package pluginstore

import (
	"crypto/sha256"
	"fmt"
	"net/http"
	"net/url"
	"strings"
	"time"
)

type preparedPluginStoreAuth struct {
	requestURL    string
	kind          string
	headers       http.Header
	authenticated bool
}

// LatestReleaseCacheKey identifies a repository under the effective credentials
// and network scope, without retaining credential material in the key.
func (c Client) LatestReleaseCacheKey(plugin Plugin) (string, error) {
	_, key, errPrepare := c.PrepareLatestRelease(plugin)
	return key, errPrepare
}

// PrepareLatestRelease binds the cache identity and initial release request to
// the same credential snapshot, even when environment values change in a queue.
func (c Client) PrepareLatestRelease(plugin Plugin) (Client, string, error) {
	owner, repo, errRepository := GitHubRepositoryParts(plugin.Repository)
	if errRepository != nil {
		return Client{}, "", errRepository
	}
	requestURL := fmt.Sprintf("https://api.github.com/repos/%s/%s/releases/latest", url.PathEscape(owner), url.PathEscape(repo))
	headers, authenticated, errHeaders := c.authHeaders(requestURL, RequestKindMetadata)
	if errHeaders != nil {
		return Client{}, "", errHeaders
	}
	c.preparedAuth = &preparedPluginStoreAuth{requestURL: requestURL, kind: RequestKindMetadata, headers: headers, authenticated: authenticated}
	return c, strings.ToLower(requestURL) + "/" + requestIdentity(c.NetworkScope, headers, authenticated), nil
}

func (c Client) authHeaders(requestURL, kind string) (http.Header, bool, error) {
	if errURL := validatePluginStoreRequestURL(c.Auth, requestURL, kind); errURL != nil {
		return nil, false, errURL
	}
	if errExpiry := validateResolvedAuthExpiry(c.ResolvedAuth, c.ResolvedAuthExpiresAt, time.Now().UTC(), requestURL, kind); errExpiry != nil {
		return nil, false, errExpiry
	}
	if prepared := c.preparedAuth; prepared != nil && prepared.requestURL == requestURL && prepared.kind == kind {
		return prepared.headers.Clone(), prepared.authenticated, nil
	}
	headers := make(http.Header)
	authenticated, errAuth := applyPluginStoreAuthForClient(headers, c.ResolvedAuth, c.Auth, requestURL, kind)
	return headers, authenticated, errAuth
}

func requestIdentity(networkScope string, headers http.Header, authenticated bool) string {
	hash := sha256.New()
	_, _ = fmt.Fprintf(hash, "%s\x00%t\x00", networkScope, authenticated)
	if authenticated {
		// Header.Write sorts header names, making equivalent auth rules share a key.
		_ = headers.Write(hash)
	}
	return fmt.Sprintf("%x", hash.Sum(nil))
}