sopsy 1.3.3

//! `sopsy doctor` — health checks for the local setup and repository.
//!
//! The doctor is purely **informational**: it prints a colorful, grouped report
//! of the environment and the current repository and always returns `Ok(())`,
//! even when optional pieces are missing. This keeps its output safe to paste
//! into a bug report or GitHub issue. Hard failures are shown as `✗` lines
//! rather than propagated as errors.
//!
//! Report groups:
//!
//! - **System** — macOS version, Apple Silicon, Secure Enclave and Touch ID.
//!   These are macOS-only and are `cfg`-gated; on other platforms (e.g. the
//!   Linux CI runner) a neutral "n/a (macOS only)" line is printed instead.
//! - **Tools** — `sops`, `age-plugin-se`, `git` resolved on `PATH`.
//! - **Repository** — whether the current directory is inside a git repo and
//!   whether `.sops.yaml` / `.sopsy.yml` are present and parse.
//! - **Recipients** — a break-glass emergency key reminder when `.sopsy.yml`
//!   is present but no break-glass recipient is configured.

use std::path::Path;

use crate::config::{CHECKSUM_FILE_NAME, CONFIG_FILE_NAME, Config};
use crate::error::Result;
use crate::git;
use crate::ui::Ui;

/// External tools sopsy depends on, in the order they are probed.
const REQUIRED_TOOLS: &[&str] = &["sops", "age-plugin-se", "git"];

/// Run the doctor checks.
///
/// Always returns `Ok(())`; problems are reported as `✗`/`⚠` lines so the
/// output is always pasteable and the command is never fatal.
pub fn run(ui: &Ui) -> Result<()> {
    ui.header("sopsy doctor");

    system_checks(ui);
    tool_checks(ui);
    repo_checks(ui);

    Ok(())
}

// ----- System -------------------------------------------------------------

/// macOS-only system probes (version, Apple Silicon, Secure Enclave, Touch ID).
///
/// On non-macOS platforms this degrades to a neutral informational line so the
/// command stays cross-platform for CI without ever failing.
fn system_checks(ui: &Ui) {
    ui.header("System");

    #[cfg(target_os = "macos")]
    macos_system_checks(ui);

    #[cfg(not(target_os = "macos"))]
    ui.info("System checks: n/a (macOS only)");
}

/// Severity of a single rendered diagnostic line, decoupling the *decision*
/// (which is pure and unit-testable) from the *rendering* (which writes to the
/// terminal via [`Ui`]).
#[cfg(target_os = "macos")]
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum Severity {
    /// Rendered as a green success line.
    Success,
    /// Rendered as a yellow warning line.
    Warn,
}

/// Probe macOS-specific properties, tolerating missing/changed tools.
///
/// The actual probes ([`capture_stdout`] / [`capture_combined`]) are the only
/// impure part; the interpretation of their results lives in the pure
/// `*_line` helpers so every branch is exercisable without Apple hardware.
#[cfg(target_os = "macos")]
fn macos_system_checks(ui: &Ui) {
    emit(
        ui,
        macos_version_line(capture_stdout("sw_vers", &["-productVersion"])),
    );
    for line in arch_lines(capture_stdout("uname", &["-m"]).as_deref()) {
        emit(ui, line);
    }
    // Touch ID detection is best-effort: `bioutil -r` is undocumented and its
    // output format varies, so we never fail on it.
    emit(
        ui,
        touch_id_line(capture_combined("bioutil", &["-r"]).as_deref()),
    );
}

/// Render a `(Severity, message)` decision to the terminal.
#[cfg(target_os = "macos")]
fn emit(ui: &Ui, (severity, message): (Severity, String)) {
    match severity {
        Severity::Success => ui.success(message),
        Severity::Warn => ui.warn(message),
    }
}

/// Interpret the `sw_vers -productVersion` result.
#[cfg(target_os = "macos")]
fn macos_version_line(version: Option<String>) -> (Severity, String) {
    match version {
        Some(version) => (Severity::Success, format!("macOS {version}")),
        None => (
            Severity::Warn,
            "could not determine macOS version (sw_vers unavailable)".to_string(),
        ),
    }
}

/// Interpret the `uname -m` architecture result. On Apple Silicon a Secure
/// Enclave is always present, which is what `age-plugin-se` relies on.
#[cfg(target_os = "macos")]
fn arch_lines(arch: Option<&str>) -> Vec<(Severity, String)> {
    if arch == Some("arm64") {
        vec![
            (Severity::Success, "Apple Silicon (arm64)".to_string()),
            (Severity::Success, "Secure Enclave available".to_string()),
        ]
    } else {
        vec![
            (
                Severity::Warn,
                format!("not Apple Silicon (arch: {})", arch.unwrap_or("unknown")),
            ),
            (
                Severity::Warn,
                "Secure Enclave unavailable (requires Apple Silicon)".to_string(),
            ),
        ]
    }
}

/// Interpret the combined `bioutil -r` output for Touch ID status.
#[cfg(target_os = "macos")]
fn touch_id_line(report: Option<&str>) -> (Severity, String) {
    match report {
        Some(out) if out.contains('1') => {
            (Severity::Success, "Touch ID appears configured".to_string())
        }
        Some(_) => (
            Severity::Warn,
            "Touch ID present but may not be enrolled".to_string(),
        ),
        None => (
            Severity::Warn,
            "Touch ID status unknown (bioutil unavailable)".to_string(),
        ),
    }
}

/// Run `bin args...` and return trimmed stdout, or `None` if the tool is
/// missing, fails, or prints nothing.
#[cfg(target_os = "macos")]
fn capture_stdout(bin: &str, args: &[&str]) -> Option<String> {
    let output = std::process::Command::new(bin).args(args).output().ok()?;
    if !output.status.success() {
        return None;
    }
    let text = String::from_utf8_lossy(&output.stdout).trim().to_string();
    if text.is_empty() { None } else { Some(text) }
}

/// Run `bin args...` and return trimmed stdout+stderr combined, ignoring the
/// exit status (some diagnostic tools report via stderr / non-zero status).
/// Returns `None` only when the binary cannot be launched.
#[cfg(target_os = "macos")]
fn capture_combined(bin: &str, args: &[&str]) -> Option<String> {
    let output = std::process::Command::new(bin).args(args).output().ok()?;
    let mut text = String::from_utf8_lossy(&output.stdout).into_owned();
    text.push_str(&String::from_utf8_lossy(&output.stderr));
    Some(text)
}

// ----- Tools --------------------------------------------------------------

/// Probe the external binaries sopsy orchestrates, reporting their resolved
/// `PATH` location or a not-found `✗` line.
fn tool_checks(ui: &Ui) {
    ui.header("Tools");
    for tool in REQUIRED_TOOLS {
        match which::which(tool) {
            Ok(path) => ui.success(format!("{tool} found at {}", path.display())),
            Err(_) => ui.failure(format!("{tool} not found on PATH")),
        }
    }
}

// ----- Repository ---------------------------------------------------------

/// Inspect the repository containing the current directory: git presence,
/// `.sops.yaml`, `.sopsy.yml`, and (transitively) the break-glass recipient.
fn repo_checks(ui: &Ui) {
    ui.header("Repository");

    let cwd = match std::env::current_dir() {
        Ok(dir) => dir,
        Err(err) => {
            ui.failure(format!("could not determine current directory: {err}"));
            return;
        }
    };

    let root = match git::repo_root(&cwd) {
        Ok(root) => {
            ui.success(format!("inside a git repository ({})", root.display()));
            root
        }
        Err(_) => {
            ui.failure("not inside a git repository");
            return;
        }
    };

    // `.sops.yaml` — consumed by sops itself; we only verify it parses as YAML.
    let sops_yaml = root.join(".sops.yaml");
    if sops_yaml.exists() {
        match parse_yaml(&sops_yaml) {
            Ok(()) => ui.success(".sops.yaml present and parses"),
            Err(err) => ui.failure(format!(".sops.yaml present but failed to parse: {err}")),
        }
    } else {
        ui.failure(".sops.yaml missing (run `sopsy init`)");
    }

    // `.sopsy.yml` — sopsy's own metadata; parse it into the typed `Config`.
    // Loaded *unverified*: the doctor is the one place allowed to read a file
    // whose checksum is stale, because its job is to repair the checksum.
    let sopsy_yml = root.join(CONFIG_FILE_NAME);
    if sopsy_yml.exists() {
        match Config::load_unverified(&sopsy_yml) {
            Ok((config, raw)) => {
                ui.success(format!("{CONFIG_FILE_NAME} present and parses"));
                checksum_check(ui, &sopsy_yml, &config, &raw);
                recipient_checks(ui, &config);
            }
            Err(err) => {
                ui.failure(format!(
                    "{CONFIG_FILE_NAME} present but failed to parse: {err}"
                ));
            }
        }
    } else {
        ui.warn(format!("{CONFIG_FILE_NAME} missing (run `sopsy init`)"));
    }
}

/// Verify the `.sopsy.sha` integrity sidecar against the current bytes of
/// `.sopsy.yml`, writing a fresh checksum when it is missing or stale.
///
/// This is the doctor's only mutation, and deliberately so: `Config::load`
/// refuses a mismatched checksum, so running the doctor is how an operator
/// blesses a legitimate manual edit.
fn checksum_check(ui: &Ui, config_path: &Path, config: &Config, raw: &str) {
    let expected = config.compute_checksum(raw);
    let sha_path = Config::checksum_path(config_path);
    let stored = std::fs::read_to_string(&sha_path).ok();
    if stored.as_deref().map(str::trim) == Some(expected.as_str()) {
        ui.success(format!("{CHECKSUM_FILE_NAME} integrity checksum verified"));
        return;
    }
    let reason = if stored.is_none() {
        "missing"
    } else {
        "stale (file was edited outside sopsy)"
    };
    match std::fs::write(&sha_path, format!("{expected}\n")) {
        Ok(()) => ui.warn(format!(
            "{CHECKSUM_FILE_NAME} was {reason} — repaired; review `git diff \
             {CONFIG_FILE_NAME}` and commit both files together"
        )),
        Err(err) => ui.failure(format!(
            "{CHECKSUM_FILE_NAME} was {reason} and could not be repaired: {err}"
        )),
    }
}

/// Verify that the file at `path` is syntactically valid YAML.
fn parse_yaml(path: &Path) -> Result<()> {
    let raw = std::fs::read_to_string(path)?;
    let _: serde_yaml_ng::Value = serde_yaml_ng::from_str(&raw)?;
    Ok(())
}

// ----- Recipients ---------------------------------------------------------

/// Report on the configured recipients, warning loudly when no break-glass
/// emergency key exists.
fn recipient_checks(ui: &Ui, config: &Config) {
    ui.header("Recipients");

    if config.recipients.is_empty() {
        ui.warn("no recipients configured");
    } else {
        ui.success(format!(
            "{} recipient(s) configured",
            config.recipients.len()
        ));
    }

    match config.break_glass_recipient() {
        Some(recipient) => {
            ui.success(format!(
                "break-glass recipient configured: {}",
                recipient.name
            ));
        }
        None => {
            ui.warn("no break-glass emergency recipient configured");
            ui.warn(
                "> [!CAUTION] Create a break-glass key pair and store it offline in a \
                 vault (e.g. 1Password) that only a few admins can access.",
            );
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::config::Recipient;
    use crate::ui::Ui;

    /// A quiet, non-interactive `Ui` suitable for exercising the print paths.
    fn ui() -> Ui {
        Ui::new(false, false, false)
    }

    #[test]
    fn run_is_always_ok() {
        // The doctor is informational and must never fail, regardless of the
        // surrounding environment.
        run(&ui()).unwrap();
    }

    #[test]
    fn parse_yaml_accepts_valid_and_rejects_invalid() {
        let dir = assert_fs::TempDir::new().unwrap();
        let good = dir.path().join("good.yaml");
        std::fs::write(&good, "a: 1\nb: [1, 2, 3]\n").unwrap();
        assert!(parse_yaml(&good).is_ok());

        let bad = dir.path().join("bad.yaml");
        // Unbalanced flow mapping is a YAML syntax error.
        std::fs::write(&bad, "a: [1, 2\n").unwrap();
        assert!(parse_yaml(&bad).is_err());

        // A missing file surfaces an I/O error rather than panicking.
        assert!(parse_yaml(&dir.path().join("missing.yaml")).is_err());
    }

    #[test]
    fn checksum_check_verifies_and_repairs() {
        let dir = assert_fs::TempDir::new().unwrap();
        let mut cfg = Config::default();
        cfg.recipients.push(Recipient::new("admin", "age1admin"));
        let path = cfg.save_to_dir(dir.path()).unwrap();
        let raw = std::fs::read_to_string(&path).unwrap();
        let sha_path = Config::checksum_path(&path);

        // Fresh save → verified, sidecar untouched.
        checksum_check(&ui(), &path, &cfg, &raw);
        let good = std::fs::read_to_string(&sha_path).unwrap();

        // Missing sidecar → repaired (rewritten identically).
        std::fs::remove_file(&sha_path).unwrap();
        checksum_check(&ui(), &path, &cfg, &raw);
        assert_eq!(std::fs::read_to_string(&sha_path).unwrap(), good);

        // Stale sidecar (hand edit happened) → repaired to match current bytes.
        std::fs::write(&sha_path, "0000\n").unwrap();
        checksum_check(&ui(), &path, &cfg, &raw);
        assert_eq!(std::fs::read_to_string(&sha_path).unwrap(), good);
        assert!(
            Config::load(&path).is_ok(),
            "a repaired checksum must satisfy the strict loader"
        );
    }

    #[test]
    fn recipient_checks_cover_all_branches() {
        // Empty recipients + no break-glass.
        recipient_checks(&ui(), &Config::default());

        // Recipients present, but still no break-glass key.
        let mut cfg = Config::default();
        cfg.recipients.push(Recipient::new("alice", "age1alice"));
        recipient_checks(&ui(), &cfg);

        // A break-glass recipient is configured.
        cfg.recipients.push(Recipient {
            break_glass: true,
            ..Recipient::new("break-glass", "age1emergency")
        });
        recipient_checks(&ui(), &cfg);
    }

    #[cfg(target_os = "macos")]
    #[test]
    fn macos_version_line_branches() {
        assert_eq!(
            macos_version_line(Some("15.0".to_string())),
            (Severity::Success, "macOS 15.0".to_string())
        );
        assert_eq!(macos_version_line(None).0, Severity::Warn);
    }

    #[cfg(target_os = "macos")]
    #[test]
    fn arch_lines_branches() {
        let arm = arch_lines(Some("arm64"));
        assert!(arm.iter().all(|(s, _)| *s == Severity::Success));
        assert!(arm.iter().any(|(_, m)| m.contains("Apple Silicon")));

        let intel = arch_lines(Some("x86_64"));
        assert!(intel.iter().all(|(s, _)| *s == Severity::Warn));
        assert!(intel.iter().any(|(_, m)| m.contains("x86_64")));

        // Unknown architecture falls back to "unknown".
        let unknown = arch_lines(None);
        assert!(unknown.iter().any(|(_, m)| m.contains("unknown")));
    }

    #[cfg(target_os = "macos")]
    #[test]
    fn touch_id_line_branches() {
        assert_eq!(touch_id_line(Some("Biometrics: 1")).0, Severity::Success);
        assert_eq!(touch_id_line(Some("no digits here")).0, Severity::Warn);
        assert_eq!(touch_id_line(None).0, Severity::Warn);
    }

    #[cfg(target_os = "macos")]
    #[test]
    fn emit_renders_both_severities() {
        emit(&ui(), (Severity::Success, "ok".to_string()));
        emit(&ui(), (Severity::Warn, "careful".to_string()));
    }

    #[cfg(target_os = "macos")]
    #[test]
    fn capture_helpers_handle_success_failure_and_missing() {
        // Success with output.
        assert_eq!(capture_stdout("echo", &["hi"]).as_deref(), Some("hi"));
        // Success but empty output → None.
        assert!(capture_stdout("true", &[]).is_none());
        // Non-zero exit → None.
        assert!(capture_stdout("false", &[]).is_none());
        // Missing binary → None.
        assert!(capture_stdout("sopsy-no-such-bin-xyz", &[]).is_none());

        // capture_combined returns Some even on failure, None only when the
        // binary cannot be launched.
        assert!(capture_combined("false", &[]).is_some());
        assert!(capture_combined("sopsy-no-such-bin-xyz", &[]).is_none());
    }
}