/** Deployment operator state. Store outside PGDATA, backups and runtime mounts. */
import assert from 'node:assert/strict'
import {constants} from 'node:fs'
import {lstat,open,rename} from 'node:fs/promises'
import path from 'node:path'
import {z} from 'zod'
import {sourceBindingBytes,sourceBindingCanonical,type DatabaseSourceBindingBody} from '../../src/db/database-source-binding.js'
import {protectedDirectory,readProtected,sha,withJournalLease} from './operator-files.mjs'
import {readProtectedDatabaseSourceBindingRegistry, type createProtectedDatabaseSourceBindingVerifier} from './protected-source-registry.mjs'

const digest=z.string().regex(/^[a-f0-9]{64}$/),uuid=z.string().uuid()
const sourcePin=z.object({registryDirectory:z.string().min(1).max(4096),installationId:uuid,publicKeySpkiSha256:digest,currentHeadSha256:digest}).strict()
const directoryPath=z.string().min(1).max(4096)
const approval=z.object({format:z.literal('database-source-activation-approval-v1'),activationDirectory:directoryPath,sourcePin,tlsSpkiSha256:digest,
 expectedActivationSha256:digest.nullable()}).strict()
const generation=z.object({generation:uuid,headSha256:digest,bindingSha256:digest,tlsSpkiSha256:digest}).strict()
const stateSchema=z.object({format:z.literal('database-source-activation-v1'),activationDirectory:directoryPath,installationId:uuid,sourceIdentityId:uuid,
 publicKeySpkiSha256:digest,status:z.enum(['active','revoked']),generations:z.array(generation).min(1).max(256)}).strict()
const maximum=131072, filename='source-activation.json'
type State=z.infer<typeof stateSchema>
const parse=(bytes:Buffer):unknown=>JSON.parse(new TextDecoder('utf8',{fatal:true}).decode(bytes))

async function present(file:string){
 try{await lstat(file);return true}catch(error){if((error as NodeJS.ErrnoException).code==='ENOENT')return false;throw error}
}

// Caller holds the same protected lease used by all activation writers.
async function current(directory:string){
 const file=path.join(directory,filename)
 assert(!await present(file+'.pending'),'Unresolved activation transition')
 if(!await present(file))return undefined
 const bytes=await readProtected(file,maximum),state=stateSchema.parse(parse(bytes))
 assert.equal(state.activationDirectory,directory,'Activation record belongs to another directory')
 assert(sourceBindingBytes(state).equals(bytes),'Noncanonical activation record')
 for(const field of ['generation','headSha256','tlsSpkiSha256'] as const){
  assert.equal(new Set(state.generations.map(item=>item[field].toLowerCase())).size,state.generations.length,'Reused activation identity')
 }
 return {state,activationSha256:sha(bytes)}
}

async function persist(directory:string,state:State){
 await protectedDirectory(directory)
 const bytes=sourceBindingBytes(stateSchema.parse(state))
 assert(bytes.length<=maximum)
 const file=path.join(directory,filename),pending=file+'.pending'
 const parent=await open(directory,constants.O_RDONLY|constants.O_DIRECTORY|constants.O_NOFOLLOW)
 let confirmed=false,cleanupUnconfirmed=false
 try{
  const handle=await open(pending,constants.O_WRONLY|constants.O_CREAT|constants.O_EXCL|constants.O_NOFOLLOW,0o600)
  try{await handle.writeFile(bytes);await handle.sync()}finally{await handle.close()}
  try{await rename(pending,file);await parent.sync()}
  catch{throw Object.assign(Error('Activation terminal requires inspection'),{code:'SOURCE_ACTIVATION_TERMINAL_UNKNOWN'})}
  confirmed=true
 }finally{try{await parent.close()}catch{cleanupUnconfirmed=confirmed}}
 return {activationSha256:sha(bytes),cleanupUnconfirmed}
}

function receipt(state:State,activationSha256:string,outcome:'committed'|'observed'){
 return {event:'database-source-activation',outcome,activationSha256,status:state.status,
  ordinal:state.generations.length,...state.generations.at(-1),generationAuthenticated:false,readyAuthorized:false,automaticReplay:false}
}

type SourceVerifier=ReturnType<typeof createProtectedDatabaseSourceBindingVerifier>

/** Keep revocation and generation changes fenced throughout one read-only SQL preflight. */
export async function withActiveSourcePreflight<T>(input:{directory:string,expectedSha256:string,sourcePin:z.infer<typeof sourcePin>,expectedSource:DatabaseSourceBindingBody['source'],tlsSpkiSha256:string,deadlineAt:number},
 verifier:SourceVerifier,work:(guardedVerifier:SourceVerifier)=>Promise<T>){
 const {directory,deadlineAt}=input
 const expectedSha256=digest.parse(input.expectedSha256),tlsSpkiSha256=digest.parse(input.tlsSpkiSha256)
 const pin=sourcePin.parse(input.sourcePin)
 return withJournalLease(directory,async()=>{
  async function readActive(){
   assert(Date.now()<deadlineAt,'Activation preflight expired')
   const active=await current(directory)
   assert(active?.state.status==='active'&&active.activationSha256===expectedSha256,'Active activation digest changed')
   assert(Date.now()<deadlineAt,'Activation preflight expired')
   return active.state
  }
  const state=await readActive(),generation=state.generations.at(-1)!
  const registry=await readProtectedDatabaseSourceBindingRegistry(pin,{deadlineAt})
  assert(state.publicKeySpkiSha256===registry.publicKeySpkiSha256&&generation.tlsSpkiSha256===tlsSpkiSha256,'Activation key differs from preflight')
  function assertGeneration(evidence:{installationId:string,sourceIdentityId:string,generation:string,ordinal:number,headSha256:string,bindingSha256:string}){
   assert(evidence.installationId===state.installationId&&evidence.sourceIdentityId===state.sourceIdentityId&&
    evidence.generation===generation.generation&&evidence.ordinal===state.generations.length&&
    evidence.headSha256===generation.headSha256&&evidence.bindingSha256===generation.bindingSha256,'Activation differs from signed source generation')
  }
  assertGeneration({...registry.head,headSha256:registry.headSha256})
  assert.equal(sourceBindingCanonical(registry.body.source),sourceBindingCanonical(input.expectedSource),'Activation source differs from reviewed configuration')
  await readActive()
  let sourceChecks=0
  const guardedVerifier:SourceVerifier=Object.freeze({async verify(...args:Parameters<SourceVerifier['verify']>){
   await readActive()
   const evidence=await verifier.verify(...args)
   assert(evidence.platformProtectionVerified&&evidence.operatorSignatureVerified&&evidence.currentHeadPinVerified&&evidence.genuineSourceFactsMatched,'Unprotected activation source evidence')
   assertGeneration(evidence)
   await readActive()
   sourceChecks++
   return evidence
  }})
  const result=await work(guardedVerifier)
  assert.equal(sourceChecks,2,'Initial and terminal source evidence required')
  await readActive()
  return result
 })
}

export async function sourceActivationMain(args:string[]){
 const command=args[0], flags=command==='source-activate'?['directory','approval','approval-sha256']:
  command==='source-revoke'?['directory','expected-sha256']:['directory']
 assert(['source-activate','source-revoke','source-status'].includes(command)&&args.length===1+2*flags.length)
 const values=new Map<string,string>()
 for(let i=1;i<args.length;i+=2){
  const name=args[i].slice(2)
  assert(args[i].startsWith('--')&&flags.includes(name)&&!values.has(name)&&args[i+1]);values.set(name,args[i+1])
 }
 const directory=values.get('directory')!
 return withJournalLease(directory,async()=>{
  const before=await current(directory)
  if(command==='source-status'){
   assert(before,'Activation record absent')
   return receipt(before.state,before.activationSha256,'observed')
  }
  if(command==='source-revoke'){
   const expected=digest.parse(values.get('expected-sha256'))
   assert(before?.activationSha256===expected&&before.state.status==='active','Active activation digest changed')
   const revoked={...before.state,status:'revoked' as const}
   const saved=await persist(directory,revoked)
   return {...receipt(revoked,saved.activationSha256,'committed'),cleanupUnconfirmed:saved.cleanupUnconfirmed}
  }
  const request=approval.parse(parse(await readProtected(values.get('approval')!,16384,digest.parse(values.get('approval-sha256')))))
  assert.equal(request.activationDirectory,directory,'Approval belongs to another activation directory')
  assert.equal(before?.activationSha256??null,request.expectedActivationSha256,'Activation predecessor changed')
  const registry=await readProtectedDatabaseSourceBindingRegistry(request.sourcePin,{deadlineAt:Date.now()+120000})
  const previous=before?.state.generations??[]
  assert.equal(registry.head.ordinal,previous.length+1,'Source ordinal changed')
  assert.equal(registry.head.previousHeadSha256,previous.at(-1)?.headSha256??null,'Signed predecessor differs')
  if(before){
   assert.equal(registry.head.installationId,before.state.installationId)
   assert.equal(registry.head.sourceIdentityId,before.state.sourceIdentityId)
   assert.equal(registry.publicKeySpkiSha256,before.state.publicKeySpkiSha256)
  }
  assert(!previous.some(item=>item.generation.toLowerCase()===registry.head.generation.toLowerCase()||item.tlsSpkiSha256===request.tlsSpkiSha256),'Generation or TLS key was already used')
  const next:State={format:'database-source-activation-v1',activationDirectory:directory,installationId:registry.head.installationId,
   sourceIdentityId:registry.head.sourceIdentityId,publicKeySpkiSha256:registry.publicKeySpkiSha256,status:'active',
   generations:[...previous,{generation:registry.head.generation,headSha256:registry.headSha256,
    bindingSha256:registry.head.bindingSha256,tlsSpkiSha256:request.tlsSpkiSha256}]}
  const saved=await persist(directory,next)
  return {...receipt(next,saved.activationSha256,'committed'),cleanupUnconfirmed:saved.cleanupUnconfirmed}
 })
}