void_core/metadata/

commit.rs

//! Commit implementation.

use ed25519_dalek::{Signature, Signer, SigningKey, VerifyingKey};
use void_crypto::{CommitCid, CommitSignature, MetadataCid, SigningPubKey};

use crate::cid::ToVoidCid;
use crate::{Result, VoidCid, VoidError};

use super::Commit;

impl Commit {
    /// Creates a new unsigned commit with a single parent.
    pub fn new(
        parent: Option<CommitCid>,
        metadata_bundle: MetadataCid,
        timestamp: u64,
        message: String,
    ) -> Self {
        Self {
            parents: parent.into_iter().collect(),
            metadata_bundle,
            timestamp,
            message,
            author: None,
            signature: None,
            manifest_cid: None,
            stats: None,
            repo_manifest_cid: None,
        }
    }

    /// Creates a new unsigned merge commit with multiple parents.
    pub fn new_merge(
        parents: Vec<CommitCid>,
        metadata_bundle: MetadataCid,
        timestamp: u64,
        message: String,
    ) -> Self {
        Self {
            parents,
            metadata_bundle,
            timestamp,
            message,
            author: None,
            signature: None,
            manifest_cid: None,
            stats: None,
            repo_manifest_cid: None,
        }
    }

    /// Returns true if this is the initial commit (no parents).
    pub fn is_initial(&self) -> bool {
        self.parents.is_empty()
    }

    /// Returns true if this is a merge commit (2+ parents).
    pub fn is_merge(&self) -> bool {
        self.parents.len() > 1
    }

    /// Returns the first parent CID, if any.
    pub fn first_parent(&self) -> Option<&CommitCid> {
        self.parents.first()
    }

    /// Returns the single parent for non-merge commits.
    pub fn parent(&self) -> Option<&CommitCid> {
        if self.parents.len() == 1 {
            self.parents.first()
        } else {
            None
        }
    }

    /// All non-parent object CIDs referenced by this commit.
    ///
    /// Returns parsed `VoidCid` for each referenced object (metadata bundle,
    /// tree manifest, repo manifest). This is the canonical list of objects
    /// a commit depends on — use it for reachability tracking to avoid
    /// missing objects when new CID fields are added to Commit.
    ///
    /// Parent commit CIDs are excluded since they serve a different purpose
    /// (graph traversal vs. object reachability).
    ///
    /// CIDs that fail to parse are silently skipped.
    pub fn referenced_object_cids(&self) -> Vec<VoidCid> {
        let mut cids = Vec::with_capacity(3);
        if let Ok(c) = self.metadata_bundle.to_void_cid() {
            cids.push(c);
        }
        if let Some(ref m) = self.manifest_cid {
            if let Ok(c) = m.to_void_cid() {
                cids.push(c);
            }
        }
        if let Some(ref r) = self.repo_manifest_cid {
            if let Ok(c) = r.to_void_cid() {
                cids.push(c);
            }
        }
        cids
    }

    /// Returns true if this commit is signed.
    pub fn is_signed(&self) -> bool {
        self.author.is_some() && self.signature.is_some()
    }

    /// Returns the bytes to sign (excludes signature field).
    ///
    /// Format: parents || metadata_bundle || timestamp || message || author || manifest_cid || stats || repo_manifest_cid
    pub fn signable_bytes(&self) -> Vec<u8> {
        let mut buf = Vec::new();

        // Parents (length-prefixed)
        buf.extend((self.parents.len() as u32).to_le_bytes());
        for parent in &self.parents {
            buf.extend((parent.as_bytes().len() as u32).to_le_bytes());
            buf.extend(parent.as_bytes());
        }

        // Metadata bundle (length-prefixed)
        buf.extend((self.metadata_bundle.as_bytes().len() as u32).to_le_bytes());
        buf.extend(self.metadata_bundle.as_bytes());

        // Timestamp
        buf.extend(self.timestamp.to_le_bytes());

        // Message (length-prefixed)
        buf.extend((self.message.len() as u32).to_le_bytes());
        buf.extend(self.message.as_bytes());

        // Author (if present)
        if let Some(author) = &self.author {
            buf.push(1); // Present marker
            buf.extend(author.as_bytes());
        } else {
            buf.push(0); // Absent marker
        }

        // manifest_cid (if present)
        if let Some(manifest_cid) = &self.manifest_cid {
            buf.push(1); // Present marker
            buf.extend((manifest_cid.as_bytes().len() as u32).to_le_bytes());
            buf.extend(manifest_cid.as_bytes());
        } else {
            buf.push(0); // Absent marker
        }

        // stats (if present)
        if let Some(stats) = &self.stats {
            buf.push(1); // Present marker
            buf.extend(stats.total_files.to_le_bytes());
            buf.extend(stats.total_bytes.to_le_bytes());
            buf.extend(&stats.paths_hash);
        } else {
            buf.push(0); // Absent marker
        }

        // repo_manifest_cid (if present)
        if let Some(repo_manifest_cid) = &self.repo_manifest_cid {
            buf.push(1); // Present marker
            buf.extend((repo_manifest_cid.as_bytes().len() as u32).to_le_bytes());
            buf.extend(repo_manifest_cid.as_bytes());
        } else {
            buf.push(0); // Absent marker
        }

        buf
    }

    /// Sign the commit with an Ed25519 signing key.
    ///
    /// Sets the author field to the public key and computes the signature.
    pub fn sign(&mut self, signing_key: &SigningKey) {
        self.author = Some(SigningPubKey::from_bytes(signing_key.verifying_key().to_bytes()));
        let signable = self.signable_bytes();
        let sig: Signature = signing_key.sign(&signable);
        self.signature = Some(CommitSignature::from_bytes(sig.to_bytes()));
    }

    /// Verify the commit signature.
    ///
    /// Returns:
    /// - `Ok(true)` if the signature is valid
    /// - `Ok(false)` if the commit is unsigned (both author and signature are None)
    /// - `Err(_)` if the signature is invalid or malformed
    pub fn verify(&self) -> Result<bool> {
        match (&self.author, &self.signature) {
            (Some(pubkey_bytes), Some(sig_bytes)) => {
                let verifying_key = VerifyingKey::from_bytes(pubkey_bytes.as_bytes()).map_err(|e| {
                    VoidError::InvalidSignature(format!("invalid public key: {}", e))
                })?;

                let signature = Signature::from_bytes(sig_bytes.as_bytes());
                let signable = self.signable_bytes();

                verifying_key
                    .verify_strict(&signable, &signature)
                    .map_err(|e| {
                        VoidError::InvalidSignature(format!("verification failed: {}", e))
                    })?;

                Ok(true)
            }
            (None, None) => Ok(false), // Unsigned commits are valid (but not signed)
            _ => Err(VoidError::InvalidSignature(
                "commit has author without signature or vice versa".to_string(),
            )),
        }
    }
}