use std::collections::BTreeMap;
use std::fmt::Debug;
use std::io;
use std::io::{BufRead, BufReader};
use std::marker::PhantomData;
use std::ops::{Deref, DerefMut};
use std::path::Path;
use std::str::FromStr;

use crypto::signature::Signer;
use crypto::{PublicKey, Signature, Unverified, Verified};
use serde::{Deserialize, Serialize};
use thiserror::Error;

use crate::git;
use crate::git::ext as git_ext;
use crate::git::Oid;
use crate::node::device::Device;
use crate::profile::env;
use crate::storage;
use crate::storage::{ReadRepository, RemoteId, RepoId, WriteRepository};

pub use crate::git::refs::storage::*;

/// File in which the signed references are stored, in the `refs/rad/sigrefs` branch.
pub const REFS_BLOB_PATH: &str = "refs";
/// File in which the signature over the references is stored in the `refs/rad/sigrefs` branch.
pub const SIGNATURE_BLOB_PATH: &str = "signature";

#[derive(Debug)]
pub enum Updated {
    /// The computed [`Refs`] were stored as a new commit.
    Updated { oid: Oid },
    /// The stored [`Refs`] were the same as the computed ones, so no new commit
    /// was created.
    Unchanged { oid: Oid },
}

#[derive(Debug, Error)]
pub enum Error {
    #[error("invalid signature: {0}")]
    InvalidSignature(#[from] crypto::Error),
    #[error("signer error: {0}")]
    Signer(#[from] crypto::signature::Error),
    #[error("canonical refs: {0}")]
    Canonical(#[from] canonical::Error),
    #[error("invalid reference")]
    InvalidRef,
    #[error("missing identity root reference '{0}'")]
    MissingIdentityRoot(git::RefString),
    #[error("missing identity object '{0}'")]
    MissingIdentity(Oid),
    #[error("mismatched identity: local {local}, remote {remote}")]
    MismatchedIdentity { local: RepoId, remote: RepoId },
    #[error("invalid reference: {0}")]
    Ref(#[from] git::RefError),
    #[error(transparent)]
    Git(#[from] git2::Error),
    #[error(transparent)]
    GitExt(#[from] git_ext::Error),
}

impl Error {
    /// Whether this error is caused by a reference not being found.
    pub fn is_not_found(&self) -> bool {
        match self {
            Self::GitExt(git::Error::NotFound(_)) => true,
            Self::GitExt(git::Error::Git(e)) if git::is_not_found_err(e) => true,
            Self::Git(e) if git::is_not_found_err(e) => true,
            _ => false,
        }
    }
}

// TODO(finto): we should turn `git::RefString` to `git::Qualified`,
// since all these refs SHOULD be `Qualified`.
/// The published state of a local repository.
#[derive(Default, Clone, Debug, PartialEq, Eq, Serialize)]
pub struct Refs(BTreeMap<git::RefString, Oid>);

impl Refs {
    /// Verify the given signature on these refs, and return [`SignedRefs`] on success.
    pub fn verified<R: ReadRepository>(
        self,
        signer: PublicKey,
        signature: Signature,
        repo: &R,
    ) -> Result<SignedRefs<Verified>, Error> {
        SignedRefs::new(self, signer, signature).verified(repo)
    }

    /// Sign these refs with the given signer and return [`SignedRefs`].
    pub fn signed<G>(self, device: &Device<G>) -> Result<SignedRefs<Unverified>, Error>
    where
        G: Signer<crypto::Signature>,
    {
        let refs = self;
        let msg = refs.canonical();
        let signature = device.try_sign(&msg)?;

        Ok(SignedRefs::new(refs, *device.public_key(), signature))
    }

    /// Get a particular ref.
    pub fn get(&self, name: &git::Qualified) -> Option<Oid> {
        self.0.get(name.to_ref_string().as_refstr()).copied()
    }

    /// Get a particular head ref.
    pub fn head(&self, name: impl AsRef<git::RefStr>) -> Option<Oid> {
        let branch = git::refname!("refs/heads").join(name);
        self.0.get(&branch).copied()
    }

    /// Create refs from a canonical representation.
    pub fn from_canonical(bytes: &[u8]) -> Result<Self, canonical::Error> {
        let reader = BufReader::new(bytes);
        let mut refs = BTreeMap::new();

        for line in reader.lines() {
            let line = line?;
            let (oid, name) = line
                .split_once(' ')
                .ok_or(canonical::Error::InvalidFormat)?;

            let name = git::RefString::try_from(name)?;
            let oid = Oid::from_str(oid)?;

            if oid.is_zero() {
                continue;
            }
            refs.insert(name, oid);
        }
        Ok(Self(refs))
    }

    pub fn canonical(&self) -> Vec<u8> {
        let mut buf = String::new();

        for (name, oid) in self.iter() {
            buf.push_str(&oid.to_string());
            buf.push(' ');
            buf.push_str(name);
            buf.push('\n');
        }
        buf.into_bytes()
    }
}

impl IntoIterator for Refs {
    type Item = (git::RefString, Oid);
    type IntoIter = std::collections::btree_map::IntoIter<git::RefString, Oid>;

    fn into_iter(self) -> Self::IntoIter {
        self.0.into_iter()
    }
}

impl From<Refs> for BTreeMap<git::RefString, Oid> {
    fn from(refs: Refs) -> Self {
        refs.0
    }
}

impl<V> From<SignedRefs<V>> for Refs {
    fn from(signed: SignedRefs<V>) -> Self {
        signed.refs
    }
}

impl From<BTreeMap<git::RefString, Oid>> for Refs {
    fn from(refs: BTreeMap<git::RefString, Oid>) -> Self {
        Self(refs)
    }
}

impl Deref for Refs {
    type Target = BTreeMap<git::RefString, Oid>;

    fn deref(&self) -> &Self::Target {
        &self.0
    }
}

impl DerefMut for Refs {
    fn deref_mut(&mut self) -> &mut Self::Target {
        &mut self.0
    }
}

/// Combination of [`Refs`] and a [`Signature`]. The signature is a cryptographic
/// signature over the refs. This allows us to easily verify if a set of refs
/// came from a particular key.
///
/// The type parameter keeps track of whether the signature was [`Verified`] or
/// [`Unverified`].
#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct SignedRefs<V> {
    /// The signed refs.
    pub refs: Refs,
    /// The signature of the signer over the refs.
    #[serde(skip)]
    pub signature: Signature,
    /// This is the remote under which these refs exist, and the public key of the signer.
    pub id: PublicKey,

    #[serde(skip)]
    _verified: PhantomData<V>,
}

impl SignedRefs<Unverified> {
    pub fn new(refs: Refs, author: PublicKey, signature: Signature) -> Self {
        Self {
            refs,
            signature,
            id: author,
            _verified: PhantomData,
        }
    }

    pub fn verified<R: ReadRepository>(self, repo: &R) -> Result<SignedRefs<Verified>, Error> {
        match self.verify(repo) {
            Ok(()) => Ok(SignedRefs {
                refs: self.refs,
                signature: self.signature,
                id: self.id,
                _verified: PhantomData,
            }),
            Err(e) => Err(e),
        }
    }

    pub fn verify<R: ReadRepository>(&self, repo: &R) -> Result<(), Error> {
        let canonical = self.refs.canonical();
        let local = repo.id();

        // Verify signature.
        if let Err(e) = self.id.verify(canonical, &self.signature) {
            return Err(e.into());
        }
        // If the identity root was signed, verify it points to the right place.
        if let Some(id_root) = self.refs.get(&IDENTITY_ROOT) {
            // Get the identity at the given oid.
            let Ok(doc) = repo.identity_doc_at(id_root) else {
                return Err(Error::MissingIdentity(id_root));
            };
            let remote = RepoId::from(doc.blob);

            // Make sure the signed identity points to the local repo identity.
            if remote != local {
                return Err(Error::MismatchedIdentity { local, remote });
            }
        } else {
            // TODO(cloudhead): Make this into a hard error (`Error::MissingIdentityRoot`) for
            // repos that have migrated to the new identity document schema.
            log::debug!(
                target: "storage",
                "Signed ref verification for {} in {local}: {} is not provided",
                self.id, *IDENTITY_ROOT
            );
        }
        Ok(())
    }
}

impl SignedRefs<Verified> {
    pub fn load<S>(remote: RemoteId, repo: &S) -> Result<Self, Error>
    where
        S: ReadRepository,
    {
        let oid = repo.reference_oid(&remote, &SIGREFS_BRANCH)?;

        SignedRefs::load_at(oid, remote, repo)
    }

    pub fn load_at<S>(oid: Oid, remote: RemoteId, repo: &S) -> Result<Self, Error>
    where
        S: storage::ReadRepository,
    {
        let refs = repo.blob_at(oid, Path::new(REFS_BLOB_PATH))?;
        let signature = repo.blob_at(oid, Path::new(SIGNATURE_BLOB_PATH))?;
        let signature: crypto::Signature = signature.content().try_into()?;
        let refs = Refs::from_canonical(refs.content())?;

        SignedRefs::new(refs, remote, signature).verified(repo)
    }

    /// Save the signed refs to disk.
    /// This creates a new commit on the signed refs branch, and updates the branch pointer.
    pub fn save<S: WriteRepository>(&self, repo: &S) -> Result<Updated, Error> {
        let sigref = &SIGREFS_BRANCH;
        let remote = &self.id;
        let raw = repo.raw();

        // N.b. if the signatures match then there are no updates
        let parent = match SignedRefsAt::load(*remote, repo)? {
            Some(SignedRefsAt { sigrefs, at }) if sigrefs.signature == self.signature => {
                return Ok(Updated::Unchanged { oid: at });
            }
            Some(SignedRefsAt { at, .. }) => Some(raw.find_commit(*at)?),
            None => None,
        };

        let tree = {
            let refs_blob_oid = raw.blob(&self.canonical())?;
            let sig_blob_oid = raw.blob(self.signature.as_ref())?;

            let mut builder = raw.treebuilder(None)?;
            builder.insert(REFS_BLOB_PATH, refs_blob_oid, 0o100_644)?;
            builder.insert(SIGNATURE_BLOB_PATH, sig_blob_oid, 0o100_644)?;

            let oid = builder.write()?;

            raw.find_tree(oid)
        }?;

        let sigref = sigref.with_namespace(remote.into());
        let author = if let Ok(s) = env::var(env::GIT_COMMITTER_DATE) {
            let Ok(timestamp) = s.trim().parse::<i64>() else {
                panic!(
                    "Invalid timestamp value {s:?} for `{}`",
                    env::GIT_COMMITTER_DATE
                );
            };
            let time = git2::Time::new(timestamp, 0);
            git2::Signature::new("radicle", remote.to_string().as_str(), &time)?
        } else {
            raw.signature()?
        };

        let commit = raw.commit(
            Some(&sigref),
            &author,
            &author,
            "Update signed refs\n",
            &tree,
            &parent.iter().collect::<Vec<&git2::Commit>>(),
        );

        match commit {
            Ok(oid) => Ok(Updated::Updated { oid: oid.into() }),
            Err(e) => match (e.class(), e.code()) {
                (git2::ErrorClass::Object, git2::ErrorCode::Modified) => {
                    log::warn!("Concurrent modification of refs: {e:?}");

                    Err(Error::Git(e))
                }
                _ => Err(e.into()),
            },
        }
    }

    pub fn unverified(self) -> SignedRefs<Unverified> {
        SignedRefs {
            refs: self.refs,
            signature: self.signature,
            id: self.id,
            _verified: PhantomData,
        }
    }
}

impl<V> Deref for SignedRefs<V> {
    type Target = Refs;

    fn deref(&self) -> &Self::Target {
        &self.refs
    }
}

/// The content-addressable information required to load a remote's
/// `rad/sigrefs`.
///
/// Use [`RefsAt::load`] to produce a [`SignedRefsAt`].
///
/// `RefsAt` can also be used for communicating announcements of updates
/// references to other nodes.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "camelCase")]
#[cfg_attr(feature = "schemars", derive(schemars::JsonSchema))]
pub struct RefsAt {
    /// The remote namespace of the `rad/sigrefs`.
    #[cfg_attr(
        feature = "schemars",
        schemars(with = "crate::schemars_ext::crypto::PublicKey")
    )]
    pub remote: RemoteId,
    /// The commit SHA that `rad/sigrefs` points to.
    #[cfg_attr(feature = "schemars", schemars(with = "crate::schemars_ext::git::Oid"))]
    pub at: Oid,
}

impl RefsAt {
    pub fn new<S: ReadRepository>(repo: &S, remote: RemoteId) -> Result<Self, git::raw::Error> {
        let at = repo.reference_oid(&remote, &storage::refs::SIGREFS_BRANCH)?;
        Ok(RefsAt { remote, at })
    }

    pub fn load<S: ReadRepository>(&self, repo: &S) -> Result<SignedRefsAt, Error> {
        SignedRefsAt::load_at(self.at, self.remote, repo)
    }

    pub fn path(&self) -> &git::Qualified {
        &SIGREFS_BRANCH
    }
}

/// Verified [`SignedRefs`] that keeps track of their content address
/// [`Oid`].
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct SignedRefsAt {
    pub sigrefs: SignedRefs<Verified>,
    pub at: Oid,
}

impl SignedRefsAt {
    /// Load the [`SignedRefs`] found under `remote`'s [`SIGREFS_BRANCH`].
    ///
    /// This will return `None` if the branch was not found, all other
    /// errors are returned.
    pub fn load<S>(remote: RemoteId, repo: &S) -> Result<Option<Self>, Error>
    where
        S: ReadRepository,
    {
        let at = match RefsAt::new(repo, remote) {
            Ok(RefsAt { at, .. }) => at,
            Err(e) if git::is_not_found_err(&e) => return Ok(None),
            Err(e) => return Err(e.into()),
        };
        Self::load_at(at, remote, repo).map(Some)
    }

    pub fn load_at<S>(at: Oid, remote: RemoteId, repo: &S) -> Result<Self, Error>
    where
        S: storage::ReadRepository,
    {
        Ok(Self {
            sigrefs: SignedRefs::load_at(at, remote, repo)?,
            at,
        })
    }

    pub fn iter(&self) -> impl Iterator<Item = (&git::RefString, &Oid)> {
        self.sigrefs.refs.iter()
    }
}

impl Deref for SignedRefsAt {
    type Target = SignedRefs<Verified>;

    fn deref(&self) -> &Self::Target {
        &self.sigrefs
    }
}

pub mod canonical {
    use super::*;

    #[derive(Debug, thiserror::Error)]
    pub enum Error {
        #[error(transparent)]
        InvalidRef(#[from] git::fmt::Error),
        #[error("invalid canonical format")]
        InvalidFormat,
        #[error(transparent)]
        Io(#[from] io::Error),
        #[error(transparent)]
        Git(#[from] git2::Error),
    }
}

#[cfg(test)]
#[allow(clippy::unwrap_used)]
mod tests {
    use qcheck_macros::quickcheck;
    use storage::{git::transport, RemoteRepository, SignRepository, WriteStorage};

    use super::*;
    use crate::assert_matches;
    use crate::{cob::identity::Identity, cob::Title, rad, test::fixtures, Storage};

    #[quickcheck]
    fn prop_canonical_roundtrip(refs: Refs) {
        let encoded = refs.canonical();
        let decoded = Refs::from_canonical(&encoded).unwrap();

        assert_eq!(refs, decoded);
    }

    #[test]
    // Test that a user's signed refs are tied to a specific RID, and they can't simply be
    // used in a different repository.
    //
    // We create two repos, `paris` and `london`, and we copy over Bob's signed refs from `paris`
    // to `london`. We expect that this does not cause the canonical head of the `london` repo
    // to change, despite Bob being a delegate of both repos, because the refs were signed for the
    // `paris` repo. We also don't expected the signed refs to validate without error.
    fn test_rid_verification() {
        let tmp = tempfile::tempdir().unwrap();
        let alice = Device::mock();
        let bob = Device::mock();
        let storage = &Storage::open(tmp.path().join("storage"), fixtures::user()).unwrap();

        transport::local::register(storage.clone());

        // Alice creates "paris" repo.
        let (paris_repo, paris_head) = fixtures::repository(tmp.path().join("paris"));
        let (paris_rid, paris_doc, _) = rad::init(
            &paris_repo,
            "paris".try_into().unwrap(),
            "Paris repository",
            git::refname!("master"),
            Default::default(),
            &alice,
            storage,
        )
        .unwrap();

        // Alice creates "london" repo.
        let (london_repo, _london_head) = fixtures::repository(tmp.path().join("london"));
        let (london_rid, london_doc, _) = rad::init(
            &london_repo,
            "london".try_into().unwrap(),
            "London repository",
            git::refname!("master"),
            Default::default(),
            &alice,
            storage,
        )
        .unwrap();

        assert_ne!(london_rid, paris_rid);

        log::debug!(target: "test", "London RID: {london_rid}");
        log::debug!(target: "test", "Paris RID: {paris_rid}");

        let paris = storage.repository_mut(paris_rid).unwrap();
        let london = storage.repository_mut(london_rid).unwrap();

        // Bob is added to both repos as a delegate, by Alice.
        {
            let paris_doc = paris_doc
                .with_edits(|doc| {
                    doc.delegates.push(bob.public_key().into());
                })
                .unwrap();
            let london_doc = london_doc
                .with_edits(|doc| {
                    doc.delegates.push(bob.public_key().into());
                })
                .unwrap();

            let mut paris_ident = Identity::load_mut(&paris).unwrap();
            let mut london_ident = Identity::load_mut(&london).unwrap();

            paris_ident
                .update(Title::new("Add Bob").unwrap(), "", &paris_doc, &alice)
                .unwrap();
            london_ident
                .update(Title::new("Add Bob").unwrap(), "", &london_doc, &alice)
                .unwrap();
        }

        // Now Bob checks out a copy of the `paris` repository and pushes a commit to the
        // default branch (master). We store the OID of that commti in `bob_head`, as this
        // is the commit we will try to get the `london` repo to point to.
        let (bob_paris_sigrefs, bob_head) = {
            let bob_working = rad::checkout(
                paris.id,
                bob.public_key(),
                tmp.path().join("working"),
                &storage,
                false,
            )
            .unwrap();

            let paris_head = bob_working.find_commit(paris_head).unwrap();
            let bob_sig = git2::Signature::now("bob", "bob@example.com").unwrap();
            let bob_head = git::empty_commit(
                &bob_working,
                &paris_head,
                git::refname!("refs/heads/master").as_refstr(),
                "Bob's commit",
                &bob_sig,
            )
            .unwrap();

            let mut bob_master_ref = bob_working.find_reference("refs/heads/master").unwrap();
            bob_master_ref.set_target(bob_head.id(), "").unwrap();
            bob_working
                .find_remote("rad")
                .unwrap()
                .push(&["refs/heads/master"], None)
                .unwrap();
            let sigrefs = paris.sign_refs(&bob).unwrap();

            assert_eq!(
                sigrefs
                    .get(&git_ext::ref_format::qualified!("refs/heads/master"))
                    .unwrap(),
                bob_head.id().into()
            );
            (sigrefs, bob_head.id())
        };

        {
            // Sanity check: make sure the default branches don't already match between Alice and Bob.
            let alice_paris_sigrefs = SignedRefsAt::load(*alice.public_key(), &paris)
                .unwrap()
                .unwrap();
            assert_ne!(
                alice_paris_sigrefs
                    .get(&git_ext::ref_format::qualified!("refs/heads/master"))
                    .unwrap(),
                bob_paris_sigrefs
                    .get(&git_ext::ref_format::qualified!("refs/heads/master"))
                    .unwrap()
            );
        }

        {
            // For the graft to work, we also have to copy over the objects that Bob created in
            // `paris`, so that the grafted signed refs point to valid objects.
            let paris_odb = paris.raw().odb().unwrap();
            let london_odb = london.raw().odb().unwrap();

            paris_odb
                .foreach(|oid| {
                    let obj = paris_odb.read(*oid).unwrap();
                    london_odb.write(obj.kind(), obj.data()).unwrap();

                    true
                })
                .unwrap();
        }
        // Now we're going to "graft" Bob's signed refs from `paris` to `london`.
        // We save Bob's `paris` signed refs in the `london` repo, performing the graft, and update
        // Bob's `master` branch reference to point to his commit, created in the `paris` repo. This
        // only modifies his own namespace. Note that anyone (eg. Eve) could create a reference
        // under her copy of Bob's namespace, and this would only be rejected during signed ref
        // validation.
        let result = bob_paris_sigrefs.save(&london).unwrap();
        assert_matches!(result, Updated::Updated { .. });

        london
            .raw()
            .reference(
                git::refs::storage::branch_of(bob.public_key(), &git::refname!("master")).as_str(),
                bob_head,
                false,
                "",
            )
            .unwrap();

        // Due to the verification, we get a validation error when trying to load Bob's remote.
        // The graft is not allowed.
        assert_matches!(
            london.remote(bob.public_key()),
            Err(Error::MismatchedIdentity {
                local,
                remote,
            })
            if local == london_rid && remote == paris_rid
        );
    }
}