//! The canonical job graph (spec §3.2) and object hashes. Pipelines,

//! jobs and receipts are encoded with Oxygen's deterministic CBOR profile

//! (Oxygen spec §5.1: unsigned integer map keys in order) and hashed the

//! way Oxygen hashes objects: `BLAKE3("oxy1 " || type || " " || len || 0x00 || body)`.

use crate::pipeline::{Job, Pipeline, Sandbox};

use oxy_core::cbor::{encode, Value};

/// A 32-byte object reference, shown as hex.

pub type Hash = [u8; 32];

/// Oxygen's object hash construction for a Flow object type.

pub fn object_hash(ty: &str, body: &[u8]) -> Hash {

    let mut h = blake3::Hasher::new();

    h.update(format!("oxy1 {ty} {}\0", body.len()).as_bytes());

    h.update(body);

    *h.finalize().as_bytes()

}

fn text(s: &str) -> Value {

    Value::Text(s.to_string())

}

fn texts(v: &[String]) -> Value {

    Value::Array(v.iter().map(|s| text(s)).collect())

}

fn hex32(s: &str) -> Value {

    Value::Bytes(hex::decode(s).unwrap_or_default())

}

pub fn sandbox_value(s: &Sandbox) -> Value {

    let mut fields = vec![

        (0, text(&s.name)),

        (1, text(s.runtime.as_str())),

        (2, hex32(&s.rootfs)),

        (3, Value::Uint(s.memory_mib as u64)),

        (4, Value::Uint(s.cpus as u64)),

        (5, text(s.network.as_str())),

    ];

    // Environment as sorted [name, value] pairs; absent when empty, so

    // sandboxes without one hash as before.

    if !s.env.is_empty() {

        fields.push((6, Value::Array(s.env.iter().map(|(k, v)| Value::Array(vec![text(k), text(v)])).collect())));

    }

    // The architecture asked for; absent when the image decides.

    if let Some(a) = &s.arch {

        fields.push((7, text(a)));

    }

    // The hosts egress may reach, sorted; absent without egress.

    if !s.egress_allow.is_empty() {

        fields.push((8, texts(&s.egress_allow)));

    }

    Value::map(fields)

}

pub fn job_value(j: &Job) -> Value {

    let mut fields = vec![

        (0, text(&j.name)),

        (1, text(&j.sandbox)),

        (2, texts(&j.scope)),

        (3, texts(&j.depends_on)),

        // Environment as sorted [name, value] pairs: the profile has integer map keys only.

        (4, Value::Array(j.env.iter().map(|(k, v)| Value::Array(vec![text(k), text(v)])).collect())),

        (5, texts(&j.exec)),

    ];

    // Mounts as [source, target, size MiB] sorted by target; absent when

    // there are none, so jobs without mounts hash as before.

    if !j.mounts.is_empty() {

        fields.push((

            6,

            Value::Array(

                j.mounts

                    .iter()

                    .map(|m| {

                        // A cache mount adds its name and key files; a plain

                        // one encodes as before caches existed.

                        let mut v = vec![text(m.source.as_str()), text(&m.target), Value::Uint(m.size_mib as u64)];

                        if let Some(c) = &m.cache {

                            v.push(text(c));

                            v.push(Value::Array(m.key.iter().map(|k| text(k)).collect()));

                        }

                        Value::Array(v)

                    })

                    .collect(),

            ),

        ));

    }

    // Outputs as [name, path] sorted by name, a report's with "report"

    // after them; absent when there are none.

    if !j.outputs.is_empty() {

        let output = |o: &crate::pipeline::Output| {

            let mut v = vec![text(&o.name), text(&o.path)];

            if !o.kind.is_artifact() {

                v.push(text(o.kind.word()));

            }

            Value::Array(v)

        };

        fields.push((7, Value::Array(j.outputs.iter().map(output).collect())));

    }

    // Secrets as [name, mount path] sorted by name; absent when there are none.

    if !j.secrets.is_empty() {

        fields.push((8, Value::Array(j.secrets.iter().map(|s| Value::Array(vec![text(&s.name), text(&s.mount_path)])).collect())));

    }

    // Identities as [audience, mount path] sorted by audience; absent when none.

    if !j.identities.is_empty() {

        fields.push((9, Value::Array(j.identities.iter().map(|i| Value::Array(vec![text(&i.audience), text(&i.mount_path)])).collect())));

    }

    // Inputs as [artifact, from, path] sorted by path; absent when none.

    // Approval as [by, others-only, expires seconds]; absent without one.

    if let Some(a) = &j.approval {

        fields.push((11, Value::Array(vec![text(&a.by), Value::Bool(a.others_only), Value::Uint(a.expires_s), Value::Bool(a.sealed)])));

    }

    // The environment it deploys to; absent without one.

    if let Some(e) = &j.environment {

        fields.push((12, text(e)));

    }

    if !j.inputs.is_empty() {

        fields.push((

            10,

            Value::Array(j.inputs.iter().map(|i| Value::Array(vec![text(&i.artifact), text(&i.from), text(&i.path)])).collect()),

        ));

    }

    Value::map(fields)

}

impl Pipeline {

    /// The canonical CBOR job graph: sandboxes and jobs in name order.

    pub fn canonical(&self) -> Vec<u8> {

        encode(&Value::map([

            (0, Value::Uint(self.schema_version as u64)),

            (1, Value::Array(self.sandboxes.values().map(sandbox_value).collect())),

            (2, Value::Array(self.jobs.values().map(job_value).collect())),

        ]))

    }

    /// `pipeline_hash` of receipts and provenance.

    pub fn hash(&self) -> Hash {

        object_hash("pipeline", &self.canonical())

    }

}

impl Job {

    /// `Hash(J)` of spec §6.2: the job with its sandbox, so a change to

    /// either is a different job.

    pub fn hash(&self, sandbox: &Sandbox) -> Hash {

        object_hash("job", &encode(&Value::Array(vec![job_value(self), sandbox_value(sandbox)])))

    }

}

/// BLAKE3 tree hash of the files a scope selects (spec §6.2): sorted

/// `(path, content hash)` pairs. An empty scope selects every file.

pub fn scope_tree_hash<'a>(scope: &[String], files: impl IntoIterator<Item = (&'a str, Hash)>) -> Hash {

    let set = {

        let mut b = globset::GlobSetBuilder::new();

        for g in scope {

            if let Ok(g) = globset::Glob::new(g) {

                b.add(g);

            }

        }

        b.build().unwrap_or_else(|_| globset::GlobSet::empty())

    };

    let mut picked: Vec<(&str, Hash)> = files.into_iter().filter(|(p, _)| scope.is_empty() || set.is_match(p)).collect();

    picked.sort();

    let body = encode(&Value::Array(picked.iter().map(|(p, h)| Value::Array(vec![text(p), Value::Bytes(h.to_vec())])).collect()));

    object_hash("scope", &body)

}