// 🤖 integrity.js — client-side tamper-evidence: verify the instance's signed
// checkpoint chain and gossip chain heads between members inside E2EE traffic
// (docs/tamper-evidence.md, #573 slice 2).
//
// The shell polls GET /api/checkpoints, verifies each new checkpoint (Ed25519
// signature where WebCrypto supports it, chain-hash recomputation and linkage
// always), and remembers the verified head. Outgoing messages carry that head
// as a tiny `_ckpt` field inside the encrypted payload — the host can't read
// it, so it can't selectively strip it — and incoming gossip (live AND from
// history/catch-up, since the host chooses which path a message arrives by)
// is compared against our own view. An honest server serves ONE checkpoints
// table to every member, so checkpoint boundaries are global: a peer boundary
// inside our verified window that we don't have is itself a fork, the same as
// a mismatched chain at a shared boundary. A peer's head the server won't
// show us within a grace period is withholding. Detection only in this slice —
// alerts are recorded and surfaced via /integrity, never a scary banner (that
// UX needs its own design pass).
//
// Every verification failure must END as a recorded alert, never a thrown
// exception — a monitor that dies quietly on malformed input is an alarm-
// suppression vector (serve one garbled row, freeze every member's monitor).
//
// Pure functions up top (unit-tested in Node, test/integrity.test.mjs); the
// stateful monitor below takes storage/fetch as plain objects so tests can
// inject fakes. Wire-format constants mirror checkpoint.go — the Go test
// vectors pin them on both sides.

const CHAIN_DOMAIN = "lchat-ckpt-chain\n";
const LEAF_DOMAIN = "lchat-ckpt-leaf\n";
const NODE_DOMAIN = "lchat-ckpt-node\n";

// How long a gossiped head may stay ahead of everything the server shows us
// before we call it withholding. Generous: the sweep runs every 5 minutes.
export const AHEAD_GRACE_MS = 15 * 60 * 1000;

const HIST_KEEP = 64; // (seqTo -> chain) boundary pairs kept for old gossip
const ROOTS_KEEP = 64; // verified checkpoint roots kept (inclusion-proof trust)
const ALERTS_KEEP = 20;
const PAGE_SIZE = 100; // server page size (checkpointsAfter limit)

async function sha256hex(str) {
  const d = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(str));
  return [...new Uint8Array(d)].map((b) => b.toString(16).padStart(2, "0")).join("");
}

// chainHashHex mirrors checkpoint.go's chainHash — a checkpoint's commitment
// to its predecessor. prev is "" for the genesis checkpoint.
export function chainHashHex(prev, root, seqTo) {
  return sha256hex(CHAIN_DOMAIN + prev + "\n" + root + "\n" + String(seqTo));
}

// ---- inclusion proofs (docs/tamper-evidence.md client sampling) -----------
// Mirror of checkpoint.go's journalLeafHash / merkleNode / rootFromAuditPath,
// so a client can prove a message it holds is committed to a checkpoint root
// it already trusts. The Go test pins these byte-for-byte against the same
// leaves — if either drifts, the platforms disagree about a valid proof.

async function sha256bytes(bytes) {
  return new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
}
function hexToBytes(hex) {
  const out = new Uint8Array(hex.length / 2);
  for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
  return out;
}
function bytesToHex(bytes) {
  return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
}

// leafHashHex mirrors journalLeafHash — the domain-separated hash of a journal
// row, the tree's leaf. Field order is wire format (checkpoint.go).
export async function leafHashHex(row) {
  const enc = LEAF_DOMAIN + row.seq + "\n" + row.ts + "\n" + row.kind + "\n" +
    row.msg_id + "\n" + row.blob_hash + "\n" + row.thread_id;
  return bytesToHex(await sha256bytes(new TextEncoder().encode(enc)));
}

async function nodeHashBytes(l, r) {
  const buf = new Uint8Array(NODE_DOMAIN.length + 64);
  buf.set(new TextEncoder().encode(NODE_DOMAIN), 0);
  buf.set(l, NODE_DOMAIN.length);
  buf.set(r, NODE_DOMAIN.length + 32);
  return sha256bytes(buf);
}

// rootFromAuditPath recomputes the Merkle root from a leaf (hex), its index m
// in a tree of n leaves, and its audit path (hex sibling hashes, bottom-up) —
// the exact mirror of checkpoint.go's rootFromAuditPath. Returns the root hex,
// or null on a malformed proof (wrong path length, out-of-range index).
export async function rootFromAuditPath(leafHex, m, n, pathHex) {
  if (m < 0 || m >= n) return null;
  const path = pathHex.map(hexToBytes);
  async function recompute(leaf, m, n, path) {
    if (n === 1) return path.length === 0 ? leaf : null;
    if (path.length === 0) return null;
    let k = 1;
    while (k * 2 < n) k *= 2;
    const sibling = path[path.length - 1];
    const rest = path.slice(0, -1);
    if (m < k) {
      const left = await recompute(leaf, m, k, rest);
      return left && (await nodeHashBytes(left, sibling));
    }
    const right = await recompute(leaf, m - k, n - k, rest);
    return right && (await nodeHashBytes(sibling, right));
  }
  const root = await recompute(hexToBytes(leafHex), m, n, path);
  return root && bytesToHex(root);
}

// verifyInclusion checks one proof: recompute the leaf from its row fields,
// walk the audit path, and confirm it reaches the proof's stated root. Returns
// { ok, root } — ok true only if the recomputed root matches proof.root. The
// caller separately checks proof.root is a root it TRUSTS (verified via the
// signed chain); this function only proves the leaf is in that root's tree.
export async function verifyInclusion(proof) {
  const leaf = await leafHashHex({
    seq: proof.seq, ts: proof.ts, kind: proof.kind, msg_id: proof.msg_id,
    blob_hash: proof.blob_hash, thread_id: proof.thread_id,
  });
  const root = await rootFromAuditPath(leaf, proof.leaf_index, proof.tree_size, proof.audit_path || []);
  return { ok: root != null && root === proof.root, root };
}

function stdB64ToBytes(b64) {
  const bin = atob(b64);
  const out = new Uint8Array(bin.length);
  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
  return out;
}

// ed25519Verify checks one signature, returning false (never throwing) on any
// malformed input. Returns null when this environment's WebCrypto lacks
// Ed25519 — hash and linkage checks still run, signatures are recorded as
// unverified (see /integrity's report). Keys are cached per pub so a page of
// checkpoints doesn't re-import per row.
const keyCache = new Map();
export async function ed25519Available() {
  try {
    await crypto.subtle.importKey("raw", new Uint8Array(32), { name: "Ed25519" }, false, ["verify"]);
    return true;
  } catch {
    return false;
  }
}
async function ed25519Verify(pubB64, payloadStr, sigB64) {
  try {
    let key = keyCache.get(pubB64);
    if (!key) {
      key = await crypto.subtle.importKey("raw", stdB64ToBytes(pubB64), { name: "Ed25519" }, false, ["verify"]);
      keyCache.set(pubB64, key);
    }
    return await crypto.subtle.verify("Ed25519", key, stdB64ToBytes(sigB64), new TextEncoder().encode(payloadStr));
  } catch {
    return false;
  }
}

// verifyCheckpointPage walks one page of served checkpoints, extending prior
// (the last verified head, or null on first sync). Each checkpoint's payload
// names its own signing key: the chain of hashes is what holds history
// together, the signature is attribution — so a mid-chain key change is
// alerted (it's investigable: a restore, a rotation, or an attack) but the
// walk CONTINUES; only broken hashes/links/signatures stop it. Returns the
// new head, the verified (seqTo -> chain) boundary pairs, alerts, and whether
// the walk completed the page.
export async function verifyCheckpointPage({ checkpoints, prior, checkSigs }) {
  const alerts = [];
  const hist = [];
  const roots = []; // verified checkpoint roots (for inclusion-proof trust)
  let head = prior || null;
  let pub = prior ? prior.pub : null;
  for (const cp of checkpoints) {
    let payload;
    try {
      const wrapper = JSON.parse(cp.signed);
      payload = JSON.parse(new TextDecoder().decode(stdB64ToBytes(wrapper.payload)));
      if (typeof payload.pub !== "string" || !payload.pub) throw new Error("no pub");
      if (checkSigs && !(await ed25519Verify(payload.pub, wrapper.payload, wrapper.sig))) {
        alerts.push({ kind: "bad-signature", id: cp.id });
        break;
      }
    } catch {
      alerts.push({ kind: "malformed", id: cp.id });
      break;
    }
    if ((await chainHashHex(payload.prev_chain, payload.root, payload.seq_to)) !== payload.chain) {
      alerts.push({ kind: "bad-chain-hash", id: cp.id });
      break;
    }
    if (payload.prev_chain !== (head ? head.chain : "")) {
      alerts.push({ kind: "broken-link", id: cp.id, seqTo: payload.seq_to });
      break;
    }
    if (head && payload.seq_from !== head.seqTo + 1) {
      alerts.push({ kind: "gap", id: cp.id, seqFrom: payload.seq_from, after: head.seqTo });
      break;
    }
    if (cp.seq_to !== payload.seq_to || cp.chain !== payload.chain) {
      alerts.push({ kind: "row-drift", id: cp.id });
      break;
    }
    if (pub && payload.pub !== pub) {
      // Legitimate-but-investigable (restore from a pre-key backup, deliberate
      // rotation) — alert once, keep verifying under the new key.
      alerts.push({ kind: "key-change", id: cp.id, seqTo: payload.seq_to, keep: true });
    }
    pub = payload.pub;
    head = { id: cp.id, seqTo: payload.seq_to, chain: payload.chain, pub };
    hist.push([payload.seq_to, payload.chain]);
    roots.push(payload.root); // root is chain-hash-bound above, so trusting it is sound
  }
  const fatal = alerts.some((a) => !a.keep);
  return { head, hist, roots, alerts, fatal };
}

// gossipVerdict compares a peer's gossiped head [seqTo, chain] against our
// verified head + bounded boundary history. Checkpoint boundaries are global
// (one checkpoints table per instance), so within our kept window a peer
// boundary we don't have at all is a fork, exactly like a chain mismatch at a
// shared boundary. Below the window there's genuinely no verdict.
export function gossipVerdict(head, hist, gossip) {
  if (!Array.isArray(gossip) || gossip.length !== 2) return "none";
  const [s, c] = gossip;
  if (typeof s !== "number" || typeof c !== "string") return "none";
  if (!head) return "no-head";
  if (s > head.seqTo) return "ahead";
  if (s === head.seqTo) return c === head.chain ? "match" : "fork";
  const floor = hist.length ? hist[0][0] : head.seqTo;
  if (s < floor) return "unknown-old";
  const ours = hist.find((h) => h[0] === s);
  if (!ours) return "fork"; // inside our window but not one of our boundaries
  return ours[1] === c ? "match" : "fork";
}

// createIntegrity wires the pure core to storage + network. `store` is any
// object with getItem/setItem (localStorage in the shell, a Map-backed fake
// in tests); `fetchPage(afterID)` returns the parsed /api/checkpoints
// response; `now()` defaults to Date.now. The shell calls poll() on connect +
// a slow interval, gossipOut() when sending, gossipIn() when receiving
// (live and history alike).
//
// Concurrency: several tabs/webviews share the storage key, and gossipIn can
// interleave with a long-running poll in the same tab. Alerts — the part that
// must never be lost — are appended with a fresh read-modify-write at record
// time; poll's final save re-reads and merges so it can't clobber alerts or a
// newer pending recorded mid-flight. head/hist are last-writer-wins on
// purpose: every writer verified them against the same server, so they
// converge.
export function createIntegrity({ store, fetchPage, now = () => Date.now(), key = "lchat_ckpt", onAlert }) {
  const blank = () => ({ v: 1, head: null, hist: [], alerts: [], stats: {} });
  const load = () => {
    try {
      return { ...blank(), ...(JSON.parse(store.getItem(key) || "null") || {}) };
    } catch {
      return blank();
    }
  };
  const save = (st) => store.setItem(key, JSON.stringify(st));
  const sameAlert = (a, b) => a.kind === b.kind && a.seqTo === b.seqTo && a.id === b.id;
  // addAlert persists immediately against fresh state (one alert per
  // kind+location — a persistent condition must not spam), then mirrors into
  // the caller's working copy.
  const addAlert = (st, a) => {
    const fresh = load();
    let added = false;
    if (!fresh.alerts.some((x) => sameAlert(x, a))) {
      fresh.alerts = fresh.alerts.slice(-(ALERTS_KEEP - 1)).concat([{ ...a, at: now() }]);
      save(fresh);
      console.warn("integrity:", a.kind, a);
      added = true;
    }
    st.alerts = fresh.alerts;
    // Fire the host hook (renders the failure banner) only for a genuinely new
    // alert, so a persistent condition re-detected every poll doesn't re-nag.
    if (added && onAlert) { try { onAlert(a); } catch {} }
  };

  return {
    // poll fetches everything past our head and verifies it. The first page
    // re-fetches the head row itself (after = head.id - 1) so a served chain
    // that no longer contains our verified head — a rollback — is caught, not
    // mistaken for silence. Network failures are silent (next poll retries);
    // verification failures alert and stop; malformed rows alert, never throw.
    async poll() {
      const st = load();
      let pages = 0;
      let first = true;
      let caughtUp = false;
      try {
        if (st.sigOk === undefined) st.sigOk = await ed25519Available();
        while (pages++ < 50) {
          let r;
          try {
            r = await fetchPage(st.head ? st.head.id - (first ? 1 : 0) : 0);
          } catch {
            return; // offline — nothing to conclude
          }
          if (!r || !Array.isArray(r.checkpoints)) return;
          const rawLen = r.checkpoints.length;
          let cps = r.checkpoints;
          if (st.head && first) {
            const mine = cps.find((c) => c.id === st.head.id);
            if (!mine || mine.seq_to !== st.head.seqTo || mine.chain !== st.head.chain) {
              addAlert(st, { kind: "rollback", id: st.head.id, seqTo: st.head.seqTo });
              return;
            }
            cps = cps.filter((c) => c.id > st.head.id);
          }
          first = false;
          if (cps.length) {
            const out = await verifyCheckpointPage({ checkpoints: cps, prior: st.head, checkSigs: st.sigOk });
            for (const a of out.alerts) addAlert(st, a);
            if (out.head) st.head = out.head;
            st.hist = st.hist.concat(out.hist).slice(-HIST_KEEP);
            st.roots = (st.roots || []).concat(out.roots || []).slice(-ROOTS_KEEP);
            if (out.fatal) return;
          }
          if (rawLen < PAGE_SIZE) {
            caughtUp = true;
            break;
          }
        }
        // A pending "ahead" gossip resolves once our verified head reaches its
        // seq: matching boundary → clean; mismatched or MISSING boundary →
        // fork (boundaries are global). Unresolved past the grace window with
        // catch-up complete → the server is withholding from us what a peer
        // already verified. Never judged mid-catch-up (the page cap) — a
        // device far behind isn't being withheld from, it's just behind.
        if (st.pending && st.head && st.head.seqTo >= st.pending.s) {
          if (gossipVerdict(st.head, st.hist, [st.pending.s, st.pending.c]) === "fork") {
            addAlert(st, { kind: "gossip-fork", seqTo: st.pending.s });
          }
          st.pendingDone = st.pending;
          st.pending = null;
        } else if (st.pending && caughtUp && now() - st.pending.at > AHEAD_GRACE_MS) {
          addAlert(st, { kind: "withheld", seqTo: st.pending.s });
          st.pendingDone = st.pending;
          st.pending = null;
        }
        st.stats.lastPollAt = now();
      } finally {
        // Merge over fresh state: alerts and gossip stats recorded mid-flight
        // (this tab's gossipIn, another tab's poll) must survive this save.
        const fresh = load();
        for (const a of fresh.alerts) if (!st.alerts.some((x) => sameAlert(x, a))) st.alerts.push(a);
        st.alerts = st.alerts.slice(-ALERTS_KEEP);
        if (!st.head || (fresh.head && fresh.head.seqTo > st.head.seqTo)) {
          st.head = fresh.head;
          st.hist = fresh.hist;
        }
        if (fresh.stats.gossipSeen > (st.stats.gossipSeen || 0)) st.stats.gossipSeen = fresh.stats.gossipSeen;
        if (fresh.stats.gossipMatch > (st.stats.gossipMatch || 0)) st.stats.gossipMatch = fresh.stats.gossipMatch;
        // Keep a pending another writer set mid-flight — unless this poll just
        // resolved that very one.
        if (!st.pending && fresh.pending && !(st.pendingDone && fresh.pending.at === st.pendingDone.at)) {
          st.pending = fresh.pending;
        }
        delete st.pendingDone;
        save(st);
      }
    },

    // gossipOut returns the `_ckpt` value for an outgoing payload (or null
    // before the first verified head).
    gossipOut() {
      const st = load();
      return st.head ? [st.head.seqTo, st.head.chain] : null;
    },

    // gossipIn folds a peer's `_ckpt` from a decrypted incoming payload —
    // live or history; the host chooses which path a message arrives by, so
    // both must count as evidence. `countPeer` guards the stats (own echoes
    // and history refolds shouldn't inflate "peer heads compared").
    gossipIn(gossip, { countPeer = true } = {}) {
      const st = load();
      const v = gossipVerdict(st.head, st.hist, gossip);
      if (countPeer && (v === "match" || v === "fork" || v === "ahead")) {
        st.stats.gossipSeen = (st.stats.gossipSeen || 0) + 1;
        if (v === "match") st.stats.gossipMatch = (st.stats.gossipMatch || 0) + 1;
      }
      if (v === "fork") addAlert(st, { kind: "gossip-fork", seqTo: gossip[0] });
      if (v === "ahead" && (!st.pending || gossip[0] > st.pending.s)) {
        st.pending = { s: gossip[0], c: gossip[1], at: st.pending ? st.pending.at : now() };
      }
      save(st);
      return v;
    },

    // sampleAndVerify proves a handful of messages the client HOLDS are
    // committed to the chain (docs/tamper-evidence.md client sampling). For
    // each {msgId, blobHash} sample, fetch its inclusion proofs and check them
    // against roots we verified via the signed chain. Sound + false-alarm-free:
    //   • a proof against a trusted root whose audit path DOESN'T recompute →
    //     the server forged it → "bad-proof" alert (unambiguous).
    //   • a proof against a trusted root that matches our held ciphertext →
    //     that message is provably committed (counted).
    //   • no matching proof → NOT alarmed (could be too recent to checkpoint);
    //     the negative "committed-but-different" case needs seq-horizon care
    //     and is a deliberate follow-up.
    // `fetchProof(msgId)` returns the /api/checkpoint-proof body.
    async sampleAndVerify(samples, fetchProof) {
      const st = load();
      const trusted = new Set(st.roots || []);
      if (!trusted.size) return; // nothing verified to check against yet
      let checked = 0, verified = 0;
      for (const { msgId, blobHash } of samples) {
        let resp;
        try {
          resp = await fetchProof(msgId);
        } catch {
          continue; // offline — no conclusion
        }
        if (!resp || !Array.isArray(resp.proofs)) continue;
        checked++;
        for (const proof of resp.proofs) {
          if (!trusted.has(proof.root)) continue; // a checkpoint we haven't verified; skip
          const { ok } = await verifyInclusion(proof);
          if (!ok) {
            addAlert(st, { kind: "bad-proof", seqTo: proof.seq });
            continue;
          }
          if (proof.blob_hash === blobHash) verified++;
        }
      }
      st.stats.sampleChecked = (st.stats.sampleChecked || 0) + checked;
      st.stats.sampleVerified = (st.stats.sampleVerified || 0) + verified;
      save(st);
      return { checked, verified };
    },

    // recordAlert lets other subsystems (e.g. key-transparency bind-MAC
    // verification in shell.js) file an integrity alert through the same
    // deduped, banner-raising path the chain checks use. `key` distinguishes
    // instances of the same kind (e.g. a user id) so re-checking the same
    // member doesn't spam.
    recordAlert(kind, key) {
      const st = load();
      // `id` is the dedup discriminator (alertKey/sameAlert), so keying by e.g.
      // a user id means re-checking the same member doesn't re-file.
      addAlert(st, { kind, seqTo: undefined, id: key });
      save(st);
    },

    // state powers the /integrity command's private reply.
    state() {
      return load();
    },

    // unresolvedAlerts returns alerts the member hasn't dismissed yet — what
    // the failure banner shows. Acknowledged alerts stay in the record (for
    // /integrity and this device's evidence) but don't re-raise the banner.
    unresolvedAlerts() {
      const st = load();
      const acked = st.acked || [];
      return st.alerts.filter((a) => !acked.some((k) => k === alertKey(a)));
    },

    // acknowledge dismisses every current alert from the banner. A LATER,
    // different alert (new kind or new seq) is not covered, so it re-raises.
    acknowledge() {
      const st = load();
      st.acked = [...new Set((st.acked || []).concat(st.alerts.map(alertKey)))].slice(-ALERTS_KEEP * 2);
      save(st);
    },
  };
}

// alertKey identifies an alert for de-dup + acknowledgement (kind + location).
function alertKey(a) {
  return `${a.kind}:${a.seqTo ?? a.id ?? ""}`;
}