void_core/collab/manifest/

io.rs

//! Manifest I/O operations.
//!
//! Handles loading and saving the contributor manifest, and ECIES
//! key wrapping/unwrapping for collaboration mode.
//!
//! The manifest is stored as **plaintext JSON** (`contributors.json`).
//! This is safe because per-contributor repo keys are individually
//! ECIES-wrapped — the wrapped blobs can only be unwrapped by each
//! contributor's X25519 private key.

use std::fs;
use std::path::Path;

use crate::collab::Identity;
use crate::{Result, VoidError};

use super::keys::{ecies_unwrap_key, RepoKey};
use super::types::Manifest;

/// Filename for the contributor manifest.
pub const MANIFEST_JSON_FILE: &str = "contributors.json";

/// Repository mode based on manifest presence.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum RepoMode {
    /// No .void directory or no manifest found.
    Uninitialized,
    /// Multi-contributor repository (has manifest).
    Collaboration,
}

/// Check if a contributor manifest exists in the given void directory.
///
/// # Arguments
/// * `void_dir` - Path to the .void directory.
pub fn manifest_exists(void_dir: impl AsRef<Path>) -> bool {
    void_dir.as_ref().join(MANIFEST_JSON_FILE).exists()
}

/// Detect the repository mode.
///
/// # Arguments
/// * `void_dir` - Path to the .void directory.
pub fn detect_repo_mode(void_dir: impl AsRef<Path>) -> RepoMode {
    let void_dir = void_dir.as_ref();
    if !void_dir.exists() {
        return RepoMode::Uninitialized;
    }

    if manifest_exists(void_dir) {
        RepoMode::Collaboration
    } else {
        RepoMode::Uninitialized
    }
}

/// Load the contributor manifest from disk.
///
/// Returns `Ok(None)` if no manifest exists.
///
/// # Arguments
/// * `void_dir` - Path to the .void directory.
///
/// # Errors
/// Returns error if a manifest exists but cannot be read or parsed.
pub fn load_manifest(void_dir: impl AsRef<Path>) -> Result<Option<Manifest>> {
    let json_path = void_dir.as_ref().join(MANIFEST_JSON_FILE);
    if json_path.exists() {
        let content = fs::read(&json_path).map_err(|e| {
            VoidError::Io(std::io::Error::new(
                e.kind(),
                format!("failed to read manifest: {}", e),
            ))
        })?;

        let manifest: Manifest = serde_json::from_slice(&content).map_err(|e| {
            VoidError::Serialization(format!("failed to parse manifest: {}", e))
        })?;

        return Ok(Some(manifest));
    }

    Ok(None)
}

/// Save the contributor manifest to disk as plaintext JSON.
///
/// Uses atomic write (write to temp file, then rename) to prevent corruption.
/// The manifest is stored as `contributors.json` — wrapped keys within the
/// manifest provide per-contributor ECIES security.
///
/// # Arguments
/// * `void_dir` - Path to the .void directory.
/// * `manifest` - The manifest to save.
///
/// # Errors
/// Returns error if serialization or writing fails.
pub fn save_manifest(void_dir: impl AsRef<Path>, manifest: &Manifest) -> Result<()> {
    let void_dir = void_dir.as_ref();
    let path = void_dir.join(MANIFEST_JSON_FILE);
    let temp_path = void_dir.join(format!("{}.tmp", MANIFEST_JSON_FILE));

    // Serialize to JSON
    let content = serde_json::to_vec_pretty(manifest).map_err(|e| {
        VoidError::Serialization(format!("failed to serialize manifest: {}", e))
    })?;

    // Atomic write: write to temp file, then rename
    fs::write(&temp_path, &content).map_err(|e| {
        VoidError::Io(std::io::Error::new(
            e.kind(),
            format!("failed to write manifest temp file: {}", e),
        ))
    })?;

    fs::rename(&temp_path, &path).map_err(|e| {
        // Clean up temp file on rename failure
        let _ = fs::remove_file(&temp_path);
        VoidError::Io(std::io::Error::new(
            e.kind(),
            format!("failed to rename manifest file: {}", e),
        ))
    })?;

    Ok(())
}

/// Delete the contributor manifest from disk.
///
/// # Arguments
/// * `void_dir` - Path to the .void directory.
///
/// # Errors
/// Returns error if deletion fails (but not if file doesn't exist).
pub fn delete_manifest(void_dir: impl AsRef<Path>) -> Result<()> {
    let path = void_dir.as_ref().join(MANIFEST_JSON_FILE);
    if path.exists() {
        fs::remove_file(&path)?;
    }

    Ok(())
}

// ============================================================================
// Unified Key Loading
// ============================================================================

/// Load the repository key in collaboration mode.
///
/// Unwraps the key from the manifest using the identity.
///
/// # Arguments
/// * `void_dir` - Path to the .void directory
/// * `identity` - Optional identity for collaboration mode (required if in collab mode)
///
/// # Errors
/// - `NotInitialized` if the repository is not initialized
/// - `InvalidKey` if identity is required but not provided
/// - Various errors if key loading/unwrapping fails
pub fn load_repo_key(void_dir: impl AsRef<Path>, identity: Option<&Identity>) -> Result<RepoKey> {
    let void_dir = void_dir.as_ref();
    match detect_repo_mode(void_dir) {
        RepoMode::Uninitialized => Err(VoidError::NotInitialized),
        RepoMode::Collaboration => {
            let identity = identity.ok_or_else(|| {
                VoidError::InvalidKey("identity required for collaboration mode".into())
            })?;
            load_collaboration_key(void_dir, identity)
        }
    }
}

/// Load the repository key in collaboration mode.
///
/// Reads the plaintext manifest, finds the ECIES-wrapped key for the given
/// identity, and unwraps it using the identity's X25519 private key.
fn load_collaboration_key(void_dir: impl AsRef<Path>, identity: &Identity) -> Result<RepoKey> {
    let manifest = load_manifest(void_dir)?
        .ok_or_else(|| VoidError::NotFound("Manifest not found".into()))?;

    // Look up our wrapped key by signing pubkey
    let signing_pubkey = identity.signing_pubkey();

    let wrapped_key = manifest
        .read_keys
        .wrapped
        .get(&signing_pubkey)
        .ok_or_else(|| {
            VoidError::InvalidKey(
                "no wrapped key found for this identity in the manifest".into(),
            )
        })?;

    // Unwrap using our X25519 private key
    Ok(ecies_unwrap_key(wrapped_key, identity)?)
}

// ============================================================================
// Tests
// ============================================================================

#[cfg(test)]
mod tests {
    use super::*;
    use crate::collab::manifest::keys::SigningPubKey;
    use tempfile::tempdir;

    fn test_manifest() -> Manifest {
        Manifest::new(SigningPubKey::from_bytes([0xaa; 32]), None)
    }

    #[test]
    fn detect_repo_mode_uninitialized() {
        let mode = detect_repo_mode(Path::new("/nonexistent/path"));
        assert_eq!(mode, RepoMode::Uninitialized);
    }

    #[test]
    fn detect_repo_mode_no_manifest() {
        let dir = tempdir().unwrap();
        let void_dir = dir.path().join(".void");
        fs::create_dir(&void_dir).unwrap();

        let mode = detect_repo_mode(&void_dir);
        assert_eq!(mode, RepoMode::Uninitialized);
    }

    #[test]
    fn detect_repo_mode_collaboration_json() {
        let dir = tempdir().unwrap();
        let void_dir = dir.path().join(".void");
        fs::create_dir(&void_dir).unwrap();

        let manifest_path = void_dir.join(MANIFEST_JSON_FILE);
        fs::write(manifest_path, b"{}").unwrap();

        let mode = detect_repo_mode(&void_dir);
        assert_eq!(mode, RepoMode::Collaboration);
    }

    #[test]
    fn manifest_exists_false_when_missing() {
        let dir = tempdir().unwrap();
        let void_dir = dir.path().join(".void");
        fs::create_dir(&void_dir).unwrap();

        assert!(!manifest_exists(&void_dir));
    }

    #[test]
    fn manifest_exists_true_when_json() {
        let dir = tempdir().unwrap();
        let void_dir = dir.path().join(".void");
        fs::create_dir(&void_dir).unwrap();

        let manifest_path = void_dir.join(MANIFEST_JSON_FILE);
        fs::write(manifest_path, b"{}").unwrap();

        assert!(manifest_exists(&void_dir));
    }

    #[test]
    fn load_manifest_returns_none_when_missing() {
        let dir = tempdir().unwrap();
        let void_dir = dir.path().join(".void");
        fs::create_dir(&void_dir).unwrap();

        let result = load_manifest(&void_dir).unwrap();
        assert!(result.is_none());
    }

    #[test]
    fn save_and_load_manifest_roundtrip() {
        let dir = tempdir().unwrap();
        let void_dir = dir.path().join(".void");
        fs::create_dir(&void_dir).unwrap();

        let manifest = test_manifest();

        // Save (plaintext JSON)
        save_manifest(&void_dir, &manifest).unwrap();
        assert!(manifest_exists(&void_dir));

        // Load
        let loaded = load_manifest(&void_dir).unwrap().unwrap();
        assert_eq!(loaded.version, manifest.version);
        assert!(loaded.is_owner(&SigningPubKey::from_bytes([0xaa; 32])));
    }

    #[test]
    fn load_manifest_invalid_json_fails() {
        let dir = tempdir().unwrap();
        let void_dir = dir.path().join(".void");
        fs::create_dir(&void_dir).unwrap();

        // Write invalid JSON to the manifest file
        fs::write(void_dir.join(MANIFEST_JSON_FILE), b"not valid json").unwrap();

        let result = load_manifest(&void_dir);
        assert!(result.is_err());
    }

    #[test]
    fn delete_manifest_removes_file() {
        let dir = tempdir().unwrap();
        let void_dir = dir.path().join(".void");
        fs::create_dir(&void_dir).unwrap();

        let manifest = test_manifest();

        save_manifest(&void_dir, &manifest).unwrap();
        assert!(manifest_exists(&void_dir));

        delete_manifest(&void_dir).unwrap();
        assert!(!manifest_exists(&void_dir));
    }

    #[test]
    fn delete_manifest_succeeds_when_missing() {
        let dir = tempdir().unwrap();
        let void_dir = dir.path().join(".void");
        fs::create_dir(&void_dir).unwrap();

        // Should not fail if manifest doesn't exist
        delete_manifest(&void_dir).unwrap();
    }

    #[test]
    fn atomic_write_no_temp_file_left() {
        let dir = tempdir().unwrap();
        let void_dir = dir.path().join(".void");
        fs::create_dir(&void_dir).unwrap();

        let manifest = test_manifest();

        save_manifest(&void_dir, &manifest).unwrap();

        // Temp file should not exist
        let temp_path = void_dir.join(format!("{}.tmp", MANIFEST_JSON_FILE));
        assert!(!temp_path.exists());
    }

    // ========================================================================
    // Unified Key Loading Tests
    // ========================================================================

    #[test]
    fn load_repo_key_uninitialized() {
        let result = load_repo_key(Path::new("/nonexistent"), None);
        assert!(result.is_err());
    }

    #[test]
    fn load_repo_key_collab_mode_needs_identity() {
        let dir = tempdir().unwrap();
        let void_dir = dir.path().join(".void");
        fs::create_dir(&void_dir).unwrap();

        // Create manifest to trigger collaboration mode
        let manifest = test_manifest();
        save_manifest(&void_dir, &manifest).unwrap();

        // Without identity, should fail
        let result = load_repo_key(&void_dir, None);
        assert!(result.is_err());
    }
}