oth_rvault 0.4.0

use std::io::Cursor;

use ansible_vault::{decrypt_vault, encrypt_vault};
use thiserror::Error;

use crate::types::{TypedValue, ValueType};

const ANSIBLE_VAULT_PREFIX: &str = "$ANSIBLE_VAULT;";

#[derive(Debug, Error)]
pub enum VaultError {
    #[error("value type isn't supported for encryption: {0}")]
    UnsupportedType(String),
    #[error("error while encrypting value: {0}")]
    Encrypt(String),
    #[error("error while decrypting value: {0}")]
    Decrypt(String),
    #[error("value doesn't contain Ansible vault prefix")]
    NoVaultPrefix,
    #[error("decrypted value is not valid UTF-8: {0}")]
    Utf8(#[from] std::string::FromUtf8Error),
}

/// Encrypt a typed value using Ansible Vault AES256.
/// If the value is a String that is already vault-encrypted, it is returned unchanged.
/// NUMBER values are formatted with 6 decimal places (matching Go's `%f`) to ensure
/// they round-trip correctly through `input_type` without being mis-detected as INTEGER.
pub fn encrypt(value: &TypedValue, password: &str) -> Result<String, VaultError> {
    if let TypedValue::String(s) = value {
        if s.contains("$ANSIBLE_VAULT") {
            return Ok(s.clone());
        }
    }

    let str_value = match value {
        TypedValue::Bool(b) => format!("{}", b),
        TypedValue::Number(f) => format!("{:.6}", f),
        TypedValue::Integer(i) => format!("{}", i),
        TypedValue::String(s) => s.clone(),
        TypedValue::Null => return Err(VaultError::UnsupportedType("Null".to_string())),
    };

    encrypt_vault(Cursor::new(str_value.as_bytes()), password)
        .map_err(|e| VaultError::Encrypt(e.to_string()))
}

/// Decrypt an Ansible Vault encrypted string, returning the raw decrypted content as a string.
/// Unlike [`decrypt`], no type detection is applied — the raw bytes are returned as-is.
/// Strips any content before the `$ANSIBLE_VAULT;` prefix.
pub fn decrypt_raw(value: &str, password: &str) -> Result<String, VaultError> {
    let index = value
        .find(ANSIBLE_VAULT_PREFIX)
        .ok_or(VaultError::NoVaultPrefix)?;
    let vault_str = &value[index..];
    let decrypted_bytes = decrypt_vault(Cursor::new(vault_str.as_bytes()), password)
        .map_err(|e| VaultError::Decrypt(e.to_string()))?;
    String::from_utf8(decrypted_bytes).map_err(Into::into)
}

/// Decrypt an Ansible Vault encrypted string.
/// Strips any content before the `$ANSIBLE_VAULT;` prefix (e.g. leading whitespace from YAML).
/// Returns the decrypted value with its detected type.
pub fn decrypt(value: &str, password: &str) -> Result<(TypedValue, ValueType), VaultError> {
    let index = value
        .find(ANSIBLE_VAULT_PREFIX)
        .ok_or(VaultError::NoVaultPrefix)?;
    let vault_str = &value[index..];

    let decrypted_bytes = decrypt_vault(Cursor::new(vault_str.as_bytes()), password)
        .map_err(|e| VaultError::Decrypt(e.to_string()))?;

    let decrypted = String::from_utf8(decrypted_bytes)?;
    Ok(input_type(&decrypted))
}

/// Parse a string and detect its most specific type.
/// Tries INTEGER, then BOOL, then NUMBER, then falls back to STRING.
pub fn input_type(value: &str) -> (TypedValue, ValueType) {
    if let Ok(i) = value.parse::<i64>() {
        return (TypedValue::Integer(i), ValueType::Integer);
    }
    if let Ok(b) = value.parse::<bool>() {
        return (TypedValue::Bool(b), ValueType::Bool);
    }
    if let Ok(f) = value.parse::<f64>() {
        return (TypedValue::Number(f), ValueType::Number);
    }
    (TypedValue::String(value.to_string()), ValueType::String)
}

#[cfg(test)]
mod tests {
    use super::*;

    const PASSWORD: &str = "_strengGeheim_";

    #[test]
    fn test_encrypt_decrypt_int() {
        let tests: &[i64] = &[42, -45, 0];
        for &v in tests {
            let encrypted = encrypt(&TypedValue::Integer(v), PASSWORD).expect("encrypt failed");
            let (decrypted, vt) = decrypt(&encrypted, PASSWORD).expect("decrypt failed");
            assert_eq!(vt, ValueType::Integer);
            assert_eq!(decrypted, TypedValue::Integer(v));
        }
    }

    #[test]
    fn test_encrypt_decrypt_bool() {
        for &v in &[true, false] {
            let encrypted = encrypt(&TypedValue::Bool(v), PASSWORD).expect("encrypt failed");
            let (decrypted, vt) = decrypt(&encrypted, PASSWORD).expect("decrypt failed");
            assert_eq!(vt, ValueType::Bool);
            assert_eq!(decrypted, TypedValue::Bool(v));
        }
    }

    #[test]
    fn test_encrypt_decrypt_float() {
        let tests: &[f64] = &[42.78, -13.8, 0.0];
        for &v in tests {
            let encrypted = encrypt(&TypedValue::Number(v), PASSWORD).expect("encrypt failed");
            let (decrypted, vt) = decrypt(&encrypted, PASSWORD).expect("decrypt failed");
            assert_eq!(vt, ValueType::Number);
            assert_eq!(decrypted, TypedValue::Number(v));
        }
    }

    #[test]
    fn test_encrypt_decrypt_string() {
        let tests: &[&str] = &["Some words with äoß", "1234x", ""];
        for &v in tests {
            let encrypted =
                encrypt(&TypedValue::String(v.to_string()), PASSWORD).expect("encrypt failed");
            let (decrypted, vt) = decrypt(&encrypted, PASSWORD).expect("decrypt failed");
            assert_eq!(vt, ValueType::String);
            assert_eq!(decrypted, TypedValue::String(v.to_string()));
        }
    }

    // Compatibility tests: decrypt values encrypted by the Go implementation.
    // Source: rust/resources/tests/partial_encrypted_example.yaml, password: "test999"

    #[test]
    fn test_decrypt_go_encrypted_bool() {
        // second.a.v = true
        let vault_str = concat!(
            "$ANSIBLE_VAULT;1.1;AES256\n",
            "35643238653231643030326432343462386436643537343863643061386261613835353835336666\n",
            "3731623866666563373637326266663963383266636465330a303437336534643232353963346535\n",
            "35356238303435303932336234356337383663346235653831316330376666323739313964343162\n",
            "6132343332646432300a643232643534323562353330643336626432666235623237643132326563\n",
            "3832"
        );
        let (value, vt) = decrypt(vault_str, "test999").expect("decrypt failed");
        assert_eq!(vt, ValueType::Bool);
        assert_eq!(value, TypedValue::Bool(true));
    }

    #[test]
    fn test_decrypt_go_encrypted_int() {
        // second.a.w = 14
        let vault_str = concat!(
            "$ANSIBLE_VAULT;1.1;AES256\n",
            "30613433363731303632376132343263336664313761613234346366653461613337323865393561\n",
            "6534386436626431373864343862633533383734623731660a313433643032373166383164326534\n",
            "63343264636166653865353965666639316361626232366266356337666162316234376232373930\n",
            "3437306362383631310a663030373266373338383935303061653566613039326637666564353438\n",
            "3461"
        );
        let (value, vt) = decrypt(vault_str, "test999").expect("decrypt failed");
        assert_eq!(vt, ValueType::Integer);
        assert_eq!(value, TypedValue::Integer(14));
    }
}