// fleets.go: customer fleets (2026-08-05-customer-fleets-design.md) — an
// account-owned group of remote boxes that dial this host over a channel
// identified by "<fleet>/<label>". Two tables: fleets (the account-owned
// record: which bucket it belongs to) and fleet_boxes (the boxes registered
// to it, each carrying a hashed bearer token). This package never sees a
// plaintext token — minting happens console-side, in a later task; here it
// is always TokenHash, the sha256 hex.
package registry

import (
	"database/sql"
	"errors"
	"fmt"
	"regexp"
	"strings"
	"time"
)

// ErrFleetBoxActive is AddFleetBox's signal that the RowsAffected guard
// fired — the (fleet, label) pair already names an ACTIVE box — as opposed
// to any other failure (a bad shape, a missing fleet, a tx/busy/disk error)
// that reaches AddFleetBox's caller. errors.Is against this is how a caller
// tells "this is the ordinary duplicate-box conflict" apart from
// "something is actually broken", which the plain fmt.Errorf this used to
// return could not do without brittle string matching.
var ErrFleetBoxActive = errors.New("registry: fleet already has an active box under that label")

// Fleet is one account-owned collection of remote boxes.
type Fleet struct {
	Name      string // ValidTunnelName
	Account   string // owning account identity, same domain as Route.Account
	Bucket    string // customer data bucket name
	CreatedAt int64
}

// FleetBox is one box registered to a Fleet. (Fleet, Label) is the channel
// identity a remote-host-agent dials in as ("<fleet>/<label>" — see
// FleetChannelAuth); TokenHash is the sha256 hex of its bearer token, never
// the plaintext.
type FleetBox struct {
	Fleet     string
	Label     string // ValidTunnelName; (Fleet, Label) is the channel identity
	TokenHash string // sha256 hex of the bearer token; never plaintext
	Status    string // "active" | "detached"
	AddedAt   int64
	Tags      string // comma-separated, ValidBoxTags grammar; "" = untagged
}

// tokenHashRe: exactly 64 lowercase hex characters — a sha256 digest,
// structurally enforcing the "token hashes only, never plaintext" rule at
// every writer that accepts one (AddFleetBox, SetFleetBoxToken). A bearer
// token or an empty string both fail this shape.
var tokenHashRe = regexp.MustCompile(`^[0-9a-f]{64}$`)

func validTokenHash(hash string) bool {
	return tokenHashRe.MatchString(hash)
}

// boxTagRe: a single tag segment — lowercase alphanumerics and interior
// hyphens, 1-24 characters, never leading or trailing with a hyphen (a
// leading '-' is how a value gets mistaken for a flag by anything that ever
// builds an argv from a tag, the same reasoning unitNameRe's first-character
// carve-out documents). Same shape family as ValidTunnelName, but its own
// regexp since tags are a comma-separated LIST rather than a single name.
var boxTagRe = regexp.MustCompile(`^[a-z0-9]([a-z0-9-]{0,22}[a-z0-9])?$`)

// ValidBoxTags reports whether tags is a well-formed comma-separated tag
// list: each tag matches boxTagRe, at most 8 tags, no empty segments. ""
// is valid and means untagged.
func ValidBoxTags(tags string) bool {
	if tags == "" {
		return true
	}
	parts := strings.Split(tags, ",")
	if len(parts) > 8 {
		return false
	}
	for _, p := range parts {
		if !boxTagRe.MatchString(p) {
			return false
		}
	}
	return true
}

// validFleetBoxStatus reports whether status is one of the two values the
// FleetBox.Status doc comment promises. Rejecting anything else at the
// writer matters because AddFleetBox's uniqueness guard keys off status =
// 'active': a typo'd status would make a live box invisible to it.
func validFleetBoxStatus(status string) bool {
	return status == "active" || status == "detached"
}

// migrateFleets creates the fleets and fleet_boxes tables — additive
// (CREATE TABLE IF NOT EXISTS), called from migrate() beside the routes DDL,
// so deploying this code over an existing registry is always safe.
//
// Both tables carry `rev`, bumped by every writer — see Fingerprint's doc
// comment (registry.go) for why a plain length/count/rowid aggregate is
// blind to a fixed-length rewrite (a sha256 token_hash never changes
// length) and rev is what fixes that.
func (r *Registry) migrateFleets() error {
	if _, err := r.sql.Exec(`
CREATE TABLE IF NOT EXISTS fleets (
  name       TEXT PRIMARY KEY,
  account    TEXT NOT NULL,
  bucket     TEXT NOT NULL,
  created_at INTEGER NOT NULL,
  rev        INTEGER NOT NULL DEFAULT 0
);`); err != nil {
		return err
	}
	if _, err := r.sql.Exec(`
CREATE TABLE IF NOT EXISTS fleet_boxes (
  fleet      TEXT NOT NULL,
  label      TEXT NOT NULL,
  token_hash TEXT NOT NULL,
  status     TEXT NOT NULL,
  added_at   INTEGER NOT NULL,
  rev        INTEGER NOT NULL DEFAULT 0,
  PRIMARY KEY (fleet, label)
);`); err != nil {
		return err
	}
	// tags: additive (2026-08-10-fleets-console-design.md D3). Pre-change rows
	// read as '' — untagged.
	if _, err := r.sql.Exec(`ALTER TABLE fleet_boxes ADD COLUMN tags TEXT NOT NULL DEFAULT ''`); err != nil && !strings.Contains(err.Error(), "duplicate column") {
		return err
	}
	return nil
}

// freshFleetsConn opens a NEW connection over the same file — the List /
// Fingerprint pattern (registry.go:455): modernc/sqlite's long-lived pool can
// serve a stale WAL snapshot for another process's commit. Every read below
// that a later task polls cross-process (FleetChannelAuth, read by the edge
// after Fingerprint moves) or that a short-lived CLI process may run moments
// after a different process wrote (ListFleets, ListFleetBoxes) goes through
// this, not r.sql.
func (r *Registry) freshFleetsConn() (*sql.DB, error) {
	db, err := sql.Open("sqlite", r.path)
	if err != nil {
		return nil, err
	}
	if _, err := db.Exec("PRAGMA busy_timeout=5000"); err != nil {
		db.Close()
		return nil, err
	}
	return db, nil
}

// UpsertFleet inserts or updates a fleet's account/bucket linkage by name.
func (r *Registry) UpsertFleet(f Fleet) error {
	if r.remote != nil {
		_, err := r.remote.call(nil, remoteRequest{Method: "UpsertFleet", F: f}, nil)
		return err
	}

	if !ValidTunnelName(f.Name) {
		return fmt.Errorf("invalid fleet name %q", f.Name)
	}
	if f.CreatedAt == 0 {
		f.CreatedAt = time.Now().Unix()
	}
	_, err := r.sql.Exec(`
INSERT INTO fleets (name, account, bucket, created_at, rev)
VALUES (?, ?, ?, ?, 1)
ON CONFLICT(name) DO UPDATE SET
  account = excluded.account, bucket = excluded.bucket, rev = fleets.rev + 1`,
		f.Name, f.Account, f.Bucket, f.CreatedAt)
	return err
}

// CreateFleet inserts a brand-new fleet, INSERT-owning the "does this name
// already exist" decision the same way AddFleetBox's uniqueness guard owns
// box uniqueness (below): the INSERT's own `ON CONFLICT(name) DO NOTHING`
// and RowsAffected are the atomic check, not a caller's read-then-write —
// so two callers racing the SAME never-before-seen name can never both
// believe they created it, and the loser can never silently steal
// ownership of the winner's row the way a call through UpsertFleet's
// ON CONFLICT DO UPDATE would. created reports which caller won; a losing
// call makes no change to the existing row at all — not even a rev bump.
func (r *Registry) CreateFleet(f Fleet) (created bool, err error) {
	if r.remote != nil {
		out, err := r.remote.call(nil, remoteRequest{Method: "CreateFleet", F: f}, nil)
		return out.Changed, err
	}

	if !ValidTunnelName(f.Name) {
		return false, fmt.Errorf("invalid fleet name %q", f.Name)
	}
	if f.CreatedAt == 0 {
		f.CreatedAt = time.Now().Unix()
	}
	res, err := r.sql.Exec(`
INSERT INTO fleets (name, account, bucket, created_at, rev)
VALUES (?, ?, ?, ?, 1)
ON CONFLICT(name) DO NOTHING`,
		f.Name, f.Account, f.Bucket, f.CreatedAt)
	if err != nil {
		return false, err
	}
	n, err := res.RowsAffected()
	if err != nil {
		return false, err
	}
	return n == 1, nil
}

// GetFleet returns the fleet named name, or (nil, nil) if there is none.
func (r *Registry) GetFleet(name string) (*Fleet, error) {
	if r.remote != nil {
		out, err := r.remote.call(nil, remoteRequest{Method: "GetFleet", Name: name}, nil)
		return out.Fleet, err
	}

	row := r.sql.QueryRow(`SELECT name, account, bucket, created_at FROM fleets WHERE name = ?`, name)
	var f Fleet
	err := row.Scan(&f.Name, &f.Account, &f.Bucket, &f.CreatedAt)
	if err == sql.ErrNoRows {
		return nil, nil
	}
	if err != nil {
		return nil, err
	}
	return &f, nil
}

// ListFleets returns every fleet, ordered by name, over a fresh connection.
func (r *Registry) ListFleets() ([]Fleet, error) {
	if r.remote != nil {
		out, err := r.remote.call(nil, remoteRequest{Method: "ListFleets"}, nil)
		return out.Fleets, err
	}

	db, err := r.freshFleetsConn()
	if err != nil {
		return nil, err
	}
	defer db.Close()
	rows, err := db.Query(`SELECT name, account, bucket, created_at FROM fleets ORDER BY name`)
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	var out []Fleet
	for rows.Next() {
		var f Fleet
		if err := rows.Scan(&f.Name, &f.Account, &f.Bucket, &f.CreatedAt); err != nil {
			return nil, err
		}
		out = append(out, f)
	}
	return out, rows.Err()
}

// AddFleetBox registers a box to a fleet. It errors if the fleet does not
// exist, if TokenHash or Status fail their shape checks, and if
// (fleet, label) already names an ACTIVE box.
//
// The fleet-existence check is a plain SELECT rather than a SQLite FOREIGN
// KEY, because FK enforcement is a per-connection PRAGMA
// (`foreign_keys=ON`) that Open() never sets and that a fresh short-lived
// connection (freshFleetsConn, another process entirely) could disagree
// with — an FK that only some connections enforce is worse than none, since
// it would look enforced in tests that happen to run through the same
// handle. Both statements run inside one transaction so the check and the
// insert see the same snapshot.
//
// The active-box check is NOT a read-then-write in Go: it is the INSERT's
// own ON CONFLICT ... WHERE clause, so a second process racing this call on
// the same (fleet, label) can never observe a stale "not active yet" read
// and steal a live channel's token out from under it — SQLite evaluates the
// WHERE clause and applies (or skips) the DO UPDATE atomically. A label that
// exists but is DETACHED clears the WHERE guard and is reactivated in place
// with the incoming token/status/added_at (rev bumped) — the path a
// re-provisioned box takes back onto its old name. RowsAffected()==0 means
// the guard fired (an active row was left untouched), which is the signal
// this returns wrapping ErrFleetBoxActive — errors.Is against it, not
// string matching, is how a caller tells this ordinary conflict apart from
// an actual failure below.
func (r *Registry) AddFleetBox(b FleetBox) error {
	if r.remote != nil {
		_, err := r.remote.call(nil, remoteRequest{Method: "AddFleetBox", B: b}, nil)
		return err
	}

	if !ValidTunnelName(b.Fleet) {
		return fmt.Errorf("invalid fleet name %q", b.Fleet)
	}
	if !ValidTunnelName(b.Label) {
		return fmt.Errorf("invalid box label %q", b.Label)
	}
	if b.Status == "" {
		b.Status = "active"
	}
	if !validFleetBoxStatus(b.Status) {
		return fmt.Errorf("invalid box status %q", b.Status)
	}
	if !validTokenHash(b.TokenHash) {
		return fmt.Errorf("invalid token hash %q (want 64 lowercase hex characters)", b.TokenHash)
	}
	if b.AddedAt == 0 {
		b.AddedAt = time.Now().Unix()
	}
	tx, err := r.sql.Begin()
	if err != nil {
		return err
	}
	var exists int
	err = tx.QueryRow(`SELECT 1 FROM fleets WHERE name = ?`, b.Fleet).Scan(&exists)
	if err == sql.ErrNoRows {
		tx.Rollback()
		return fmt.Errorf("no fleet %q", b.Fleet)
	}
	if err != nil {
		tx.Rollback()
		return err
	}
	res, err := tx.Exec(`
INSERT INTO fleet_boxes (fleet, label, token_hash, status, added_at, rev)
VALUES (?, ?, ?, ?, ?, 1)
ON CONFLICT(fleet, label) DO UPDATE SET
  token_hash = excluded.token_hash, status = excluded.status, added_at = excluded.added_at,
  rev = fleet_boxes.rev + 1
WHERE fleet_boxes.status <> 'active'`,
		b.Fleet, b.Label, b.TokenHash, b.Status, b.AddedAt)
	if err != nil {
		tx.Rollback()
		return err
	}
	n, err := res.RowsAffected()
	if err != nil {
		tx.Rollback()
		return err
	}
	if n == 0 {
		tx.Rollback()
		return fmt.Errorf("fleet %q already has an active box %q: %w", b.Fleet, b.Label, ErrFleetBoxActive)
	}
	return tx.Commit()
}

// SetFleetBoxToken rotates a box's stored token hash. Errors when no
// (fleet, label) row exists — a caller minting a fresh token against a box
// that no longer exists is a race worth reporting, not swallowing. Bumps
// rev: a sha256 token_hash is always 64 characters, so the rotation alone
// changes no length Fingerprint could otherwise key off.
func (r *Registry) SetFleetBoxToken(fleet, label, tokenHash string) error {
	if r.remote != nil {
		_, err := r.remote.call(nil, remoteRequest{Method: "SetFleetBoxToken", Fleet: fleet, Label: label, TokenHash: tokenHash}, nil)
		return err
	}

	if !ValidTunnelName(fleet) {
		return fmt.Errorf("invalid fleet name %q", fleet)
	}
	if !ValidTunnelName(label) {
		return fmt.Errorf("invalid box label %q", label)
	}
	if !validTokenHash(tokenHash) {
		return fmt.Errorf("invalid token hash %q (want 64 lowercase hex characters)", tokenHash)
	}
	res, err := r.sql.Exec(`UPDATE fleet_boxes SET token_hash = ?, rev = rev + 1 WHERE fleet = ? AND label = ?`, tokenHash, fleet, label)
	if err != nil {
		return err
	}
	n, err := res.RowsAffected()
	if err != nil {
		return err
	}
	if n == 0 {
		return fmt.Errorf("no box %q/%q", fleet, label)
	}
	return nil
}

// SetFleetBoxTags mirrors SetFleetBoxToken: same rev bump, same
// RowsAffected guard for an unknown (fleet, label).
func (r *Registry) SetFleetBoxTags(fleet, label, tags string) error {
	if r.remote != nil {
		_, err := r.remote.call(nil, remoteRequest{Method: "SetFleetBoxTags", Fleet: fleet, Label: label, Tags: tags}, nil)
		return err
	}

	if !ValidTunnelName(fleet) {
		return fmt.Errorf("invalid fleet name %q", fleet)
	}
	if !ValidTunnelName(label) {
		return fmt.Errorf("invalid box label %q", label)
	}
	if !ValidBoxTags(tags) {
		return fmt.Errorf("invalid box tags %q", tags)
	}
	res, err := r.sql.Exec(`UPDATE fleet_boxes SET tags = ?, rev = rev + 1 WHERE fleet = ? AND label = ?`, tags, fleet, label)
	if err != nil {
		return err
	}
	n, err := res.RowsAffected()
	if err != nil {
		return err
	}
	if n == 0 {
		return fmt.Errorf("no box %q/%q", fleet, label)
	}
	return nil
}

// SetFleetBoxStatus flips a box between "active" and "detached". Errors when
// no (fleet, label) row exists, same contract as SetFleetBoxToken. Rejects
// any status outside those two values — AddFleetBox's uniqueness guard keys
// off status = 'active', so a typo'd status here would make a live box
// invisible to it.
func (r *Registry) SetFleetBoxStatus(fleet, label, status string) error {
	if r.remote != nil {
		_, err := r.remote.call(nil, remoteRequest{Method: "SetFleetBoxStatus", Fleet: fleet, Label: label, Status: status}, nil)
		return err
	}

	if !ValidTunnelName(fleet) {
		return fmt.Errorf("invalid fleet name %q", fleet)
	}
	if !ValidTunnelName(label) {
		return fmt.Errorf("invalid box label %q", label)
	}
	if !validFleetBoxStatus(status) {
		return fmt.Errorf("invalid box status %q", status)
	}
	res, err := r.sql.Exec(`UPDATE fleet_boxes SET status = ?, rev = rev + 1 WHERE fleet = ? AND label = ?`, status, fleet, label)
	if err != nil {
		return err
	}
	n, err := res.RowsAffected()
	if err != nil {
		return err
	}
	if n == 0 {
		return fmt.Errorf("no box %q/%q", fleet, label)
	}
	return nil
}

// ListFleetBoxes returns every box registered to fleet, ordered by label,
// over a fresh connection (same rationale as ListFleets).
func (r *Registry) ListFleetBoxes(fleet string) ([]FleetBox, error) {
	if r.remote != nil {
		out, err := r.remote.call(nil, remoteRequest{Method: "ListFleetBoxes", Fleet: fleet}, nil)
		return out.FleetBoxes, err
	}

	db, err := r.freshFleetsConn()
	if err != nil {
		return nil, err
	}
	defer db.Close()
	rows, err := db.Query(`SELECT fleet, label, token_hash, status, added_at, tags FROM fleet_boxes WHERE fleet = ? ORDER BY label`, fleet)
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	var out []FleetBox
	for rows.Next() {
		var b FleetBox
		if err := rows.Scan(&b.Fleet, &b.Label, &b.TokenHash, &b.Status, &b.AddedAt, &b.Tags); err != nil {
			return nil, err
		}
		out = append(out, b)
	}
	return out, rows.Err()
}

// fleetPlacementPrefix is the Region-column prefix that marks a route as
// bound to a customer fleet rather than a residency code — see
// FleetPlacement/PlacementTarget below.
const fleetPlacementPrefix = "fleet/"

// FleetPlacement parses a Route.Region value as a fleet placement target:
// "fleet/pi" -> ("pi", true). Anything else answers ("", false) — "" (no
// placement), a bare region code like "eu" (a FUTURE placement form this v1
// does not parse — SetPlacement refuses it too), and "fleet/<name>" where
// name fails ValidTunnelName (a syntactically-right prefix is not enough;
// the name half must be one Registry would itself accept as a fleet name).
func FleetPlacement(region string) (fleet string, ok bool) {
	name, hasPrefix := strings.CutPrefix(region, fleetPlacementPrefix)
	if !hasPrefix || !ValidTunnelName(name) {
		return "", false
	}
	return name, true
}

// PlacementTarget renders a fleet name as the Region-column value that binds
// a route to it — the inverse of FleetPlacement. It does not validate name;
// callers that need "is this fleet name legal" should ask ValidTunnelName
// (or round-trip through FleetPlacement) themselves.
func PlacementTarget(fleet string) string {
	return fleetPlacementPrefix + fleet
}

// FleetChannelAuth returns every ACTIVE box's token hash, keyed by its
// channel name "<fleet>/<label>" — the edge's auth table for an incoming
// remote-host-agent dial-in. Fresh connection: this is exactly the
// cross-process poll List/Fingerprint exist for (the edge holds a long-lived
// Registry handle and reloads this whenever Fingerprint moves).
func (r *Registry) FleetChannelAuth() (map[string]string, error) {
	if r.remote != nil {
		out, err := r.remote.call(nil, remoteRequest{Method: "FleetChannelAuth"}, nil)
		return out.StringMap, err
	}

	db, err := r.freshFleetsConn()
	if err != nil {
		return nil, err
	}
	defer db.Close()
	rows, err := db.Query(`SELECT fleet, label, token_hash FROM fleet_boxes WHERE status = 'active'`)
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	out := make(map[string]string)
	for rows.Next() {
		var fleet, label, hash string
		if err := rows.Scan(&fleet, &label, &hash); err != nil {
			return nil, err
		}
		out[fleet+"/"+label] = hash
	}
	return out, rows.Err()
}