zoi_package/

registry.rs

//! Registry management and metadata generation.
//!
//! This module provides functions for initializing registries, adding packages
//! and security advisories, and generating the optimized JSON index files used
//! by Zoi.

use std::collections::HashMap;
use std::fs;
use std::path::Path;

use anyhow::{Result, anyhow};
use chrono::Datelike;
use colored::Colorize;
use walkdir::WalkDir;
use zoi_core::types;
use zoi_lua;

use crate::{doctor as pkg_doctor, init_lsp};

/// Initializes a new Zoi registry at the given path.
///
/// This creates the necessary directory structure, `repo.yaml`,
/// `packages.json`, and `advisories.json`, and sets up LSP support.
///
/// # Errors
///
/// Returns an error if:
/// - The registry directory or its subdirectories cannot be created.
/// - LSP workspace setup fails.
/// - Any of the initial configuration files cannot be written.
pub fn init(path: &Path) -> Result<()> {
    println!(
        "{} Initializing new Zoi registry at {}...",
        "::".bold().blue(),
        path.display()
    );

    fs::create_dir_all(path)?;

    let dirs = ["core", "main", "community", "test", "archive"];
    for dir in &dirs {
        let dir_path = path.join(dir);
        if !dir_path.exists() {
            fs::create_dir_all(&dir_path)?;
        }
    }

    init_lsp::setup_lsp_workspace(path)?;
    println!(
        "{} LSP support initialized. Created .luarc.json and type definitions.",
        "::".bold().green()
    );

    let repo_yaml_path = path.join("repo.yaml");
    if !repo_yaml_path.exists() {
        let content = r#"# Zoi Registry Configuration
# For detailed documentation, visit: https://zillowe.qzz.io/docs/zds/zoi/repositories#the-repoyaml-file

name: "My-Registry"
description: "A custom Zoi package registry"
handle: "my-registry"
advisory_prefix: "RSA" # Prefix for security advisories, e.g. RSA-2026-A0001

# Git mirrors for this registry
# For more info: https://zillowe.qzz.io/docs/zds/zoi/guides/mirroring
git:
  - type: main
    url: "https://github.com/user/my-registry.git"

# Pre-built package mirrors (optional)
# pkg:
#   - type: main
#     url: "https://example.com/pkgs/{repo}/{os}/{arch}/{version}"

# Trusted PGP keys for this registry
# pgp:
#   - name: maintainer-key
#     key: "https://example.com/keys/maintainer.asc"

# Repository tiers
repos:
  - name: core
    type: official
    active: true
  - name: main
    type: official
    active: true
  - name: community
    type: community
    active: false
  - name: test
    type: test
    active: false
  - name: archive
    type: archive
    active: false
"#;
        fs::write(repo_yaml_path, content)?;
    }

    let packages_json_path = path.join("packages.json");
    if !packages_json_path.exists() {
        let content = r#"{
  "version": "2",
  "packages": {}
}"#;
        fs::write(packages_json_path, content)?;
    }

    let advisories_json_path = path.join("advisories.json");
    if !advisories_json_path.exists() {
        let current_year = chrono::Utc::now().year();
        let content = format!(
            r#"{{
  "version": "2",
  "advisories": {{}},
  "last_id": 0,
  "year": {current_year}
}}"#,
        );
        fs::write(advisories_json_path, content)?;
    }

    println!("{}", "Registry initialized successfully.".green());
    println!(
        "{} Edit 'repo.yaml' to configure your registry mirrors and \
         authorities.",
        "Note:".yellow()
    );
    Ok(())
}

/// Adds a new package definition to the registry.
///
/// This creates a new directory for the package and a template `.pkg.lua` file.
/// If `name` or `repo` are not provided, it prompts the user for input.
///
/// # Errors
///
/// Returns an error if:
/// - The path is not a Zoi registry.
/// - Package name or repository tier are not provided.
/// - The package directory cannot be created.
/// - The package already exists.
pub fn add_package(
    registry_root: &Path,
    name: Option<&str>,
    repo: Option<&str>
) -> Result<()> {
    use std::io::{Write, stdin, stdout};

    if !registry_root.join("repo.yaml").exists() {
        return Err(anyhow!(
            "Not a Zoi registry (missing repo.yaml). Run 'zoi reg init' first."
        ));
    }

    let get_input = |prompt: &str| -> String {
        print!("{prompt}: ");
        let _ = stdout().flush();
        let mut input = String::new();
        let _ = stdin().read_line(&mut input);
        input.trim().to_string()
    };

    let name = match name {
        Some(n) => n.to_string(),
        None => get_input("Package name")
    };

    let repo = match repo {
        Some(r) => r.to_string(),
        None => get_input("Repository tier (e.g. community, main)")
    };

    if name.is_empty() || repo.is_empty() {
        return Err(anyhow!("Package name and repository tier are required."));
    }

    let pkg_dir = registry_root.join(&repo).join(&name);
    fs::create_dir_all(&pkg_dir)?;

    let pkg_lua_path = pkg_dir.join(format!("{name}.pkg.lua"));
    if pkg_lua_path.exists() {
        return Err(anyhow!(
            "Package '{name}' already exists in repo '{repo}'.",
        ));
    }

    let content = format!(
        r#"-- Zoi Package Definition: {name}
-- For detailed documentation, visit: https://zillowe.qzz.io/docs/zds/zoi/creating-packages

metadata({{
  name = "{name}",
  repo = "{repo}",
  version = "1.0.0",
  revision = "1",
  description = "A short description of {name}.",
  website = "https://example.com",
  license = "Apache-2.0",
  maintainer = {{ name = "Your Name", email = "you@example.com" }},
  bins = {{ "{name}" }},
  types = {{ "pre-compiled" }}, -- Supports "source", "pre-compiled"
}})

dependencies({{
  build = {{
    -- Build-time dependencies
    -- For format info: https://zillowe.qzz.io/docs/zds/zoi/dependencies
  }},
  runtime = {{
    -- Runtime dependencies
  }}
}})

function prepare()
  -- Fetch source or binaries
  -- Example: UTILS.EXTRACT("https://example.com/release.tar.gz", "src")
end

function package()
  -- Stage files for the package
  -- Example: zcp("src/{name}", "${{pkgstore}}/bin/{name}")
end

-- function verify()
--   -- Security verification
--   -- return verifyHash("release.tar.gz", "sha256-...")
-- end

-- function test()
--   -- Integration tests (run via zoi package test)
--   -- local _, _, code = cmd(STAGING_DIR .. "/data/pkgstore/bin/{name} --version")
--   -- return code == 0
-- end

function uninstall()
  -- Cleanup outside the package store
end
"#,
    );

    fs::write(pkg_lua_path, content)?;
    println!(
        "{} Package '{}' created in repo '{}'.",
        "::".bold().green(),
        name.cyan(),
        repo.cyan()
    );

    Ok(())
}

/// Adds a new security advisory to the registry.
///
/// This creates a temporary `.sec.yaml` file for the given package.
/// The ID will be automatically assigned during `generate_metadata`.
///
/// # Errors
///
/// Returns an error if:
/// - The path is not a Zoi registry.
/// - The package is not found in the registry.
/// - A temporary advisory already exists.
pub fn add_advisory(
    registry_root: &Path,
    package_name: Option<&str>,
    repo: Option<&str>
) -> Result<()> {
    use std::io::{Write, stdin, stdout};

    if !registry_root.join("repo.yaml").exists() {
        return Err(anyhow!(
            "Not a Zoi registry (missing repo.yaml). Run 'zoi reg init' first."
        ));
    }

    let get_input = |prompt: &str| -> String {
        print!("{prompt}: ");
        let _ = stdout().flush();
        let mut input = String::new();
        let _ = stdin().read_line(&mut input);
        input.trim().to_string()
    };

    let package_name = match package_name {
        Some(n) => n.to_string(),
        None => get_input("Package name")
    };

    let package_name_str = package_name.as_str();

    let pkg_dir = if let Some(r) = repo {
        let dir = registry_root.join(r).join(package_name_str);
        if !dir.join(format!("{package_name_str}.pkg.lua")).exists() {
            return Err(anyhow!(
                "Package '{package_name_str}' not found in repo '{r}'.",
            ));
        }
        dir
    } else {
        let mut found = None;
        for entry in WalkDir::new(registry_root)
            .into_iter()
            .filter_map(Result::ok)
        {
            if entry.file_type().is_dir()
                && entry.file_name().to_string_lossy() == package_name_str
                && entry
                    .path()
                    .join(format!("{package_name_str}.pkg.lua"))
                    .exists()
            {
                found = Some(entry.path().to_path_buf());
                break;
            }
        }
        found.ok_or_else(|| {
            anyhow!(
                "Package '{package_name_str}' not found in registry. Try \
                 specifying --repo.",
            )
        })?
    };

    let repo_config_str = fs::read_to_string(registry_root.join("repo.yaml"))?;
    let repo_config: types::RepoConfig =
        serde_yaml::from_str(&repo_config_str)?;
    let prefix = repo_config
        .advisory_prefix
        .unwrap_or_else(|| "ZSA".to_string());
    // Validated for the same reason as in `generate_metadata`: this prefix is
    // interpolated into the advisory file name below.
    let prefix = validate_advisory_prefix(&prefix)?;

    let current_year = chrono::Utc::now().year();
    let adv_file_path =
        pkg_dir.join(format!("{prefix}-{current_year}-TEMP.sec.yaml"));

    if adv_file_path.exists() {
        return Err(anyhow!(
            "A temporary advisory already exists for this package."
        ));
    }

    println!(
        "{} Adding security advisory for package: {}",
        "::".bold().blue(),
        package_name_str.cyan()
    );
    println!(
        "For detailed documentation, visit: https://zillowe.qzz.io/docs/zds/zoi/guides/security-advisories\n"
    );

    let summary = get_input("Summary (short description)");
    let severity = get_input("Severity (low, medium, high, critical)");
    let affected_range =
        get_input("Affected version range (e.g. >=1.0.0, <1.2.3)");
    let fixed_in = get_input("Fixed in version");
    let description = get_input("Detailed description");
    let reference = get_input("Reference URL (optional)");

    let content = format!(
        r#"# Zoi Security Advisory
# For schema details: https://zillowe.qzz.io/docs/zds/zoi/guides/security-advisories#advisory-schema

id: "{prefix}-{current_year}-TEMP"
package: "{package_name}"
summary: "{summary}"
severity: "{severity}"
affected_range: "{affected_range}"
fixed_in: "{fixed_in}"
description: |
  {description}
references:
  - "{reference}"
"#,
    );

    fs::write(&adv_file_path, content)?;
    println!(
        "\n{} Temporary advisory created: {}",
        "::".bold().green(),
        adv_file_path.display().to_string().cyan()
    );
    println!(
        "{} ID will be automatically assigned during 'zoi reg gen-meta' or in \
         CI.",
        "Note:".yellow()
    );

    Ok(())
}

/// Validates the `advisory_prefix` from a registry's `repo.yaml`.
///
/// The prefix is interpolated straight into the file name every advisory is
/// written to (`{prefix}-{year}-{sev}{n}.sec.yaml`). A registry setting a
/// prefix that contains a separator, a dot segment, or a NUL byte would
/// therefore make `zoi reg addadvisory` and `zoi reg build` read and write
/// outside the registry root. An allowlist is used rather than a denylist so
/// percent-encoding and Unicode look-alikes cannot smuggle a separator past it.
///
/// # Errors
///
/// Returns an error if the prefix is empty or contains anything outside
/// ASCII letters, digits, hyphen, or underscore.
fn validate_advisory_prefix(prefix: &str) -> Result<String> {
    if prefix.is_empty()
        || !prefix
            .chars()
            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_'))
    {
        return Err(anyhow!(
            "advisory_prefix '{prefix}' in repo.yaml must be non-empty and \
             contain only ASCII letters, digits, '-' or '_'"
        ));
    }
    Ok(prefix.to_string())
}

/// Scans the entire registry to generate optimized JSON index files.
///
/// This function is the "Build Pipeline" for Zoi registries. It:
/// - Chronologically assigns permanent IDs to new security advisories.
/// - Parses every `.pkg.lua` file to extract static metadata.
/// - Populates `packages.json` (the primary index) and `advisories.json`.
/// - Enables clients to resolve packages and vulnerabilities without cloning
///   the entire Git repository or parsing thousands of Lua scripts.
///
/// # Errors
///
/// Returns an error if:
/// - The path is not a Zoi registry.
/// - The registry index files cannot be written.
/// - Any package or advisory definition is malformed.
/// - `repo.yaml` declares an `advisory_prefix` that is not a plain name.
pub fn generate_metadata(registry_root: &Path) -> Result<()> {
    if !registry_root.join("repo.yaml").exists() {
        return Err(anyhow!(
            "Not a Zoi registry (missing repo.yaml). Run 'zoi reg init' first."
        ));
    }

    println!("{} Generating registry metadata...", "::".bold().blue());

    let repo_config_str = fs::read_to_string(registry_root.join("repo.yaml"))?;
    let repo_config: types::RepoConfig =
        serde_yaml::from_str(&repo_config_str)?;
    let advisory_prefix = repo_config
        .advisory_prefix
        .clone()
        .unwrap_or_else(|| "ZSA".to_string());

    let advisory_prefix = validate_advisory_prefix(&advisory_prefix)?;

    let advisories_json_path = registry_root.join("advisories.json");
    let mut adv_registry: types::AdvisoryRegistry =
        if advisories_json_path.exists() {
            serde_json::from_str(&fs::read_to_string(&advisories_json_path)?)?
        } else {
            types::AdvisoryRegistry::default()
        };

    let current_year = chrono::Utc::now().year();
    let current_year_u32 = u32::try_from(current_year).unwrap_or(0);
    if adv_registry.year != current_year_u32 {
        adv_registry.year = current_year_u32;
        adv_registry.last_id = 0;
    }

    for entry in WalkDir::new(registry_root)
        .into_iter()
        .filter_map(Result::ok)
    {
        let file_name = entry.file_name().to_string_lossy();
        if file_name.ends_with("-TEMP.sec.yaml") {
            let path = entry.path();
            let content_str = fs::read_to_string(path)?;
            let mut content: serde_yaml::Value =
                serde_yaml::from_str(&content_str)?;
            let severity = content
                .get("severity")
                .and_then(|v| v.as_str())
                .unwrap_or("low")
                .to_lowercase();
            let sev_char = match severity.as_str() {
                "medium" => "B",
                "high" => "C",
                "critical" => "D",
                _ => "A"
            };

            adv_registry.last_id += 1;
            let final_id = format!(
                "{advisory_prefix}-{current_year}-{sev_char}{:04}",
                adv_registry.last_id
            );

            if let Some(mapping) = content.as_mapping_mut() {
                mapping.insert(
                    serde_yaml::Value::String("id".to_string()),
                    serde_yaml::Value::String(final_id.clone())
                );
            }

            let final_path =
                path.with_file_name(format!("{final_id}.sec.yaml"));
            fs::write(&final_path, serde_yaml::to_string(&content)?)?;
            fs::remove_file(path)?;
            println!("Assigned ID {} to {}", final_id.green(), path.display());
        }
    }

    let mut advisories_map = std::collections::BTreeMap::new();
    let mut max_id = adv_registry.last_id;

    for entry in WalkDir::new(registry_root)
        .into_iter()
        .filter_map(Result::ok)
    {
        let file_name = entry.file_name().to_string_lossy();
        if file_name.ends_with(".sec.yaml")
            && !file_name.ends_with("-TEMP.sec.yaml")
        {
            let content_str = fs::read_to_string(entry.path())?;
            let content: types::Advisory = serde_yaml::from_str(&content_str)?;
            if let Some(last_part) = content.id.split('-').next_back() {
                let id_num_str = if last_part.len() > 4 {
                    &last_part[1..]
                } else {
                    last_part
                };
                if let Ok(id_num) = id_num_str.parse::<u32>() {
                    if id_num > max_id {
                        max_id = id_num;
                    }
                    let rel_path = entry.path().strip_prefix(registry_root)?;
                    advisories_map.insert(
                        content.id.clone(),
                        rel_path.to_string_lossy().to_string()
                    );
                }
            }
        }
    }

    adv_registry.last_id = max_id;
    adv_registry.advisories = advisories_map;
    adv_registry.version = "2".to_string();
    fs::write(
        &advisories_json_path,
        serde_json::to_string_pretty(&adv_registry)?
    )?;

    let mut packages_map = std::collections::BTreeMap::new();
    let repo_types: HashMap<String, String> = repo_config
        .repos
        .iter()
        .map(|r| (r.name.clone(), r.repo_type.clone()))
        .collect();

    for entry in WalkDir::new(registry_root)
        .into_iter()
        .filter_map(Result::ok)
    {
        if entry.file_type().is_file()
            && entry.file_name().to_string_lossy().ends_with(".pkg.lua")
        {
            let path = entry.path();
            let path_str = path.to_string_lossy();
            if let Ok(pkg) =
                zoi_lua::parser::parse_lua_package(&path_str, None, None, true)
            {
                let rel_path = path.strip_prefix(registry_root)?;
                let mut repo_parts: Vec<_> = rel_path
                    .components()
                    .map(|c| c.as_os_str().to_string_lossy().to_string())
                    .collect();
                repo_parts.pop();
                repo_parts.pop();
                let repo_path = repo_parts.join("/");

                let major_repo =
                    repo_path.split('/').next().unwrap_or_default();
                let repo_type = repo_types
                    .get(major_repo)
                    .cloned()
                    .unwrap_or_else(|| "unofficial".to_string());

                let version = pkg
                    .version
                    .clone()
                    .or_else(|| {
                        pkg.versions
                            .as_ref()
                            .and_then(|v| v.get("stable").cloned())
                    })
                    .unwrap_or_else(|| "unknown".to_string());

                let mut vulns = Vec::new();
                let pkg_dir = path.parent().ok_or_else(|| {
                    anyhow!("Package path has no parent directory")
                })?;
                if let Ok(sec_entries) = fs::read_dir(pkg_dir) {
                    for sec_entry in sec_entries.flatten() {
                        if sec_entry
                            .file_name()
                            .to_string_lossy()
                            .ends_with(".sec.yaml")
                        {
                            let sec_content_str =
                                fs::read_to_string(sec_entry.path())?;
                            if let Ok(adv) =
                                serde_yaml::from_str::<types::Advisory>(
                                    &sec_content_str
                                )
                            {
                                vulns.push(
                                    zoi_core::types::MiniVulnerability {
                                        id: adv.id,
                                        severity: format!("{:?}", adv.severity)
                                            .to_lowercase(),
                                        affected_range: adv.affected_range,
                                        fixed_in: adv.fixed_in,
                                        summary: adv.summary
                                    }
                                );
                            }
                        }
                    }
                }

                let packages_key =
                    format!("@{repo_path}/{name}", name = pkg.name);

                let dependencies_v2 = pkg.dependencies.map(|deps| {
                    let mut runtime = Vec::new();
                    if let Some(r) = deps.runtime {
                        runtime = match r {
                            types::DependencyGroup::Simple(d) => d,
                            types::DependencyGroup::Complex(c) => {
                                let mut all = c.required;
                                all.extend(c.optional);
                                for opt in c.options {
                                    all.extend(opt.depends);
                                }
                                all
                            }
                        };
                    }

                    let mut build = Vec::new();
                    if let Some(b) = deps.build {
                        match b {
                            types::BuildDependencies::Group(g) => {
                                let packages = match g {
                                    types::DependencyGroup::Simple(d) => d,
                                    types::DependencyGroup::Complex(c) => {
                                        let mut all = c.required;
                                        all.extend(c.optional);
                                        for opt in c.options {
                                            all.extend(opt.depends);
                                        }
                                        all
                                    }
                                };
                                build.push(types::BuildDependencyV2 {
                                    build_type: "source".to_string(),
                                    packages
                                });
                            }
                            types::BuildDependencies::Typed(t) => {
                                for (bt, g) in t.types {
                                    let packages = match g {
                                        types::DependencyGroup::Simple(d) => d,
                                        types::DependencyGroup::Complex(c) => {
                                            let mut all = c.required;
                                            all.extend(c.optional);
                                            for opt in c.options {
                                                all.extend(opt.depends);
                                            }
                                            all
                                        }
                                    };
                                    build.push(types::BuildDependencyV2 {
                                        build_type: bt,
                                        packages
                                    });
                                }
                            }
                            types::BuildDependencies::List(l) => {
                                for entry in l {
                                    build.push(types::BuildDependencyV2 {
                                        build_type: entry.build_type,
                                        packages: entry.packages
                                    });
                                }
                            }
                        }
                    }

                    let mut test = Vec::new();
                    if let Some(t) = deps.test {
                        test = match t {
                            types::DependencyGroup::Simple(d) => d,
                            types::DependencyGroup::Complex(c) => {
                                let mut all = c.required;
                                all.extend(c.optional);
                                for opt in c.options {
                                    all.extend(opt.depends);
                                }
                                all
                            }
                        };
                    }

                    types::DependenciesV2 {
                        runtime,
                        build,
                        test
                    }
                });

                packages_map.insert(
                    packages_key,
                    types::PurlPackageIndexV2 {
                        repo: repo_path,
                        repo_type,
                        version,
                        epoch: pkg.epoch,
                        revision: pkg.revision.clone(),
                        description: pkg.description,
                        scope: Some(pkg.scope),
                        scopes: pkg.scopes.clone(),
                        dependencies: dependencies_v2,
                        sub_packages: pkg.sub_packages.unwrap_or_default(),
                        main_sub_packages: pkg.main_subs.unwrap_or_default(),
                        vuln: vulns
                    }
                );
            }
        }
    }

    let index = types::RegistryIndexV2 {
        version: "2".to_string(),
        packages: packages_map
    };
    fs::write(
        registry_root.join("packages.json"),
        serde_json::to_string_pretty(&index)?
    )?;

    println!("{}", "Metadata generation complete.".green());

    Ok(())
}

/// Checks the integrity of all package definitions in the registry.
///
/// This runs `zoi doctor` on every `.pkg.lua` file in the registry.
///
/// # Errors
///
/// Returns an error if any package fails the health check.
pub fn check(registry_root: &Path) -> Result<()> {
    if !registry_root.join("repo.yaml").exists() {
        return Err(anyhow!(
            "Not a Zoi registry (missing repo.yaml). Run 'zoi reg init' first."
        ));
    }

    println!("{} Checking registry integrity...", "::".bold().blue());

    let mut errors = 0;
    let mut warnings = 0;

    for entry in WalkDir::new(registry_root)
        .into_iter()
        .filter_map(Result::ok)
    {
        if entry.file_type().is_file()
            && entry.file_name().to_string_lossy().ends_with(".pkg.lua")
        {
            println!(
                "  Checking {}...",
                entry.path().display().to_string().cyan()
            );
            match pkg_doctor::run(entry.path(), None, None) {
                Ok(report) => {
                    for error in &report.errors {
                        eprintln!("    {} {error}", "Error:".red().bold());
                        errors += 1;
                    }
                    for warning in &report.warnings {
                        println!(
                            "    {} {warning}",
                            "Warning:".yellow().bold()
                        );
                        warnings += 1;
                    }
                }
                Err(e) => {
                    eprintln!(
                        "    {} Failed to parse package: {e}",
                        "Error:".red().bold(),
                    );
                    errors += 1;
                }
            }
        }
    }

    if errors > 0 {
        return Err(anyhow!(
            "Registry check failed with {errors} error(s) and {warnings} \
             warning(s).",
        ));
    }

    println!(
        "{} Registry check passed with {} warning(s).",
        "::".bold().green(),
        warnings
    );
    Ok(())
}