//! A release's trust report (hub spec §9.1): who wrote what the release

//! holds and how it is authenticated, what built each asset, in which

//! pinned environment, from which inputs, under which signed receipt, and

//! an audit of all of it. The page draws it as a graph; the same report is

//! JSON for export, carrying the signed receipts so an auditor can check

//! them offline with `oxy receipt verify`.

use super::{filters, lookup, Error, Page, RepoShell, Shell};

use crate::auth::Viewer;

use crate::db::{self, flow as fdb, releases as rdb};

use crate::repos::RepoName;

use crate::Shared;

use askama::Template;

use axum::extract::{Path, Query, State};

use axum::response::{IntoResponse, Response};

use oxy_core::hash::{ChangeHash, ObjectRef};

use oxy_core::identity::{verify, Domain};

use oxy_core::repo::SignatureStatus;

use serde::{Deserialize, Serialize};

use std::collections::{BTreeMap, HashMap};

/// A key as the report names it.

#[derive(Clone, Debug, Default, Serialize)]

pub struct KeyInfo {

    pub key: String,

    pub name: String,

    pub email: String,

    /// The account the key is linked to on this hub.

    pub account: Option<String>,

}

#[derive(Clone, Debug, Default, Serialize)]

pub struct AuthorTrust {

    pub who: KeyInfo,

    pub changes: usize,

    /// Changes authenticated by their own signature.

    pub signed: usize,

    /// Changes authenticated by a seal.

    pub sealed: usize,

    pub unsigned: usize,

    /// Authenticated by a key since revoked.

    pub revoked: usize,

    pub invalid: usize,

}

#[derive(Clone, Debug, Serialize)]

pub struct BuildTrust {

    pub run: i64,

    pub job: String,

    pub run_url: String,

    /// The heads the run built, joined with `+`.

    pub heads: String,

    /// Whether that is exactly the tagged state.

    pub same_state_as_tag: bool,

    pub pipeline_hash: String,

    pub scope_tree_hash: String,

    /// Hash of the environment the job ran in (runtime, pinned parts,

    /// rootfs, argv, env).

    pub environment: String,

    pub rootfs: String,

    pub runtime: String,

    pub exit_code: Option<i64>,

    pub runner: Option<KeyInfo>,

    /// The receipt attestation, when a signed receipt was kept.

    pub receipt: Option<String>,

    pub receipt_url: Option<String>,

    /// Why the kept receipt does not verify now, if it does not.

    pub receipt_problem: Option<String>,

    pub runner_revoked: bool,

    /// The runner's key is one a runner token on this hub signs with, or a

    /// short-lived key this hub certified for the repository (#241).

    pub runner_known: bool,

    /// The subject this hub certified the short-lived key that signed the

    /// receipt for, when it was one.

    pub certified_for: Option<String>,

    /// The signed receipt, hex, for `oxy receipt verify`.

    pub signed_receipt: Option<String>,

}

#[derive(Clone, Debug, Serialize)]

pub struct AssetTrust {

    pub name: String,

    pub size: i64,

    pub blake3: String,

    pub url: String,

    pub build: Option<BuildTrust>,

}

#[derive(Clone, Debug, Serialize, PartialEq, Eq)]

#[serde(rename_all = "lowercase")]

pub enum Verdict {

    Pass,

    Warn,

    Fail,

}

#[derive(Clone, Debug, Serialize)]

pub struct Check {

    pub verdict: Verdict,

    pub title: String,

    pub detail: String,

}

impl Check {

    pub fn glyph(&self) -> &'static str {

        match self.verdict {

            Verdict::Pass => "✔",

            Verdict::Warn => "!",

            Verdict::Fail => "✘",

        }

    }

    pub fn class(&self) -> &'static str {

        match self.verdict {

            Verdict::Pass => "pass",

            Verdict::Warn => "warn",

            Verdict::Fail => "fail",

        }

    }

}

/// One claim of the trust summary: `pass`, `warn` or `fail`, and what it says.

pub struct TrustBadge {

    pub class: &'static str,

    pub text: String,

}

#[derive(Clone, Debug, Serialize)]

pub struct ReleaseTrust {

    pub repository: String,

    pub tag: String,

    pub title: String,

    pub release_url: String,

    pub heads: Vec<String>,

    pub tag_signer: Option<KeyInfo>,

    /// `valid`, `unsigned`, `invalid: …` or `revoked`.

    pub tag_signature: String,

    /// The previous release, which bounds the changes counted.

    pub since: Option<String>,

    pub changes: usize,

    pub authors: Vec<AuthorTrust>,

    pub assets: Vec<AssetTrust>,

    pub audit: Vec<Check>,

    pub generated_ms: i64,

}

impl ReleaseTrust {

    pub fn verdict_class(&self) -> &'static str {

        match self.verdict() {

            Verdict::Pass => "pass",

            Verdict::Warn => "warn",

            Verdict::Fail => "fail",

        }

    }

    /// The page's trust summary, one badge per claim: the tag's signature,

    /// how many changes are authenticated, and how many assets an attested

    /// OxygenFlow build produced (oxygenhub#79).

    pub fn summary(&self) -> Vec<TrustBadge> {

        let tag = match self.tag_signature.as_str() {

            "valid" => ("pass", format!("Tag signed by {}", self.tag_signer.as_ref().map(|k| k.name.as_str()).unwrap_or("its signer"))),

            "unsigned" => ("warn", "Tag unsigned".to_string()),

            other => ("fail", format!("Tag signature {other}")),

        };

        let authenticated: usize = self.authors.iter().map(|a| a.signed + a.sealed).sum();

        let bad: usize = self.authors.iter().map(|a| a.invalid + a.revoked).sum();

        let changes = (

            if bad > 0 {

                "fail"

            } else if authenticated < self.changes {

                "warn"

            } else {

                "pass"

            },

            format!("{authenticated} of {} changes signed or sealed", self.changes),

        );

        let attested =

            self.assets.iter().filter(|a| a.build.as_ref().is_some_and(|b| b.receipt.is_some() && b.receipt_problem.is_none())).count();

        let assets = (

            if attested == self.assets.len() { "pass" } else { "warn" },

            if self.assets.is_empty() {

                "No assets".to_string()

            } else {

                format!("{attested} of {} assets built and attested by OxygenFlow", self.assets.len())

            },

        );

        [tag, changes, assets].into_iter().map(|(class, text)| TrustBadge { class, text }).collect()

    }

    pub fn verdict(&self) -> Verdict {

        if self.audit.iter().any(|c| c.verdict == Verdict::Fail) {

            Verdict::Fail

        } else if self.audit.iter().any(|c| c.verdict == Verdict::Warn) {

            Verdict::Warn

        } else {

            Verdict::Pass

        }

    }

}

/// What the repository says about the release: read in one go.

struct RepoFacts {

    heads: Vec<ChangeHash>,

    tag_signer: Option<KeyInfo>,

    tag_signature: String,

    authors: Vec<AuthorTrust>,

    changes: usize,

    /// Kept receipts by attestation: (runner, problem, revoked, signed hex).

    receipts: HashMap<String, KeptReceipt>,

}

fn key_info(r: &oxy_core::repo::Repo, key: &ObjectRef) -> KeyInfo {

    match r.store().get_identity(key) {

        Ok(i) => KeyInfo { key: key.to_hex(), name: i.name, email: i.email, account: None },

        Err(_) => KeyInfo { key: key.to_hex(), ..Default::default() },

    }

}

/// An asset's build: the matching artifact's job, with its run and job rows.

type Build = (fdb::Provenance, Option<fdb::Run>, Option<fdb::Job>);

/// Build the report for release `tag`, or `None` when there is no such

/// release or its tag is gone.

/// A kept receipt as the report sees it: its signer, why it does not

/// verify (if it does not), whether the key was revoked, the signed

/// receipt in hex, and the issuer and subject of a short-lived key's

/// certificate.

type KeptReceipt = (KeyInfo, Option<String>, bool, String, Option<(String, String)>);

pub async fn report(app: &Shared, repo: &RepoName, row: &db::repos::RepoRow, tag: &str) -> Result<Option<ReleaseTrust>, String> {

    let releases = rdb::list(&app.db, row.id).await.map_err(|e| e.to_string())?;

    let Some(rel) = releases.iter().find(|r| r.tag == tag).cloned() else { return Ok(None) };

    // The previous release: the next older one in the list (newest first).

    let since = releases.iter().skip_while(|r| r.id != rel.id).nth(1).map(|r| r.tag.clone());

    let assets = rdb::assets(&app.db, rel.id).await.map_err(|e| e.to_string())?;

    let mut builds: Vec<Option<Build>> = Vec::new();

    for a in &assets {

        match fdb::provenance(&app.db, row.id, &a.hash).await.map_err(|e| e.to_string())? {

            Some(p) => {

                let run = fdb::run(&app.db, row.id, p.run_number).await.map_err(|e| e.to_string())?;

                let job = match &run {

                    Some(r) => fdb::jobs(&app.db, r.id).await.map_err(|e| e.to_string())?.into_iter().find(|j| j.name == p.job),

                    None => None,

                };

                builds.push(Some((p, run, job)));

            }

            None => builds.push(None),

        }

    }

    let attests: Vec<String> = builds.iter().flatten().map(|(p, _, _)| p.receipt_attest.clone()).filter(|a| !a.is_empty()).collect();

    let (tag_s, since_s) = (tag.to_string(), since.clone());

    let facts = app

        .repos

        .read(repo, move |r, cache| {

            let Some(heads) = r.tag_heads(&tag_s)? else { return Ok(None) };

            // The tag's attestation and whether its signature verifies.

            let (tag_signer, tag_signature) = match r.tag_attest(&tag_s)? {

                Some((ar, sa)) => match sa.sigs.first() {

                    Some(sig) => {

                        let who = key_info(r, &sig.key);

                        let verdict = match r.store().get_identity(&sig.key) {

                            Ok(id) => match verify(&id, sig, Domain::Attest, &ar) {

                                Ok(()) if r.is_revoked(&sig.key)? => "revoked".to_string(),

                                Ok(()) => "valid".to_string(),

                                Err(e) => format!("invalid: {e}"),

                            },

                            Err(_) => "invalid: the signer's identity is missing".to_string(),

                        };

                        (Some(who), verdict)

                    }

                    None => (None, "unsigned".to_string()),

                },

                None => (None, "unsigned".to_string()),

            };

            // The changes the release adds over the previous one, by author.

            let now = cache.load(r, &heads)?;

            let before = match &since_s {

                Some(p) => r.tag_heads(p)?.unwrap_or_default(),

                None => vec![],

            };

            let then = cache.load(r, &before)?;

            let mut by_author: BTreeMap<String, AuthorTrust> = BTreeMap::new();

            let mut changes = 0;

            for (h, meta) in now.state.changes() {

                if then.state.contains(h) {

                    continue;

                }

                changes += 1;

                let a = by_author

                    .entry(meta.author.to_hex())

                    .or_insert_with(|| AuthorTrust { who: key_info(r, &meta.author), ..Default::default() });

                if meta.author.is_zero() {

                    a.who.name = "(no author: imported or made before an identity)".into();

                }

                a.changes += 1;

                match r.authenticate_change(h)? {

                    SignatureStatus::Valid { revoked: true, .. } => a.revoked += 1,

                    SignatureStatus::Valid { sealed: true, .. } => a.sealed += 1,

                    SignatureStatus::Valid { .. } => a.signed += 1,

                    SignatureStatus::Unsigned => a.unsigned += 1,

                    SignatureStatus::Invalid(_) => a.invalid += 1,

                }

            }

            let mut authors: Vec<AuthorTrust> = by_author.into_values().collect();

            authors.sort_by(|a, b| b.changes.cmp(&a.changes).then(a.who.name.cmp(&b.who.name)));

            // Kept receipts, verified again from the store.

            let mut receipts = HashMap::new();

            for a in &attests {

                let Some(ar) = ObjectRef::from_hex(a) else { continue };

                if let Ok(i) = r.receipt(&ar) {

                    let runner = KeyInfo {

                        key: i.signed.runner.hash().to_hex(),

                        name: i.signed.runner.name.clone(),

                        email: i.signed.runner.email.clone(),

                        account: None,

                    };

                    // A short-lived key's certificate: its issuer and subject.

                    let certified = i.signed.certificate.as_ref().map(|c| (c.cert.cert.issuer.to_hex(), c.cert.cert.subject.clone()));

                    receipts.insert(a.clone(), (runner, i.problem.clone(), i.revoked, hex::encode(i.signed.encode()), certified));

                }

            }

            Ok(Some(RepoFacts { heads, tag_signer, tag_signature, authors, changes, receipts }))

        })

        .await

        .map_err(|e| e.to_string())?;

    let Some(mut facts) = facts else { return Ok(None) };

    // Link keys to accounts.

    let links: HashMap<String, String> = db::accounts::identity_accounts(&app.db).await.unwrap_or_default().into_iter().collect();

    if let Some(s) = facts.tag_signer.as_mut() {

        s.account = links.get(&s.key).cloned();

    }

    for a in &mut facts.authors {

        a.who.account = links.get(&a.who.key).cloned();

    }

    let known_runner_keys: Vec<String> = db::runners::keys(&app.db).await.unwrap_or_default();

    let base = format!("{}/{}", app.config.base_url(), row.slug());

    let mut tag_heads: Vec<String> = facts.heads.iter().map(|h| h.to_hex()).collect();

    tag_heads.sort();

    let tag_state = tag_heads.join("+");

    let mut asset_rows = Vec::new();

    for (a, b) in assets.iter().zip(builds) {

        let build = b.map(|(p, run, job)| {

            let receipt_json: serde_json::Value =

                job.as_ref().and_then(|j| serde_json::from_str(&j.receipt).ok()).unwrap_or(serde_json::Value::Null);

            let sandbox: serde_json::Value =

                job.as_ref().and_then(|j| serde_json::from_str(&j.sandbox).ok()).unwrap_or(serde_json::Value::Null);

            let heads = run.as_ref().map(|r| r.heads.clone()).unwrap_or_default();

            let kept = facts.receipts.get(&p.receipt_attest).cloned();

            // Certified by this hub's key for this repository: as good as

            // a runner key of this hub (the certificate itself was checked

            // with the receipt).

            let certified_for = kept

                .as_ref()

                .and_then(|(.., c)| c.clone())

                .filter(|(issuer, subject)| *issuer == app.hub_key.key.to_hex() && subject.starts_with(&format!("repo:{}:", row.slug())));

            let certified_for = certified_for.map(|(_, subject)| subject);

            let s = |v: &serde_json::Value| v.as_str().unwrap_or("").to_string();

            BuildTrust {

                run: p.run_number,

                job: p.job.clone(),

                run_url: format!("{base}/flow/{}", p.run_number),

                same_state_as_tag: heads == tag_state,

                heads,

                pipeline_hash: s(&receipt_json["pipeline_hash"]),

                scope_tree_hash: s(&receipt_json["scope_tree_hash"]),

                environment: s(&receipt_json["environment"]),

                rootfs: s(&sandbox["rootfs"]),

                runtime: s(&sandbox["runtime"]),

                exit_code: job.as_ref().and_then(|j| j.exit_code),

                runner_known: kept.as_ref().is_some_and(|(k, ..)| known_runner_keys.contains(&k.key)) || certified_for.is_some(),

                certified_for,

                runner: kept.as_ref().map(|(k, ..)| k.clone()),

                receipt: kept.as_ref().map(|_| p.receipt_attest.clone()),

                receipt_url: kept.as_ref().map(|_| format!("{base}/receipts/{}", p.receipt_attest)),

                receipt_problem: kept.as_ref().and_then(|(_, pr, ..)| pr.clone()),

                runner_revoked: kept.as_ref().is_some_and(|(_, _, rv, ..)| *rv),

                signed_receipt: kept.map(|(_, _, _, hex, _)| hex),

            }

        });

        asset_rows.push(AssetTrust {

            name: a.name.clone(),

            size: a.size,

            blake3: a.hash.clone(),

            url: format!("{base}/asset/{}/{}", a.id, a.name),

            build,

        });

    }

    let mut t = ReleaseTrust {

        repository: row.slug(),

        tag: tag.to_string(),

        title: rel.title.clone(),

        release_url: format!("{base}/releases/tag/{tag}"),

        heads: tag_heads,

        tag_signer: facts.tag_signer,

        tag_signature: facts.tag_signature,

        since,

        changes: facts.changes,

        authors: facts.authors,

        assets: asset_rows,

        audit: vec![],

        generated_ms: db::now_ms(),

    };

    t.audit = audit(&t);

    Ok(Some(t))

}

/// The audit: every claim the report makes, judged.

pub fn audit(t: &ReleaseTrust) -> Vec<Check> {

    let mut out = Vec::new();

    let check = |verdict, title: String, detail: String| Check { verdict, title, detail };

    let signer = t.tag_signer.as_ref().map(|k| if k.name.is_empty() { k.key[..12].to_string() } else { k.name.clone() });

    out.push(match t.tag_signature.as_str() {

        "valid" => check(Verdict::Pass, format!("Tag {} is signed", t.tag), format!("by {}", signer.unwrap_or_default())),

        "unsigned" => check(

            Verdict::Warn,

            format!("Tag {} is not signed", t.tag),

            "Create tags with a key (`oxy identity create`) so they carry a signed attestation.".into(),

        ),

        "revoked" => check(Verdict::Fail, format!("Tag {} is signed by a revoked key", t.tag), signer.unwrap_or_default()),

        other => check(Verdict::Fail, format!("Tag {}'s signature does not verify", t.tag), other.to_string()),

    });

    let sum = |f: fn(&AuthorTrust) -> usize| t.authors.iter().map(f).sum::<usize>();

    let (unsigned, invalid, revoked) = (sum(|a| a.unsigned), sum(|a| a.invalid), sum(|a| a.revoked));

    let scope = match &t.since {

        Some(p) => format!("since {p}"),

        None => "in the release".to_string(),

    };

    out.push(if invalid > 0 || revoked > 0 {

        check(

            Verdict::Fail,

            format!("{} of {} changes {scope} fail authentication", invalid + revoked, t.changes),

            format!("{invalid} with an invalid signature, {revoked} by revoked keys"),

        )

    } else if unsigned > 0 {

        check(

            Verdict::Warn,

            format!("{unsigned} of {} changes {scope} are unsigned", t.changes),

            "Changes are authenticated when their author signs or seals them on push (Oxygen spec §14.4).".into(),

        )

    } else {

        let what = match t.changes {

            1 => format!("The one change {scope} is authenticated"),