// Package tlog calls the transparency-log's POST /api/v1/log/entries
// endpoint. Idempotent on the server side: resubmitting the same
// (envelope, content_hash) returns the same log_index + inclusion proof.
// See DEV-600 and services/transparency-log for the server-side contract.
package tlog

import (
	"bytes"
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"time"

	"basicstack.de/proofedmesh/services/approval-service/internal/signer"
)

// InclusionProof mirrors the server-side ADR-0005 inclusion proof.
type InclusionProof struct {
	TreeSize          int64    `json:"tree_size"`
	TreeRootHash      string   `json:"tree_root_hash"`
	SignedTreeHeadRef string   `json:"signed_tree_head_ref"`
	Hashes            []string `json:"hashes"`
}

// Receipt is what the transparency-log hands back on a successful submit.
type Receipt struct {
	LogIndex       int64          `json:"log_index"`
	ContentHash    string         `json:"content_hash"`
	LoggedAt       time.Time      `json:"logged_at"`
	InclusionProof InclusionProof `json:"inclusion_proof"`
}

// ErrTLogUnavailable classifies connection errors and 5xx responses from
// the transparency-log. Callers (the HTTP /confirm handler) use this to
// decide between returning a logged approval and an attestation-pending
// one — the Approval row is persisted either way.
var ErrTLogUnavailable = errors.New("tlog: transparency-log unavailable")

// Client is the tlog submit client.
type Client struct {
	BaseURL     string
	HTTPClient  *http.Client
	TokenSource signer.TokenSource
}

type submitRequest struct {
	Envelope    signer.Envelope `json:"envelope"`
	ContentHash string          `json:"content_hash"`
}

// Submit sends env + its contentHash to the transparency-log. Returns the
// server receipt on 200/201 (idempotent repeat / fresh insert) and
// ErrTLogUnavailable on any transport-level or 5xx failure. All other
// non-2xx responses are reported with the raw status.
func (c Client) Submit(ctx context.Context, env signer.Envelope, contentHash string) (Receipt, error) {
	if c.BaseURL == "" {
		return Receipt{}, errors.New("tlog.Client: BaseURL is empty")
	}
	hc := c.HTTPClient
	if hc == nil {
		hc = &http.Client{Timeout: 10 * time.Second}
	}
	body, err := json.Marshal(submitRequest{Envelope: env, ContentHash: contentHash})
	if err != nil {
		return Receipt{}, fmt.Errorf("marshal submit: %w", err)
	}
	endpoint, err := url.JoinPath(c.BaseURL, "/api/v1/log/entries")
	if err != nil {
		return Receipt{}, fmt.Errorf("join tlog url: %w", err)
	}
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
	if err != nil {
		return Receipt{}, err
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Accept", "application/json")
	if c.TokenSource != nil {
		tok, err := c.TokenSource.Token(ctx)
		if err != nil {
			return Receipt{}, fmt.Errorf("token: %w", err)
		}
		if tok != "" {
			req.Header.Set("Authorization", "Bearer "+tok)
		}
	}
	resp, err := hc.Do(req)
	if err != nil {
		return Receipt{}, fmt.Errorf("%w: %v", ErrTLogUnavailable, err)
	}
	defer resp.Body.Close()
	raw, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
	switch {
	case resp.StatusCode == http.StatusOK, resp.StatusCode == http.StatusCreated:
		// ok
	case resp.StatusCode >= 500:
		return Receipt{}, fmt.Errorf("%w: status %d: %s", ErrTLogUnavailable, resp.StatusCode, truncate(raw, 256))
	default:
		return Receipt{}, fmt.Errorf("tlog: status %d: %s", resp.StatusCode, truncate(raw, 256))
	}
	var out Receipt
	if err := json.Unmarshal(raw, &out); err != nil {
		return Receipt{}, fmt.Errorf("decode receipt: %w", err)
	}
	if out.ContentHash != contentHash {
		return out, fmt.Errorf("tlog returned content_hash %q != sent %q", out.ContentHash, contentHash)
	}
	if out.LogIndex < 0 {
		return out, fmt.Errorf("tlog returned negative log_index %d", out.LogIndex)
	}
	return out, nil
}

func truncate(b []byte, n int) string {
	if len(b) <= n {
		return string(b)
	}
	return string(b[:n]) + "…"
}