envseal 0.3.14

//! Read-only queries against the vault directory.
//!
//! Most functions in this file work on the filesystem only — no
//! `Vault::open*` call, no master key in memory. Used by the
//! desktop GUI's filesystem-only refresh paths (Secrets list,
//! Audit log, Dashboard counters), the CLI's `list` / `status`
//! commands, and the MCP server's status endpoints.
//!
//! The two read-only operations that *do* need an unlocked vault
//! ([`peek_secret`], [`peek_secret_default`]) live here too because
//! they're the natural counterpart to `list_secrets` from a
//! consumer's standpoint — knowing a secret exists is one step
//! short of seeing its redacted preview.

use std::path::{Path, PathBuf};

/// Render the one-line "last audit event" summary for the status
/// surface. Decrypted [`crate::audit::ParsedEntry`] path (post-0.3.13) so the human
/// fields are extracted from the typed enum rather than substring-
/// grepping a sealed JSON line. Mirrors the legacy formatter's
/// three branches (binary+secret / secret-only / event-only) so
/// the status output stays visually unchanged across the
/// encryption migration.
fn format_audit_summary(ts_short: &str, event: &crate::audit::AuditEvent) -> String {
    use crate::audit::AuditEvent;
    let (tag, binary, secret): (&str, Option<&str>, Option<&str>) = match event {
        AuditEvent::ApprovalRequested { binary, secret } => (
            "approval_requested",
            Some(binary.as_str()),
            Some(secret.as_str()),
        ),
        AuditEvent::ApprovalResult { binary, secret, .. } => (
            "approval_result",
            Some(binary.as_str()),
            Some(secret.as_str()),
        ),
        AuditEvent::SecretAccessed { binary, secret } => (
            "secret_accessed",
            Some(binary.as_str()),
            Some(secret.as_str()),
        ),
        AuditEvent::SupervisorLeakDetected { binary, secret, .. } => (
            "supervisor_leak_detected",
            Some(binary.as_str()),
            Some(secret.as_str()),
        ),
        AuditEvent::SecretStored { name } => ("secret_stored", None, Some(name.as_str())),
        AuditEvent::SecretRevoked { name } => ("secret_revoked", None, Some(name.as_str())),
        AuditEvent::SecretStoreFailed { name, .. } => {
            ("secret_store_failed", None, Some(name.as_str()))
        }
        AuditEvent::SignalRecorded { .. } => ("signal_recorded", None, None),
        AuditEvent::ChallengeAttempted { .. } => ("challenge_attempted", None, None),
        AuditEvent::TierChanged { .. } => ("tier_changed", None, None),
        AuditEvent::RateLimited { .. } => ("rate_limited", None, None),
        AuditEvent::Fido2Enrolled { .. } => ("fido2_enrolled", None, None),
        AuditEvent::Fido2Disabled { .. } => ("fido2_disabled", None, None),
        AuditEvent::Fido2Unlock { .. } => ("fido2_unlock", None, None),
        AuditEvent::EncryptedUnreadable { .. } => ("encrypted_unreadable", None, None),
    };
    match (binary, secret) {
        (Some(b), Some(s)) => format!(" {ts_short}  {tag:<22} {b} → {s}"),
        (None, Some(s)) => format!(" {ts_short}  {tag:<22} {s}"),
        _ => format!(" {ts_short}  {tag}"),
    }
}

/// Read a file as UTF-8 with a hard byte cap, returning the same
/// shape as [`std::fs::read_to_string`]. Used by status / dashboard
/// readers that surface user-pointed config files where a hostile
/// substitution must not be able to allocate gigabytes.
fn read_capped_to_string(path: &Path, max_bytes: u64) -> std::io::Result<String> {
    use std::io::Read;
    let file = std::fs::File::open(path)?;
    let mut s = String::new();
    file.take(max_bytes).read_to_string(&mut s)?;
    Ok(s)
}

use zeroize::Zeroize;

use crate::audit::extract_json_field;
use crate::error::Error;
use crate::vault::Vault;

/// Get the default vault root directory without opening or unlocking.
///
/// Respects `XDG_CONFIG_HOME`. Otherwise falls back to:
/// - `$HOME/.config/envseal` on Unix
/// - `$HOME/.config/envseal` on Windows when `HOME` is set (e.g. Git Bash)
/// - `%USERPROFILE%/.config/envseal` on plain `cmd.exe` / `PowerShell`
///
/// The Windows `USERPROFILE` fallback prevents the "HOME not set" error
/// users hit on a clean install with no Git-for-Windows on PATH.
pub fn vault_root() -> Result<PathBuf, Error> {
    // Reuse the validated dirs_path() so XDG_CONFIG_HOME poisoning
    // is caught consistently across all vault-root resolution paths.
    Ok(crate::vault::store::dirs_path()?.join("envseal"))
}

// ── Secret listing (no passphrase — filesystem only) ──────────────

/// Information about a stored secret (no decryption needed).
#[derive(Debug, Clone)]
pub struct SecretInfo {
    /// Secret name (derived from filename).
    pub name: String,
    /// Last modification time.
    pub modified: Option<std::time::SystemTime>,
}

/// List all secrets in the vault with metadata.
///
/// Does NOT require a passphrase — just scans `.seal` files.
/// Use this for `list`, `status`, pre-validation, etc.
pub fn list_secrets(root: &Path) -> Result<Vec<SecretInfo>, Error> {
    let vault_dir = root.join("vault");
    crate::guard::verify_not_symlink(&vault_dir)?;
    let mut entries = Vec::new();

    if vault_dir.exists() {
        for entry in std::fs::read_dir(&vault_dir)? {
            let entry = entry?;
            let path = entry.path();
            if path.extension().and_then(|e| e.to_str()) == Some("seal") {
                if let Some(stem) = path.file_stem().and_then(|s| s.to_str()) {
                    crate::guard::verify_not_symlink(&path)?;
                    let modified = std::fs::symlink_metadata(&path)
                        .ok()
                        .and_then(|m| m.modified().ok());
                    entries.push(SecretInfo {
                        name: stem.to_string(),
                        modified,
                    });
                }
            }
        }
    }

    entries.sort_by(|a, b| a.name.cmp(&b.name));
    Ok(entries)
}

/// List secret names only (convenience wrapper).
pub fn list_secret_names(root: &Path) -> Result<Vec<String>, Error> {
    Ok(list_secrets(root)?.into_iter().map(|s| s.name).collect())
}

/// Check if a specific secret exists without passphrase.
pub fn secret_exists(root: &Path, name: &str) -> Result<bool, Error> {
    // Validate name to prevent path-traversal probes via this helper.
    if name.contains('/') || name.contains('\\') || name.contains('\0') || name.starts_with('.') {
        return Err(Error::CryptoFailure(format!(
            "invalid secret name '{name}': must not contain path separators or start with '.'"
        )));
    }
    let path = root.join("vault").join(format!("{name}.seal"));
    crate::guard::verify_not_symlink(&path)?;
    Ok(path.exists())
}

// ── Format helpers ────────────────────────────────────────────────

/// Format a duration as a human-readable age string.
#[must_use]
pub fn format_age(modified: std::time::SystemTime) -> String {
    std::time::SystemTime::now()
        .duration_since(modified)
        .ok()
        .map_or_else(
            || "—".to_string(),
            |d| {
                let secs = d.as_secs();
                if secs < 60 {
                    "just now".to_string()
                } else if secs < 3600 {
                    format!("{}m ago", secs / 60)
                } else if secs < 86400 {
                    format!("{}h ago", secs / 3600)
                } else {
                    format!("{}d ago", secs / 86400)
                }
            },
        )
}

// ── Secret type detection ─────────────────────────────────────────

/// Detect the type of a secret by its value prefix.
///
/// Returns a human-readable label (for example, an `OpenAI` API key) or `None`.
#[must_use]
pub fn detect_secret_type(value: &str) -> Option<&'static str> {
    // Order matters — more specific prefixes first
    static DETECTIONS: &[(&str, &str)] = &[
        ("sk-proj-", "OpenAI Project Key"),
        ("sk-ant-", "Anthropic API Key"),
        ("sk-", "OpenAI API Key"),
        ("ghp_", "GitHub PAT"),
        ("gho_", "GitHub OAuth"),
        ("github_pat_", "GitHub Fine-Grained PAT"),
        ("glpat-", "GitLab PAT"),
        ("AKIA", "AWS Access Key"),
        ("xoxb-", "Slack Bot Token"),
        ("xoxp-", "Slack User Token"),
        ("sk_live_", "Stripe Secret Key"),
        ("sk_test_", "Stripe Test Key"),
        ("pk_live_", "Stripe Publishable Key"),
        ("pk_test_", "Stripe Test Publishable Key"),
        ("rk_live_", "Stripe Restricted Key"),
        ("SG.", "SendGrid API Key"),
        ("key-", "Mailgun API Key"),
        ("AIza", "Google API Key"),
        ("npm_", "npm Token"),
        ("pypi-", "PyPI Token"),
        ("eyJ", "JWT Token"),
        ("https://", "URL"),
        ("http://", "URL"),
        ("postgresql://", "PostgreSQL URL"),
        ("postgres://", "PostgreSQL URL"),
        ("mysql://", "MySQL URL"),
        ("redis://", "Redis URL"),
        ("mongodb://", "MongoDB URL"),
        ("mongodb+srv://", "MongoDB Atlas URL"),
    ];

    DETECTIONS
        .iter()
        .find(|(prefix, _)| value.starts_with(prefix))
        .map(|(_, label)| *label)
}

// ── Peek (redacted preview — needs unlocked vault) ────────────────

/// Result of peeking at a secret (redacted preview).
#[derive(Debug, Clone)]
pub struct PeekResult {
    /// Secret name.
    pub name: String,
    /// Redacted value (e.g., "sk-p...X84f").
    pub redacted: String,
    /// Character count of the full value.
    pub length: usize,
    /// Detected secret type, if any.
    pub secret_type: Option<&'static str>,
}

/// Get a redacted preview of a secret.
///
/// Shows first 4 and last 4 characters. Detects secret type by prefix.
/// NEVER returns the full value.
pub fn peek_secret(vault: &Vault, name: &str) -> Result<PeekResult, Error> {
    let mut plaintext = vault.decrypt(name)?;
    let vec = std::mem::take(&mut *plaintext);
    let s = match String::from_utf8(vec) {
        Ok(s) => s,
        Err(e) => {
            let mut vec = e.into_bytes();
            vec.zeroize();
            return Err(Error::CryptoFailure(
                "secret is not valid UTF-8".to_string(),
            ));
        }
    };
    let mut value = zeroize::Zeroizing::new(s);

    let redacted = if value.len() <= 10 {
        let mut prefix = value.chars().take(2).collect::<String>();
        let res = format!("{prefix}***");
        prefix.zeroize();
        res
    } else {
        let mut prefix = value.chars().take(4).collect::<String>();
        let mut suffix_rev = value.chars().rev().take(4).collect::<String>();
        let mut suffix = suffix_rev.chars().rev().collect::<String>();
        let res = format!("{prefix}...{suffix}");
        prefix.zeroize();
        suffix_rev.zeroize();
        suffix.zeroize();
        res
    };

    let length = value.len();
    let secret_type = detect_secret_type(&value);

    // H batch 1 (audit, May 2026): zeroize BEFORE shrink_to_fit.
    // shrink_to_fit may allocate a smaller buffer and copy the
    // (still-cleartext) bytes into it before deallocating the
    // original — leaving the secret in allocator slop until reuse.
    // Wiping in-place first, then shrinking, is the safe order.
    // The `Zeroizing` Drop also wipes on scope exit, so this
    // explicit `value.zeroize()` is belt-and-suspenders against
    // a future refactor that drops the wrapper.
    value.zeroize();
    value.shrink_to_fit();

    Ok(PeekResult {
        name: name.to_string(),
        redacted,
        length,
        secret_type,
    })
}

/// Peek at a secret in the default vault (redacted preview only).
pub fn peek_secret_default(name: &str) -> Result<PeekResult, Error> {
    let vault = Vault::open_default()?;
    peek_secret(&vault, name)
}

/// Peek at a secret in the default vault, requiring GUI approval for full value.
pub fn peek_secret_full_default(name: &str) -> Result<zeroize::Zeroizing<String>, Error> {
    let vault = Vault::open_default()?;
    let config = crate::security_config::load_config(vault.root(), vault.master_key_bytes())?;
    let binary_path = std::env::current_exe()
        .map_err(|e| Error::BinaryResolution(format!("cannot determine current executable: {e}")))?
        .to_string_lossy()
        .to_string();

    let approval = crate::gui::request_approval(
        &binary_path,
        &[
            String::from("envseal"),
            String::from("peek"),
            name.to_string(),
            String::from("--full"),
        ],
        name,
        "",
        &config,
    )?;

    match approval {
        crate::gui::Approval::AllowOnce | crate::gui::Approval::AllowAlways => {
            let mut plaintext = vault.decrypt(name)?;
            match String::from_utf8(std::mem::take(&mut *plaintext)) {
                // Wrap the returned plaintext in Zeroizing so the heap
                // buffer is wiped on drop after the caller is done
                // displaying it. Without this, `cli peek --full`'s
                // `println!` consumed the String and dropped it via
                // default String::drop, leaving the secret bytes in
                // allocator slop until reuse.
                Ok(s) => Ok(zeroize::Zeroizing::new(s)),
                Err(e) => {
                    let mut vec = e.into_bytes();
                    vec.zeroize();
                    Err(Error::CryptoFailure(
                        "secret is not valid UTF-8".to_string(),
                    ))
                }
            }
        }
        crate::gui::Approval::Deny => Err(Error::UserDenied),
    }
}

// ── .envseal file checking ────────────────────────────────────────

/// Result of checking a .envseal file against the vault.
#[derive(Debug, Clone)]
pub struct CheckResult {
    /// Secrets that are present in the vault.
    pub satisfied: Vec<EnvMapping>,
    /// Secrets that are missing from the vault.
    pub missing: Vec<EnvMapping>,
}

/// A single env var → secret name mapping.
#[derive(Debug, Clone)]
pub struct EnvMapping {
    /// Environment variable name.
    pub env_var: String,
    /// Secret name in the vault.
    pub secret_name: String,
    /// Whether this secret exists in the vault.
    pub present: bool,
}

/// Check a .envseal file against the vault (no passphrase needed).
pub fn check_envseal_file(root: &Path, envseal_path: &Path) -> Result<CheckResult, Error> {
    let mappings = crate::envseal_file::parse_envseal_file(envseal_path)?;
    let names = list_secret_names(root)?;

    let mut satisfied = Vec::new();
    let mut missing = Vec::new();

    for m in mappings {
        let present = names.contains(&m.secret_name);
        let mapping = EnvMapping {
            env_var: m.env_var.clone(),
            secret_name: m.secret_name.clone(),
            present,
        };
        if present {
            satisfied.push(mapping);
        } else {
            missing.push(mapping);
        }
    }

    Ok(CheckResult { satisfied, missing })
}

/// Dry-run: show what env vars would be injected (no passphrase needed).
pub fn env_dry_run(root: &Path, cwd: &Path) -> Result<CheckResult, Error> {
    let mappings = if let Some(m) = crate::envseal_file::discover_and_load(cwd)? {
        m
    } else {
        let names = list_secret_names(root)?;
        crate::envseal_file::auto_map_from_names(&names)
    };

    let names = list_secret_names(root)?;
    let mut satisfied = Vec::new();
    let mut missing = Vec::new();

    for m in mappings {
        let present = names.contains(&m.secret_name);
        let mapping = EnvMapping {
            env_var: m.env_var.clone(),
            secret_name: m.secret_name.clone(),
            present,
        };
        if present {
            satisfied.push(mapping);
        } else {
            missing.push(mapping);
        }
    }

    Ok(CheckResult { satisfied, missing })
}

// ── Vault status (no passphrase) ──────────────────────────────────

/// High-level vault status overview.
#[derive(Debug, Clone)]
pub struct VaultStatus {
    /// Vault root directory.
    pub root: PathBuf,
    /// Number of secrets stored.
    pub secret_count: usize,
    /// Whether the master key is initialized.
    pub initialized: bool,
    /// Whether a .envseal file was found in cwd.
    pub envseal_found: bool,
    /// Security tier string.
    pub security_tier: String,
    /// Last audit log entry.
    pub last_audit: Option<String>,
}

/// Get vault status overview.
pub fn vault_status(root: &Path) -> Result<VaultStatus, Error> {
    let secrets = list_secrets(root)?;
    let initialized = root.join("master.key").exists();

    let cwd = std::env::current_dir().unwrap_or_default();
    let envseal_found = crate::envseal_file::discover_and_load(&cwd)
        .ok()
        .flatten()
        .is_some();

    let mut corrupted = false;
    if initialized {
        let mk_path = root.join("master.key");
        if let Ok(raw) = std::fs::read(&mk_path) {
            if crate::vault::hardware::parse_v2(&raw).is_err() {
                let min_v1_len = 16 + 12; // ARGON2_SALT_LEN + NONCE_LEN
                if raw.len() < min_v1_len {
                    corrupted = true;
                }
            }
        } else {
            corrupted = true;
        }
    }

    // Do not call Vault::open(root) here as it prompts the user for a passphrase!
    let security_tier = if corrupted {
        "Corrupted".to_string()
    } else if !initialized {
        "Standard (default)".to_string()
    } else if root.join("security.sealed").exists() {
        // v0.3.0+ sealed config exists but requires the master key to decrypt.
        "Locked (passphrase required)".to_string()
    } else if root.join("security.toml").exists() {
        // v0.2.x legacy: try to read the tier field without verifying HMAC.
        // This is acceptable for a status command that makes no security decisions.
        // Cap the read at 1 MiB — legitimate security.toml is < 4 KiB; the
        // cap prevents a hostile substitution with a multi-GB file from
        // pinning RAM during a `status` query.
        read_capped_to_string(&root.join("security.toml"), 1024 * 1024)
            .ok()
            .and_then(|content| {
                content
                    .lines()
                    .find(|l| l.trim_start().starts_with("tier"))
                    .map(|l| {
                        l.split('=').nth(1).map_or_else(
                            || "Standard".to_string(),
                            |v| v.trim().trim_matches('"').to_string(),
                        )
                    })
            })
            .unwrap_or_else(|| "Standard (default)".to_string())
    } else {
        "Standard (default)".to_string()
    };

    // Audit lines are sealed since 0.3.13 — `event`/`binary`/`secret`
    // fields no longer live in the raw JSON. Use the parsed reader
    // (which decrypts under the per-vault audit key) so the status
    // line keeps showing the latest event in human form. Fall back
    // to the legacy field-extract path for pre-encryption entries
    // that may still be on disk during the migration window.
    let last_audit = crate::audit::read_last_parsed_at(root, 1)
        .entries
        .into_iter()
        .next()
        .map(|p| {
            let ts_short = p.ts.get(..16).unwrap_or(&p.ts).replace('T', " ");
            format_audit_summary(&ts_short, &p.event)
        })
        .or_else(|| {
            crate::audit::read_last(1).into_iter().next().map(|raw| {
                let ts = extract_json_field(&raw, "ts").unwrap_or_default();
                let event = extract_json_field(&raw, "event").unwrap_or_default();
                let binary = extract_json_field(&raw, "binary").unwrap_or_default();
                let secret = extract_json_field(&raw, "secret").unwrap_or_default();
                let ts_short = ts.get(..16).unwrap_or(&ts).replace('T', " ");
                if !binary.is_empty() && !secret.is_empty() {
                    format!(" {ts_short}  {event:<22} {binary} → {secret}")
                } else if !secret.is_empty() {
                    format!(" {ts_short}  {event:<22} {secret}")
                } else {
                    format!(" {ts_short}  {event}")
                }
            })
        });

    Ok(VaultStatus {
        root: root.to_path_buf(),
        secret_count: secrets.len(),
        initialized: initialized && !corrupted,
        envseal_found,
        security_tier,
        last_audit,
    })
}

/// Return the last `n` audit entries from the default vault as raw
/// JSON lines. Used by `envseal audit` and any external consumer
/// that wants newline-delimited JSON unchanged.
#[must_use]
pub fn audit_log(n: usize) -> Vec<String> {
    crate::audit::read_last(n)
}

/// Return the last `n` audit entries from the default vault, parsed
/// into typed [`crate::audit::ParsedEntry`] values. Used by the
/// desktop GUI (and any structured renderer) so per-event icons,
/// summaries, and timestamps can be rendered without re-parsing
/// JSON in every consumer.
#[must_use]
pub fn audit_log_parsed(n: usize) -> crate::audit::ParsedReadResult {
    let Ok(dir) = crate::audit::log::default_audit_dir() else {
        return crate::audit::ParsedReadResult::default();
    };
    crate::audit::read_last_parsed_at(&dir, n)
}

/// Return the last `n` audit entries from the default vault that
/// match `filter`, as raw JSON lines.
#[must_use]
pub fn audit_log_filtered(n: usize, filter: &crate::audit::AuditFilter) -> Vec<String> {
    crate::audit::read_last_filtered(n, filter)
}

/// Return the last `n` audit entries from the default vault that
/// match `filter`, parsed into typed [`crate::audit::ParsedEntry`]
/// values. Used by the desktop GUI's filter bar.
#[must_use]
pub fn audit_log_parsed_filtered(
    n: usize,
    filter: &crate::audit::AuditFilter,
) -> crate::audit::ParsedReadResult {
    let Ok(dir) = crate::audit::log::default_audit_dir() else {
        return crate::audit::ParsedReadResult::default();
    };
    crate::audit::read_last_parsed_filtered_at(&dir, n, filter)
}