//go:build linux

package host

import (
	"context"
	"github.com/carlosframework/platform/internal/rootstate"
	"net"
	"path/filepath"
	"sort"
	"time"

	"github.com/carlosframework/platform/internal/hostbox"
	"github.com/carlosframework/platform/internal/hostclaim"
	"github.com/carlosframework/platform/internal/hostguard"
	"github.com/carlosframework/platform/internal/provision"
)

// servingParkRoot composes local root authority with the filesystem ledger.
// Requests supply identities only; installation paths and receipts are read
// under root's host lock. Serving activation still waits for recovery witnesses.
type servingParkRoot struct {
	root   ClaimRootHTTP
	ledger *servingParkLedger
	empty  servingEmptyAuthority
}

func newServingParkAuthority(h ClaimRootHTTP, state rootstate.Store, empty servingEmptyAuthority) (servingParkAuthority, error) {
	if state == nil || h.Journals == nil || h.Journals.Launches == nil || h.Journals.Inventory == nil || h.Journals.Inventory.Remote() || h.Stop.Coordinator.Guard.Root == nil || h.Stop.Authenticate == nil || h.RequireNewWork == nil || h.InventoryActor == nil || empty == nil || !filepath.IsAbs(h.Roots["data"]) || h.Roots["data"] != h.Stop.Coordinator.Guard.DataDir {
		return nil, hostbox.ErrUnsupported
	}
	ledger := &servingParkLedger{state: state, fs: newServingParkFS(h.Roots["data"], state), journal: h.Journals.Launches, now: time.Now}
	return &servingParkRoot{root: h, ledger: ledger, empty: empty}, nil
}

func (p *servingParkRoot) withAuthority(ctx context.Context, conn net.Conn, current servingArtifactIdentity, fn func(hostclaim.Observed, hostguard.FenceView, hostbox.Actor, servingArtifactDirectory, uint64) error) error {
	if conn == nil || fn == nil {
		return hostbox.ErrUnsupported
	}
	return p.withRootInstallation(ctx, current, func() error {
		// Waiting for root locks must not preserve a stale peer authentication.
		peer, err := p.root.Stop.Authenticate(ctx, conn)
		if err != nil {
			return err
		}
		if peer.UID == 0 || peer.PID <= 0 || peer.ProcessStart == "" || peer.BootID == "" || peer.ControllerID == "" {
			return ErrClaimStopIdentity
		}
		return nil
	}, fn)
}

// withRootInstallation is also used by root startup to replay private intents.
// It grants no new admission, enrollment, stop receipt or claim tag.
func (p *servingParkRoot) withRootInstallation(ctx context.Context, current servingArtifactIdentity, check func() error, fn func(hostclaim.Observed, hostguard.FenceView, hostbox.Actor, servingArtifactDirectory, uint64) error) error {
	if ctx == nil || check == nil || p == nil || p.ledger == nil || p.root.Stop.Authenticate == nil || p.root.RequireNewWork == nil || p.root.InventoryActor == nil || p.root.Journals == nil || p.root.Journals.Inventory == nil || p.root.Journals.Inventory.Remote() || p.root.Stop.Coordinator.Guard.Root == nil || fn == nil {
		return hostbox.ErrUnsupported
	}
	data := p.root.Roots["data"]
	if !filepath.IsAbs(data) || data != p.root.Stop.Coordinator.Guard.DataDir {
		return hostbox.ErrChanged
	}
	return p.ledger.withNamespace(ctx, func() error {
		return p.root.Stop.Coordinator.Guard.WithServingRetirement(ctx, current.Host, hostguard.Captured{Incarnation: current.Incarnation, Stamp: current.Stamp}, func(o hostclaim.Observed, view hostguard.FenceView) error {
			if err := check(); err != nil {
				return err
			}
			if err := p.root.RequireNewWork(ctx); err != nil {
				return err
			}
			actor, err := p.root.InventoryActor(ctx)
			if err != nil {
				return err
			}
			if !actor.Eligible || actor.Quarantined || actor.Enrollment == "" || actor.Revision == 0 || actor.Binding == "" {
				return hostbox.ErrChanged
			}
			actual, err := servingWriterIdentity(o, actor.Box, actor.Region)
			if err != nil || actual != current || o.ETag == "" {
				return hostbox.ErrChanged
			}
			in, revision, err := p.root.Journals.Inventory.Snapshot(ctx, current.Host, view.Captured)
			if err != nil {
				return err
			}
			dir, err := servingParkStateDirectory(data, o, view.Installation, in, revision, actor)
			if err != nil {
				return err
			}
			db, err := filepath.Rel(data, provision.NestedDBPath(data, current.Host))
			if err != nil {
				return err
			}
			tags, err := servingInventoryPair(o.Claim.Inventory[actor.Box], filepath.ToSlash(db))
			if err != nil || tags > current.Stamp {
				return hostbox.ErrChanged
			}
			if err = ctx.Err(); err != nil {
				return err
			}
			fresh, err := p.root.Stop.Coordinator.Guard.Claims.Read(ctx, current.Host)
			if err != nil {
				return err
			}
			if fresh.ETag != o.ETag || fresh.Absent {
				return hostbox.ErrChanged
			}
			return fn(o, view, actor, dir, tags)
		})
	})
}

func servingRootStops(ctx context.Context, view hostguard.FenceView, prior servingArtifactIdentity, actor hostbox.Actor) ([]hostguard.FenceReceipt, error) {
	if prior.Host != view.Host || prior.Incarnation != view.Installation.Incarnation || prior.Box != actor.Box || prior.Region != actor.Region || prior.Stamp == 0 || prior.Session != prior.Stamp {
		return nil, hostbox.ErrChanged
	}
	known := view.Captured == (hostguard.Captured{Incarnation: prior.Incarnation, Stamp: prior.Stamp})
	for _, retired := range view.Retired {
		known = known || retired == (hostguard.Captured{Incarnation: prior.Incarnation, Stamp: prior.Stamp})
	}
	if !known {
		return nil, hostguard.ErrNoFenceReceipt
	}
	var out []hostguard.FenceReceipt
	seen := make(map[string]bool)
	for _, receipt := range view.Receipts {
		t := receipt.Target
		if t.Host != prior.Host || t.Incarnation != prior.Incarnation || t.Stamp != prior.Stamp || t.Box != prior.Box || t.Op != "" || t.Phase != "" || t.ObligationID != "" {
			continue
		}
		if t.Session != prior.Session || t.Region != prior.Region || t.Enrollment != actor.Enrollment || !servingPriorBinding(t.DirectoryRevision, actor) || t.FenceID == "" || seen[t.FenceID] || verifyRetirementReceipt(ctx, receipt) != nil {
			return nil, ErrClaimStopReceipt
		}
		seen[t.FenceID] = true
		out = append(out, receipt)
	}
	if len(out) == 0 {
		return nil, hostguard.ErrNoFenceReceipt
	}
	sort.Slice(out, func(i, j int) bool { return out[i].Target.FenceID < out[j].Target.FenceID })
	return out, nil
}

func (p *servingParkRoot) parkServingDatabase(ctx context.Context, conn net.Conn, current, requestedPrior servingArtifactIdentity) (servingParkAuthorization, error) {
	var out servingParkAuthorization
	resumeLegacy := false
	err := p.withAuthority(ctx, conn, current, func(o hostclaim.Observed, view hostguard.FenceView, actor hostbox.Actor, dir servingArtifactDirectory, tags uint64) error {
		var a servingParkAuthorization
		var saved *servingParkRecord
		var continuation []hostguard.FenceReceipt
		var next servingParkAuthorization
		slot, err := p.ledger.slot(servingParkAuthorization{Successor: current})
		if err != nil {
			return err
		}
		id := slot.Pending
		if id == "" && tags == current.Stamp {
			id = slot.Last
		}
		if id != "" {
			r, err := p.ledger.read(id)
			if err != nil {
				return err
			}
			a, saved = r.Authorization, &r
			if a.Legacy {
				if requestedPrior != (servingArtifactIdentity{}) {
					prior, e := servingPredecessor(o.Claim, current, tags, requestedPrior.Generation)
					if e != nil || prior != requestedPrior {
						return hostbox.ErrChanged
					}
				}
				resumeLegacy = true
				return nil
			}
			if a.Directory != dir {
				return hostbox.ErrChanged
			}
			active := r.activeAuthorization()
			if err = validateServingRootHistory(ctx, o, view, actor, r); err != nil {
				return err
			}
			if requestedPrior != (servingArtifactIdentity{}) {
				stamp := tags
				if tags == current.Stamp {
					// Retagging has consumed the old pair. An original request
					// still selects the predecessor saved before that change.
					stamp = active.TagsFrom
				}
				prior, e := servingPredecessor(o.Claim, current, stamp, requestedPrior.Generation)
				if e != nil || prior != requestedPrior {
					return hostbox.ErrChanged
				}
			}
			if tags != active.TagsFrom && tags != active.Successor.Stamp && tags != current.Stamp {
				return hostbox.ErrChanged
			}
			if active.Successor != current {
				if r.Complete || active.Successor.Stamp >= current.Stamp {
					return hostbox.ErrChanged
				}
				prior, e := servingPredecessor(o.Claim, current, active.Successor.Stamp, active.Successor.Generation)
				if e != nil || prior != active.Successor {
					return hostbox.ErrChanged
				}
				continuation, err = servingRootStops(ctx, view, prior, actor)
				if err != nil {
					return err
				}
				next = active
				next.Successor, next.TagsFrom = current, tags
			}
		} else {
			if requestedPrior == (servingArtifactIdentity{}) {
				return hostbox.ErrChanged
			}
			prior, err := servingPredecessor(o.Claim, current, tags, requestedPrior.Generation)
			if err != nil || prior != requestedPrior {
				return hostbox.ErrChanged
			}
			a = servingParkAuthorization{TagsFrom: tags, Predecessor: prior, OriginalSuccessor: current, Successor: current, Directory: dir}
			a.ID = servingRetirementID(prior, current, false)
		}
		prior, err := servingPredecessor(o.Claim, current, a.Predecessor.Stamp, a.Predecessor.Generation)
		if err != nil || prior != a.Predecessor {
			return hostbox.ErrChanged
		}
		receipts, err := servingRootStops(ctx, view, prior, actor)
		if err != nil {
			return err
		}
		if saved != nil && !sameServingRootStops(saved.Receipts, receipts) {
			return ErrClaimStopReceipt
		}
		if err = p.prepareServingNamespace(ctx, a, receipts, nil); err != nil {
			return err
		}
		r, err := p.ledger.parkLocked(ctx, a, receipts)
		if err != nil {
			return err
		}
		if err = p.ledger.fs.CheckParked(&r); err != nil {
			return err
		}
		if next.ID != "" {
			r, err = p.ledger.continueLocked(ctx, a.ID, next, continuation)
			if err != nil {
				return err
			}
		}
		out = r.activeAuthorization()
		return nil
	})
	if err == nil && resumeLegacy {
		return p.parkLegacyServingDatabase(ctx, conn, current, servingLegacyPredecessor{})
	}
	return out, err
}

func (p *servingParkRoot) completeServingDatabasePark(ctx context.Context, conn net.Conn, id string, current servingArtifactIdentity) error {
	return p.withAuthority(ctx, conn, current, func(o hostclaim.Observed, view hostguard.FenceView, actor hostbox.Actor, dir servingArtifactDirectory, tags uint64) error {
		r, err := p.ledger.read(id)
		if err != nil {
			return err
		}
		a := r.activeAuthorization()
		if err = validateServingRootHistory(ctx, o, view, actor, r); err != nil {
			return err
		}
		if a.Successor != current || a.Directory != dir || tags != current.Stamp {
			return hostbox.ErrChanged
		}
		if a.Legacy {
			if err = p.validateLegacyRootEvidence(ctx, o, view, actor, r.Authorization, r.LegacyEvidence, r.Receipts); err != nil {
				return err
			}
			if err = p.ledger.legacyUnlaunched(ctx, current, actor.Enrollment); err != nil {
				return err
			}
			return p.ledger.completeLocked(ctx, id, current)
		}
		prior, err := servingPredecessor(o.Claim, current, a.Predecessor.Stamp, a.Predecessor.Generation)
		if err != nil || prior != a.Predecessor {
			return hostbox.ErrChanged
		}
		receipts, err := servingRootStops(ctx, view, prior, actor)
		if err != nil {
			return err
		}
		if !sameServingRootStops(r.Receipts, receipts) {
			return ErrClaimStopReceipt
		}
		return p.ledger.completeLocked(ctx, id, current)
	})
}

// Every recorded successor must still be a retained local admission; each
// transition carries the root stop of the successor it superseded.
func validateServingRootHistory(ctx context.Context, o hostclaim.Observed, view hostguard.FenceView, actor hostbox.Actor, r servingParkRecord) error {
	current, err := servingWriterIdentity(o, actor.Box, actor.Region)
	if err != nil {
		return err
	}
	previous := r.Authorization.Successor
	for _, continuation := range r.Continuations {
		prior, err := servingPredecessor(o.Claim, current, previous.Stamp, previous.Generation)
		if err != nil || prior != previous {
			return hostbox.ErrChanged
		}
		receipts, err := servingRootStops(ctx, view, previous, actor)
		if err != nil {
			return err
		}
		if !sameServingRootStops(receipts, continuation.Receipts) {
			return ErrClaimStopReceipt
		}
		previous = continuation.Authorization.Successor
	}
	if previous == current {
		return nil
	}
	prior, err := servingPredecessor(o.Claim, current, previous.Stamp, previous.Generation)
	if err != nil || prior != previous {
		return hostbox.ErrChanged
	}
	return nil
}