dotprot 0.3.0

//! The dotprot commands: setup, lock, unlock, and the bare-toggle dispatcher.

use std::collections::BTreeSet;
use std::fs;
use std::path::{Path, PathBuf};

use anyhow::{bail, Result};

use crate::op::OpBackend;
use crate::prot::{self, ProtData};

pub const VAULT_NAME: &str = ".prot";
const PROT_FILE: &str = ".prot";
const VAULT_DESCRIPTION: &str = "Managed by dotprot — protected .env and config files.";

/// Ensure the user is signed in to 1Password before running a command.
///
/// The default entry point used by the commands; it asks the user via an
/// interactive terminal prompt. See [`ensure_signed_in_with`] for the testable
/// core that takes the confirmation decision as a parameter.
fn ensure_signed_in(op: &impl OpBackend) -> Result<()> {
    ensure_signed_in_with(op, || {
        prompt_yes_no("You are not signed in to 1Password. Sign in now?")
    })
}

/// Core of [`ensure_signed_in`], with the "should we sign in?" decision injected
/// so it can be exercised without a real terminal.
///
/// If already signed in, returns immediately. Otherwise `confirm` decides
/// whether to run `op signin`; the production path makes that an interactive
/// prompt that is itself a no (false) in non-interactive contexts, so CI and
/// pipes never hang — they fall back to the same clear error as before.
fn ensure_signed_in_with(
    op: &impl OpBackend,
    confirm: impl FnOnce() -> Result<bool>,
) -> Result<()> {
    if op.is_signed_in()? {
        return Ok(());
    }

    if !confirm()? {
        bail!("You are not signed in to 1Password. Run `op signin` first.");
    }

    op.sign_in()?;

    // `op signin` reported success; confirm the session is actually usable
    // before we proceed to touch any protected files.
    if op.is_signed_in()? {
        Ok(())
    } else {
        bail!("Still not signed in to 1Password after `op signin`. Aborting.");
    }
}

/// Ask a yes/no question on the terminal, defaulting to "no".
///
/// Returns `Ok(false)` without prompting when stdin/stdout isn't an interactive
/// terminal, so non-interactive runs (CI, pipes) fail fast with a clear error
/// rather than blocking on input that will never arrive.
fn prompt_yes_no(question: &str) -> Result<bool> {
    use std::io::{IsTerminal, Write};

    if !std::io::stdin().is_terminal() || !std::io::stdout().is_terminal() {
        return Ok(false);
    }

    print!("{question} [y/N] ");
    std::io::stdout().flush().ok();

    let mut answer = String::new();
    std::io::stdin().read_line(&mut answer)?;
    let answer = answer.trim().to_lowercase();
    Ok(answer == "y" || answer == "yes")
}

fn prot_path(cwd: &Path) -> PathBuf {
    cwd.join(PROT_FILE)
}

/// Expand the user's patterns against the working dir into concrete relative
/// file paths. The `.prot` file itself is always excluded. Globs only match
/// files that exist on disk (used by lock). Results are sorted and de-duped.
fn expand_patterns(cwd: &Path, patterns: &[String]) -> Result<Vec<String>> {
    let mut matches: BTreeSet<String> = BTreeSet::new();

    for pattern in patterns {
        // Resolve the glob relative to cwd, then store the path back as a
        // cwd-relative string so document titles and .prot keys stay stable.
        let abs_pattern = cwd.join(pattern);
        let abs_pattern = abs_pattern.to_string_lossy();
        for entry in glob::glob(&abs_pattern)? {
            let path = match entry {
                Ok(p) => p,
                Err(e) => {
                    // An entry we couldn't read (e.g. a permission error while
                    // walking). Don't abort the whole lock over one bad entry,
                    // but never swallow it silently: a file the user meant to
                    // protect could otherwise be skipped while they believe it
                    // was handled, leaving a secret in plaintext on disk.
                    eprintln!("  warning: could not read {} — skipped", e.path().display());
                    continue;
                }
            };
            if !path.is_file() {
                continue;
            }
            if let Ok(rel) = path.strip_prefix(cwd) {
                let rel = rel.to_string_lossy().to_string();
                if rel != PROT_FILE {
                    matches.insert(rel);
                }
            }
        }
    }

    Ok(matches.into_iter().collect())
}

/// A 1Password title that's unique per absolute file path.
fn document_title(cwd: &Path, rel_file: &str) -> String {
    cwd.join(rel_file).to_string_lossy().to_string()
}

/// Whether a protected file is present on disk.
///
/// Uses `try_exists` rather than `exists` so a "couldn't determine" (e.g. a
/// permission error) is not silently read as "absent". An indeterminate result
/// is treated as **present**, which is the safe bias for every caller: unlock
/// then declines to overwrite a file it can't read, and toggle steers away from
/// a destructive restore when it can't be sure the original is gone.
fn file_exists(p: &Path) -> bool {
    p.try_exists().unwrap_or(true)
}

// ---------------------------------------------------------------------------
// setup
// ---------------------------------------------------------------------------

pub fn setup(op: &impl OpBackend) -> Result<()> {
    ensure_signed_in(op)?;

    if let Some(id) = op.find_vault(VAULT_NAME)? {
        println!("Vault \"{VAULT_NAME}\" already exists ({id}).");
        return Ok(());
    }

    let id = op.create_vault(VAULT_NAME, VAULT_DESCRIPTION)?;
    println!("Created vault \"{VAULT_NAME}\" ({id}).");
    Ok(())
}

/// Resolve the vault ID, finding it if not already cached in `prot`. If the
/// vault doesn't exist in 1Password yet, create it (a one-time action) and
/// announce it clearly so the user knows a vault was made in their account.
fn ensure_vault(op: &impl OpBackend, prot: &mut ProtData) -> Result<String> {
    if let Some(v) = &prot.vault {
        return Ok(v.clone());
    }
    let id = match op.find_vault(VAULT_NAME)? {
        Some(found) => found,
        None => {
            let created = op.create_vault(VAULT_NAME, VAULT_DESCRIPTION)?;
            println!("Created 1Password vault \"{VAULT_NAME}\" ({created}).");
            println!("(one-time setup — future runs reuse it)");
            created
        }
    };
    prot.vault = Some(id.clone());
    Ok(id)
}

// ---------------------------------------------------------------------------
// lock
// ---------------------------------------------------------------------------

/// Lock the protected files into 1Password.
///
/// With `keep = true`, files are uploaded and verified but NOT deleted from
/// disk — useful for confirming the vault copy yourself before trusting
/// dotprot to remove anything.
pub fn lock(op: &impl OpBackend, cwd: &Path, keep: bool) -> Result<()> {
    ensure_signed_in(op)?;

    let file = prot_path(cwd);
    let mut prot = match prot::read(&file)? {
        Some(p) => p,
        None => {
            // Auto-create on first lock, defaulting to .env*.
            let p = ProtData::empty();
            prot::write(&file, &p)?;
            println!("Created {PROT_FILE} (protecting: {}).", p.patterns.join(", "));
            p
        }
    };

    let vault = ensure_vault(op, &mut prot)?;
    let files = expand_patterns(cwd, &prot.patterns)?;

    if files.is_empty() {
        bail!(
            "No files match the patterns in {PROT_FILE} ({}).\n\
             Either the files are already locked, or no matching files exist.",
            prot.patterns.join(", ")
        );
    }

    let mut locked = 0;
    for rel_file in &files {
        let abs_file = cwd.join(rel_file);
        let content = fs::read(&abs_file)?;
        let title = document_title(cwd, rel_file);
        let file_name = Path::new(rel_file)
            .file_name()
            .map(|n| n.to_string_lossy().to_string())
            .unwrap_or_else(|| rel_file.clone());

        // op rejects empty stdin/empty files; a zero-byte file can't be stored
        // as a document. Skip it rather than fail.
        if content.is_empty() {
            println!("  skip {rel_file} (empty file — nothing to protect)");
            continue;
        }

        // Re-lock if we already have a doc id for this pattern entry; otherwise
        // create a fresh document.
        let id = match prot.document_id(rel_file) {
            Some(existing) => {
                let existing = existing.to_string();
                op.edit_document(&vault, &existing, &title, &file_name, &content)?;
                existing
            }
            None => op.create_document(&vault, &title, &file_name, &content)?,
        };

        // Verify-then-delete: read the document back and byte-compare before we
        // ever remove the original from disk.
        let round_trip = op.get_document(&vault, &id)?;
        if round_trip != content {
            bail!(
                "Verification failed for {rel_file}: the copy in 1Password does not \
                 match the file on disk. Left {rel_file} in place; nothing deleted."
            );
        }

        prot.set_document(rel_file, &id);
        // Persist the document id (and vault) immediately, before deleting the
        // file. If a later file fails, everything locked so far is recorded in
        // .prot and recoverable.
        prot::write(&file, &prot)?;
        if keep {
            println!("  uploaded {rel_file} -> 1Password (kept on disk)");
        } else {
            fs::remove_file(&abs_file)?;
            println!("  locked {rel_file} -> 1Password");
        }
        locked += 1;
    }

    if keep {
        println!(
            "Uploaded {locked} file(s) to vault \"{VAULT_NAME}\". \
             Originals kept on disk (--keep); run `dotprot lock` to remove them."
        );
    } else {
        println!("Locked {locked} file(s) into vault \"{VAULT_NAME}\".");
    }
    Ok(())
}

// ---------------------------------------------------------------------------
// unlock
// ---------------------------------------------------------------------------

pub fn unlock(op: &impl OpBackend, cwd: &Path) -> Result<()> {
    ensure_signed_in(op)?;

    let file = prot_path(cwd);
    let mut prot = match prot::read(&file)? {
        Some(p) => p,
        None => bail!("No {PROT_FILE} found in {}. Nothing to unlock.", cwd.display()),
    };
    if prot.documents.is_empty() {
        bail!("{PROT_FILE} has no locked documents recorded. Nothing to unlock.");
    }

    let vault = ensure_vault(op, &mut prot)?;

    let mut unlocked = 0;
    for (rel_file, id) in &prot.documents {
        let abs_file = cwd.join(rel_file);
        if file_exists(&abs_file) {
            println!("  skip {rel_file} (already present on disk)");
            continue;
        }
        let content = op.get_document(&vault, id)?;
        write_owner_only(&abs_file, &content)?;
        unlocked += 1;
        println!("  unlocked {rel_file} <- 1Password");
    }

    // Documents are intentionally kept in 1Password so the directory can
    // re-lock later. We leave prot.documents intact.
    println!("Unlocked {unlocked} file(s) from vault \"{VAULT_NAME}\".");
    Ok(())
}

/// Write a restored file with owner-only (0600) permissions on Unix.
fn write_owner_only(path: &Path, content: &[u8]) -> Result<()> {
    use std::io::Write;
    let mut opts = fs::OpenOptions::new();
    opts.write(true).create(true).truncate(true);
    #[cfg(unix)]
    {
        use std::os::unix::fs::OpenOptionsExt;
        opts.mode(0o600);
    }
    let mut f = opts.open(path)?;
    f.write_all(content)?;
    Ok(())
}

// ---------------------------------------------------------------------------
// bare `dotprot` — infer lock vs unlock from current state
// ---------------------------------------------------------------------------

pub fn toggle(op: &impl OpBackend, cwd: &Path, keep: bool) -> Result<()> {
    let file = prot_path(cwd);
    let prot = prot::read(&file)?;

    // No .prot at all (or nothing recorded) -> first run -> lock.
    let prot = match prot {
        Some(p) if !p.documents.is_empty() => p,
        _ => return lock(op, cwd, keep),
    };

    // Compare recorded documents against what's on disk.
    let mut present: Vec<&str> = Vec::new();
    let mut absent: Vec<&str> = Vec::new();
    for (rel_file, _) in &prot.documents {
        if file_exists(&cwd.join(rel_file)) {
            present.push(rel_file);
        } else {
            absent.push(rel_file);
        }
    }

    if !present.is_empty() && !absent.is_empty() {
        bail!(
            "Mixed state: some recorded files are present on disk and others are missing, \
             so it's unclear whether you mean to lock or unlock.\n\
             \x20 present: {}\n\
             \x20 missing: {}\n\
             Use `dotprot lock` or `dotprot unlock` explicitly to resolve the ambiguity.",
            present.join(", "),
            absent.join(", "),
        );
    }

    if !absent.is_empty() {
        // Everything recorded is missing -> restore. (--keep is a no-op here.)
        unlock(op, cwd)
    } else {
        // Everything recorded is present -> re-lock.
        lock(op, cwd, keep)
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::op::OpBackend;
    use std::cell::RefCell;

    /// A fake [`OpBackend`] that records each call and stores "uploaded"
    /// document bytes in memory, so tests can drive lock/unlock without a live
    /// vault and assert the verify-then-delete ordering.
    struct MockOp {
        /// Ordered log of operations, for asserting sequencing.
        calls: RefCell<Vec<String>>,
        /// id -> bytes, as if stored in 1Password.
        docs: RefCell<Vec<(String, Vec<u8>)>>,
        /// When true, `get_document` returns bytes that differ from what was
        /// uploaded — simulating a corrupted or partial upload on read-back.
        corrupt_readback: bool,
        /// Current sign-in state. `sign_in()` flips it to true, modelling a
        /// successful `op signin`.
        signed_in: RefCell<bool>,
        /// When true, `sign_in()` does NOT flip `signed_in` — modelling a user
        /// who cancels the auth or whose session still isn't usable afterward.
        signin_fails: bool,
    }

    impl MockOp {
        fn new() -> Self {
            MockOp {
                calls: RefCell::new(Vec::new()),
                docs: RefCell::new(Vec::new()),
                corrupt_readback: false,
                signed_in: RefCell::new(true),
                signin_fails: false,
            }
        }

        fn corrupting() -> Self {
            let mut m = Self::new();
            m.corrupt_readback = true;
            m
        }

        /// A backend that starts signed out. `sign_in()` will flip it to
        /// signed-in unless `signin_fails` is also set.
        fn signed_out() -> Self {
            let m = Self::new();
            *m.signed_in.borrow_mut() = false;
            m
        }

        fn called(&self, name: &str) -> bool {
            self.calls.borrow().iter().any(|c| c == name)
        }

        fn store(&self, id: &str, content: &[u8]) {
            let mut docs = self.docs.borrow_mut();
            if let Some(entry) = docs.iter_mut().find(|(i, _)| i == id) {
                entry.1 = content.to_vec();
            } else {
                docs.push((id.to_string(), content.to_vec()));
            }
        }
    }

    impl OpBackend for MockOp {
        fn is_signed_in(&self) -> Result<bool> {
            self.calls.borrow_mut().push("is_signed_in".into());
            Ok(*self.signed_in.borrow())
        }
        fn sign_in(&self) -> Result<()> {
            self.calls.borrow_mut().push("sign_in".into());
            if !self.signin_fails {
                *self.signed_in.borrow_mut() = true;
            }
            Ok(())
        }
        fn find_vault(&self, _name: &str) -> Result<Option<String>> {
            Ok(Some("VAULT".into()))
        }
        fn create_vault(&self, _name: &str, _description: &str) -> Result<String> {
            Ok("VAULT".into())
        }
        fn create_document(
            &self,
            _vault: &str,
            _title: &str,
            _file_name: &str,
            content: &[u8],
        ) -> Result<String> {
            self.calls.borrow_mut().push("create_document".into());
            let id = format!("DOC{}", self.docs.borrow().len());
            self.store(&id, content);
            Ok(id)
        }
        fn edit_document(
            &self,
            _vault: &str,
            id: &str,
            _title: &str,
            _file_name: &str,
            content: &[u8],
        ) -> Result<()> {
            self.calls.borrow_mut().push("edit_document".into());
            self.store(id, content);
            Ok(())
        }
        fn get_document(&self, _vault: &str, id: &str) -> Result<Vec<u8>> {
            self.calls.borrow_mut().push("get_document".into());
            let bytes = self
                .docs
                .borrow()
                .iter()
                .find(|(i, _)| i == id)
                .map(|(_, b)| b.clone())
                .unwrap_or_default();
            if self.corrupt_readback {
                // Return something that won't match what's on disk.
                Ok(b"CORRUPTED".to_vec())
            } else {
                Ok(bytes)
            }
        }
    }

    /// Write a `.prot` with a single `.env` pattern and a real `.env` file.
    fn setup_dir(secret: &[u8]) -> tempfile::TempDir {
        let dir = tempfile::tempdir().unwrap();
        fs::write(dir.path().join(".env"), secret).unwrap();
        let mut prot = ProtData::empty();
        prot.vault = Some("VAULT".to_string());
        prot::write(&dir.path().join(PROT_FILE), &prot).unwrap();
        dir
    }

    #[test]
    fn lock_deletes_only_after_successful_readback() {
        let dir = setup_dir(b"SECRET=1\n");
        let op = MockOp::new();

        lock(&op, dir.path(), false).unwrap();

        // File is gone, but only because the round-trip matched.
        assert!(!dir.path().join(".env").exists(), ".env should be deleted");

        // The read-back (get_document) must precede nothing destructive on disk,
        // and must come after the upload. Verify the upload->verify ordering.
        let calls = op.calls.borrow();
        let upload = calls.iter().position(|c| c == "create_document").unwrap();
        let verify = calls.iter().position(|c| c == "get_document").unwrap();
        assert!(
            upload < verify,
            "upload must happen before read-back verify"
        );

        // The document id was persisted to .prot.
        let prot = prot::read(&dir.path().join(PROT_FILE)).unwrap().unwrap();
        assert_eq!(prot.document_id(".env"), Some("DOC0"));
    }

    #[test]
    fn lock_keeps_file_when_readback_mismatches() {
        let dir = setup_dir(b"SECRET=1\n");
        let op = MockOp::corrupting();

        // The cardinal rule: a mismatched read-back must NOT delete the file.
        let err = lock(&op, dir.path(), false).unwrap_err();

        assert!(
            dir.path().join(".env").exists(),
            ".env must survive a failed verification"
        );
        assert!(
            err.to_string().contains("Verification failed"),
            "expected a verification-failed error, got: {err}"
        );
        // And we never recorded a (bogus) success in .prot.
        let prot = prot::read(&dir.path().join(PROT_FILE)).unwrap().unwrap();
        assert_eq!(prot.document_id(".env"), None);
    }

    #[test]
    fn lock_with_keep_uploads_and_verifies_but_does_not_delete() {
        let dir = setup_dir(b"SECRET=1\n");
        let op = MockOp::new();

        lock(&op, dir.path(), true).unwrap();

        assert!(
            dir.path().join(".env").exists(),
            "--keep must leave the file on disk"
        );
        // It was still uploaded and verified (id recorded), so the user can
        // confirm the vault copy before trusting deletion.
        let calls = op.calls.borrow();
        assert!(calls.iter().any(|c| c == "get_document"), "must verify");
        let prot = prot::read(&dir.path().join(PROT_FILE)).unwrap().unwrap();
        assert_eq!(prot.document_id(".env"), Some("DOC0"));
    }

    #[test]
    fn unlock_restores_file_with_owner_only_mode() {
        let dir = setup_dir(b"SECRET=restored\n");
        let op = MockOp::new();

        // Lock first (file gets deleted), then unlock to restore it.
        lock(&op, dir.path(), false).unwrap();
        assert!(!dir.path().join(".env").exists());

        unlock(&op, dir.path()).unwrap();

        let restored = fs::read(dir.path().join(".env")).unwrap();
        assert_eq!(restored, b"SECRET=restored\n");

        #[cfg(unix)]
        {
            use std::os::unix::fs::PermissionsExt;
            let mode = fs::metadata(dir.path().join(".env"))
                .unwrap()
                .permissions()
                .mode();
            assert_eq!(mode & 0o777, 0o600, "restored file must be 0600");
        }
    }

    // --- sign-in orchestration --------------------------------------------

    #[test]
    fn ensure_signed_in_is_noop_when_already_signed_in() {
        let op = MockOp::new(); // starts signed in
        ensure_signed_in_with(&op, || panic!("must not prompt when already signed in")).unwrap();
        assert!(
            !op.called("sign_in"),
            "must not sign in when already signed in"
        );
    }

    #[test]
    fn ensure_signed_in_signs_in_when_user_confirms() {
        let op = MockOp::signed_out();
        // User says yes.
        ensure_signed_in_with(&op, || Ok(true)).unwrap();
        assert!(op.called("sign_in"), "should have run sign_in on confirm");
    }

    #[test]
    fn ensure_signed_in_errors_and_skips_signin_when_user_declines() {
        let op = MockOp::signed_out();
        // User says no (this is also the non-interactive fallback: confirm = false).
        let err = ensure_signed_in_with(&op, || Ok(false)).unwrap_err();
        assert!(
            err.to_string().contains("not signed in"),
            "expected a not-signed-in error, got: {err}"
        );
        assert!(
            !op.called("sign_in"),
            "must not sign in when the user declines / non-interactive"
        );
    }

    #[test]
    fn ensure_signed_in_errors_when_signin_does_not_take() {
        let mut op = MockOp::signed_out();
        op.signin_fails = true; // op signin "succeeds" but session still unusable
        let err = ensure_signed_in_with(&op, || Ok(true)).unwrap_err();
        assert!(
            err.to_string().contains("Still not signed in"),
            "expected a post-signin failure, got: {err}"
        );
    }

    #[test]
    fn lock_aborts_without_touching_files_when_not_signed_in() {
        let dir = setup_dir(b"SECRET=1\n");
        // Signed out; non-interactive test harness means the prompt resolves to
        // "no", so lock must bail before uploading or deleting anything.
        let op = MockOp::signed_out();

        let err = lock(&op, dir.path(), false).unwrap_err();

        assert!(err.to_string().contains("not signed in"));
        assert!(
            dir.path().join(".env").exists(),
            ".env must be untouched when not signed in"
        );
        assert!(
            !op.called("create_document"),
            "must not upload when signed out"
        );
    }
}