package resolution

import (
	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
)

// enrolmentDecision is the record that made the seat.
const enrolmentDecision = "novox/hq ADR 0587"

// enrolmentVerbs are the seat's verbs: what reads all it holds and does by hand all it does (ADR 0587 §8). Not optional:
// the seat is new with its holder, so no holder of before serves fewer.
func enrolmentVerbs() []mcat.Verb {
	str := func(description string) map[string]any {
		return map[string]any{"type": "string", "description": description}
	}
	return []mcat.Verb{
		{Name: mcat.EnrolmentVerbIssue, Description: "Issue a one-time token for a new machine, on the operator's Approve: " +
			"refused at once, naming every finding, for a name that is not a node name or that a node record, a placement " +
			"key or an open enrolment holds, and for every call before the controller's lease is handed away. Otherwise " +
			"reserves the lowest free private-network address, asks the operator under the seat's own name and, on the " +
			"warrant, adds the node to placement with its tunnel key, asks the vault for the token and says enrolment-issued. " +
			"The token itself is read only through tokens.",
			Input: schema(map[string]string{
				"node":    "the new machine's name in the mesh",
				"why":     "why it joins, shown to the operator with the ask",
				"expires": "how long the token lasts, a duration such as 1h or 24h: one hour when not given, at most 24 hours",
				// The operator's decision of 2026-11-02 01:05: the tunnel key is given at issue, so on the Approve the node
				// enters placement with it and the hub peers it before redeem.
				"overlay_key": "the new machine's private network (tunnel) public key, as `nox-mesh-host key` prints it",
			}, []string{"node", "why", "overlay_key"})},
		{Name: mcat.EnrolmentVerbRedeem, Description: "Spend a token: asked by a joining node-engine dialled as enrol.<node> " +
			"alone, with the public halves of its keys and its identity key's proof over them. Spends the token, asks the " +
			"vault for the node's account and certificate, writes the node into placement, and answers the account sealed " +
			"to the node, its certificate and the vault's public half, signed by the vault. Asked again with the same keys " +
			"it finishes what is not done and answers the same; with other keys it is refused.",
			Input: map[string]any{"type": "object", "additionalProperties": false,
				"required": []string{"node", "public_key", "sealing_key", "proof"},
				"properties": map[string]any{
					"node":        str("the node the token was issued for"),
					"public_key":  str("the identity key's public half, base64"),
					"overlay_key": str("the private network key's public half"),
					"sealing_key": str("the sealing key's public half, which the account is sealed to"),
					"serving_key": str("the serving key's public half, which the certificate binds"),
					"profile":     map[string]any{"type": "object", "description": "what the machine is, as its record says it"},
					"tunnel":      map[string]any{"type": "object", "description": "a tunnel found on the machine: everything but its private key"},
					"proof":       str("the identity key's signature over the redeem's proof bytes (delivery.RedeemProof), base64"),
				}}},
		{Name: mcat.EnrolmentVerbConfirm, Description: "Confirm an enrolment: asked by the node-engine dialled as its own " +
			"node login alone, the runtime's proof of that caller being the confirmation. Says node-enrolled and ends the " +
			"enrolment.",
			Input: schema(map[string]string{}, nil)},
		{Name: mcat.EnrolmentVerbRevoke, Description: "End an enrolment at any stage, with why, without an Approve: withdraws " +
			"an open ask, deletes the node's key and its address, has the vault retire an account it already minted for " +
			"it, records the act as a hand act and says enrolment-revoked.",
			Input: schema(map[string]string{"node": "the node", "why": "why, recorded with the hand act"},
				[]string{"node", "why"})},
		{Name: mcat.EnrolmentVerbTokens, Description: "Read every open enrolment, or one: its stage, expiry, ask and revision, " +
			"the bucket's fill against its cap. For a node at live, its " +
			"token sealed to the operator key, asked of the vault at that moment and relayed as the vault sealed it. With " +
			"history, the ended enrolments from the seat's events, as far back as the events are kept.",
			Input: schema(map[string]string{"node": "one node", "history": "\"true\": the ended enrolments too"},
				nil, "history")},
		{Name: mcat.EnrolmentVerbAgain, Description: "Raise an issue's ask again when the operator's channel does not hold it, " +
			"and nothing more.",
			Input: schema(map[string]string{"node": "the node whose ask is raised again"}, []string{"node"})},
	}
}