//! Signing with short-lived keys (spec §14.7, oxygenhub#241): with

//! `author.signer = keyless`, oxy asks the hub to certify a fresh key

//! whenever it must sign, with the agent's grant token as the credential,

//! and keeps the key in memory for its certificate's minutes. Nothing that

//! signs is ever written to disk: the home holds only the grant token,

//! which its owner revokes on the hub. The certificate carries the owner's

//! grant, so what the key signs counts in the owner's name.

use super::*;

use crate::cert::{certify_challenge, SignedCertificate};

use crate::credentials::{hub_of, Credentials};

use crate::protocol::{http_get, http_json, RemoteOptions};

/// A certified key is used until this long before its certificate ends,

/// so a push started near the end does not outlive it.

const MARGIN_MS: u64 = 2 * 60 * 1000;

impl Repo {

    /// The hub that certifies keys: `keyless.hub`, else the default

    /// remote's.

    fn keyless_hub(&self) -> Result<String> {

        let url = match &self.config.keyless_hub {

            Some(h) => h.clone(),

            None => self

                .config

                .remotes

                .get(&self.default_remote())

                .cloned()

                .ok_or_else(|| {

                    RepoError::Msg(

                        "author.signer is keyless, but neither keyless.hub nor a default remote names the hub that certifies keys"

                            .into(),

                    )

                })?,

        };

        hub_of(&url).ok_or_else(|| RepoError::Msg(format!("{url} is not a hub URL")))

    }

    /// The key to sign with now: the one certified last while it has more

    /// than a couple of minutes left, else a fresh one the hub certifies.

    pub(crate) fn keyless_secret(&self) -> Result<(KeyId, SecretKey)> {

        let now = Hlc::now().wall_ms;

        if let Some((k, sk, until)) = self.keyless_key.borrow().as_ref() {

            if now + MARGIN_MS < *until {

                return Ok((*k, sk.clone()));

            }

        }

        let hub = self.keyless_hub()?;

        let home = self

            .user_config

            .parent()

            .map(Path::to_path_buf)

            .unwrap_or_else(default_home);

        let creds = Credentials::at(home.clone());

        let token = creds.grant(&hub).map_err(RepoError::Msg)?.ok_or_else(|| {

            RepoError::Msg(format!(

                "author.signer is keyless, but there is no agent grant for {hub}: its owner makes one with `oh agent grant NAME`, and `oxy auth grant TOKEN` keeps it"

            ))

        })?;

        let options = RemoteOptions {

            token: Some(token.clone()),

            ca: creds.get(&hub).map_err(RepoError::Msg)?.and_then(|e| e.ca),

            ..RemoteOptions::default()

        };

        let sk = SecretKey::generate();

        let id = sk.identity(&self.config.author_name, &self.config.author_email, now);

        let key = id.hash();

        let proof = sk

            .sign_challenge(&key, &certify_challenge(&token))

            .map_err(|e| RepoError::Msg(e.to_string()))?;

        let body = serde_json::json!({

            "identity": crate::dsse::base64(&id.encode()),

            "proof": crate::dsse::base64(&crate::cbor::encode(&proof.to_value())),

            "scope": "changes,refs,seal",

        });

        let (code, answer) = http_json(

            "POST",

            &format!("{hub}/api/v1/keyless/certify"),

            Some(&body.to_string()),

            &options,

        )?;

        let reply: serde_json::Value = serde_json::from_str(&answer).unwrap_or_default();

        if !(200..300).contains(&code) {

            let why = reply["error"].as_str().unwrap_or(answer.trim());

            return fail(format!(

                "{hub} would not certify a key (HTTP {code}): {why}"

            ));

        }

        let cert = reply["certificate"]

            .as_str()

            .and_then(crate::dsse::base64_decode)

            .ok_or_else(|| RepoError::Msg(format!("{hub} answered with no certificate")))?;

        let cert = SignedCertificate::decode(&cert)

            .map_err(|e| RepoError::Msg(format!("{hub}'s certificate: {e}")))?;

        if cert.cert.key_id() != key {

            return fail(format!(

                "{hub} certified another key than the one it was asked for"

            ));

        }

        // The issuer's identity, so this repository (and whoever it pushes

        // to) can check the certificate: the hub's own, as it publishes it.

        let issuer = match self.store.get_identity(&cert.cert.issuer) {

            Ok(i) => i,

            Err(_) => {

                let bytes = http_get(

                    &format!("{hub}/.well-known/oxyhub-key"),

                    &RemoteOptions {

                        token: None,

                        ..options.clone()

                    },

                )?;

                let i = Identity::decode(&bytes)?;

                if i.hash() != cert.cert.issuer {

                    return fail(format!(

                        "{hub}'s published key is not the one that signed its certificate"

                    ));

                }

                i

            }

        };

        cert.verify(&issuer)

            .map_err(|e| RepoError::Msg(format!("{hub}'s certificate: {e}")))?;

        // The grant's author, so the grant can be checked here and wherever

        // this pushes (oxygen#134): from the hub's answer, else this home's

        // copy of it. Without it, a repository that never saw the owner's

        // current identity reads the change as signed by an unknown author.

        if let Some(g) = &cert.cert.grant {

            let grantor = g.grant.grantor;

            if self.store.get_identity(&grantor).is_err() {

                let sent = reply["grantor_identity"]

                    .as_str()

                    .and_then(crate::dsse::base64_decode)

                    .and_then(|b| Identity::decode(&b).ok());

                let kept = || {

                    std::fs::read(

                        home.join("keys")

                            .join(format!("{}.identity", grantor.to_hex())),

                    )

                    .ok()

                    .and_then(|b| Identity::decode(&b).ok())

                };

                match sent.filter(|i| i.hash() == grantor).or_else(|| kept().filter(|i| i.hash() == grantor)) {

                    Some(i) => {

                        self.store.put_identity(&i)?;

                    }

                    None => {

                        return fail(format!(

                            "the grant is signed by {}, whose identity neither {hub} nor this home has: export it there (oxy identity export) into this home's keys/",

                            grantor.short(12)

                        ))

                    }

                }

            }

        }

        if let (Some(owner), Some(g)) = (&self.config.author_for, &cert.cert.grant) {

            self.follow_author(owner, &cert.cert.subject, g.grant.grantor, &reply, &home)?;

        }

        self.store.put_identity(&issuer)?;

        self.store.put_identity(&id)?;

        self.store.put_certificate(&cert)?;

        *self.keyless_key.borrow_mut() = Some((key, sk.clone(), cert.cert.expires));

        Ok((key, sk))

    }

}

impl Repo {

    /// `author.for` (oxygen#82): keep the identity the hub names as the

    /// grant's owner's newest (`author_chain`, newest first, each the

    /// successor of the next, the last the grant's key's), store the chain

    /// here so the grant checks against it, and note its key in the home,

    /// so this and the home's next commands author as it.

    fn follow_author(

        &self,

        owner: &str,

        subject: &str,

        grantor: KeyId,

        reply: &serde_json::Value,

        home: &Path,

    ) -> Result<()> {

        let granted_by = subject.rsplit_once('@').map(|(_, o)| o).unwrap_or(subject);

        if !granted_by.eq_ignore_ascii_case(owner) {

            return fail(format!(

                "author.for is {owner}, but this home's grant is from {granted_by}: set author.for to the account that granted it"

            ));

        }

        let chain: Vec<Identity> = reply["author_chain"]

            .as_array()

            .map(|a| {

                a.iter()

                    .filter_map(|v| v.as_str().and_then(crate::dsse::base64_decode))

                    .filter_map(|b| Identity::decode(&b).ok())

                    .collect()

            })

            .unwrap_or_default();

        let linked = chain.windows(2).all(|w| w[0].previous == Some(w[1].hash()))

            && chain.last().is_none_or(|l| l.previous == Some(grantor));

        if !linked {

            return fail(

                "the hub's author chain does not lead back to the grant's key".to_string(),

            );

        }

        let keys = home.join("keys");

        std::fs::create_dir_all(&keys)?;

        for id in &chain {

            self.store.put_identity(id)?;

            let path = keys.join(format!("{}.identity", id.hash().to_hex()));

            if !path.exists() {

                crate::durable::write_atomic(&path, &id.encode())?;

            }

        }

        let newest = chain.first().map(Identity::hash).unwrap_or(grantor);

        crate::durable::write_atomic(

            &keys.join(super::config::AUTHOR_FOR_FILE),

            format!("{}\n", newest.to_hex()).as_bytes(),

        )?;

        Ok(())

    }

}

/// The key a home names as its author (`author.key` in its

/// `config.toml`), with its secret from the home's `keys/`: what signs

/// outside any repository, such as a grant to an agent (`oh agent grant`).

/// `None` when the home names no key or does not hold its secret.

pub fn home_key(home: &Path) -> Result<Option<(Identity, SecretKey)>> {

    let config = read_config_file(&home.join("config.toml"))?;

    let Some(hex) = config.get("author.key").filter(|v| !v.is_empty()) else {

        return Ok(None);

    };

    let key = KeyId::from_hex(hex)

        .ok_or_else(|| RepoError::Msg("author.key must be a 64-character hex KeyId".into()))?;

    let keys = home.join("keys");

    let secret = match fs::read(keys.join(format!("{hex}.secret"))) {

        Ok(b) => b,

        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),

        Err(e) => return Err(e.into()),

    };

    let (k, sk) = SecretKey::decode(&secret)?;

    let id = Identity::decode(&fs::read(keys.join(format!("{hex}.identity")))?)?;

    if k != key || id.hash() != key {

        return fail(format!(

            "{} holds another key than author.key",

            keys.display()

        ));

    }

    Ok(Some((id, sk)))

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn a_home_s_key_signs_outside_any_repository() {

        static HOME: std::sync::OnceLock<tempfile::TempDir> = std::sync::OnceLock::new();

        HOME.get_or_init(|| {

            let d = tempfile::tempdir().unwrap();

            std::env::set_var("OXY_HOME", d.path());

            d

        });

        let dir = tempfile::tempdir().unwrap();

        let home = dir.path().join("home");

        assert!(home_key(&home).unwrap().is_none(), "no config, no key");

        let mut r = Repo::init(&dir.path().join("work"))

            .unwrap()

            .with_home(home.clone());

        let (key, id) = r

            .create_identity("Andy", "[email protected]", IdentityScope::User)

            .unwrap();

        let (got, sk) = home_key(&home).unwrap().expect("the home's author key");

        assert_eq!(got, id);

        let sig = sk.sign(Domain::Grant, &key, &ObjectRef([1; 32]));

        assert!(verify_signature(&id, &sig, Domain::Grant, &ObjectRef([1; 32])).is_ok());

        // An agent whose signer is keyless signs nothing until it asks.

        r.set_user_config("author.signer", "keyless").unwrap();

        assert!(r.config.signer_keyless && r.config.signer_key.is_none());

        assert_eq!(r.signing_key(), None);

        let err = r.secret_key().unwrap_err().to_string();

        assert!(err.contains("keyless.hub nor a default remote"), "{err}");

    }

}