package host

import (
	"errors"
	"fmt"
	"strings"

	"github.com/carlosframework/platform/internal/registry"
)

// FleetIdentity is a fleet box's resolved identity: which fleet it belongs
// to, and which of that fleet's boxes IT is.
//
// Label is the operator-chosen fleet_boxes.label — the channel identity the
// edge actually dials ("<Fleet>/<Label>", edge.fleetChannelFor) — and
// deliberately NEVER status.Label(machineID). That hashed value is the
// PUBLIC status page's opaque pseudonym, chosen specifically so a customer's
// machine id can never be recovered from a feed anyone can view; a fleet
// box's real identity is a name an operator picked when they ran
// `carlos fleets add-box`, and nothing else on the platform (the edge's
// tunnel hub, the registry's fleet_boxes table, a fleet binding object) ever
// refers to a box any other way. Using the hashed pseudonym here would
// publish bindings the edge could never dial back.
type FleetIdentity struct {
	Fleet string
	Label string
}

// errNotFleetBox is resolveFleetIdentity's sentinel for "this agent isn't a
// fleet box at all" (CARLOS_FLEET unset) — distinct from an invalid
// identity, which callers must treat very differently: the former is every
// platform box today (silent, expected), the latter is a fleet box
// misconfigured badly enough that it must refuse to arm its fleet
// machinery rather than run under a label nothing else in the system would
// recognize.
var errNotFleetBox = errors.New("host: CARLOS_FLEET is not set")

// resolveFleetIdentity reads CARLOS_FLEET and CARLOS_FLEET_BOX (falling
// back to CARLOS_TUNNEL_NAME, since a fleet box's tunnel name already has
// the "<fleet>/<label>" shape tunnel_client.go dials with) and validates
// both halves with registry.ValidTunnelName — the exact grammar
// fleet_boxes.label, Route.Tunnel, and a fleet name in Route.Region
// ("fleet/<name>", registry.FleetPlacement) all already share, so a value
// this accepts is guaranteed usable everywhere else in the system that
// stores or parses one.
//
// Returns (_, errNotFleetBox) when CARLOS_FLEET is unset — the ordinary,
// silent, every-platform-box-today case; callers must not log anything for
// it. Any OTHER non-nil error names a genuine misconfiguration (an invalid
// fleet name, or a box label that isn't set and can't be derived/doesn't
// validate) — callers must refuse to arm whatever fleet-box behavior they
// gate on this, loudly, rather than fall back to guessing an identity.
func resolveFleetIdentity(getenv func(string) string) (FleetIdentity, error) {
	fleet := strings.TrimSpace(getenv("CARLOS_FLEET"))
	if fleet == "" {
		return FleetIdentity{}, errNotFleetBox
	}
	if !registry.ValidTunnelName(fleet) {
		return FleetIdentity{}, fmt.Errorf("CARLOS_FLEET=%q is not a valid fleet name", fleet)
	}

	label := strings.TrimSpace(getenv("CARLOS_FLEET_BOX"))
	if label == "" {
		// A fleet box's CARLOS_TUNNEL_NAME is minted as "<fleet>/<label>"
		// (plan doc: "FleetChannelAuth: channel name '<fleet>/<label>'"), so
		// stripping this fleet's own prefix recovers the label without a
		// second env var in the common case. CutPrefix — not TrimPrefix — is
		// load-bearing here (fix round 2, Opus re-review): TrimPrefix
		// no-ops when CARLOS_TUNNEL_NAME doesn't actually carry this exact
		// prefix, silently leaving the WHOLE tunnel name behind as the
		// "label" — and a bare legacy tunnel name (CARLOS_TUNNEL_NAME=
		// "pi-box", no "/" at all — the live shape in today's runbook)
		// still passes ValidTunnelName, so that silent fallback would have
		// published a Box the edge could never dial: fleetChannelFor's rule
		// 1 checks hub.State(fleet+"/"+boxLabel), but the hub only ever
		// knows this box's channel by its RAW CARLOS_TUNNEL_NAME — "pi-box",
		// not "pi/pi-box". A fleet box's channel MUST be "<fleet>/<label>"
		// for FleetChannelAuth to key it at all, so a tunnel name missing
		// that exact prefix is refused here rather than silently accepted.
		tunnelName := strings.TrimSpace(getenv("CARLOS_TUNNEL_NAME"))
		derived, ok := strings.CutPrefix(tunnelName, fleet+"/")
		if !ok {
			return FleetIdentity{}, fmt.Errorf(
				"fleet box label could not be derived from CARLOS_TUNNEL_NAME=%q (want the %q prefix) — set CARLOS_FLEET_BOX explicitly",
				tunnelName, fleet+"/")
		}
		label = derived
	}
	if label == "" || !registry.ValidTunnelName(label) {
		return FleetIdentity{}, fmt.Errorf(
			"fleet box label %q is invalid — set CARLOS_FLEET_BOX, or CARLOS_TUNNEL_NAME=%s/<label>",
			label, fleet)
	}
	return FleetIdentity{Fleet: fleet, Label: label}, nil
}