//! The apt repository at `/apt` (oxygenhub#85): the `.deb` assets of the
//! configured repositories' releases, indexed and signed so that
//! `apt install oxy oh` and `apt upgrade` work. Nothing is stored apart:
//! the index is built from the releases when they change, and the pool
//! serves the assets' own bytes.

use crate::{db, Shared};
use axum::extract::{Path, State};
use axum::http::{header, StatusCode};
use axum::response::{IntoResponse, Response};
use sha2::Digest;
use std::collections::{BTreeMap, HashMap};
use std::io::Read;
use std::sync::{Arc, Mutex, OnceLock};

/// One package as the index lists it.
#[derive(Clone, Debug)]
struct Entry {
    /// The control paragraph, as the package has it.
    control: String,
    package: String,
    architecture: String,
    /// The asset's name, which is its pool file name.
    file: String,
    size: u64,
    md5: String,
    sha256: String,
}

/// The signed index, built from one set of assets.
struct Index {
    /// What it was built from: each `.deb` asset's id and hash.
    key: String,
    /// `main/binary-ARCH/Packages` and `.gz`, by their path under the suite.
    files: BTreeMap<String, Vec<u8>>,
    release: String,
    in_release: Vec<u8>,
    release_gpg: Vec<u8>,
    /// Pool file name to the asset's blob hash.
    pool: HashMap<String, String>,
}

/// Parsed `.deb`s by blob hash: a package is read once.
fn parsed() -> &'static Mutex<HashMap<String, Entry>> {
    static P: OnceLock<Mutex<HashMap<String, Entry>>> = OnceLock::new();
    P.get_or_init(Default::default)
}

fn built() -> &'static Mutex<Option<Arc<Index>>> {
    static B: OnceLock<Mutex<Option<Arc<Index>>>> = OnceLock::new();
    B.get_or_init(Default::default)
}

// ------------------------------------------------------------- .deb files

/// The members of an `ar` archive, by name.
fn ar_members(bytes: &[u8]) -> Result<Vec<(String, &[u8])>, String> {
    let body = bytes.strip_prefix(b"!<arch>\n").ok_or("not an ar archive")?;
    let mut out = Vec::new();
    let mut at = 0;
    while at + 60 <= body.len() {
        let head = &body[at..at + 60];
        let name = String::from_utf8_lossy(&head[..16]).trim().trim_end_matches('/').to_string();
        let size: usize = String::from_utf8_lossy(&head[48..58]).trim().parse().map_err(|_| "bad ar member size")?;
        let start = at + 60;
        let end = start.checked_add(size).filter(|e| *e <= body.len()).ok_or("truncated ar archive")?;
        out.push((name, &body[start..end]));
        at = end + (size & 1);
    }
    Ok(out)
}

/// The `control` file of a `.deb`.
pub fn deb_control(bytes: &[u8]) -> Result<String, String> {
    let members = ar_members(bytes)?;
    let (name, data) = members.into_iter().find(|(n, _)| n.starts_with("control.tar")).ok_or("no control.tar member")?;
    let mut tar_bytes = Vec::new();
    match name.as_str() {
        "control.tar" => tar_bytes.extend_from_slice(data),
        "control.tar.gz" => {
            flate2::read::GzDecoder::new(data).read_to_end(&mut tar_bytes).map_err(|e| e.to_string())?;
        }
        "control.tar.xz" => lzma_rs::xz_decompress(&mut std::io::BufReader::new(data), &mut tar_bytes).map_err(|e| e.to_string())?,
        "control.tar.zst" => tar_bytes = zstd::decode_all(data).map_err(|e| e.to_string())?,
        other => return Err(format!("{other}: a compression this hub does not read")),
    }
    let mut archive = tar::Archive::new(tar_bytes.as_slice());
    for entry in archive.entries().map_err(|e| e.to_string())? {
        let mut entry = entry.map_err(|e| e.to_string())?;
        let path = entry.path().map_err(|e| e.to_string())?.to_string_lossy().to_string();
        if path.trim_start_matches("./") == "control" {
            let mut text = String::new();
            entry.read_to_string(&mut text).map_err(|e| e.to_string())?;
            return Ok(text);
        }
    }
    Err("no control file".into())
}

/// A control paragraph's field.
fn field<'a>(control: &'a str, name: &str) -> Option<&'a str> {
    control.lines().find_map(|l| l.strip_prefix(name).and_then(|r| r.strip_prefix(':')).map(str::trim))
}

fn entry_of(file: &str, bytes: &[u8]) -> Result<Entry, String> {
    let control = deb_control(bytes)?;
    let package = field(&control, "Package").ok_or("no Package field")?.to_string();
    let architecture = field(&control, "Architecture").ok_or("no Architecture field")?.to_string();
    field(&control, "Version").ok_or("no Version field")?;
    Ok(Entry {
        control: control.trim_end().to_string(),
        package,
        architecture,
        file: file.to_string(),
        size: bytes.len() as u64,
        md5: hex::encode(md5::Md5::digest(bytes)),
        sha256: hex::encode(sha2::Sha256::digest(bytes)),
    })
}

// ------------------------------------------------------------------ index

/// The `.deb` assets of the configured public repositories: (asset id,
/// name, blob hash).
async fn debs(app: &Shared) -> Result<Vec<(i64, String, String)>, sqlx::Error> {
    let mut out = Vec::new();
    for slug in &app.config.apt.repos {
        let Some((owner, name)) = slug.split_once('/') else { continue };
        let Some(row) = db::repos::get(&app.db, owner, name).await? else { continue };
        if row.visibility() != hub_api::Visibility::Public {
            tracing::warn!("apt: {slug} is not public, so its packages are not served");
            continue;
        }
        let rows: Vec<(i64, String, String)> = sqlx::query_as(
            "SELECT a.id, a.name, a.hash FROM release_assets a JOIN releases r ON r.id = a.release_id \
             WHERE r.repo_id = $1 AND a.name LIKE '%.deb' ORDER BY a.id",
        )
        .bind(row.id)
        .fetch_all(&app.db)
        .await?;
        out.extend(rows);
    }
    Ok(out)
}

/// The pool path of a package: `pool/COMPONENT/p/PACKAGE/FILE`.
fn pool_path(component: &str, e: &Entry) -> String {
    let first: String = e.package.chars().take(1).collect();
    format!("pool/{component}/{first}/{}/{}", e.package, e.file)
}

/// RFC 2822 date in UTC, as Release files carry it.
fn rfc2822(secs: i64) -> String {
    let t = time::OffsetDateTime::from_unix_timestamp(secs).unwrap_or(time::OffsetDateTime::UNIX_EPOCH);
    let fmt = time::macros::format_description!("[weekday repr:short], [day] [month repr:short] [year] [hour]:[minute]:[second] UTC");
    t.format(&fmt).unwrap_or_default()
}

/// Run gpg with the repository's key on `input`.
async fn gpg(app: &Shared, args: &[&str], input: &[u8]) -> Result<Vec<u8>, String> {
    use tokio::io::AsyncWriteExt;
    let home = app.config.data.join(&app.config.apt.gnupg_home);
    let mut child = tokio::process::Command::new("gpg")
        .arg("--homedir")
        .arg(&home)
        .args(["--batch", "--yes", "--quiet", "--no-tty", "--pinentry-mode", "loopback", "--passphrase", ""])
        .args(args)
        .stdin(std::process::Stdio::piped())
        .stdout(std::process::Stdio::piped())
        .stderr(std::process::Stdio::piped())
        .spawn()
        .map_err(|e| format!("gpg: {e}"))?;
    let mut stdin = child.stdin.take().expect("piped");
    stdin.write_all(input).await.map_err(|e| e.to_string())?;
    drop(stdin);
    let out = child.wait_with_output().await.map_err(|e| e.to_string())?;
    if !out.status.success() {
        return Err(format!("gpg {}: {}", args.join(" "), String::from_utf8_lossy(&out.stderr).trim()));
    }
    Ok(out.stdout)
}

/// The index for the assets there are now, built when they changed.
async fn index(app: &Shared) -> Result<Arc<Index>, String> {
    let assets = debs(app).await.map_err(|e| e.to_string())?;
    let key: String = assets.iter().map(|(id, _, h)| format!("{id}:{h};")).collect();
    if let Some(i) = built().lock().unwrap().as_ref().filter(|i| i.key == key) {
        return Ok(i.clone());
    }
    let cfg = &app.config.apt;
    let mut entries: Vec<Entry> = Vec::new();
    let mut pool = HashMap::new();
    for (_, name, hash) in &assets {
        let known = parsed().lock().unwrap().get(hash).cloned();
        let e = match known {
            Some(e) => Entry { file: name.clone(), ..e },
            None => {
                let bytes = tokio::fs::read(crate::web::releases::blob_path(app, hash)).await.map_err(|e| e.to_string())?;
                match entry_of(name, &bytes) {
                    Ok(e) => {
                        parsed().lock().unwrap().insert(hash.clone(), e.clone());
                        e
                    }
                    Err(why) => {
                        tracing::warn!("apt: {name} is left out: {why}");
                        continue;
                    }
                }
            }
        };
        if pool.contains_key(&e.file) {
            continue;
        }
        pool.insert(e.file.clone(), hash.clone());
        entries.push(e);
    }
    let mut files = BTreeMap::new();
    for arch in &cfg.architectures {
        let mut text = String::new();
        for e in entries.iter().filter(|e| e.architecture == *arch || e.architecture == "all") {
            text.push_str(&format!(
                "{}\nFilename: {}\nSize: {}\nMD5sum: {}\nSHA256: {}\n\n",
                e.control,
                pool_path(&cfg.component, e),
                e.size,
                e.md5,
                e.sha256
            ));
        }
        let mut gz = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::best());
        std::io::Write::write_all(&mut gz, text.as_bytes()).map_err(|e| e.to_string())?;
        let gz = gz.finish().map_err(|e| e.to_string())?;
        files.insert(format!("{}/binary-{arch}/Packages", cfg.component), text.into_bytes());
        files.insert(format!("{}/binary-{arch}/Packages.gz", cfg.component), gz);
    }
    let sums = |f: &dyn Fn(&[u8]) -> String| -> String {
        files.iter().map(|(path, bytes)| format!(" {} {:>8} {path}\n", f(bytes), bytes.len())).collect()
    };
    let release = format!(
        "Origin: {site}\nLabel: {site}\nSuite: {suite}\nCodename: {suite}\nDate: {date}\nArchitectures: {arches}\nComponents: {component}\nDescription: {site} packages (oxy and oh)\nMD5Sum:\n{md5}SHA256:\n{sha256}",
        site = app.config.site.name,
        suite = cfg.suite,
        date = rfc2822(db::now_ms() / 1000),
        arches = cfg.architectures.join(" "),
        component = cfg.component,
        md5 = sums(&|b| hex::encode(md5::Md5::digest(b))),
        sha256 = sums(&|b| hex::encode(sha2::Sha256::digest(b))),
    );
    let in_release = gpg(app, &["--clearsign", "--digest-algo", "SHA512"], release.as_bytes()).await?;
    let release_gpg = gpg(app, &["--detach-sign", "--armor", "--digest-algo", "SHA512"], release.as_bytes()).await?;
    let i = Arc::new(Index { key, files, release, in_release, release_gpg, pool });
    *built().lock().unwrap() = Some(i.clone());
    Ok(i)
}

// ----------------------------------------------------------------- routes

fn enabled(app: &Shared) -> bool {
    !app.config.apt.repos.is_empty()
}

fn reply(ct: &str, bytes: Vec<u8>) -> Response {
    ([(header::CONTENT_TYPE, ct.to_string()), (header::CACHE_CONTROL, "no-cache".to_string())], bytes).into_response()
}

fn not_found() -> Response {
    (StatusCode::NOT_FOUND, "not found\n").into_response()
}

fn failed(why: String) -> Response {
    tracing::warn!("apt: {why}");
    (StatusCode::SERVICE_UNAVAILABLE, "the package index is not available just now\n").into_response()
}

/// `GET /apt`: how to use it.
pub async fn home(State(app): State<Shared>) -> Response {
    if !enabled(&app) {
        return not_found();
    }
    let base = app.config.base_url();
    let cfg = &app.config.apt;
    let text = format!(
        "{site} apt repository: oxy and oh for Debian and Ubuntu ({arches}).\n\n\
         Installing a .deb from a release adds this repository by itself. To add it by hand:\n\n\
         sudo curl -fsSLo /usr/share/keyrings/oxygenhub-archive-keyring.gpg {base}/apt/oxygenhub.gpg\n\
         sudo tee /etc/apt/sources.list.d/oxygenhub.sources >/dev/null <<EOF\n\
         Types: deb\nURIs: {base}/apt\nSuites: {suite}\nComponents: {component}\n\
         Signed-By: /usr/share/keyrings/oxygenhub-archive-keyring.gpg\nEOF\n\
         sudo apt update && sudo apt install oxy oh\n\n\
         The signing key's fingerprint is in {base}/apt/oxygenhub.asc (gpg --show-keys).\n",
        site = app.config.site.name,
        arches = cfg.architectures.join(", "),
        suite = cfg.suite,
        component = cfg.component,
    );
    reply("text/plain; charset=utf-8", text.into_bytes())
}

/// `GET /apt/oxygenhub.gpg` (binary keyring) and `/apt/oxygenhub.asc`.
pub async fn key(State(app): State<Shared>, Path(file): Path<String>) -> Response {
    if !enabled(&app) {
        return not_found();
    }
    let armor = match file.as_str() {
        "oxygenhub.gpg" => false,
        "oxygenhub.asc" => true,
        _ => return not_found(),
    };
    let args: &[&str] = if armor { &["--armor", "--export"] } else { &["--export"] };
    match gpg(&app, args, b"").await {
        Ok(k) if !k.is_empty() => reply(if armor { "text/plain; charset=utf-8" } else { "application/pgp-keys" }, k),
        Ok(_) => failed("the signing key is missing".into()),
        Err(e) => failed(e),
    }
}

/// `GET /apt/dists/SUITE/…`: the Release files and the Packages indexes.
pub async fn dists(State(app): State<Shared>, Path((suite, rest)): Path<(String, String)>) -> Response {
    if !enabled(&app) || suite != app.config.apt.suite {
        return not_found();
    }
    let i = match index(&app).await {
        Ok(i) => i,
        Err(e) => return failed(e),
    };
    match rest.as_str() {
        "InRelease" => reply("text/plain; charset=utf-8", i.in_release.clone()),
        "Release" => reply("text/plain; charset=utf-8", i.release.clone().into_bytes()),
        "Release.gpg" => reply("application/pgp-signature", i.release_gpg.clone()),
        path => match i.files.get(path) {
            Some(b) if path.ends_with(".gz") => reply("application/gzip", b.clone()),
            Some(b) => reply("text/plain; charset=utf-8", b.clone()),
            None => not_found(),
        },
    }
}

/// `GET /apt/pool/…/FILE`: a package's bytes.
pub async fn pool(State(app): State<Shared>, Path(path): Path<String>) -> Response {
    if !enabled(&app) {
        return not_found();
    }
    let i = match index(&app).await {
        Ok(i) => i,
        Err(e) => return failed(e),
    };
    let file = path.rsplit('/').next().unwrap_or("");
    let Some(hash) = i.pool.get(file) else { return not_found() };
    match tokio::fs::read(crate::web::releases::blob_path(&app, hash)).await {
        Ok(bytes) => (
            [
                (header::CONTENT_TYPE, "application/vnd.debian.binary-package".to_string()),
                (header::CACHE_CONTROL, "public, max-age=31536000, immutable".to_string()),
            ],
            bytes,
        )
            .into_response(),
        Err(_) => not_found(),
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    /// A minimal `.deb`: an ar archive with a control archive compressed
    /// as `name` says.
    pub fn deb(control: &str, member: &str) -> Vec<u8> {
        let mut tar_bytes = Vec::new();
        {
            let mut t = tar::Builder::new(&mut tar_bytes);
            let mut h = tar::Header::new_gnu();
            h.set_size(control.len() as u64);
            h.set_mode(0o644);
            h.set_cksum();
            t.append_data(&mut h, "./control", control.as_bytes()).unwrap();
            t.finish().unwrap();
        }
        let packed = match member {
            "control.tar.gz" => {
                let mut gz = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());
                std::io::Write::write_all(&mut gz, &tar_bytes).unwrap();
                gz.finish().unwrap()
            }
            "control.tar.xz" => {
                let mut out = Vec::new();
                lzma_rs::xz_compress(&mut tar_bytes.as_slice(), &mut out).unwrap();
                out
            }
            "control.tar.zst" => zstd::encode_all(tar_bytes.as_slice(), 3).unwrap(),
            _ => tar_bytes,
        };
        let mut out = b"!<arch>\n".to_vec();
        for (name, data) in [("debian-binary", b"2.0\n".to_vec()), (member, packed), ("data.tar.gz", vec![0u8; 3])] {
            out.extend_from_slice(format!("{:<16}{:<12}{:<6}{:<6}{:<8}{:<10}`\n", name, 0, 0, 0, 100644, data.len()).as_bytes());
            out.extend_from_slice(&data);
            if data.len() % 2 == 1 {
                out.push(b'\n');
            }
        }
        out
    }

    #[test]
    fn control_is_read_from_every_compression() {
        let control = "Package: oxy\nVersion: 0.3.0\nArchitecture: amd64\nDescription: test\n";
        for m in ["control.tar", "control.tar.gz", "control.tar.xz", "control.tar.zst"] {
            let e = entry_of("oxy_0.3.0_amd64.deb", &deb(control, m)).unwrap();
            assert_eq!((e.package.as_str(), e.architecture.as_str()), ("oxy", "amd64"), "{m}");
            assert!(e.control.contains("Version: 0.3.0"));
        }
        assert!(deb_control(b"not a deb").is_err());
        assert_eq!(
            pool_path("main", &entry_of("oxy_0.3.0_amd64.deb", &deb(control, "control.tar.gz")).unwrap()),
            "pool/main/o/oxy/oxy_0.3.0_amd64.deb"
        );
        assert_eq!(rfc2822(0), "Thu, 01 Jan 1970 00:00:00 UTC");
    }
}