, OBJECTS_RESULT};

pub use tags::TagInfo;

pub use transparency::LogAudit;

pub use workspace::{FileLock, SnapshotLock, WorkingCopyLock, WorkspaceInfo};

/// The file name under which per-bookmark or per-tag data is kept: `/`

/// (and `%`) escaped, so `feature/x` is one file beside `feature` rather

/// than a directory that would clash with it.

pub(crate) fn name_file(name: &str) -> String {

    name.replace('%', "%25").replace('/', "%2F")

}

/// The name a [`name_file`] file name stands for.

pub(crate) fn file_name_to_name(file: &str) -> String {

    file.replace("%2F", "/").replace("%25", "%")

}

fn write_atomic(path: &Path, data: &[u8]) -> Result<()> {

    Ok(crate::durable::write_atomic(path, data)?)

}

/// Replace a cache file: whole or not at all, but without waiting for the

/// disk. A cache checks its own bytes when read, so one a crash leaves

/// short or stale is rebuilt rather than trusted.

/// How many changes a state index may fall behind its working copy before

/// it is written again; until then each load replays them.

const INDEX_REPLAY_LIMIT: usize = 16;

/// The changes whose encodings are kept for building graphs: a batch of

/// files often takes inline text from a few changes in turn.

const CHANGE_CACHE_COUNT: usize = 4;

const CHANGE_CACHE_BYTES: usize = 512 << 20;

/// How many state indexes a workspace keeps.

const STATE_INDEXES_KEPT: usize = 2;

const INDEX_REPLAY_TIME: std::time::Duration = std::time::Duration::from_millis(50);

pub(crate) fn write_cache(path: &Path, data: &[u8]) -> Result<()> {

    let tmp = path.with_extension(format!("tmp-{}", std::process::id()));

    fs::write(&tmp, data)?;

    fs::rename(&tmp, path)?;

    Ok(())

}

pub struct LogEntry {

    pub hash: ChangeHash,

    /// Metadata from the state; the full change may be absent in a shallow repository.

    pub change: crate::state::ChangeMeta,

    pub is_working_copy: bool,

    pub is_head: bool,

}

/// A text file's base graph key, by path, as a walk asks for it.

pub(crate) type KeyOf<'a> = dyn Fn(&str) -> Option<[u8; 32]> + Sync + 'a;

/// A file as found on disk or in an imported tree.

#[derive(Clone)]

pub(crate) struct FsEntry {

    pub kind: NodeKind,

    pub exec: bool,

    /// File content, or a symlink's target. Empty when `blob` is set.

    /// Shared, so a new file's insert holds it without a copy.

    pub content: std::sync::Arc<Vec<u8>>,

    /// The stored blob of an opaque file whose size and mtime are unchanged

    /// since the last manifest (spec §12.3 stat cache); the content was not

    /// read.

    pub blob: Option<ObjectRef>,

    /// BLAKE3 of the content, carried over from the manifest when the stat

    /// is unchanged, so the manifest can be rewritten without rehashing.

    pub content_hash: Option<[u8; 32]>,

    /// A text file known equal to the base's rendering without reading it:

    /// its stat matches the manifest and the manifest recorded it equal to

    /// a base file graph with the same key (spec §12.3). `content` is empty.

    pub unchanged: bool,

    /// The base graph key this file equals, for the next manifest.

    pub graph_key: Option<[u8; 32]>,

    /// Size and mtime already known to be current (a checkout leaving the

    /// file as it was), so the manifest need not stat it again.

    pub stat: Option<(u64, u128)>,

}

impl FsEntry {

    pub(crate) fn new(kind: NodeKind, exec: bool, content: Vec<u8>) -> FsEntry {

        FsEntry {

            kind,

            exec,

            content: std::sync::Arc::new(content),

            blob: None,

            content_hash: None,

            unchanged: false,

            graph_key: None,

            stat: None,

        }

    }

}

pub struct Repo {

    /// The key a host accepts certified updates with (spec §14.7): when

    /// set, accepting a reference update signed by a short-lived key also

    /// records the host's acceptance and its time.

    pub(crate) acceptor: Option<std::sync::Arc<(Identity, crate::identity::SecretKey)>>,

    /// With `author.signer = keyless`, the fresh key the hub last

    /// certified and when its certificate ends (spec §14.7): kept in memory

    /// only, for one command.

    pub(crate) keyless_key: std::cell::RefCell<Option<(KeyId, crate::identity::SecretKey, u64)>>,

    /// Oxygen-pinned subrepos skipped by the running Git export.

    pub(crate) git_export_skipped: std::cell::Cell<usize>,

    /// The manifest as last read, with the file identity it was read from,

    /// so one command parses it once (see `read_manifest`).

    pub(crate) manifest_cache: std::cell::RefCell<Option<prompt::CachedManifest>>,

    /// A listing of the working copy left by a failed clean check, for the

    /// snapshot that follows it to reuse; taken by the next walk and

    /// dropped whenever the manifest is written.

    pub(crate) listing_cache: std::cell::RefCell<Option<walk::Listing>>,

    /// The nested repositories the last walk left out, being neither

    /// registered nor tracked subrepos (oxygen#43).

    pub(crate) untracked_nested: std::cell::RefCell<Vec<String>>,

    /// New untracked files the last walk left out for their size, with

    /// their sizes (oxygen#98).

    pub(crate) skipped_large: std::cell::RefCell<Vec<(String, u64)>>,

    root: PathBuf,

    oxy: PathBuf,

    store: Store,

    workspace: WorkspaceId,

    /// A hosted repository with no working copy (spec §12.2, hub spec §4.1).

    bare: bool,

    keys_dir: PathBuf,

    user_config: PathBuf,

    pub config: Config,

    /// What the working copy's file system can represent (spec §7.7).

    platform: crate::portable::Platform,

    /// The encodings of the changes last read for their inline inserts,

    /// oldest first.

    last_change: std::cell::RefCell<Vec<(ChangeHash, std::sync::Arc<Vec<u8>>)>>,

    /// `--at-op`: read the repository as it was after this operation;

    /// recording an operation is refused.

    at_op: Option<ObjectRef>,

    /// The operation head this handle reads (oxygenhub#249): read once, on

    /// first use, and moved only by this handle's own operations or by

    /// [`Repo::refresh`], so one command or request never mixes two heads.

    head_seen: std::cell::Cell<Option<ObjectRef>>,

    /// The directories (with their times) and nested repositories of the

    /// last walk, for the manifest written from it.

    pub(crate) walked_dirs: std::cell::RefCell<Option<WalkedDirs>>,

    /// The directories a manifest check listed, for its restamp only.

    pub(crate) listed_dirs: std::cell::RefCell<Option<WalkedDirs>>,

}

/// A walk's directories with their times, and its nested repositories.

pub(crate) type WalkedDirs = (Vec<(String, u128)>, Vec<String>);

/// Marker file of a bare repository, inside `.oxy/`.

const BARE_MARKER: &str = "bare";

/// Marker of a hosted repository that has no id yet: the first push binds

/// it to the pusher's id (spec §16.1).

const UNBOUND_MARKER: &str = "unbound";

/// The user's oxy directory: `$OXY_HOME`, else `$XDG_CONFIG_HOME/oxy`, else

/// `~/.config/oxy`. It holds `config.toml` (spec §19) and `keys/`.

pub fn default_home() -> PathBuf {

    if let Ok(h) = std::env::var("OXY_HOME") {

        return PathBuf::from(h);

    }

    if let Ok(x) = std::env::var("XDG_CONFIG_HOME") {

        return PathBuf::from(x).join("oxy");

    }

    // Windows has no HOME as a rule: the roaming profile's application

    // data, as Windows programs keep theirs.

    #[cfg(windows)]

    if let Some(d) = std::env::var_os("APPDATA").or_else(|| std::env::var_os("USERPROFILE")) {

        return PathBuf::from(d).join("oxy");

    }

    let home = std::env::var("HOME").unwrap_or_else(|_| ".".into());

    PathBuf::from(home).join(".config").join("oxy")

}

pub fn default_keys_dir() -> PathBuf {

    default_home().join("keys")

}

pub fn default_user_config() -> PathBuf {

    default_home().join("config.toml")

}

/// Where `create_identity` records the author.

#[derive(Clone, Copy, Debug, PartialEq, Eq)]

pub enum IdentityScope {

    /// The user file: every repository of this user signs with it.

    User,

    /// This repository only.

    Repo,

}

impl Repo {

    // ------------------------------------------------------------ lifecycle

    pub fn init(root: &Path) -> Result<Repo> {

        let mut id = [0u8; 16];

        rand::rngs::OsRng.fill_bytes(&mut id);

        Self::init_with_id(root, id)

    }

    /// Initialize a repository with a given repository ID (clones share the

    /// ID of their origin, spec §14.4).

    pub fn init_with_id(root: &Path, id: [u8; 16]) -> Result<Repo> {

        Self::init_on(root, id, None)

    }

    /// A new repository with a fresh id, bare or not, on `storage` or in

    /// `.oxy/objects` (`oxy init [--bare] [--store URL]`).

    pub fn init_new(root: &Path, bare: bool, storage: Option<&str>) -> Result<Repo> {

        let mut id = [0u8; 16];

        rand::rngs::OsRng.fill_bytes(&mut id);

        if bare {

            Self::init_bare_on(root, id, storage)

        } else {

            Self::init_on(root, id, storage)

        }

    }

    /// Initialize a repository whose objects and operation head are kept

    /// on the store at `storage` (`storage.url`), or in `.oxy/objects`.

    pub fn init_on(root: &Path, id: [u8; 16], storage: Option<&str>) -> Result<Repo> {

        fs::create_dir_all(root)?;

        let root = crate::portable::canonical(root).unwrap_or_else(|_| root.to_path_buf());

        let oxy = root.join(OXY_DIR);

        if oxy.exists() {

            return fail(format!("{} is already an oxy repository", root.display()));

        }

        fs::create_dir_all(oxy.join("ops"))?;

        write_atomic(&oxy.join("format"), FORMAT_LINE.as_bytes())?;

        write_atomic(&oxy.join("id"), hex::encode(id).as_bytes())?;

        let mut config = Config::load(Some(&default_user_config()), &oxy.join("config"))?;

        if let Some(url) = storage {

            config.set("storage.url", url)?;

        }

        config.save(&oxy.join("config"))?;

        let workspace = WorkspaceId::random();

        write_atomic(&oxy.join("workspace"), workspace.to_hex().as_bytes())?;

        let store = open_objects(&oxy, &config)?;

        let repo = Repo {

            acceptor: None,

            keyless_key: Default::default(),

            last_change: Default::default(),

            at_op: None,

            head_seen: Default::default(),

            walked_dirs: Default::default(),

            listed_dirs: Default::default(),

            git_export_skipped: Default::default(),

            manifest_cache: Default::default(),

            listing_cache: Default::default(),

            untracked_nested: Default::default(),

            skipped_large: Default::default(),

            root,

            oxy,

            store,

            workspace,

            bare: false,

            keys_dir: default_keys_dir(),

            platform: crate::portable::Platform::current(),

            user_config: default_user_config(),

            config,

        };

        repo.register_workspace(&workspace, &repo.root)?;

        let wc = repo.new_working_copy(vec![], "");

        let wc_hash = repo.store.put_change(&wc)?;

        let mut view = View::default();

        view.bookmarks.insert(

            repo.config.bookmark.clone(),

            repo.store.put_state(&StateObject::new(vec![]))?,

        );

        view.workspaces.insert(workspace, wc_hash);

        repo.record_op(&[], "oxy init", view)?;

        Ok(repo)

    }

    /// Create a bare repository: an object store, operation log and

    /// references with no workspace and no working copy, for hosting

    /// (hub spec §4.1). `root` holds `.oxy/` and nothing else.

    pub fn init_bare(root: &Path) -> Result<Repo> {

        let mut id = [0u8; 16];

        rand::rngs::OsRng.fill_bytes(&mut id);

        Self::init_bare_with_id(root, id)

    }

    pub fn init_bare_with_id(root: &Path, id: [u8; 16]) -> Result<Repo> {

        Self::init_bare_on(root, id, None)

    }

    /// [`Repo::init_on`] for a bare repository.

    pub fn init_bare_on(root: &Path, id: [u8; 16], storage: Option<&str>) -> Result<Repo> {

        fs::create_dir_all(root)?;

        let root = crate::portable::canonical(root).unwrap_or_else(|_| root.to_path_buf());

        let oxy = root.join(OXY_DIR);

        if oxy.exists() {

            return fail(format!("{} is already an oxy repository", root.display()));

        }

        fs::create_dir_all(oxy.join("ops"))?;

        write_atomic(&oxy.join("format"), FORMAT_LINE.as_bytes())?;

        write_atomic(&oxy.join("id"), hex::encode(id).as_bytes())?;

        write_atomic(&oxy.join(BARE_MARKER), b"")?;

        let mut config = Config::load(Some(&default_user_config()), &oxy.join("config"))?;

        if let Some(url) = storage {

            config.set("storage.url", url)?;

        }

        config.save(&oxy.join("config"))?;

        let store = open_objects(&oxy, &config)?;

        let repo = Repo {

            acceptor: None,

            keyless_key: Default::default(),

            last_change: Default::default(),

            at_op: None,

            head_seen: Default::default(),

            walked_dirs: Default::default(),

            listed_dirs: Default::default(),

            git_export_skipped: Default::default(),

            manifest_cache: Default::default(),

            listing_cache: Default::default(),

            untracked_nested: Default::default(),

            skipped_large: Default::default(),

            root,

            oxy,

            store,

            workspace: WorkspaceId::ZERO,