// Package tlog submits attestation envelopes to the transparency-log per
// POST /api/v1/log/entries (ADR-0005). The TLog is idempotent on
// content_hash: re-submitting the same (envelope, content_hash) returns
// the original log_index.
package tlog

import (
	"bytes"
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"time"

	"basicstack.de/proofedmesh/services/dummy-sink/internal/auth"
	"basicstack.de/proofedmesh/services/dummy-sink/internal/dsse"
)

// InclusionProof mirrors the server-side ADR-0005 inclusion proof.
type InclusionProof struct {
	TreeSize          int64    `json:"tree_size"`
	TreeRootHash      string   `json:"tree_root_hash"`
	SignedTreeHeadRef string   `json:"signed_tree_head_ref"`
	Hashes            []string `json:"hashes"`
}

// Receipt is what the TLog returns on a successful submit.
type Receipt struct {
	LogIndex       int64          `json:"log_index"`
	ContentHash    string         `json:"content_hash"`
	LoggedAt       time.Time      `json:"logged_at"`
	InclusionProof InclusionProof `json:"inclusion_proof"`
}

// ErrTLogUnavailable classifies connection errors and 5xx responses.
var ErrTLogUnavailable = errors.New("tlog: transparency-log unavailable")

// Client is the TLog submit client.
type Client struct {
	BaseURL     string
	HTTPClient  *http.Client
	TokenSource auth.TokenSource
}

type submitRequest struct {
	Envelope    dsse.Envelope `json:"envelope"`
	ContentHash string        `json:"content_hash"`
}

// Submit posts env + its contentHash to the TLog. Returns the receipt on
// 200/201 (idempotent repeat / fresh insert) and ErrTLogUnavailable on
// transport/5xx. Other non-2xx responses are reported with the raw status.
func (c Client) Submit(ctx context.Context, env dsse.Envelope, contentHash string) (Receipt, error) {
	if c.BaseURL == "" {
		return Receipt{}, errors.New("tlog.Client: BaseURL is empty")
	}
	hc := c.HTTPClient
	if hc == nil {
		hc = &http.Client{Timeout: 10 * time.Second}
	}
	body, err := json.Marshal(submitRequest{Envelope: env, ContentHash: contentHash})
	if err != nil {
		return Receipt{}, fmt.Errorf("tlog: marshal submit: %w", err)
	}
	endpoint, err := url.JoinPath(c.BaseURL, "/api/v1/log/entries")
	if err != nil {
		return Receipt{}, fmt.Errorf("tlog: build url: %w", err)
	}
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
	if err != nil {
		return Receipt{}, err
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Accept", "application/json")
	if c.TokenSource != nil {
		tok, err := c.TokenSource.Token(ctx)
		if err != nil {
			return Receipt{}, fmt.Errorf("tlog: token: %w", err)
		}
		if tok != "" {
			req.Header.Set("Authorization", "Bearer "+tok)
		}
	}
	resp, err := hc.Do(req)
	if err != nil {
		return Receipt{}, fmt.Errorf("%w: %v", ErrTLogUnavailable, err)
	}
	defer resp.Body.Close()
	raw, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
	switch {
	case resp.StatusCode == http.StatusOK, resp.StatusCode == http.StatusCreated:
		// ok
	case resp.StatusCode >= 500:
		return Receipt{}, fmt.Errorf("%w: status %d: %s", ErrTLogUnavailable, resp.StatusCode, truncate(raw, 256))
	default:
		return Receipt{}, fmt.Errorf("tlog: status %d: %s", resp.StatusCode, truncate(raw, 256))
	}
	var out Receipt
	if err := json.Unmarshal(raw, &out); err != nil {
		return Receipt{}, fmt.Errorf("tlog: decode receipt: %w", err)
	}
	if out.ContentHash != contentHash {
		return out, fmt.Errorf("tlog returned content_hash %q != sent %q", out.ContentHash, contentHash)
	}
	if out.LogIndex < 0 {
		return out, fmt.Errorf("tlog returned negative log_index %d", out.LogIndex)
	}
	return out, nil
}

func truncate(b []byte, n int) string {
	if len(b) <= n {
		return string(b)
	}
	return string(b[:n]) + "…"
}