//go:build linux

package host

import (
	"bytes"
	"crypto/ed25519"
	"crypto/rand"
	"encoding/base64"
	"encoding/json"
	"errors"
	"io"
	"os"
	"path/filepath"
	"strings"

	"github.com/carlosframework/platform/internal/hostactors"
	"github.com/carlosframework/platform/internal/hostfence"
	"github.com/carlosframework/platform/internal/release"
	"github.com/carlosframework/platform/internal/safefile"
	"golang.org/x/sys/unix"
)

// Each component is opened relative to the checked parent, before any create.
func activationDir(path string, create bool) (*os.File, error) {
	if os.Geteuid() != 0 || !filepath.IsAbs(path) || filepath.Clean(path) != path {
		return nil, errActivation
	}
	fd, err := unix.Open("/", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
	if err != nil {
		return nil, err
	}
	for _, name := range strings.Split(strings.TrimPrefix(path, "/"), "/") {
		var st unix.Stat_t
		if err = unix.Fstat(fd, &st); err != nil || st.Uid != 0 || st.Mode&0022 != 0 {
			unix.Close(fd)
			return nil, errActivation
		}
		if name == "" {
			continue
		}
		next, e := unix.Openat(fd, name, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
		if e == unix.ENOENT && create {
			e = unix.Mkdirat(fd, name, 0700)
			if e == nil || e == unix.EEXIST {
				if e = unix.Fsync(fd); e == nil {
					next, e = unix.Openat(fd, name, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
				}
			}
		}
		unix.Close(fd)
		if e != nil {
			return nil, e
		}
		fd = next
	}
	var st unix.Stat_t
	if err = unix.Fstat(fd, &st); err != nil || st.Uid != 0 || st.Mode&0022 != 0 {
		unix.Close(fd)
		return nil, errActivation
	}
	return os.NewFile(uintptr(fd), path), nil
}

func activationReadAt(dir *os.File, name string, private bool) ([]byte, error) {
	f, err := safefile.OpenFileAt(int(dir.Fd()), name, os.O_RDONLY, 0)
	if err != nil {
		return nil, err
	}
	defer f.Close()
	var st unix.Stat_t
	if err = unix.Fstat(int(f.Fd()), &st); err != nil {
		return nil, err
	}
	if st.Uid != 0 || st.Mode&0022 != 0 || private && st.Mode&0777 != 0600 && st.Mode&0777 != 0400 {
		return nil, errActivation
	}
	raw, err := io.ReadAll(io.LimitReader(f, 65537))
	if err != nil {
		return nil, err
	}
	if len(raw) > 65536 {
		return nil, errActivation
	}
	return raw, nil
}
func activationRead(path string, private bool) ([]byte, error) {
	dir, err := activationDir(filepath.Dir(path), false)
	if err != nil {
		return nil, err
	}
	defer dir.Close()
	return activationReadAt(dir, filepath.Base(path), private)
}
func activationLock(dir *os.File) (*os.File, error) {
	f, err := safefile.OpenFileAt(int(dir.Fd()), activationLockName, os.O_CREATE|os.O_RDWR, 0600)
	if err != nil {
		return nil, err
	}
	var st unix.Stat_t
	if err = unix.Fstat(int(f.Fd()), &st); err != nil || st.Uid != 0 || st.Mode&0777 != 0600 {
		f.Close()
		return nil, errActivation
	}
	if err = unix.Flock(int(f.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
		f.Close()
		return nil, err
	}
	return f, nil
}

type activationKeyProof struct {
	Binding hostactors.CensusKeyBinding `json:"binding"`
	Proof   []byte                      `json:"proof"`
}

func installActivationEvidenceKey(path string, binding hostactors.CensusKeyBinding, dry bool) (activationKeyProof, error) {
	var result activationKeyProof
	if binding.Bucket == "" || binding.Box == "" || len(binding.Enrollment) != 32 || len(binding.PublicKey) != 0 && len(binding.PublicKey) != ed25519.PublicKeySize {
		return result, errActivation
	}
	dir, err := activationDir(filepath.Dir(path), false)
	if err != nil {
		return result, err
	}
	defer dir.Close()
	if !dry {
		lock, e := activationLock(dir)
		if e != nil {
			return result, e
		}
		defer lock.Close()
	}
	raw, err := activationReadAt(dir, filepath.Base(path), true)
	if errors.Is(err, os.ErrNotExist) || errors.Is(err, unix.ENOENT) {
		if len(binding.PublicKey) != 0 {
			return result, errActivation
		}
		if dry {
			return result, nil
		}
		_, key, e := ed25519.GenerateKey(rand.Reader)
		if e != nil {
			return result, e
		}
		raw = []byte(base64.StdEncoding.EncodeToString(key.Seed()) + "\n")
		if err = safefile.WriteAt(int(dir.Fd()), filepath.Base(path), raw, 0600); err != nil {
			return result, err
		}
		verified, e := activationReadAt(dir, filepath.Base(path), true)
		if e != nil || !bytes.Equal(raw, verified) {
			return result, errActivation
		}
	} else if err != nil {
		return result, err
	}
	key, err := release.ParseSigningKey(strings.TrimSpace(string(raw)), path)
	if err != nil {
		return result, errActivation
	}
	if len(binding.PublicKey) != 0 && !bytes.Equal(binding.PublicKey, key.Public().(ed25519.PublicKey)) {
		return result, errActivation
	}
	binding.PublicKey = key.Public().(ed25519.PublicKey)
	wire, err := json.Marshal(binding)
	if err != nil {
		return result, err
	}
	result = activationKeyProof{Binding: binding, Proof: ed25519.Sign(key, wire)}
	if !ed25519.Verify(binding.PublicKey, wire, result.Proof) {
		return activationKeyProof{}, errActivation
	}
	return result, nil
}
func installActivationFenceCredentials(source, target string, scope activationFenceScope, dry bool) error {
	raw, err := activationRead(source, true)
	if err != nil {
		return err
	}
	if err = hostfence.ValidateActivationCredentials(raw, scope.Bucket, scope.Region, scope.Role); err != nil {
		return errActivation
	}
	dir, err := activationDir(filepath.Dir(target), !dry)
	if dry && (errors.Is(err, os.ErrNotExist) || errors.Is(err, unix.ENOENT)) {
		return nil
	}
	if err != nil {
		return err
	}
	defer dir.Close()
	if !dry {
		lock, e := activationLock(dir)
		if e != nil {
			return e
		}
		defer lock.Close()
	}
	existing, err := activationReadAt(dir, filepath.Base(target), true)
	if err == nil {
		if !bytes.Equal(existing, raw) {
			return errActivation
		}
	} else if !errors.Is(err, os.ErrNotExist) && !errors.Is(err, unix.ENOENT) {
		return err
	}
	receipt := hostfence.ActivationCredentialReceipt(raw)
	prior, receiptErr := activationReadAt(dir, "credentials.installation.json", true)
	if receiptErr == nil && !bytes.Equal(prior, receipt) {
		return errActivation
	}
	if receiptErr != nil && !errors.Is(receiptErr, os.ErrNotExist) {
		return receiptErr
	}
	if dry {
		return nil
	}
	if err != nil {
		if err = safefile.WriteAt(int(dir.Fd()), filepath.Base(target), raw, 0600); err != nil {
			return err
		}
	}
	after, err := activationReadAt(dir, filepath.Base(target), true)
	if err != nil || !bytes.Equal(raw, after) {
		return errActivation
	}
	if receiptErr != nil {
		if err = safefile.WriteAt(int(dir.Fd()), "credentials.installation.json", receipt, 0600); err != nil {
			return err
		}
	}
	after, err = activationReadAt(dir, "credentials.installation.json", true)
	if err != nil || !bytes.Equal(receipt, after) {
		return errActivation
	}
	return nil
}

func installActivationControl(envPath, unitPath string, dry bool, systemctl func(...string) (string, error)) error {
	raw, err := activationRead(envPath, false)
	if err != nil {
		return err
	}
	cfg, err := activationUnitSettings(raw)
	if err != nil {
		return err
	}
	dir, err := activationDir(unitPath, false)
	if err != nil {
		return err
	}
	defer dir.Close()
	// Refuse a masked/symlinked control unit, including an operator's own mask.
	if _, err = activationReadAt(dir, claimControlUnit, false); err != nil && !errors.Is(err, os.ErrNotExist) && !errors.Is(err, unix.ENOENT) {
		return err
	}
	content, err := unitsFS.ReadFile("units/" + claimControlUnit)
	if err != nil {
		return err
	}
	if dry {
		return nil
	}
	lock, err := activationLock(dir)
	if err != nil {
		return err
	}
	defer lock.Close()
	cfg.rootRetry, err = prepareRootRetryUnitDirectory()
	if err != nil {
		return err
	}
	content = claimUnitContent(claimControlUnit, content, cfg)
	if err = safefile.WriteAt(int(dir.Fd()), claimControlUnit, content, 0644); err != nil {
		return err
	}
	after, err := activationReadAt(dir, claimControlUnit, false)
	if err != nil || !bytes.Equal(after, content) {
		return errActivation
	}
	_, err = systemctl("daemon-reload")
	return err
}

func installActivationConsole(envPath, dropPath string, raw []byte, dry bool, systemctl func(...string) (string, error)) error {
	parent, err := activationDir(filepath.Dir(envPath), false)
	if err != nil {
		return err
	}
	defer parent.Close()
	unitParent, err := activationDir(filepath.Dir(dropPath), false)
	if err != nil {
		return err
	}
	defer unitParent.Close()
	if !dry {
		lock, e := activationLock(parent)
		if e != nil {
			return e
		}
		defer lock.Close()
	}
	existing, err := activationReadAt(parent, filepath.Base(envPath), true)
	off := bytes.Replace(raw, []byte("CARLOS_HOST_CLAIM=1\n"), []byte("CARLOS_HOST_CLAIM=\n"), 1)
	if err == nil && !bytes.Equal(existing, raw) && !bytes.Equal(existing, off) {
		return errActivation
	}
	if err != nil && !errors.Is(err, os.ErrNotExist) {
		return err
	}
	drop, err := activationDir(dropPath, !dry)
	if dry && errors.Is(err, os.ErrNotExist) {
		return nil
	}
	if err != nil {
		return err
	}
	defer drop.Close()
	content := []byte("[Service]\nEnvironmentFile=" + envPath + "\n")
	old, err := activationReadAt(drop, "91-claim-runtime.conf", false)
	if err == nil && !bytes.Equal(old, content) {
		return errActivation
	}
	if err != nil && !errors.Is(err, os.ErrNotExist) {
		return err
	}
	if dry {
		return nil
	}
	if err = safefile.WriteAt(int(parent.Fd()), filepath.Base(envPath), raw, 0600); err != nil {
		return err
	}
	if err = safefile.WriteAt(int(drop.Fd()), "91-claim-runtime.conf", content, 0644); err != nil {
		return err
	}
	got, err := activationReadAt(parent, filepath.Base(envPath), true)
	if err != nil || !bytes.Equal(got, raw) {
		return errActivation
	}
	got, err = activationReadAt(drop, "91-claim-runtime.conf", false)
	if err != nil || !bytes.Equal(got, content) {
		return errActivation
	}
	_, err = systemctl("daemon-reload")
	return err
}