package identity

import (
	"context"
	"crypto/ed25519"
	"encoding/base64"
	"errors"

	"github.com/jackc/pgx/v5"
)

// The reads of what Certify and EstablishAuthority would keep, without keeping anything (design 47 R4b, issue 1383): the
// controller's adapter from its stores to mesh-sdk's composition input fills the certificate and the authority it holds, and
// a machine whose certificate is not held yet is composed with a stand-in until the next send issues it.

// KnownAuthority is the mesh's public certificate when it has an authority, and false when none was established yet. It
// establishes nothing.
func (i *Identity) KnownAuthority(ctx context.Context) (string, bool, error) {
	held, err := i.authority(ctx)
	if errors.Is(err, pgx.ErrNoRows) {
		return "", false, nil
	}
	if err != nil {
		return "", false, err
	}
	return held.Certificate, true, nil
}

// KeptCertificate is the certificate Certify would answer without signing, for a node's internal name and serving key: the
// one kept for the key while it is for that name, binds that key and has life left. False when Certify would sign a fresh
// one. It writes nothing.
func (i *Identity) KeptCertificate(ctx context.Context, name, servingKey string) (string, bool, error) {
	public, err := base64.StdEncoding.DecodeString(servingKey)
	if err != nil || len(public) != ed25519.PublicKeySize {
		return "", false, nil
	}
	var kept *string
	err = i.store.Pool().QueryRow(ctx,
		`select certificate from node_key where serving_key = $1 and revoked is null`, servingKey).Scan(&kept)
	if err != nil && !errors.Is(err, pgx.ErrNoRows) {
		return "", false, err
	}
	if kept != nil && stillStands(*kept, name, public) {
		return *kept, true, nil
	}
	return "", false, nil
}