//! What a host (a hub) does to a repository without a workspace (hub spec

//! §6.9, §7.6): build a change from an edit set on any state, sign a

//! reference update with a key it holds, and apply both through the same

//! validation a received push gets. Nothing here bypasses policy.

use super::*;

use crate::identity::SecretKey;

/// One file of an edit set: new content, or `None` to remove the path.

#[derive(Clone, Debug, PartialEq, Eq)]

pub struct FileEdit {

    pub path: String,

    pub content: Option<Vec<u8>>,

}

impl Repo {

    /// Build (but do not store or sign) a change that turns the state with

    /// `heads` into that state with `edits` applied, authored by `author`.

    /// Files the edits do not name keep their content, conflict markers

    /// included, so an edit that removes a file's markers resolves that

    /// file's conflict (a resolution change, spec §9.6).

    pub fn build_change(

        &self,

        heads: &[ChangeHash],

        edits: &[FileEdit],

        message: &str,

        author: KeyId,

    ) -> Result<Change> {

        self.build_change_with(heads, edits, &[], message, author)

    }

    /// Build (but do not store or sign) a change that moves the subrepo at

    /// `path` in the state with `heads` to `pin`: a hub moving a consumer's

    /// pin for Diffusion (oxygenhub#148). The path must already be a

    /// subrepo; nothing else changes.

    pub fn build_pin_change(

        &self,

        heads: &[ChangeHash],

        path: &str,

        pin: &crate::subrepo::Pin,

        message: &str,

        author: KeyId,

    ) -> Result<Change> {

        self.build_change_with(

            heads,

            &[],

            &[(path.to_string(), pin.clone())],

            message,

            author,

        )

    }

    fn build_change_with(

        &self,

        heads: &[ChangeHash],

        edits: &[FileEdit],

        pins: &[(String, crate::subrepo::Pin)],

        message: &str,

        author: KeyId,

    ) -> Result<Change> {

        if message.trim().is_empty() {

            return fail("a change message is required");

        }

        if edits.is_empty() && pins.is_empty() {

            return fail("nothing to change");

        }

        let base = self.load_state(heads)?;

        let base_snapshot = base.materialize();

        let mut entries: BTreeMap<String, FsEntry> = BTreeMap::new();

        for (path, f) in &base_snapshot.files {

            let entry = match (&f.kind, &f.content) {

                (NodeKind::Dir, _) | (_, FileContent::Dir) => continue,

                (kind, FileContent::Text { bytes, .. }) => {

                    FsEntry::new(*kind, f.mode.exec, bytes.clone())

                }

                (kind, FileContent::Opaque { blobs }) => FsEntry {

                    blob: blobs.first().copied(),

                    ..FsEntry::new(*kind, f.mode.exec, vec![])

                },

            };

            entries.insert(path.clone(), entry);

        }

        for e in edits {

            let path = e.path.trim_matches('/');

            if path.is_empty()

                || path

                    .split('/')

                    .any(|c| c.is_empty() || c == "." || c == ".." || c == OXY_DIR)

            {

                return fail(format!("{:?} is not a valid path", e.path));

            }

            match &e.content {

                Some(bytes) => {

                    let exec = entries.get(path).map(|x| x.exec).unwrap_or(false);

                    // A file cannot sit where a directory is, or inside a file.

                    if base_snapshot

                        .files

                        .get(path)

                        .is_some_and(|f| f.kind == NodeKind::Dir)

                    {

                        return fail(format!("{path} is a directory"));

                    }

                    let mut parent = path;

                    while let Some((p, _)) = parent.rsplit_once('/') {

                        if base_snapshot

                            .files

                            .get(p)

                            .is_some_and(|f| f.kind != NodeKind::Dir)

                        {

                            return fail(format!("{p} is a file, not a directory"));

                        }

                        parent = p;

                    }

                    entries.insert(

                        path.to_string(),

                        FsEntry::new(NodeKind::File, exec, bytes.clone()),

                    );

                }

                None => {

                    if entries.remove(path).is_none() {

                        // Removing a directory removes everything below it.

                        let prefix = format!("{path}/");

                        let before = entries.len();

                        entries.retain(|p, _| !p.starts_with(&prefix));

                        if entries.len() == before {

                            return fail(format!("{path} does not exist"));

                        }

                    }

                }

            }

        }

        for (path, pin) in pins {

            let path = path.trim_matches('/');

            match base_snapshot.files.get(path) {

                Some(f) if f.kind == NodeKind::Subrepo => {}

                Some(_) => return fail(format!("{path} is not a subrepo")),

                None => return fail(format!("{path} does not exist")),

            }

            entries.insert(

                path.to_string(),

                FsEntry::new(NodeKind::Subrepo, false, pin.encode()),

            );

        }

        // A path the user writes settles its replace conflict, if any: they

        // chose that content (spec §9.3).

        let written: std::collections::HashSet<String> = edits

            .iter()

            .filter(|e| e.content.is_some())

            .map(|e| e.path.trim_matches('/').to_string())

            .chain(pins.iter().map(|(p, _)| p.trim_matches('/').to_string()))

            .collect();

        let built = self.build_from_entries_resolving(

            &base,

            &base_snapshot,

            HashMap::new(),

            &entries,

            &written,

        )?;

        if let Some(s) = built

            .statuses

            .iter()

            .find(|s| s.status == ChangeStatus::ConflictEdited)

        {

            return fail(format!("{} still contains conflict markers", s.path));

        }

        if built.tree_ops.is_empty() && built.edits.is_empty() {

            return fail("the edits change nothing");

        }

        let mut change = Change {

            version: crate::objects::CHANGE_VERSION,

            change_id: ChangeId::random(),

            deps: vec![],

            author,

            hlc: Hlc::now(),

            message: message.trim_end().to_string(),

            tree_ops: built.tree_ops,

            edits: built.edits,

            kind: if built.resolves {

                ChangeKind::Resolution

            } else {

                ChangeKind::Normal

            },

        };

        let mut deps: BTreeSet<ChangeHash> = referenced_changes(&change, &base);

        deps.extend(built.contributors.iter().copied());

        change.deps = deps.into_iter().collect();

        change.normalize();

        Ok(change)

    }

    /// A reference update of `bookmark` to `heads`, attested by `signer`

    /// when given (the attestation a push would carry, spec §14.4).

    pub fn host_ref_update(

        &self,

        bookmark: &str,

        heads: &[ChangeHash],

        signer: Option<(&KeyId, &SecretKey)>,

    ) -> Result<RefUpdate> {

        let view = self.view()?;

        let empty = self.store.put_state(&StateObject::new(vec![]))?;

        let old_state = view.bookmarks.get(bookmark).copied().unwrap_or(empty);

        let new_state = self.store.put_state(&StateObject::new(heads.to_vec()))?;

        let attestation = match signer {

            Some((key, sk)) => {

                let serial = self

                    .latest_ref_attest(bookmark)?

                    .and_then(|(_, a)| match a.attest.body {

                        AttestBody::Ref { serial, .. } => Some(serial),

                        _ => None,

                    })

                    .map(|s| s + 1)

                    .unwrap_or(1);

                let attest = Attest {

                    repo: self.id()?,

                    hlc: Hlc::now(),

                    body: AttestBody::Ref {

                        name: bookmark.to_string(),

                        old_state,

                        new_state,

                        serial,

                    },

                };

                let r = attest.hash();

                let sig = sk.sign(Domain::Attest, key, &r);

                Some(SignedAttest {

                    attest,

                    sigs: vec![sig],

                })

            }

            None => None,

        };

        Ok(RefUpdate {

            name: bookmark.to_string(),

            old_state,

            new_state,

            force: false,

            attestation,

        })

    }

    /// Create tag `name` for the state of `heads` as a host does for a

    /// signed-in user (oxygenhub#295): attested by `signer` (a delegate of

    /// the user, or the host's own key), with `identities` it needs, and

    /// received as a pushed tag is, so the same policy checks apply.

    pub fn host_tag_create(

        &self,

        name: &str,

        heads: &[ChangeHash],

        message: &str,

        signer: (&KeyId, &SecretKey),

        identities: &[Identity],

    ) -> Result<PushReport> {

        crate::objects::validate_name(name)

            .map_err(|e| RepoError::Msg(format!("tag name: {e}")))?;

        let st = self.load_state_history(heads)?;

        let heads = st.maximal(heads);

        if heads.is_empty() {

            return fail("a tag needs at least one change");

        }

        let state_object = StateObject::new(heads.clone());

        let state = state_object.hash();

        let body = AttestBody::Tag {

            name: name.into(),

            state,

            message: message.into(),

        };

        let mut bundle = self.hosted_bundle(identities);

        bundle

            .objects

            .push((ObjectType::State, state_object.encode()));

        let t = crate::protocol::TagRef::new(

            name.into(),

            state,

            heads,

            Some(self.host_attest(body, signer)?),

        );

        self.receive_push_report(bundle, vec![], None, vec![t])

    }

    /// Withdraw tag `name` as a host does for a signed-in user

    /// (oxygenhub#301): an `untag` attestation by `signer`, received as a

    /// pushed withdrawal is.

    pub fn host_tag_withdrawal(

        &self,

        name: &str,

        reason: &str,

        signer: (&KeyId, &SecretKey),

        identities: &[Identity],

    ) -> Result<PushReport> {

        let Some(state) = self.view()?.tags.get(name).copied() else {

            return fail(format!("no tag {name:?}"));

        };

        let body = AttestBody::Untag {

            name: name.into(),

            state,

            reason: reason.into(),

        };

        let t = crate::protocol::TagRef::new(

            name.into(),

            state,

            vec![],

            Some(self.host_attest(body, signer)?),

        );

        self.receive_push_report(self.hosted_bundle(identities), vec![], None, vec![t])

    }

    fn host_attest(

        &self,

        body: AttestBody,

        (key, sk): (&KeyId, &SecretKey),

    ) -> Result<SignedAttest> {

        let attest = Attest {

            repo: self.id()?,

            hlc: Hlc::now(),

            body,

        };

        let sig = sk.sign(Domain::Attest, key, &attest.hash());

        Ok(SignedAttest {

            attest,

            sigs: vec![sig],

        })

    }

    fn hosted_bundle(&self, identities: &[Identity]) -> Bundle {

        let mut bundle = Bundle::default();

        for id in identities {

            bundle.objects.push((ObjectType::Identity, id.encode()));

        }

        bundle

    }

    /// Apply a host-made update as if it had been pushed: the new change

    /// (with its signatures) if any, the identities it needs, and the

    /// reference update, all through `receive_push_report`, so the same

    /// authentication, compare-and-swap and policy checks apply.

    pub fn apply_hosted(

        &self,

        change: Option<(Change, Vec<Signature>)>,

        identities: &[Identity],

        update: RefUpdate,

    ) -> Result<PushReport> {

        let mut bundle = Bundle::default();

        for id in identities {

            bundle.objects.push((ObjectType::Identity, id.encode()));

        }

        if let Ok(st) = self.store.get_state(&update.new_state) {

            bundle.objects.push((ObjectType::State, st.encode()));

        }

        if let Some((c, sigs)) = change {

            bundle.changes.push((c, sigs));

        }

        self.receive_push_report(bundle, vec![update], None, vec![])

    }

}

#[cfg(test)]

mod tests {

    use super::*;

    use crate::identity::SecretKey;

    fn hermetic() {

        static ONCE: std::sync::Once = std::sync::Once::new();

        static DIR: std::sync::OnceLock<tempfile::TempDir> = std::sync::OnceLock::new();

        ONCE.call_once(|| {

            let d = tempfile::tempdir().unwrap();

            std::env::set_var("OXY_HOME", d.path());

            DIR.set(d).ok();

        });

    }

    fn write(root: &Path, rel: &str, content: &[u8]) {

        let p = root.join(rel);

        fs::create_dir_all(p.parent().unwrap()).unwrap();

        fs::write(p, content).unwrap();

    }

    /// A user repository pushed to a bare host, and a hub key the user

    /// has delegated to. Returns (host, user, hub key, hub secret).

    fn setup(

        root: &Path,

        with_policy: bool,

        delegate: bool,

    ) -> (Repo, Repo, KeyId, SecretKey, Identity) {

        hermetic();

        let host_dir = root.join("host");

        Repo::init_bare_unbound(&host_dir).unwrap();

        let work = root.join("work");

        let mut user = Repo::init(&work).unwrap();

        user.create_identity("Andy", "[email protected]", IdentityScope::Repo)

            .unwrap();

        user.config.set("core.sign", "change").unwrap();

        user.config

            .set("remote.origin.url", host_dir.to_str().unwrap())

            .unwrap();

        user.save_config().unwrap();

        let hub_sk = SecretKey::generate();

        let hub_id = hub_sk.identity("Hub", "hub@example", 1);

        let hub_key = hub_id.hash();

        if with_policy {

            user.policy_init().unwrap();

        }

        if delegate {

            user.delegate_add(hub_id.clone(), Scope::CHANGES | Scope::REFS, None)

                .unwrap();

        }

        write(&work, "a.txt", b"one\ntwo\n");

        user.snapshot("t").unwrap();

        user.commit("first", &[]).unwrap();

        let r = user.push("origin", false).unwrap();

        assert!(r.iter().all(|x| x.ok), "{r:?}");

        (

            Repo::open(&host_dir).unwrap(),

            user,

            hub_key,

            hub_sk,

            hub_id,

        )

    }

    #[test]

    fn a_host_edit_signed_by_a_delegate_lands() {

        let dir = tempfile::tempdir().unwrap();

        let (host, user, hub_key, hub_sk, hub_id) = setup(dir.path(), false, true);

        let author = user.config.author_key.unwrap();

        let heads = host.bookmark_heads().unwrap();

        let change = host

            .build_change(

                &heads,

                &[

                    FileEdit {

                        path: "a.txt".into(),

                        content: Some(b"one\ntwo\nthree\n".to_vec()),

                    },

                    FileEdit {

                        path: "docs/new.md".into(),

                        content: Some(b"# New\n".to_vec()),

                    },

                ],

                "Edit on the web",

                author,

            )

            .unwrap();

        assert_eq!(change.author, author);

        assert_eq!(change.kind, ChangeKind::Normal);

        let hash = change.hash();

        let sig = hub_sk.sign(Domain::Change, &hub_key, &hash);

        let mut new_heads = heads.clone();

        new_heads.push(hash);

        let update = host

            .host_ref_update("main", &[hash], Some((&hub_key, &hub_sk)))

            .unwrap();

        let ids = vec![hub_id, user.identity(&author).unwrap()];

        let report = host

            .apply_hosted(Some((change, vec![sig])), &ids, update)

            .unwrap();

        assert!(report.results.iter().all(|r| r.ok), "{:?}", report.results);

        assert_eq!(host.bookmark_heads().unwrap(), vec![hash]);

        assert_eq!(

            host.file_at("a.txt", Some(&[hash])).unwrap(),

            b"one\ntwo\nthree\n"

        );

        assert_eq!(

            host.file_at("docs/new.md", Some(&[hash])).unwrap(),

            b"# New\n"

        );

        // Authored by the user, authenticated by the hub key as delegate.

        assert!(

            matches!(host.authenticate_change(&hash).unwrap(), SignatureStatus::Valid { key, name, .. } if key == hub_key && name == "Hub")

        );