package hostfence

import (
	"context"
	"time"

	"github.com/carlosframework/platform/internal/hostactors"
	"github.com/carlosframework/platform/internal/hostclaim"
	"github.com/carlosframework/platform/internal/termfence"
)

// ClaimFenceAuthority authenticates current active, unfenced writer standing
// against the signed roster without a reverse hostclaim dependency.
type ClaimFenceAuthority struct {
	Directory hostactors.Directory
	Now       func() time.Time
}

var _ hostclaim.FenceAuthority = ClaimFenceAuthority{}

func (a ClaimFenceAuthority) ValidateFence(ctx context.Context, f termfence.Record) (hostclaim.FenceBinding, error) {
	if a.Now == nil || f.WrittenBy.Box == f.Box {
		return hostclaim.FenceBinding{}, hostclaim.ErrFence
	}
	o, err := a.Directory.Read(ctx)
	if err != nil {
		return hostclaim.FenceBinding{}, err
	}
	if err := a.Directory.ValidateTerminationFenceAuthority(ctx, o, f.Box, f, a.Now()); err != nil {
		return hostclaim.FenceBinding{}, err
	}
	return hostclaim.FenceBinding{FleetHomeRegion: o.Roster.HomeRegion, Region: o.Roster.Boxes[f.Box].Region, RosterRevision: o.Roster.Revision, RosterETag: o.ETag}, nil
}

func ClaimFenceRef(ref EvidenceRef) hostclaim.FenceRef {
	return hostclaim.FenceRef{Enrollment: ref.Enrollment, Key: ref.Key, SHA256: ref.SHA256}
}