package repo

import (
	"context"
	"fmt"
	"os"
	"path/filepath"
	"strings"
	"time"
)

// KeyLister is the half of the store this needs, so a caller does not drag the whole database in.
type KeyLister interface {
	AllKeys(ctx context.Context) ([]AuthKey, error)
}

// AuthKey is one public key and the account it authorises.
type AuthKey struct {
	Account string
	Algo    string
	Blob    string
	// Retired is when the key stopped granting access, and the zero time means it still does.
	Retired time.Time
}

// keyOptions refuse everything ssh can do except run the one command. Chapter 41.3.
const keyOptions = "no-port-forwarding,no-x11-forwarding,no-agent-forwarding,no-pty"

// WriteAuthorizedKeys rewrites the file from the database, because the database is what grants access.
func WriteAuthorizedKeys(dir, bin string, keys []AuthKey) error {
	if dir == "" {
		return fmt.Errorf("no ssh directory to write into")
	}
	if bin == "" {
		bin = "barerepo"
	}
	var b strings.Builder
	b.WriteString("# Written by barerepo from its own database. Edits here are lost on the next write.\n")
	for _, k := range keys {
		if k.Account == "" || k.Algo == "" || k.Blob == "" {
			continue
		}
		// A quote in the account name would end the command, and a name cannot hold one anyway.
		if strings.ContainsAny(k.Account, "\"\\\n\r") {
			continue
		}
		fmt.Fprintf(&b, "command=\"%s ssh --account %s\",%s %s %s\n",
			bin, k.Account, keyOptions, k.Algo, k.Blob)
	}
	if err := os.MkdirAll(dir, 0o700); err != nil {
		return err
	}
	// Written beside the target and moved, so a reader never sees half a file and lose every key.
	tmp := filepath.Join(dir, ".authorized_keys.tmp")
	if err := os.WriteFile(tmp, []byte(b.String()), 0o600); err != nil {
		return err
	}
	return os.Rename(tmp, filepath.Join(dir, "authorized_keys"))
}

// WriteAllowedSigners writes the keys git checks a commit signature against, in ssh-keygen's format.
func WriteAllowedSigners(path string, keys []AuthKey) error {
	if path == "" {
		return fmt.Errorf("no allowed signers file to write")
	}
	var b strings.Builder
	b.WriteString("# Written by barerepo from its own database. Edits here are lost on the next write.\n")
	seen := map[string]bool{}
	for _, k := range keys {
		if k.Algo == "" || k.Blob == "" || seen[k.Blob] {
			continue
		}
		seen[k.Blob] = true
		// The principal is a wildcard because a commit names an address barerepo never issued, and the namespace is what stops a sign in signature counting as a commit signature.
		opts := "namespaces=\"git\""
		if !k.Retired.IsZero() {
			// One second past retirement in local time with no suffix, which is the only spelling ssh-keygen reads as a moment.
			opts += ",valid-before=\"" + k.Retired.Local().Add(time.Second).Format("20060102150405") + "\""
		}
		fmt.Fprintf(&b, "* %s %s %s\n", opts, k.Algo, k.Blob)
	}
	if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
		return err
	}
	tmp := path + ".tmp"
	if err := os.WriteFile(tmp, []byte(b.String()), 0o600); err != nil {
		return err
	}
	return os.Rename(tmp, path)
}