package release

import (
	"context"
	"crypto/ed25519"
	"github.com/carlosframework/platform/internal/hostwrite"
	"github.com/carlosframework/platform/internal/registry"
)

// CheckRouteReleaseIdentity authenticates the channel before accepting either
// its current target or the installed rollback target named in signed history.
func CheckRouteReleaseIdentity(ctx context.Context, s Store, pub ed25519.PublicKey, rt registry.Route, id hostwrite.Identity) error {
	if id.Config != "" || id.Release == "" {
		return hostwrite.ErrUnavailable
	}
	pointer, err := Channel(ctx, s, pub, RouteAccount(rt), rt.App, routeChannel(rt))
	if err != nil {
		return err
	}
	versions := []string{pointer.Version}
	for _, v := range pointer.History {
		if v == rt.Version && v != pointer.Version {
			versions = append(versions, v)
		}
	}
	for _, v := range versions {
		m, err := GetManifest(ctx, s, RouteAccount(rt), rt.App, v)
		if err != nil {
			return err
		}
		expected, err := releaseIdentity(m)
		if err != nil {
			return err
		}
		if id == expected {
			return nil
		}
	}
	return hostwrite.ErrUnavailable
}