package main

import (
	"encoding/json"
	engcomp "github.com/novox/mesh-host/internal/compositions"
	"os"
	"path/filepath"
	"strings"

	"git.novox.be/novox/mesh-sdk/go/catalogue"
)

// authorityPath is where this engine keeps the mesh's own certificate as it last applied it (public): beside the
// certificate issued for the machine's name, read into its record (novox/hq ADR 0555 §3).
func authorityPath(state string) string { return filepath.Join(filepath.Dir(state), "authority.crt") }

// keepAuthority keeps the mesh's own certificate a composition carries (the resource a module's certificate.authority
// asks for, catalogue.AuthorityID), so the record says the authority this machine holds. A composition carrying none
// changes nothing.
func keepAuthority(state string, c engcomp.Composed) error {
	for _, raw := range c.Resources {
		var r struct {
			ID      string `json:"id"`
			Content string `json:"content"`
		}
		if json.Unmarshal(raw, &r) != nil || r.Content == "" || !strings.HasSuffix(r.ID, "."+catalogue.AuthorityID()) {
			continue
		}
		path := authorityPath(state)
		if was, err := os.ReadFile(path); err == nil && string(was) == r.Content {
			return nil
		}
		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
			return err
		}
		return os.WriteFile(path, []byte(r.Content), 0o644)
	}
	return nil
}