//! Repositories kept in their owner's bucket (hub spec §4, oxygenhub#96,
//! oxygen#68). The repository's objects and operation log live in an S3,
//! Google Cloud Storage or Azure bucket the owner chose; the hub keeps a
//! bare repository directory with a cache in front (`storage.url` in its
//! config) and the credentials, sealed under `keys/secrets.key`. Stores
//! are opened by URL, and the credentials are handed to them through
//! oxy-strata's lookup, so nothing from the hub host's own environment or
//! cloud profiles is ever used for a repository.

use crate::db::{now_ms, Pool};
use crate::Shared;
use oxy_strata::Credentials;
use std::collections::HashMap;
use std::sync::RwLock;

#[derive(Clone, Debug, sqlx::FromRow)]
pub struct Storage {
    pub repo_id: i64,
    pub url: String,
    /// Sealed; `App.secret_key` opens it.
    pub credentials: Vec<u8>,
    pub created_ms: i64,
    pub checked_ms: Option<i64>,
    pub check_result: String,
}

/// What the stores opened by URL get: each repository's credentials by
/// its store URL, and the URL by repository id for pages.
#[derive(Default)]
struct Known {
    credentials: HashMap<String, Credentials>,
    /// By the repository's directory, unique even between hubs in one process.
    urls: HashMap<std::path::PathBuf, String>,
}

static KNOWN: RwLock<Option<Known>> = RwLock::new(None);

fn lookup(url: &str) -> Option<Credentials> {
    KNOWN.read().ok()?.as_ref()?.credentials.get(url).cloned()
}

fn remember(dir: std::path::PathBuf, url: &str, credentials: Credentials) {
    let mut known = KNOWN.write().unwrap_or_else(|p| p.into_inner());
    let known = known.get_or_insert_with(Known::default);
    known.credentials.insert(url.to_string(), credentials);
    known.urls.insert(dir, url.to_string());
}

fn forget(dir: &std::path::Path) {
    let mut known = KNOWN.write().unwrap_or_else(|p| p.into_inner());
    if let Some(k) = known.as_mut() {
        if let Some(url) = k.urls.remove(dir) {
            k.credentials.remove(&url);
        }
    }
}

/// Where a repository's data lives, when it is not on this hub's disk.
/// What the repository header shows of a store (#123): which provider,
/// and, for the repository's admins, where in it.
#[derive(Clone, Debug, PartialEq)]
pub struct StoreBadge {
    /// `gcs`, `s3` or `azure`: picks the icon.
    pub kind: &'static str,
    pub provider: &'static str,
    /// The bucket, or for Azure the storage account and container.
    pub place: String,
    pub prefix: String,
    pub region: Option<String>,
    /// The URL as stored, query and all.
    pub url: String,
}

impl StoreBadge {
    /// The parts of a store URL; `None` for a scheme the hub does not
    /// keep repositories on.
    pub fn of(url: &str) -> Option<StoreBadge> {
        let (scheme, rest) = url.split_once("://")?;
        let (path, query) = rest.split_once('?').unwrap_or((rest, ""));
        let region = query.split('&').find_map(|kv| kv.strip_prefix("region=")).filter(|r| !r.is_empty()).map(str::to_string);
        let mut parts = path.trim_matches('/').splitn(if scheme == "az" { 3 } else { 2 }, '/');
        let (kind, provider, place) = match scheme {
            "gs" => ("gcs", "Google Cloud Storage", parts.next()?.to_string()),
            "s3" => ("s3", "Amazon S3", parts.next()?.to_string()),
            "az" => ("azure", "Azure Blob Storage", format!("{} / {}", parts.next()?, parts.next()?)),
            _ => return None,
        };
        Some(StoreBadge { kind, provider, place, prefix: parts.next().unwrap_or("").to_string(), region, url: url.to_string() })
    }
}

pub fn location(app: &Shared, owner: &str, name: &str) -> Option<String> {
    let dir = app.repos.dir(&crate::repos::RepoName::new(owner, name)?);
    KNOWN.read().ok()?.as_ref()?.urls.get(&dir).cloned()
}

/// The directory of the repository with row `repo_id`.
async fn dir_of(app: &Shared, repo_id: i64) -> Option<std::path::PathBuf> {
    let row = crate::db::repos::get_by_id(&app.db, repo_id).await.ok()??;
    Some(app.repos.dir(&crate::repos::RepoName::new(&row.owner, &row.name)?))
}

/// Hand the cloud stores to oxy-core, and every repository's credentials
/// to them. At start.
pub async fn load(app: &Shared) -> sqlx::Result<()> {
    oxy_strata::register();
    oxy_strata::set_credentials_lookup(lookup);
    for s in all(&app.db).await? {
        match app.secret_key.open(&s.credentials).map(|j| Credentials::from_json(&j)) {
            Some(Ok(c)) => match dir_of(app, s.repo_id).await {
                Some(dir) => remember(dir, &s.url, c),
                None => tracing::warn!("storage: repository {} has a store but no row", s.repo_id),
            },
            _ => tracing::warn!("storage: the credentials of repository {} do not open under keys/secrets.key", s.repo_id),
        }
    }
    Ok(())
}

pub async fn all(pool: &Pool) -> sqlx::Result<Vec<Storage>> {
    sqlx::query_as("SELECT * FROM repo_storage").fetch_all(pool).await
}

pub async fn of(pool: &Pool, repo_id: i64) -> sqlx::Result<Option<Storage>> {
    sqlx::query_as("SELECT * FROM repo_storage WHERE repo_id = $1").bind(repo_id).fetch_optional(pool).await
}

/// Check a store URL a user gave: a bucket on S3, Google Cloud Storage or
/// Azure, with no setting but `region`. A profile, a key file or an
/// endpoint would make the hub use its own host's credentials or reach
/// addresses on its network, and `dir://` its own disk.
pub fn check_url(url: &str) -> Result<oxy_strata::StoreUrl, String> {
    let scheme = url.trim().split_once("://").map(|(s, _)| s).unwrap_or("");
    if !matches!(scheme, "s3" | "gs" | "az") {
        return Err("a store is s3://BUCKET/PREFIX, gs://BUCKET/PREFIX or az://ACCOUNT/CONTAINER/PREFIX".into());
    }
    let parsed = oxy_strata::StoreUrl::parse(url.trim()).map_err(|e| e.to_string())?;
    if parsed.scheme == "az" && parsed.path.is_empty() {
        return Err("an Azure store names the account and the container: az://ACCOUNT/CONTAINER/PREFIX".into());
    }
    if let Some(k) = parsed.params.keys().find(|k| k.as_str() != "region") {
        return Err(format!("?{k}= is not allowed here: the only setting a hub accepts is ?region="));
    }
    Ok(parsed)
}

/// The credentials a form gave for a store of `scheme`.
pub fn credentials_from(
    scheme: &str,
    access_key_id: &str,
    secret_access_key: &str,
    service_account_key: &str,
    tenant_id: &str,
    client_id: &str,
    client_secret: &str,
) -> Result<Credentials, String> {
    let json = match scheme {
        "s3" => serde_json::json!({ "kind": "aws", "access_key_id": access_key_id, "secret_access_key": secret_access_key }),
        "gs" => serde_json::json!({ "kind": "gcp", "service_account_key": service_account_key }),
        "az" => serde_json::json!({ "kind": "azure", "tenant_id": tenant_id, "client_id": client_id, "client_secret": client_secret }),
        _ => return Err("unknown kind of store".into()),
    };
    Credentials::from_json(&json.to_string()).map_err(|e| e.to_string())
}

/// Run the conformance check against a store under a probe prefix of its
/// own, which it leaves empty: what passed, or what failed. With
/// `must_be_empty` the store must hold nothing yet (a new repository's).
pub async fn probe(url: &str, credentials: &Credentials, must_be_empty: bool) -> Result<String, String> {
    let (url, credentials) = (url.to_string(), credentials.clone());
    tokio::task::spawn_blocking(move || {
        use oxy_core::strata::Store as _;
        let store = oxy_strata::CloudStore::open_with(&url, Some(&credentials)).map_err(|e| e.to_string())?;
        if must_be_empty {
            let found = store.list("").map_err(|e| e.to_string())?;
            if !found.is_empty() {
                return Err(format!(
                    "{} already holds {} object(s): a new repository needs an empty bucket or prefix",
                    store.describe(),
                    found.len()
                ));
            }
        }
        let mut nonce = [0u8; 6];
        rand::RngCore::fill_bytes(&mut rand::rngs::OsRng, &mut nonce);
        let prefix = format!("oxy-probe-{}", hex::encode(nonce));
        let passed = oxy_core::strata::conformance(&store, &prefix).map_err(|e| {
            for e in store.list(&prefix).unwrap_or_default() {
                let _ = store.delete(&e.key);
            }
            e.to_string()
        })?;
        Ok(format!("{} checks passed", passed.len()))
    })
    .await
    .map_err(|e| e.to_string())?
}

/// Create repository `name` (row `repo_id`, already in the database) in
/// the store at `url`: checked first, then the credentials sealed and
/// kept, then the bare repository made over the store.
pub async fn create(app: &Shared, name: &crate::repos::RepoName, repo_id: i64, url: &str, credentials: Credentials) -> Result<(), String> {
    let result = probe(url, &credentials, true).await?;
    let sealed = app.secret_key.seal(&credentials.to_json());
    let dir = app.repos.dir(name);
    remember(dir.clone(), url, credentials);
    let made = {
        let (app, name, url) = (app.clone(), name.clone(), url.to_string());
        tokio::task::spawn_blocking(move || app.repos.create_on(&name, &url).map(drop).map_err(|e| e.to_string()))
            .await
            .map_err(|e| e.to_string())
            .and_then(|r| r)
    };
    if let Err(e) = made {
        forget(&dir);
        return Err(format!("the repository could not be made in {url}: {e}"));
    }
    let now = now_ms();
    sqlx::query(
        "INSERT INTO repo_storage (repo_id, url, credentials, created_ms, checked_ms, check_result) VALUES ($1, $2, $3, $4, $5, $6)",
    )
    .bind(repo_id)
    .bind(url)
    .bind(sealed)
    .bind(now)
    .bind(now)
    .bind(&result)
    .execute(&app.db)
    .await
    .map_err(|e| e.to_string())?;
    Ok(())
}

/// Check a repository's store again and record the result.
pub async fn check(app: &Shared, s: &Storage) -> Result<String, String> {
    let json = app.secret_key.open(&s.credentials).ok_or("the credentials do not open under this hub's key")?;
    let credentials = Credentials::from_json(&json).map_err(|e| e.to_string())?;
    let result = probe(&s.url, &credentials, false).await;
    let text = match &result {
        Ok(r) => r.clone(),
        Err(e) => format!("failed: {e}"),
    };
    sqlx::query("UPDATE repo_storage SET checked_ms = $1, check_result = $2 WHERE repo_id = $3")
        .bind(now_ms())
        .bind(&text)
        .bind(s.repo_id)
        .execute(&app.db)
        .await
        .map_err(|e| e.to_string())?;
    result
}

/// Replace a repository's credentials (a rotated key), once they pass the
/// check against its store.
pub async fn set_credentials(app: &Shared, s: &Storage, credentials: Credentials) -> Result<String, String> {
    let result = probe(&s.url, &credentials, false).await?;
    sqlx::query("UPDATE repo_storage SET credentials = $1, checked_ms = $2, check_result = $3 WHERE repo_id = $4")
        .bind(app.secret_key.seal(&credentials.to_json()))
        .bind(now_ms())
        .bind(&result)
        .bind(s.repo_id)
        .execute(&app.db)
        .await
        .map_err(|e| e.to_string())?;
    if let Some(dir) = dir_of(app, s.repo_id).await {
        remember(dir, &s.url, credentials);
    }
    Ok(result)
}

/// A repository is gone (its store row with it): forget its credentials.
pub fn removed(app: &Shared, name: &crate::repos::RepoName) {
    forget(&app.repos.dir(name));
}

/// A repository moved to another name (a transfer): its store goes with it.
pub fn renamed(app: &Shared, from: &crate::repos::RepoName, to: &crate::repos::RepoName) {
    let mut known = KNOWN.write().unwrap_or_else(|p| p.into_inner());
    if let Some(k) = known.as_mut() {
        if let Some(url) = k.urls.remove(&app.repos.dir(from)) {
            k.urls.insert(app.repos.dir(to), url);
        }
    }
}

/// An organisation's storage policy: every new repository in a bucket,
/// and only in stores under these URL prefixes when there are any. The
/// buckets an organisation lists are its own, so where they are (the
/// region, the provider, the country) is where its data is.
#[derive(Clone, Debug, Default, PartialEq, Eq)]
pub struct Policy {
    pub require_bucket: bool,
    pub allowed: Vec<String>,
}

impl Policy {
    /// Whether a new repository may be kept at `store` (`None`: this
    /// hub's disk); otherwise what to tell its creator.
    pub fn permits(&self, org: &str, store: Option<&str>) -> Result<(), String> {
        match store {
            None if self.require_bucket => Err(format!(
                "{org} keeps every new repository in a bucket: choose “my own bucket” under Storage{}",
                if self.allowed.is_empty() { String::new() } else { format!(" ({})", self.allowed.join(", ")) }
            )),
            Some(url) if !self.allowed.is_empty() && !self.allowed.iter().any(|p| url.trim().starts_with(p.as_str())) => {
                Err(format!("{org} allows only these stores: {}", self.allowed.join(", ")))
            }
            _ => Ok(()),
        }
    }
}

pub async fn policy(pool: &Pool, org_id: i64) -> sqlx::Result<Policy> {
    let row: Option<(bool, String)> = sqlx::query_as("SELECT require_bucket, allowed FROM org_storage_policy WHERE org_id = $1")
        .bind(org_id)
        .fetch_optional(pool)
        .await?;
    Ok(row
        .map(|(r, a)| Policy { require_bucket: r, allowed: a.lines().map(str::trim).filter(|l| !l.is_empty()).map(String::from).collect() })
        .unwrap_or_default())
}

/// Set a policy from what a form gave: the allowed prefixes one per line
/// (or comma-separated), each a store URL of a bucket.
pub async fn set_policy(pool: &Pool, org_id: i64, require_bucket: bool, allowed: &str) -> Result<Policy, String> {
    let mut prefixes = Vec::new();
    for p in allowed.split([',', '\n']).map(str::trim).filter(|p| !p.is_empty()) {
        if p.contains('?') {
            return Err(format!("{p}: a prefix names a bucket and a path, with no settings"));
        }
        check_url(p).map_err(|e| format!("{p}: {e}"))?;
        prefixes.push(p.to_string());
    }
    sqlx::query(
        "INSERT INTO org_storage_policy (org_id, require_bucket, allowed) VALUES ($1, $2, $3) \
         ON CONFLICT (org_id) DO UPDATE SET require_bucket = excluded.require_bucket, allowed = excluded.allowed",
    )
    .bind(org_id)
    .bind(require_bucket)
    .bind(prefixes.join("\n"))
    .execute(pool)
    .await
    .map_err(|e| e.to_string())?;
    Ok(Policy { require_bucket, allowed: prefixes })
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn store_urls_a_hub_accepts() {
        assert!(check_url("s3://bucket/repos/x?region=eu-west-2").is_ok());
        assert!(check_url("gs://bucket/x").is_ok());
        assert!(check_url("az://account/container/x").is_ok());
        for (bad, why) in [
            ("s3://b/x?profile=prod", "?profile="),
            ("s3://b/x?region=a&endpoint=http://10.0.0.1", "?endpoint="),
            ("gs://b/x?credentials=/etc/key.json", "?credentials="),
            ("dir:///srv", "a store is"),
            ("file:///srv", "a store is"),
            ("az://account", "the container"),
        ] {
            let e = check_url(bad).unwrap_err();
            assert!(e.contains(why), "{bad}: {e}");
        }
    }

    #[test]
    fn a_policy_says_what_it_allows() {
        let open = Policy::default();
        assert!(open.permits("acme", None).is_ok());
        let strict = Policy { require_bucket: true, allowed: vec!["s3://acme-london/".into(), "gs://acme-eu/".into()] };
        let e = strict.permits("acme", None).unwrap_err();
        assert!(e.contains("acme keeps every new repository in a bucket") && e.contains("s3://acme-london/"), "{e}");
        assert!(strict.permits("acme", Some("s3://acme-london/repos/x?region=eu-west-2")).is_ok());
        let e = strict.permits("acme", Some("s3://acme-virginia/x")).unwrap_err();
        assert!(e.contains("allows only these stores"), "{e}");
    }
}

#[cfg(test)]
mod badge_tests {
    use super::StoreBadge;

    #[test]
    fn a_store_url_names_its_provider_place_prefix_and_region() {
        let g = StoreBadge::of("gs://doomsdayone-oxy-repos/repos/tetris").unwrap();
        assert_eq!(
            (g.kind, g.provider, g.place.as_str(), g.prefix.as_str(), g.region),
            ("gcs", "Google Cloud Storage", "doomsdayone-oxy-repos", "repos/tetris", None)
        );
        let s = StoreBadge::of("s3://my-bucket/repos/name?region=eu-west-2").unwrap();
        assert_eq!(
            (s.kind, s.place.as_str(), s.prefix.as_str(), s.region.as_deref()),
            ("s3", "my-bucket", "repos/name", Some("eu-west-2"))
        );
        let a = StoreBadge::of("az://account/container/repos/x").unwrap();
        assert_eq!((a.kind, a.place.as_str(), a.prefix.as_str()), ("azure", "account / container", "repos/x"));
        assert_eq!(StoreBadge::of("s3://bucket").unwrap().prefix, "");
        assert!(StoreBadge::of("dir:///tmp/x").is_none());
        assert!(StoreBadge::of("az://only-account").is_none());
    }
}