holger-intel 2.0.0

//! The persistent local advisory database on the secure side.
//!
//! ```text
//! <db_dir>/
//!   installed.json               what is live: sequence, snapshot date, digests
//!   advisories-<sequence>.json   the advisory set of that generation
//!   state/                       the anti-rollback floor (update-bundle RollbackStore)
//!   bundles/<bundle_id>.holger.znippy   the verified bundle, kept for re-verify
//!   receipts/<bundle_id>.json    the import receipt
//! ```
//!
//! A new generation is written beside the live one and goes live in ONE atomic
//! rename of `installed.json`, so a reader sees either the old set or the new
//! one, never half of either. `installed.json` records the set's SHA-256 and a
//! load refuses a set that no longer matches it: a database edited in place is
//! an error, not an answer.

use std::path::{Path, PathBuf};

use anyhow::{bail, Context, Result};
use chrono::{DateTime, Utc};
use holger_update_bundle::atomic_write;
use holger_update_bundle::digest::sha256_hex;
use serde::{Deserialize, Serialize};

use crate::set::AdvisorySet;

/// The schema of `installed.json`.
pub const INSTALLED_SCHEMA: &str = "holger.intel-installed/v1";

/// What is live.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
pub struct InstalledIntel {
    pub schema: String,
    pub bundle_id: String,
    pub sequence: u64,
    pub supplier: String,
    /// The bundle's `created_at`: the date the advisories are as of. Staleness
    /// counts from here.
    pub snapshot_at: DateTime<Utc>,
    pub imported_at: DateTime<Utc>,
    pub candidate_digest: String,
    pub release_signer_fingerprint: String,
    /// File name of the live set, inside the database directory.
    pub advisories_file: String,
    pub advisories_sha256: String,
    pub advisories: u64,
}

impl InstalledIntel {
    /// `seq 42 dated 2026-10-19`.
    pub fn describe(&self) -> String {
        format!("seq {} dated {}", self.sequence, self.snapshot_at.format("%Y-%m-%d"))
    }
}

/// The database directory.
#[derive(Debug, Clone)]
pub struct LocalIntelDb {
    root: PathBuf,
}

impl LocalIntelDb {
    pub fn open(root: impl AsRef<Path>) -> Self {
        Self { root: root.as_ref().to_path_buf() }
    }

    pub fn root(&self) -> &Path {
        &self.root
    }
    pub fn state_dir(&self) -> PathBuf {
        self.root.join("state")
    }
    pub fn bundles_dir(&self) -> PathBuf {
        self.root.join("bundles")
    }
    pub fn receipts_dir(&self) -> PathBuf {
        self.root.join("receipts")
    }
    pub fn lock_path(&self) -> PathBuf {
        self.root.join(".intel-import.lock")
    }
    fn installed_path(&self) -> PathBuf {
        self.root.join("installed.json")
    }

    /// The file a generation's set lives in.
    pub fn generation_file(sequence: u64) -> String {
        format!("advisories-{sequence}.json")
    }

    /// What is live, or `None` for a database nothing was ever imported into.
    pub fn installed(&self) -> Result<Option<InstalledIntel>> {
        let p = self.installed_path();
        let bytes = match std::fs::read(&p) {
            Ok(b) => b,
            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
            Err(e) => return Err(e).with_context(|| format!("read {}", p.display())),
        };
        let meta: InstalledIntel = serde_json::from_slice(&bytes)
            .with_context(|| format!("{} is not an intel install record", p.display()))?;
        if meta.schema != INSTALLED_SCHEMA {
            bail!("{} has schema {:?}, expected {INSTALLED_SCHEMA:?}", p.display(), meta.schema);
        }
        Ok(Some(meta))
    }

    /// The live set, checked against the digest `installed.json` recorded.
    pub fn load(&self) -> Result<Option<(InstalledIntel, AdvisorySet)>> {
        let Some(meta) = self.installed()? else {
            return Ok(None);
        };
        if meta.advisories_file.contains('/') || meta.advisories_file.contains("..") {
            bail!("intel install record names an unsafe file {:?}", meta.advisories_file);
        }
        let p = self.root.join(&meta.advisories_file);
        let bytes = std::fs::read(&p).with_context(|| format!("read {}", p.display()))?;
        let got = sha256_hex(&bytes);
        if got != meta.advisories_sha256 {
            bail!(
                "the local advisory database at {} does not match its install record \
                 (sha256 {got}, recorded {}): it was changed after import. Re-import a \
                 signed intel bundle.",
                p.display(),
                meta.advisories_sha256
            );
        }
        let set = AdvisorySet::from_json_bytes(&bytes)?;
        Ok(Some((meta, set)))
    }

    /// Write a generation's set beside the live one. Not live yet.
    pub fn stage_generation(&self, sequence: u64, bytes: &[u8]) -> Result<PathBuf> {
        std::fs::create_dir_all(&self.root).with_context(|| format!("mkdir {}", self.root.display()))?;
        let p = self.root.join(Self::generation_file(sequence));
        atomic_write(&p, bytes).map_err(|e| anyhow::anyhow!("write {}: {e}", p.display()))?;
        Ok(p)
    }

    /// Make `meta` live in one atomic rename, then drop generations that are
    /// neither live nor the one before it.
    pub fn activate(&self, meta: &InstalledIntel) -> Result<()> {
        let bytes = serde_json::to_vec_pretty(meta)?;
        let previous = self.installed().ok().flatten().map(|m| m.advisories_file);
        atomic_write(&self.installed_path(), &bytes)
            .map_err(|e| anyhow::anyhow!("activate intel generation: {e}"))?;
        if let Ok(rd) = std::fs::read_dir(&self.root) {
            for e in rd.flatten() {
                let n = e.file_name().to_string_lossy().into_owned();
                let is_gen = n.starts_with("advisories-") && n.ends_with(".json");
                if is_gen && n != meta.advisories_file && Some(&n) != previous.as_ref() {
                    let _ = std::fs::remove_file(e.path());
                }
            }
        }
        Ok(())
    }
}