package release

import (
	"crypto/ed25519"
	"errors"
	"time"
)

// HostRetryGrant is the console's signed `carlos instances retry <host>`
// (zero-downtime spec §8.4, §11; Paul's ruling on plan 6 Q4, amadan #272):
// a box clears a host's failure hold only on a grant the deployment root
// signed, naming that account, app, host and the build that restricts it.
//
// The host-retry log it rides (HostRetryKey; the restart-scope log before
// readiness round 2, whose legacy entries boxes still honour) is writable
// by every box (Astra impl-6 finding 5), so an unsigned entry is a request
// anyone with a box could have written, and it clears nothing. The signature closes forgery; Epoch
// and Book close replay (plan review finding 13; the crash-epoch hard limit,
// readiness round 2 Task 1): Epoch is the app's restriction generation as
// the box published it (rollout.FailureBook.PublishedEpoch), which the box
// publishes only once it is on disk and never hands out twice, so a grant
// clears the restriction state the member saw and nothing that changed
// after, even across an agent restart.
type HostRetryGrant struct {
	V       int    `json:"v"`
	Account string `json:"account"`
	App     string `json:"app"`
	Host    string `json:"host"`
	// Build is the build whose restriction the grant lifts: the failure
	// record of that build for Host, and Host's hold-ran marker when it
	// names that build (plan review finding 5). It is not the build the
	// host should move to.
	Build string `json:"build"`
	// Epoch is the app's restriction generation as published, which the
	// console read from the box's report (status.HostRollout.HeldEpoch):
	// every change to any restriction of the app moves it, so the grant
	// clears only while nothing of the app's restrictions changed since.
	// Zero is an older box that reported none, or a box whose book owes a
	// save: the console still signs it, and no box accepts it.
	Epoch uint64 `json:"epoch"`
	// Book is the identity of the failure book Epoch counts in, as the box
	// reported it (status.HostRollout.HeldBook): epochs are a counter every
	// book starts alike, so a grant binds the restriction only with both
	// (final review round 1, finding 3). Empty is a console or a box older
	// than the identity: the console still signs it, and no box accepts it.
	Book     string `json:"book"`
	IssuedAt string `json:"issued_at"` // RFC 3339, UTC, whole seconds
}

// HostRetryGrantTTL is how long a box accepts a grant after it was issued.
// It is a backstop only: the epoch is what binds a grant to one failure.
const HostRetryGrantTTL = 24 * time.Hour

// hostRetrySkew is how far ahead of a box's clock a grant's IssuedAt may be.
const hostRetrySkew = time.Minute

// ErrHostRetryGrant is a grant that verified but is not for this request.
var ErrHostRetryGrant = errors.New("host retry grant: not valid for this request")

// SignHostRetry signs a grant with the deployment root. A scoped release
// key is refused (SignRootEnvelope): a channel delegate has no say over
// another instance's failure hold.
func SignHostRetry(sg Signer, acct, app, host, build, book string, epoch uint64, now time.Time) (string, error) {
	g := HostRetryGrant{V: 1, Account: acct, App: app, Host: host, Build: build, Epoch: epoch, Book: book,
		IssuedAt: now.UTC().Truncate(time.Second).Format(time.RFC3339)}
	wire, err := SignRootEnvelope(sg, g)
	return string(wire), err
}

// VerifyHostRetry checks wire against the root key and the entry it rode in:
// the same account, app and host, a build and a non-zero epoch, issued no
// later than now plus a minute of skew and no earlier than now minus
// HostRetryGrantTTL. Whether the epoch is still the restriction's, and the
// book the box's, is the failure book's check, made where the clear is.
func VerifyHostRetry(pub ed25519.PublicKey, wire, acct, app, host string, now time.Time) (HostRetryGrant, error) {
	var g HostRetryGrant
	if err := VerifyRootEnvelope(pub, []byte(wire), &g); err != nil {
		return HostRetryGrant{}, err
	}
	at, err := time.Parse(time.RFC3339, g.IssuedAt)
	if err != nil || g.V != 1 || g.Account != acct || g.App != app || g.Host != host || g.Build == "" || g.Epoch == 0 ||
		at.After(now.Add(hostRetrySkew)) || at.Before(now.Add(-HostRetryGrantTTL)) {
		return HostRetryGrant{}, ErrHostRetryGrant
	}
	return g, nil
}