package release

import (
	"bytes"
	"context"
	"crypto/ed25519"
	"encoding/base64"
	"encoding/json"
	"errors"
	"os"
	"reflect"
	"strings"
)

func ReleaseTag(tag string) (SemVer, bool) {
	if !strings.HasPrefix(tag, "v") {
		return SemVer{}, false
	}
	return ParseSemVer(strings.TrimPrefix(tag, "v"))
}

func VerifySystemIdentity(pub ed25519.PublicKey, wire []byte) (*SystemPointer, error) {
	var wrapper signedWrapper
	if json.Unmarshal(wire, &wrapper) != nil {
		return nil, ErrBadSystemPointer
	}
	raw, err := base64.StdEncoding.DecodeString(wrapper.Payload)
	if err != nil {
		return nil, ErrBadSystemPointer
	}
	var claimed SystemPointer
	if json.Unmarshal(raw, &claimed) != nil {
		return nil, ErrBadSystemPointer
	}
	p, err := verifySystemPointer(pub, wire, SystemComponentRouter, claimed.Channel)
	if err != nil {
		return nil, err
	}
	if _, ok := ReleaseTag(p.Current.ReleaseTag); !ok || p.Current.MovesProtocol < 1 {
		return nil, ErrBadSystemPointer
	}
	return p, nil
}

func IdentityKey(tag string) (string, error) {
	if _, ok := ReleaseTag(tag); !ok {
		return "", ErrBadSystemPointer
	}
	return "control/system/router/releases/" + tag + ".json", nil
}

// SignSystemIdentity signs one release's identity on the trusted host: the
// router component on the stable channel, no history, no audit and a zero
// spread, so the record says only what the release is. The channel is
// required by the pointer format and read by nothing that checks an
// identity. rel.ReleasedAt is kept as given (zero from the claims phase), so
// signing the same release again gives an equal Current and
// PublishSystemIdentity treats it as a no-op. The result verifies as an
// identity before it is returned.
func SignSystemIdentity(sg Signer, rel SystemRelease) ([]byte, error) {
	p := &SystemPointer{Component: SystemComponentRouter, Channel: "stable", Current: rel, Spread: "0s"}
	wire, err := signSystemPointer(sg, p)
	if err != nil {
		return nil, err
	}
	if _, err = VerifySystemIdentity(sg.verifyPub(), wire); err != nil {
		return nil, err
	}
	return wire, nil
}

// PublishSystemIdentity accepts a release-workflow signed pointer, never an
// upload request's assertion of its own tag.
func PublishSystemIdentity(ctx context.Context, s Store, pub ed25519.PublicKey, wire []byte) error {
	p, err := VerifySystemIdentity(pub, wire)
	if err != nil {
		return err
	}
	key, err := IdentityKey(p.Current.ReleaseTag)
	if err != nil {
		return err
	}
	_, err = s.Put(ctx, key, wire, "")
	if !errors.Is(err, ErrCASConflict) {
		return err
	}
	old, _, err := s.Get(ctx, key)
	if err != nil {
		return err
	}
	prev, err := VerifySystemIdentity(pub, old)
	if err != nil || !reflect.DeepEqual(prev.Current, p.Current) {
		return ErrCASConflict
	}
	return nil
}

func GetSystemIdentity(ctx context.Context, s Store, pub ed25519.PublicKey, tag string) (*SystemPointer, error) {
	key, err := IdentityKey(tag)
	if err != nil {
		return nil, err
	}
	raw, _, err := s.Get(ctx, key)
	if err != nil {
		return nil, err
	}
	p, err := VerifySystemIdentity(pub, raw)
	if err != nil {
		return nil, err
	}
	if p.Current.ReleaseTag != tag {
		return nil, ErrBadSystemPointer
	}
	return p, nil
}

func CreateExact(ctx context.Context, s Store, key string, raw []byte) error {
	_, err := s.Put(ctx, key, raw, "")
	if err == nil {
		return nil
	}
	// A timed-out PUT may have committed. Only identical bytes count as success.
	got, _, readErr := s.Get(ctx, key)
	if readErr == nil && bytes.Equal(raw, got) {
		return nil
	}
	if readErr != nil && !errors.Is(readErr, os.ErrNotExist) {
		return errors.Join(err, readErr)
	}
	return err
}