package release

import (
	"context"
	"crypto/ed25519"
	"crypto/sha256"
	"errors"
	"fmt"
	"strings"
	"time"
)

// ManifestDigest is the sha256 of a manifest's canonical bytes: exactly what
// the store holds at ManifestKey, never a re-marshal (#253, spec §4.6). The
// manifest carries every artifact's sha256, so this one digest binds the
// bytes a box will stage.
func ManifestDigest(raw []byte) string { return etagOf(raw) }

// ErrManifestDigest is a manifest whose bytes do not hash to the digest a
// signed pointer (or, from plan 2, a promotion record) recorded for it: a
// version name reused with other bytes, or a swapped object.
var ErrManifestDigest = errors.New("release: manifest does not hash to the digest its signer recorded")

// CheckManifestDigest reads version's canonical manifest and, when want is
// set, refuses it unless its bytes hash to want. The manifest and bytes it
// returns are the ones it checked: a caller must stage from these and never
// re-read the manifest, or a swap between the check and the read would slip
// through. want "" is today's read, unchecked.
func CheckManifestDigest(ctx context.Context, s Store, acct, app, version, want string) (*Manifest, []byte, error) {
	m, raw, err := GetManifestRaw(ctx, s, acct, app, version)
	if err != nil {
		return nil, nil, err
	}
	if want != "" {
		if got := ManifestDigest(raw); got != want {
			return nil, nil, fmt.Errorf("%w: %s/%s hashes to %s, the pointer signed %s",
				ErrManifestDigest, app, version, digestShort(got), digestShort(want))
		}
	}
	return m, raw, nil
}

// validDigest is the one shape a digest may take: 64 lowercase hex.
func validDigest(d string) bool {
	if len(d) != 2*sha256.Size {
		return false
	}
	for _, c := range d {
		if !(c >= '0' && c <= '9' || c >= 'a' && c <= 'f') {
			return false
		}
	}
	return true
}

// digestShort is a digest as a person reads it in a log line.
func digestShort(d string) string {
	if len(d) > 12 {
		return d[:12]
	}
	return d
}

// DigestOf is the signed digest of version as this pointer names it: the
// head's when version is the head, else the History entry's. "" when the
// pointer signs none for it, or does not name it.
func (p *ChannelPointer) DigestOf(version string) string {
	if p == nil {
		return ""
	}
	if version == p.Version {
		return p.Digest
	}
	for i, v := range p.History {
		if v == version && i < len(p.HistoryDigests) {
			return p.HistoryDigests[i]
		}
	}
	return ""
}

// CarriesDigests is the test the ratchet and CARLOS_REQUIRE_POINTER_DIGEST
// apply: a pointer "with digests" signs one for its head.
func (p *ChannelPointer) CarriesDigests() bool { return p != nil && p.Digest != "" }

// ChannelHasDigests reports whether any entry carries a digest: the rollback
// rule's test (spec §4.6, "once its channel has any digest").
func (p *ChannelPointer) ChannelHasDigests() bool {
	if p == nil {
		return false
	}
	if p.CarriesDigests() {
		return true
	}
	for _, d := range p.HistoryDigests {
		if d != "" {
			return true
		}
	}
	return false
}

// alignedHistoryDigests is p.HistoryDigests at History's length: an absent
// list is all "". The copy is the writer's to change.
func alignedHistoryDigests(p *ChannelPointer) []string {
	out := make([]string, len(p.History))
	copy(out, p.HistoryDigests)
	return out
}

// inheritedDigests is the history half of the provenance rule for a write
// that moves the head to version: each entry's digest copied verbatim from
// the verified predecessor, aligned with the History the write builds, and
// never computed (spec §4.6). Its length always equals that History's.
func inheritedDigests(old *ChannelPointer, version string) []string {
	hd := alignedHistoryDigests(old)
	if old.Version != "" && old.Version != version {
		hd = prependCapped(old.Digest, hd, historyMax)
	}
	return hd
}

// ResignNeededError is a move onto a history entry that carries no digest, on
// a channel that carries some (spec §4.6): a rollback, or a promote of a build
// already in the channel's history.
type ResignNeededError struct{ App, Channel, Version string }

func (e *ResignNeededError) Error() string {
	return fmt.Sprintf(TextRollbackResign, e.App, e.Channel, e.Version, e.App, e.Channel)
}

// ChannelDigestState is one channel's line in the straggler report (spec
// §4.6 "Watch for stragglers"). Err set means the channel's pointer could not
// be read or verified: its digest state is unknown, and every other field is
// zero. A report with such a line is incomplete, so it never says the fleet
// is ready for CARLOS_REQUIRE_POINTER_DIGEST (Astra r1 #4).
type ChannelDigestState struct {
	Channel        string    `json:"channel"`
	Version        string    `json:"version"`
	PromotedAt     time.Time `json:"promoted_at"`
	HeadDigest     bool      `json:"head_digest"`
	HistoryMissing int       `json:"history_missing"`
	Straggler      bool      `json:"straggler"`
	Err            string    `json:"error,omitempty"`
}

// DigestStateOf is a verified pointer's line. A straggler is a pointer
// without digests signed after the marker went on: an old writer is still in
// use.
func DigestStateOf(p *ChannelPointer, marker *DigestMarker) ChannelDigestState {
	st := ChannelDigestState{Channel: p.Channel, Version: p.Version, PromotedAt: p.PromotedAt, HeadDigest: p.CarriesDigests()}
	hd := alignedHistoryDigests(p)
	for _, d := range hd {
		if d == "" {
			st.HistoryMissing++
		}
	}
	st.Straggler = marker != nil && !st.HeadDigest && p.PromotedAt.After(marker.At)
	return st
}

// DigestReport is every channel of one app, plus the account's marker. A
// pointer that cannot be read or does not verify is never skipped: it comes
// back as a line with Err set, its state unknown.
func DigestReport(ctx context.Context, s Store, pub ed25519.PublicKey, acct, app string) ([]ChannelDigestState, *DigestMarker, error) {
	marker, err := ReadDigestMarker(ctx, s, pub, acct)
	if err != nil {
		return nil, nil, err
	}
	prefix := ChannelsPrefix(acct, app)
	keys, err := s.List(ctx, prefix)
	if err != nil {
		return nil, nil, err
	}
	var out []ChannelDigestState
	for _, k := range keys {
		name, ok := strings.CutSuffix(strings.TrimPrefix(k, prefix), ".json")
		if !ok || name == "" {
			continue
		}
		p, err := Channel(ctx, s, pub, acct, app, name)
		if err != nil {
			out = append(out, ChannelDigestState{Channel: name, Err: fmt.Sprintf("%s: %v", ChannelKey(acct, app, name), err)})
			continue
		}
		out = append(out, DigestStateOf(p, marker))
	}
	return out, marker, nil
}