// Package auth also reads gpg keys, because a signature is only useful against a key barerepo holds.
package auth

import (
	"context"
	"errors"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
)

// GPGKey is what one pasted armor says about itself.
type GPGKey struct {
	Fingerprint string
	UID         string
}

// ReadGPGKey asks gpg what the armor holds without keeping any of it. It never imports.
func ReadGPGKey(ctx context.Context, armor string) (GPGKey, error) {
	if !strings.Contains(armor, "BEGIN PGP PUBLIC KEY BLOCK") {
		return GPGKey{}, errors.New("that is not a public key block. paste the output of gpg --armor --export")
	}
	if strings.Contains(armor, "PRIVATE KEY BLOCK") {
		return GPGKey{}, errors.New("that is a private key. export the public half instead, and treat this one as compromised")
	}
	cmd := exec.CommandContext(ctx, "gpg", "--batch", "--with-colons",
		"--import-options", "show-only", "--import")
	cmd.Stdin = strings.NewReader(armor)
	out, err := cmd.Output()
	if err != nil {
		return GPGKey{}, errors.New("that key does not read as a public key")
	}
	return parseColons(string(out))
}

// parseColons reads the fingerprint and the first user id out of gpg's machine format.
func parseColons(out string) (GPGKey, error) {
	var k GPGKey
	for _, line := range strings.Split(out, "\n") {
		f := strings.Split(line, ":")
		switch {
		case len(f) > 9 && f[0] == "fpr" && k.Fingerprint == "":
			k.Fingerprint = f[9]
		case len(f) > 9 && f[0] == "uid" && k.UID == "":
			k.UID = strings.ReplaceAll(f[9], `\x3a`, ":")
		}
	}
	if k.Fingerprint == "" {
		return k, errors.New("that key has no fingerprint, so it is not a key")
	}
	return k, nil
}

// Keyring writes every held key into one directory, which is what gpg needs to check a signature.
func Keyring(ctx context.Context, dir string, armors []string) (string, error) {
	if len(armors) == 0 {
		return "", errors.New("no keys")
	}
	if err := os.MkdirAll(dir, 0o700); err != nil {
		return "", err
	}
	// No agent, because a ring of public keys never needs one and its socket path can be too long.
	if err := os.WriteFile(filepath.Join(dir, "gpg.conf"), []byte("no-autostart\n"), 0o600); err != nil {
		return "", err
	}
	cmd := exec.CommandContext(ctx, "gpg", "--batch", "--quiet", "--no-autostart", "--import")
	cmd.Env = append(os.Environ(), "GNUPGHOME="+dir)
	cmd.Stdin = strings.NewReader(strings.Join(armors, "\n"))
	// The exit code is not the answer: gpg fails on a missing agent it did not need. Ask the ring.
	_ = cmd.Run()
	list := exec.CommandContext(ctx, "gpg", "--batch", "--no-autostart", "--list-keys", "--with-colons")
	list.Env = append(os.Environ(), "GNUPGHOME="+dir)
	out, err := list.Output()
	if err != nil || !strings.Contains(string(out), "fpr:") {
		return "", errors.New("no key could be read into the keyring")
	}
	return filepath.Clean(dir), nil
}