// The store door: release.Store spoken over HTTPS on the edge's reserved
// tunnel hostname, so a fleet box needs no AWS credentials on the platform's
// deployment bucket at all (spec 2026-08-11-fleet-api-surface-design.md,
// F1-F4; issue #73).
//
// One mechanism, not N endpoints: the five Store operations, authenticated
// per request by the credential the box already holds (its fleet tunnel
// token, verified through TunnelHub.VerifyDynamic — the same hash table
// detach/rotate already converge in seconds), and ACL'd server-side from the
// fleet's registry row. The box's own loops — adoption, fast-converge,
// config, status, metrics, bindings — run unchanged against the client half
// (Task 3).
//
// Everything a caller is not entitled to is a byte-identical 404: wrong
// token, static (non-fleet) name, another tenant's key, a key that does not
// exist, a key shaped like a traversal. The keyspace must never be an
// oracle, so no response distinguishes them, and no refusal ever costs more
// than one constant-time verify.
package edge

import (
	"encoding/json"
	"errors"
	"io"
	"log"
	"net/http"
	"os"
	"sort"
	"strconv"
	"strings"

	"github.com/carlosframework/platform/internal/domains"
	"github.com/carlosframework/platform/internal/plans"
	"github.com/carlosframework/platform/internal/release"
)

const (
	// storeDoorPrefix is what edge.go routes to this handler on the reserved
	// tunnel hostname; /register (the tunnel handshake) stays with the hub.
	storeDoorPrefix   = "/store/"
	storeObjectPrefix = "/store/o/"
	storeListPath     = "/store/list"
	storeDirsPath     = "/store/dirs"

	// maxStoreKeyBytes is the pre-ACL key ceiling (spec: keys >1024 bytes are
	// refused before the ACL runs). S3's own limit.
	maxStoreKeyBytes = 1024
	// maxStoreBodyBytes bounds one PUT. Everything a box may write lives
	// under fleets/<own>/ — heartbeats, metrics, alerts, bindings, shipped
	// logs — none of which approach this; the ceiling exists so a
	// compromised box cannot make the edge buffer arbitrary memory.
	maxStoreBodyBytes = 32 << 20
)

// storeDoor serves release.Store over HTTPS for fleet boxes (spec F1-F4).
//
// It holds the deployment-store handle the edge ALREADY has (EnableStatic's,
// shared with the static and status serving classes) — never a second S3
// client, and never anything the request can influence: no client-supplied
// AWS header is read, and no bucket identity is ever exposed (F8: artifact
// bytes stream through the edge rather than being redirected to a presigned
// URL).
type storeDoor struct {
	hub   *TunnelHub    // VerifyDynamic: the one auth path, called once per request
	store release.Store // the deployment bucket, edge's own handle
	// fleetAccount maps an authenticated fleet name to its owning account's
	// sqid — the whole basis of the read ACL. Backed by the edge's
	// reload-time snapshot (Edge.fleetAccount), refreshed on the same pass
	// that feeds the hub's FleetChannelAuth table, so a fleet's identity and
	// its credentials can never come from two different reads of the
	// registry.
	fleetAccount func(fleet string) (sqid string, ok bool)
}

// ServeHTTP is the whole door. The order is load-bearing:
//
//  1. auth — exactly once, before anything else, for every path and method;
//  2. fleet → account (the ACL's identity);
//  3. key canonicalization (traversal, empty segments, oversize);
//  4. the ACL;
//  5. only then the request's own well-formedness (a PUT's precondition) and
//     the store.
//
// Steps 1-4 all answer http.NotFound, so a caller cannot learn from a
// response which of them refused it — in particular a 400 for a missing
// precondition is only ever reachable on a key this fleet may actually
// write, never as a probe for whether such a key exists.
//
// The CAS mapping onto release.Store's contract (store.go), exactly:
//
//	If-None-Match: *   → Put(ifMatch: "")      create-only
//	If-Match: <etag>   → Put(ifMatch: <etag>)  replace-only
//	neither            → 400 (there is no unconditional Put in the contract)
//	ErrCASConflict     → 412
//	Get not-found      → 404 (os.ErrNotExist-wrapped, per the contract)
//	Delete             → 204, always, for an in-scope key (idempotent)
//
// Etags are opaque strings on this wire, passed through in both directions
// exactly as the backing store produced them (DirStore's bare sha256 hex,
// S3's quoted tag): the door never parses or rewrites one, so the client's
// If-Match always carries the same bytes its Get was handed.
func (d *storeDoor) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	// Auth, once. Same two headers as the tunnel dial (F1), same table (F2):
	// only fleet channels ("<fleet>/<label>") can pass — VerifyDynamic
	// refuses slash-less static names outright, so a CARLOS_TUNNEL_CLIENTS
	// credential can never open this door. The token is never logged, never
	// echoed, and never compared in the clear.
	name := r.Header.Get("Carlos-Tunnel-Name")
	token, hasBearer := strings.CutPrefix(r.Header.Get("Authorization"), "Bearer ")
	if name == "" || !hasBearer {
		http.NotFound(w, r)
		return
	}
	fleet, ok := d.hub.VerifyDynamic(name, token)
	if !ok {
		http.NotFound(w, r)
		return
	}
	sqid, ok := d.fleetAccount(fleet)
	if !ok || sqid == "" {
		// Authenticated, but the fleet's registry row is not in the edge's
		// current snapshot (a fleet deleted between reloads, or a hub whose
		// auth table was set by hand). No identity, no ACL, no answer.
		http.NotFound(w, r)
		return
	}
	switch {
	case strings.HasPrefix(r.URL.Path, storeObjectPrefix):
		d.serveObject(w, r, sqid, fleet, strings.TrimPrefix(r.URL.Path, storeObjectPrefix))
	case r.URL.Path == storeListPath:
		d.serveListing(w, r, sqid, fleet, false)
	case r.URL.Path == storeDirsPath:
		d.serveListing(w, r, sqid, fleet, true)
	default:
		http.NotFound(w, r)
	}
}

// serveObject is Get/Put/Delete on one key. rawKey is the path remainder,
// already percent-decoded by net/http — which is exactly what must be
// canonicalized: an encoded "%2e%2e" arrives here as a real ".." segment.
func (d *storeDoor) serveObject(w http.ResponseWriter, r *http.Request, sqid, fleet, rawKey string) {
	key, ok := canonicalKey(rawKey)
	if !ok {
		http.NotFound(w, r)
		return
	}
	ctx := r.Context()
	switch r.Method {
	case http.MethodGet:
		if strings.HasPrefix(key, domains.ClaimsPrefix) {
			d.serveClaim(w, r, sqid, key)
			return
		}
		if !aclRead(sqid, fleet, key) {
			http.NotFound(w, r)
			return
		}
		body, etag, err := d.store.Get(ctx, key)
		if err != nil {
			if errors.Is(err, os.ErrNotExist) {
				http.NotFound(w, r) // byte-identical to every refusal above
				return
			}
			d.storeFailed(w, r, "get", key, err)
			return
		}
		if etag != "" {
			w.Header().Set("ETag", etag)
		}
		w.Header().Set("Content-Type", "application/octet-stream")
		w.Header().Set("Content-Length", strconv.Itoa(len(body)))
		w.Write(body)
	case http.MethodPut:
		if !aclWrite(sqid, fleet, key) {
			http.NotFound(w, r)
			return
		}
		// Precondition parsing is AFTER the ACL on purpose: a 400 here must
		// never be reachable for a key the caller may not write, or the
		// difference between 400 and 404 would map the keyspace.
		ifMatch, ok := putPrecondition(r)
		if !ok {
			http.Error(w, "want If-Match: <etag> or If-None-Match: *", http.StatusBadRequest)
			return
		}
		body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, maxStoreBodyBytes))
		if err != nil {
			var tooLarge *http.MaxBytesError
			if errors.As(err, &tooLarge) {
				http.Error(w, "body too large", http.StatusRequestEntityTooLarge)
				return
			}
			http.Error(w, "read body", http.StatusBadRequest)
			return
		}
		etag, err := d.store.Put(ctx, key, body, ifMatch)
		if err != nil {
			if errors.Is(err, release.ErrCASConflict) {
				// The client maps this back to release.ErrCASConflict, so a
				// heartbeat or binding takeover keeps its exact semantics
				// through the proxy (F4).
				http.Error(w, "precondition failed", http.StatusPreconditionFailed)
				return
			}
			d.storeFailed(w, r, "put", key, err)
			return
		}
		if etag != "" {
			w.Header().Set("ETag", etag)
		}
		w.WriteHeader(http.StatusOK)
	case http.MethodDelete:
		if !aclWrite(sqid, fleet, key) {
			http.NotFound(w, r)
			return
		}
		if err := d.store.Delete(ctx, key); err != nil {
			d.storeFailed(w, r, "delete", key, err)
			return
		}
		w.WriteHeader(http.StatusNoContent) // idempotent, per the Store contract
	default:
		http.NotFound(w, r)
	}
}

// serveListing is List (dirs=false) and ListDirs (dirs=true). The requested
// prefix is scope-MAPPED rather than merely checked (aclListScope): a caller
// asking for "apps/" gets its own account's subtree, which is what lets an
// unmodified release.Store caller work through the door. Every returned entry
// is then re-checked per tenant — aclRead for objects, aclDir for child
// prefixes — so the answer is in scope even if a future mapping rule is ever
// wrong, and so the one scope that IS shared (accounts/) can only ever answer
// with this caller's own record.
func (d *storeDoor) serveListing(w http.ResponseWriter, r *http.Request, sqid, fleet string, dirs bool) {
	if r.Method != http.MethodGet {
		http.NotFound(w, r)
		return
	}
	prefix, ok := canonicalPrefix(r.URL.Query().Get("prefix"))
	if !ok {
		http.NotFound(w, r)
		return
	}
	scope, ok := aclListScope(sqid, fleet, prefix)
	if !ok {
		http.NotFound(w, r)
		return
	}
	if scope == domains.ClaimsPrefix {
		d.serveClaimListing(w, r, dirs)
		return
	}
	out := []string{} // never null on the wire: an empty listing is []
	if dirs {
		got, err := d.store.ListDirs(r.Context(), scope)
		if err != nil {
			d.storeFailed(w, r, "listdirs", scope, err)
			return
		}
		for _, dir := range got {
			// Judged per TENANT, never "is it under the prefix we listed":
			// under the shared accounts/ scope that test is a tautology and
			// would enumerate every account on the platform (aclDir).
			if aclDir(sqid, fleet, dir) {
				out = append(out, dir)
			}
		}
	} else {
		got, err := d.store.List(r.Context(), scope)
		if err != nil {
			d.storeFailed(w, r, "list", scope, err)
			return
		}
		for _, key := range got {
			if aclRead(sqid, fleet, key) {
				out = append(out, key)
			}
		}
	}
	w.Header().Set("Content-Type", "application/json")
	_ = json.NewEncoder(w).Encode(out)
}

// storeFailed answers a genuine backing-store failure. It is deliberately NOT
// folded into the 404 shape: a bucket outage that looked like "the object is
// gone" would make a box act on absence (a missing channel pointer, an empty
// listing) instead of retrying. It is no keyspace oracle either — it is only
// reachable once the key has already passed canonicalization and the ACL, so
// the caller learns nothing it was not already entitled to. The log line
// carries the key and the error; never the token, never the auth header.
func (d *storeDoor) storeFailed(w http.ResponseWriter, r *http.Request, op, key string, err error) {
	log.Printf("edge: store door: %s %s: %v", op, key, err)
	http.Error(w, "store error", http.StatusBadGateway)
}

// putPrecondition maps the request's conditional headers onto release.Store's
// ifMatch argument. The Store contract has no unconditional Put — "" is
// create-only (If-None-Match: *) and non-empty is replace-only — so a PUT
// carrying neither header is a client bug, refused rather than silently
// turned into a create. Both headers together is equally ill-defined.
// If-None-Match is honoured only as the literal "*": an etag list there would
// mean something this wire does not implement.
func putPrecondition(r *http.Request) (ifMatch string, ok bool) {
	im := strings.TrimSpace(r.Header.Get("If-Match"))
	inm := strings.TrimSpace(r.Header.Get("If-None-Match"))
	switch {
	case im != "" && inm != "":
		return "", false
	case inm == "*":
		return "", true
	case inm != "":
		return "", false
	case im != "":
		return im, true
	default:
		return "", false
	}
}

// canonicalKey is the pre-ACL gate: it refuses, rather than cleans, anything
// that could re-point a prefix — "..", "." and empty segments (which covers a
// leading "/", a trailing "/" and any "//"), an empty key, control bytes, and
// anything over maxStoreKeyBytes. Refusing rather than normalizing is the
// point: the ACL below is prefix-string exact, and a key that had to be
// rewritten to be safe is a key whose author meant something else.
//
// It runs BEFORE the ACL, so "apps/<own>/../<other>/x" never reaches a prefix
// comparison that would have approved its first segment.
func canonicalKey(raw string) (string, bool) {
	if raw == "" || len(raw) > maxStoreKeyBytes {
		return "", false
	}
	if strings.HasPrefix(raw, "/") || strings.HasSuffix(raw, "/") {
		return "", false
	}
	for i := 0; i < len(raw); i++ {
		if raw[i] < 0x20 || raw[i] == 0x7f {
			return "", false
		}
	}
	for _, seg := range strings.Split(raw, "/") {
		if seg == "" || seg == "." || seg == ".." {
			return "", false
		}
	}
	return raw, true
}

// canonicalPrefix is canonicalKey for a LISTING prefix: same refusals, except
// that a prefix may end in "/" (and usually does — "apps/", "fleets/pi/").
// The trailing slash is preserved, because aclListScope's mapping rules are
// exact string matches and "apps" must not be allowed to stand in for a
// prefix that would also match "appsomething/".
func canonicalPrefix(raw string) (string, bool) {
	if _, ok := canonicalKey(strings.TrimSuffix(raw, "/")); !ok {
		return "", false
	}
	return raw, true
}

// aclRead is the read half of F3, prefix-string exact against the
// authenticated fleet's own identity:
//
//	control/serial                    the convergence poll
//	bootstrap/carlos                  the sanctioned self-update path (F7);
//	                                  stays until update-platform-binary.sh
//	                                  is retired (spec §10)
//	control/layout.json               the fleet's layout intent (isolated-exec
//	                                  design §8.2) — see release.LayoutIntentKey()
//	control/system/<c>/<ch>.json      its platform channel pointer (system
//	                                  update spec §3) — see systemReadKey
//	bootstrap/router/<v>/<asset>      a mirrored platform artifact — see
//	                                  systemReadKey
//	accounts/<sqid>/**    its owning account's record — the manifest lives at
//	                      accounts/<sqid>/account.json (domains.AccountManifestKey),
//	                      NOT accounts/<sqid>.json: a box that cannot read it
//	                      sees an empty account set, and provision.Reconcile's
//	                      removal phase then retires every provisioned route on
//	                      the box (knownAccounts -> ParseRecordKey)
//	apps/<sqid>/**        its owning account's whole app estate
//	fleets/<fleet>/**     its own corner
//	releases/<sqid>/<app>/promoted/<version>
//	                      a promotion record of its owning account's
//	                      build — see promotionRecordRead
//
// domains/ is NOT here, and is served by its own two paths instead
// (serveClaim, serveClaimListing): a box can list every claimed hostname,
// but reads only its own account's verified claims, with the person who
// made each one stripped out (#215).
//
// The fleets/<fleet>/** line is not in F3's enumeration and is not a
// widening of it: the fleet's own prefix is the only place it may WRITE, and
// every write on this wire is a CAS (read the etag, then Put with If-Match).
// A write scope you cannot read is a write scope you cannot use — the
// binding takeover guard and the heartbeat both read their own object first.
// It grants access to nothing beyond what aclWrite already grants.
//
// control/layout.json is not in F3's enumeration either, and is granted for
// the same reason control/serial is: every box needs the fleet's layout
// intent to converge (isolated-exec design §8.2), and the object holds
// nothing more than a mode and a box label, never tenant data. Write stays
// console-only: aclWrite never answers true for it.
//
// domains/ was once readable here whole (#151), on the reasoning that a
// claim says no more than DNS does. It says more: who made it (a person's
// address), the account and app behind it, its path map, and names that do
// not resolve yet or that nobody has proved they control. Anyone can create
// an account and a fleet, so that was every tenant's claims for the asking.
// What a box actually needs is narrower. ReconcileAliases only ever
// materializes a claim whose route is a local route of the claim's own
// account, and a fleet box's routes are all its own account's, so those are
// the only bodies the door serves (serveClaim). It also needs to know which
// NAMES are claimed at all, whoever by, so the listing stays whole
// (serveClaimListing). Write stays console-only: aclWrite never answers true
// for a domains/ key.
//
// A promotion record (settings spec §4.1, release.PromotionRecordKey) is
// granted because a box needs it and it holds nothing secret: it is the
// root-signed digest of one of the account's own builds, readable by anyone
// holding the public key it verifies under. HeldAuthorized reads it before
// staging a held release, and AuthorizedManifest before any install the
// settings add. Without the grant every record reads as absent through the
// door, so a build authorized by record alone could never stage on a fleet
// box, and one a legacy pointer still names would fall back to that
// pointer's weaker word. The grant is one object shape, not the prefix the
// records sit under: releases/ also holds the account's pointer digest
// marker, which a box has no use for. Listing is not granted (aclDir and
// aclListScope are unchanged), and write stays console-only: aclWrite never
// answers true for a releases/ key.
func aclRead(sqid, fleet, key string) bool {
	if sqid == "" || fleet == "" {
		return false
	}
	switch key {
	case "control/serial", "bootstrap/carlos", release.LayoutIntentKey(), plans.MarkerKey():
		return true
	}
	if systemReadKey(key) || promotionRecordRead(sqid, key) {
		return true
	}
	return strings.HasPrefix(key, "accounts/"+sqid+"/") ||
		strings.HasPrefix(key, "apps/"+sqid+"/") ||
		strings.HasPrefix(key, "fleets/"+fleet+"/")
}

// promotionRecordRead is the one releases/ shape aclRead grants: exactly
// releases/<sqid>/<app>/promoted/<version>, five segments, the box's own
// account, and a valid app and version name (release.PromotionRecordKey's
// inputs). canonicalKey has already refused any "." or ".." segment.
func promotionRecordRead(sqid, key string) bool {
	seg := strings.Split(key, "/")
	return len(seg) == 5 && seg[0] == "releases" && seg[1] == sqid &&
		release.ValidApp(seg[2]) && seg[3] == "promoted" && release.ValidVersion(seg[4])
}

// systemReadKey is the two shapes the system-update spec (§3) grants every
// fleet box: its platform channel pointer and a mirrored platform artifact.
// Shapes, not prefixes — exactly three segments each, so nothing else that
// ever lands under control/ or bootstrap/ is readable by a box. Listing is
// not granted (aclDir is unchanged), and canonicalKey has already refused
// any "." or ".." segment before this runs.
func systemReadKey(key string) bool {
	if rest, ok := strings.CutPrefix(key, "control/system/"); ok {
		comp, file, ok := strings.Cut(rest, "/")
		return ok && comp != "" && file != "" && !strings.Contains(file, "/") &&
			strings.HasSuffix(file, ".json") && len(file) > len(".json")
	}
	if rest, ok := strings.CutPrefix(key, "bootstrap/router/"); ok {
		ver, asset, ok := strings.Cut(rest, "/")
		return ok && ver != "" && asset != "" && !strings.Contains(asset, "/")
	}
	return false
}

// aclDir is aclRead for a LISTING's child prefixes (ListDirs), which are
// directories rather than objects and so cannot be judged by it: a returned
// prefix is in scope exactly when it lies inside one of this tenant's own
// subtrees, or IS its own account directory.
//
// It exists because "the prefix we listed under" is not a sufficient filter
// for the one shared scope: accounts/ must be listable (it is how a box
// discovers its own account record) but ListDirs("accounts/") returns
// accounts/<sqid>/ for EVERY tenant on the platform, and a HasPrefix check
// against the scope we just used is a tautology that would hand all of them
// back.
func aclDir(sqid, fleet, dir string) bool {
	if sqid == "" || fleet == "" {
		return false
	}
	if dir == "accounts/"+sqid+"/" {
		return true
	}
	return strings.HasPrefix(dir, "apps/"+sqid+"/") ||
		strings.HasPrefix(dir, "fleets/"+fleet+"/")
}

// aclWrite is the write half of F3 — and DELETE's half too. Two scopes, and
// only two:
//
//	fleets/<fleet>/**                  its own corner
//	apps/<sqid>/<app>/<family>/**      its own account's app logs, errors, analytics (applog.Prefix)
//
// It can never write a release artifact, a channel pointer, or an instance
// record, which is the tamper surface the whole spec exists to close (F6:
// retention does not arm on a fleet box either). It can never write a
// domains/ claim either (#151): the door only ever reads claims to a box
// (serveClaim, serveClaimListing). A claim is a console-mediated hostname
// reservation, and a box that could write one could mint or steal any
// hostname on the platform, not just its own account's.
//
// The family scope is SEGMENT-EXACT on purpose, and the exactness is the
// security property: the grant is apps/<sqid>/<ONE app segment>/<ONE family>/**, where
// family is one of [logs, errors, analytics], never apps/<sqid>/** and never
// a "family appears somewhere in the key" test. A blanket own-account write
// would let a box pin its own channels/*.json (self-promoting any build it
// likes) or mint instances/*.json records (self-authorizing routes) —
// precisely the writes this door exists to prevent. Chunks and day files are
// the one thing a box legitimately produces about its own tenant's apps
// (applog.ChunkKey), and they are write-once objects under a per-box subtree.
//
// HONEST LIMIT: the <box> segment inside that subtree is an unverifiable
// pseudonym (status.Label of a machine id the box chose), so one box of an
// account can in principle delete a same-account sibling box's chunks. The
// blast radius is inside a single account's own logs — no other tenant, no
// release data — and pruning its own subtree is exactly what logship must do
// every hour; verifying the segment would need a per-box identity the door
// does not have today.
func aclWrite(sqid, fleet, key string) bool {
	if fleet == "" {
		return false
	}
	if strings.HasPrefix(key, "fleets/"+fleet+"/") {
		return true
	}
	return aclWriteAppFamily(sqid, key)
}

// chunkFamilies is the allow-list of app subtrees a box may write: the
// chunk and day-file families it produces about its own tenant's apps
// (applog.Family). Exact segment names — "logs" is not "logsx".
var chunkFamilies = map[string]bool{"logs": true, "errors": true, "analytics": true}

// aclWriteAppFamily implements aclWrite's second scope: exactly
// apps/<sqid>/<app>/<family>/<something>, with <app> a single non-empty
// segment, <family> one of chunkFamilies, and at least one key component
// below the family. Anything else — a shorter key, a second path shape,
// a family name as the app segment — is refused, so the grant can never be
// widened by a key that merely contains the word.
func aclWriteAppFamily(sqid, key string) bool {
	if sqid == "" {
		return false
	}
	rest, ok := strings.CutPrefix(key, "apps/"+sqid+"/")
	if !ok {
		return false
	}
	app, tail, ok := strings.Cut(rest, "/")
	if !ok || app == "" {
		return false
	}
	fam, below, ok := strings.Cut(tail, "/")
	return ok && chunkFamilies[fam] && below != ""
}

// aclListScope maps a requested listing prefix onto the prefix the door will
// actually list, or refuses. Mapping rather than refusing is what keeps
// unmodified release.Store callers working: "apps/" is what platform code
// asks for, and a fleet box asking it gets its own account's subtree back
// (spec F3: "list of accounts/ and apps/ answers only the own-account
// subset"). A bare "apps"/"fleets"/"accounts" (no trailing slash) maps the
// same way; anything narrower must already be inside the caller's own
// subtree, and a partial sqid or fleet name ("apps/ab1", "fleets/pix/") is
// refused rather than widened, since S3 prefix matching would otherwise reach
// a sibling tenant.
//
// accounts/ is the one scope that maps to a SHARED prefix — it has to be
// listable, since that is how a box finds its own account manifest
// (provision.knownAccounts lists accounts/ and parses
// accounts/<sqid>/account.json). The caller may see only its own record
// there, which serveListing enforces by re-checking every returned entry
// (aclRead for objects, aclDir for the child prefixes ListDirs returns —
// there is one per account on the platform).
func aclListScope(sqid, fleet, prefix string) (string, bool) {
	if sqid == "" || fleet == "" || prefix == "" {
		return "", false
	}
	ownApps := "apps/" + sqid + "/"
	ownFleet := "fleets/" + fleet + "/"
	switch {
	case prefix == "apps" || prefix == "apps/" || prefix == "apps/"+sqid:
		return ownApps, true
	case strings.HasPrefix(prefix, ownApps):
		return prefix, true
	case strings.HasPrefix(prefix, "apps/"):
		return "", false
	case prefix == "accounts" || prefix == "accounts/":
		return "accounts/", true
	case prefix == "domains" || prefix == "domains/":
		// #151: the OTHER shared scope. Claims are keyed by hostname, not
		// tenant, so there is no subtree to narrow into: serveClaimListing
		// names every claimed hostname, and serveClaim withholds every body
		// but this account's verified ones (#215). ReconcileAliases always
		// lists the whole prefix; a narrower ask (e.g.
		// "domains/x.example.json") is refused rather than widened, matching accounts/'s deliberate refusal of
		// "accounts/<sqid>/" — see that case's comment.
		return "domains/", true
	case prefix == "fleets" || prefix == "fleets/" || prefix == "fleets/"+fleet:
		return ownFleet, true
	case strings.HasPrefix(prefix, ownFleet):
		return prefix, true
	default:
		return "", false
	}
}

// serveClaim answers a GET of one hostname claim. A box gets a claim only
// when it is its own account's and verified — the only claims its
// ReconcileAliases could ever act on — and never its created_by, which is a
// person's address the box has no use for. Everything else is the door's
// byte-identical 404, so a fleet credential cannot probe which hostnames
// other tenants hold.
//
// The body is redacted as a generic JSON object rather than through
// domains.Claim, so a field a newer console wrote survives the trip to a
// box that understands it even if this edge does not.
func (d *storeDoor) serveClaim(w http.ResponseWriter, r *http.Request, sqid, key string) {
	body, etag, err := d.store.Get(r.Context(), key)
	if err != nil {
		if errors.Is(err, os.ErrNotExist) {
			http.NotFound(w, r)
			return
		}
		d.storeFailed(w, r, "get", key, err)
		return
	}
	var obj map[string]json.RawMessage
	if json.Unmarshal(body, &obj) != nil {
		http.NotFound(w, r)
		return
	}
	var account string
	var pending bool
	_ = json.Unmarshal(obj["account"], &account)
	_ = json.Unmarshal(obj["pending"], &pending)
	if account != sqid || pending {
		http.NotFound(w, r)
		return
	}
	delete(obj, "created_by")
	out, err := json.Marshal(obj)
	if err != nil {
		d.storeFailed(w, r, "get", key, err)
		return
	}
	if etag != "" {
		w.Header().Set("ETag", etag)
	}
	w.Header().Set("Content-Type", "application/octet-stream")
	w.Header().Set("Content-Length", strconv.Itoa(len(out)))
	w.Write(out)
}

// serveClaimListing lists every claim KEY under domains/: hostnames only,
// whoever holds them. The listing has to be whole, because ReconcileAliases
// decides "a claim on this name wins, whoever holds it" from it (an instance
// catch-all derives no <label>.<parent> alias over a name another account
// claimed), and a listing narrowed to this account would let a box shadow
// another tenant's claim. A hostname alone is what DNS publishes anyway; the
// claim behind it (who, which app, its paths, whether it is proven) stays
// behind serveClaim's 404. Child directories: none, claims are flat.
func (d *storeDoor) serveClaimListing(w http.ResponseWriter, r *http.Request, dirs bool) {
	out := []string{}
	if !dirs {
		keys, err := d.store.List(r.Context(), domains.ClaimsPrefix)
		if err != nil {
			d.storeFailed(w, r, "list", domains.ClaimsPrefix, err)
			return
		}
		for _, key := range keys {
			if _, ok := canonicalKey(key); ok && strings.HasSuffix(key, ".json") {
				out = append(out, key)
			}
		}
		sort.Strings(out)
	}
	w.Header().Set("Content-Type", "application/json")
	_ = json.NewEncoder(w).Encode(out)
}