//! Identity homes on disk (spec §8.0, §21.3): `keys/KEYID.secret` (0600),

//! `keys/KEYID.identity`, and `identity.toml` naming the current KeyId. The

//! owner's home is `$SPECTRA_HOME`, else `$XDG_CONFIG_HOME/spectra`, else

//! `~/.config/spectra`; each agent's is the `--home` it was added with.

//!

//! The instance key (spec §9.5) is kept in the data directory instead, at

//! `keys/instance.secret` and `keys/instance.identity`.

use crate::durable::{write_atomic, write_atomic_private};

use crate::identity::{Delegate, Identity, KeyId, SecretKey, Signature};

use anyhow::{bail, Context, Result};

use std::fs;

use std::path::{Path, PathBuf};

/// The owner's identity home.

pub fn default_home() -> PathBuf {

    if let Some(h) = std::env::var_os("SPECTRA_HOME").filter(|h| !h.is_empty()) {

        return PathBuf::from(h);

    }

    std::env::var_os("XDG_CONFIG_HOME")

        .filter(|p| !p.is_empty())

        .map(PathBuf::from)

        .or_else(|| std::env::var_os("HOME").map(|h| PathBuf::from(h).join(".config")))

        .unwrap_or_else(|| PathBuf::from("."))

        .join("spectra")

}

/// A key pair with its identity: the instance, an agent, or the owner.

#[derive(Clone, Debug)]

pub struct KeyPair {

    pub key: KeyId,

    pub identity: Identity,

    secret: SecretKey,

}

impl KeyPair {

    /// A fresh key pair named `name`, made now.

    pub fn generate(name: &str, contact: &str) -> KeyPair {

        let secret = SecretKey::generate();

        let identity = secret.identity(name, contact, crate::ids::now_ms());

        KeyPair { key: identity.hash(), identity, secret }

    }

    /// Sign `message`, which carries its own `spectra1 …` prefix.

    pub fn sign(&self, message: &[u8]) -> Signature {

        self.secret.sign(&self.key, message)

    }

    /// Make a key pair in a new identity home and name it current.

    pub fn create_home(home: &Path, name: &str, contact: &str) -> Result<KeyPair> {

        if current_key(home)?.is_some() {

            bail!("{} already holds an identity", home.display());

        }

        let pair = KeyPair::generate(name, contact);

        fs::create_dir_all(home).with_context(|| format!("creating {}", home.display()))?;

        #[cfg(unix)]

        {

            use std::os::unix::fs::PermissionsExt;

            fs::set_permissions(home, fs::Permissions::from_mode(0o700))?;

        }

        pair.write(home)?;

        Ok(pair)

    }

    /// Write this key pair into `home` and name it current.

    fn write(&self, home: &Path) -> Result<()> {

        let keys = home.join("keys");

        write_atomic_private(&keys.join(format!("{}.secret", self.key.to_hex())), &self.secret.encode(&self.key))?;

        write_atomic(&keys.join(format!("{}.identity", self.key.to_hex())), &self.identity.encode())?;

        write_atomic(

            &home.join("identity.toml"),

            format!(

                "# The identity this home signs with (spec §8.0).\ncurrent = \"{}\"\nname = {}\n",

                self.key.to_hex(),

                toml_str(&self.identity.name)

            )

            .as_bytes(),

        )?;

        Ok(())

    }

    /// The key pair a home signs with: `current` in `identity.toml`, else

    /// its only secret key.

    pub fn load_home(home: &Path) -> Result<KeyPair> {

        let keys = home.join("keys");

        let key = match current_key(home)? {

            Some(k) => k,

            None => {

                let secrets: Vec<PathBuf> = fs::read_dir(&keys)

                    .with_context(|| format!("{} holds no identity (spectra identity create)", home.display()))?

                    .filter_map(|e| e.ok().map(|e| e.path()))

                    .filter(|p| p.extension().is_some_and(|x| x == "secret"))

                    .collect();

                match secrets.as_slice() {

                    [one] => KeyId::from_hex(one.file_stem().and_then(|s| s.to_str()).unwrap_or(""))

                        .context("a secret key file is not named by its key")?,

                    [] => bail!("{} holds no identity (spectra identity create)", home.display()),

                    _ => bail!("{} holds several keys and its identity.toml names none", home.display()),

                }

            }

        };

        KeyPair::load_key(home, &key)

    }

    /// The key pair of the identity `key` in `home`.

    pub fn load_key(home: &Path, key: &KeyId) -> Result<KeyPair> {

        let keys = home.join("keys");

        KeyPair::load(&keys.join(format!("{}.secret", key.to_hex())), &keys.join(format!("{}.identity", key.to_hex())))

    }

    /// Read a secret and its identity, checking that they belong together.

    pub fn load(secret: &Path, identity: &Path) -> Result<KeyPair> {

        let (key, secret_key) = SecretKey::decode(&fs::read(secret).with_context(|| format!("reading {}", secret.display()))?)

            .map_err(|e| anyhow::anyhow!("{}: {e}", secret.display()))?;

        let identity = Identity::decode(&fs::read(identity).with_context(|| format!("reading {}", identity.display()))?)

            .map_err(|e| anyhow::anyhow!("{}: {e}", identity.display()))?;

        if identity.hash() != key {

            bail!("{} is not the identity of {}", identity.name, secret.display());

        }

        if !secret_key.matches(&identity) {

            bail!("the secret key in {} does not match its identity", secret.display());

        }

        Ok(KeyPair { key, identity, secret: secret_key })

    }

    /// The data directory's instance key, made on first use (spec §9.5).

    pub fn instance(data: &Path, name: &str) -> Result<KeyPair> {

        let keys = data.join("keys");

        let (secret, identity) = (keys.join("instance.secret"), keys.join("instance.identity"));

        if secret.exists() {

            return KeyPair::load(&secret, &identity);

        }

        fs::create_dir_all(&keys)?;

        let pair = KeyPair::generate(name, "");

        write_atomic_private(&secret, &pair.secret.encode(&pair.key))?;

        write_atomic(&identity, &pair.identity.encode())?;

        Ok(pair)

    }

    /// The successor of this identity with `delegates`, written into `home`

    /// and made current there.

    pub fn succeed(&self, home: &Path, delegates: Vec<Delegate>) -> Result<KeyPair> {

        let identity = self.identity.successor(delegates, self.identity.expires, crate::ids::now_ms());

        let next = KeyPair { key: identity.hash(), identity, secret: self.secret.clone() };

        next.write(home)?;

        Ok(next)

    }

}

/// Delegate to `key` from the current identity in `home` (replacing any

/// delegation to it): the owner's successor, made current.

pub fn delegate(home: &Path, key: KeyId, expires: Option<u64>) -> Result<KeyPair> {

    let cur = KeyPair::load_home(home)?;

    let mut d: Vec<Delegate> = cur.identity.delegates.iter().filter(|x| x.key != key).cloned().collect();

    d.push(Delegate { key, expires });

    cur.succeed(home, d)

}

/// Stop delegating to `key`: the owner's successor without it.

pub fn undelegate(home: &Path, key: KeyId) -> Result<KeyPair> {

    let cur = KeyPair::load_home(home)?;

    let d = cur.identity.delegates.iter().filter(|x| x.key != key).cloned().collect();

    cur.succeed(home, d)

}

/// The identity a home names as current.

pub fn home_identity(home: &Path) -> Result<Identity> {

    let key = current_key(home)?.with_context(|| format!("{} holds no identity (spectra identity create)", home.display()))?;

    let path = home.join("keys").join(format!("{}.identity", key.to_hex()));

    Identity::decode(&fs::read(&path).with_context(|| format!("reading {}", path.display()))?)

        .map_err(|e| anyhow::anyhow!("{}: {e}", path.display()))

}

/// An identity file of any home, by its KeyId.

pub fn identity_in(home: &Path, key: &KeyId) -> Option<Identity> {

    let path = home.join("keys").join(format!("{}.identity", key.to_hex()));

    Identity::decode(&fs::read(path).ok()?).ok()

}

fn current_key(home: &Path) -> Result<Option<KeyId>> {

    let path = home.join("identity.toml");

    let Ok(text) = fs::read_to_string(&path) else { return Ok(None) };

    let table: toml::Table = text.parse().with_context(|| format!("reading {}", path.display()))?;

    match table.get("current").and_then(|v| v.as_str()) {

        Some(hex) => Ok(Some(KeyId::from_hex(hex).with_context(|| format!("{}: current is not a KeyId", path.display()))?)),

        None => Ok(None),

    }

}

fn toml_str(s: &str) -> String {

    toml::Value::String(s.to_string()).to_string()

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn a_home_made_here_reads_back_signs_and_delegates() {

        let dir = tempfile::tempdir().unwrap();

        let made = KeyPair::create_home(dir.path(), "Andy McCall", "").unwrap();

        let read = KeyPair::load_home(dir.path()).unwrap();

        assert_eq!(made.key, read.key);

        assert_eq!(home_identity(dir.path()).unwrap().hash(), made.key);

        let msg = b"spectra1 test message of some length";

        crate::identity::verify(&made.identity, &read.sign(msg), msg).unwrap();

        assert!(KeyPair::create_home(dir.path(), "again", "").is_err());

        let agent = KeyPair::generate("claude", "");

        let next = delegate(dir.path(), agent.key, Some(u64::MAX)).unwrap();

        assert_eq!(next.identity.previous, Some(made.key));

        assert_eq!(KeyPair::load_home(dir.path()).unwrap().key, next.key, "the successor is current");

        assert!(next.identity.delegates_to(&agent.key, 1));

        assert!(KeyPair::load_key(dir.path(), &made.key).is_ok(), "the old identity is kept");

        let after = undelegate(dir.path(), agent.key).unwrap();

        assert!(!after.identity.delegates_to(&agent.key, 1));

    }

    #[test]

    fn the_instance_key_is_made_once() {

        let dir = tempfile::tempdir().unwrap();

        let a = KeyPair::instance(dir.path(), "laptop").unwrap();

        let b = KeyPair::instance(dir.path(), "laptop").unwrap();

        assert_eq!(a.key, b.key);

    }

}