//! The credential this hive reads the forge with: its own read-only account,
//! whose token `swarm-controller` mints into the store at
//! `swarm/hives/<hive>/forge/token`.

use super::basic_auth_header;

/// A forge token and the account it belongs to.
///
/// No `Debug` derive: `value` is a live forge credential.
pub struct ReaderToken {
    login: String,
    value: String,
}

impl std::fmt::Debug for ReaderToken {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("ReaderToken")
            .field("login", &self.login)
            .field("value", &"<redacted>")
            .finish()
    }
}

impl ReaderToken {
    /// The `http.extraHeader` value for git; see [`basic_auth_header`].
    pub fn auth_header(&self) -> String {
        basic_auth_header(&self.login, &self.value)
    }
}

/// The token to read the forge with, or `None` when the store holds none for
/// this hive.
///
/// 🩸 Logs the store path, never a value.
pub async fn reader_token() -> Option<ReaderToken> {
    let token = stored_reader_token().await;
    if let Some(t) = &token {
        tracing::debug!(login = %t.login, "forge: reading as this account");
    }
    token
}

/// This hive's token from the store, under the hive's own identity.
///
/// `None`, never an error, for every way it can come up empty — no hive name,
/// no `BAO_*` identity, an unreachable store, nothing at the path.
async fn stored_reader_token() -> Option<ReaderToken> {
    let hive = std::env::var("HYPERHIVE_HIVE_NAME")
        .ok()
        .filter(|h| !h.is_empty())?;
    let path = match swarm_secret_client::forge::hive_token_path(&hive) {
        Ok(path) => path,
        Err(e) => {
            tracing::warn!(error = %e, "forge: this hive's name does not form a store path");
            return None;
        }
    };
    let store = match swarm_secret_client::SecretStore::from_env(&hive).await {
        Ok(store) => store,
        Err(e) => {
            tracing::debug!(error = %e, "forge: no swarm secret store to read the hive token from");
            return None;
        }
    };
    match store
        .read::<swarm_secret_client::forge::Credential>(&path)
        .await
    {
        Ok(credential) if !credential.value.trim().is_empty() => Some(ReaderToken {
            login: swarm_secret_client::forge::hive_login(&hive),
            value: credential.value.trim().to_owned(),
        }),
        Ok(_) => {
            tracing::warn!(%path, "forge: the stored hive token is empty");
            None
        }
        Err(e) => {
            tracing::debug!(%path, error = %e, "forge: no hive token in the store");
            None
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    fn stored() -> ReaderToken {
        ReaderToken {
            login: "hive-alpha".to_owned(),
            value: "from-the-store".to_owned(),
        }
    }

    #[test]
    fn the_header_names_the_tokens_own_account() {
        use base64::Engine as _;
        let header = stored().auth_header();
        let encoded = header
            .strip_prefix("Authorization: Basic ")
            .expect("a basic auth header");
        let decoded = base64::engine::general_purpose::STANDARD
            .decode(encoded)
            .expect("base64");
        assert_eq!(decoded, b"hive-alpha:from-the-store");
    }

    #[test]
    fn debug_never_prints_the_value() {
        let shown = format!("{:?}", stored());
        assert!(!shown.contains("from-the-store"), "{shown}");
        assert!(shown.contains("hive-alpha"), "{shown}");
    }
}