/**
 * T15 — CA-key / secret-manager bootstrap + KMS-signer factory (§3.1). The intermediate
 * leaf-signing key is a non-exportable KMS/HSM key: signing is a `sign()` CALL, the raw private
 * key is NEVER loaded into control-plane memory. `buildCaSigner` FAILS FAST at startup (INV9) if
 * the key ref is unresolvable OR its policy does not restrict `sign` to the control-plane
 * service principal. Both T8 `signHostLeaf` and T15 `renewHostLeaf` call this shared primitive —
 * neither loads a raw key.
 *
 * Two in-process dev/test signers implement the SAME `CaSigner` surface (never a KMS — production
 * mandates a real non-exportable key): `inProcessCaSigner` (Ed25519, the relay agent-CA path) and
 * `inProcessP256CaSigner` (ECDSA-with-SHA256, the native-tunnel `frp-client-CA` / `device-CA` P-256
 * path). The P-256 signer returns a raw P1363 `r||s` signature — the shape hardware emits — which
 * `x509-assembler` normalizes to DER; both expose the same `sign()` so callers stay KMS-shaped.
 */
import { createPublicKey, generateKeyPairSync, sign as nodeSign } from 'node:crypto'
import { readFileSync } from 'node:fs'
import type { ControlPlaneEnv } from '../env.js'
import { createPrivateKey, ed25519Sign, generateEd25519, type KeyObject } from '../util/crypto.js'

/** Wraps KMS `sign()`; no raw key ever crosses this boundary. */
export interface CaSigner {
  sign(tbsCert: Uint8Array): Promise<Uint8Array>
  /** Public verifying key of the CA (for tests / chain assembly). */
  readonly publicKeyRaw: Uint8Array
}

/**
 * KMS resolver seam. Production resolves a real KMS/HSM key handle + policy; tests inject a fake.
 * A resolver returns `{ canSign, policyRestrictedToServicePrincipal }` for the given ref, or throws
 * if the ref cannot be resolved at all.
 */
export interface KmsResolver {
  resolve(keyRef: string): Promise<{
    readonly signer: CaSigner
    readonly policyRestrictedToServicePrincipal: boolean
  }>
}

/**
 * Build the CA signer for the configured intermediate KMS key. Fail-fast (INV9, §3.1):
 *  - throws if the resolver cannot resolve the ref;
 *  - throws if the KMS key policy is broader than the control-plane service principal.
 */
export async function buildCaSigner(env: ControlPlaneEnv, resolver: KmsResolver): Promise<CaSigner> {
  let resolved
  try {
    resolved = await resolver.resolve(env.caIntermediateKmsKeyRef)
  } catch (err: unknown) {
    // Never log the ref VALUE — only that resolution failed (INV9).
    throw new Error(
      `CA intermediate KMS key could not be resolved: ${err instanceof Error ? err.message : 'unknown'}`,
    )
  }
  if (!resolved.policyRestrictedToServicePrincipal) {
    throw new Error(
      'CA intermediate KMS key policy is broader than the control-plane service principal (§3.1) — refusing to boot',
    )
  }
  return resolved.signer
}

/**
 * In-process Ed25519 CA signer — TEST/DEV ONLY (clearly NOT a KMS; the plan mandates a real
 * non-exportable KMS key in production, §3.1). Exposes the same `sign()` surface so callers are
 * KMS-shaped and never touch a raw key path themselves.
 */
export function inProcessCaSigner(privateKey?: KeyObject): CaSigner {
  const key = privateKey ?? generateEd25519().privateKey
  const pub = derivePublicRaw(key)
  return {
    publicKeyRaw: pub,
    async sign(tbsCert) {
      return ed25519Sign(key, tbsCert)
    },
  }
}

function derivePublicRaw(privateKey: KeyObject): Uint8Array {
  // Recover the raw 32-byte Ed25519 public key from the private KeyObject.
  const spki = createPublicKey(privateKey).export({ format: 'der', type: 'spki' }) as Buffer
  return new Uint8Array(spki.subarray(spki.length - 32))
}

/**
 * In-process P-256 (ECDSA-with-SHA256) CA signer — TEST/DEV ONLY, same disclaimer as the Ed25519
 * variant. This is the dev stand-in for the native-tunnel `frp-client-CA` / `device-CA` (both P-256).
 * `sign()` returns a RAW P1363 `r||s` (64-byte) signature over the TBS — the same shape hardware
 * (Secure Enclave / StrongBox / WebCrypto) emits — which `x509-assembler` normalizes to DER.
 * `publicKeyRaw` carries the CA's SubjectPublicKeyInfo DER (not a bare point) so tests can import it
 * directly as a verifying key.
 */
export function inProcessP256CaSigner(privateKey?: KeyObject): CaSigner {
  const key = privateKey ?? generateKeyPairSync('ec', { namedCurve: 'P-256' }).privateKey
  const spkiDer = createPublicKey(key).export({ format: 'der', type: 'spki' }) as Buffer
  return {
    publicKeyRaw: new Uint8Array(spkiDer),
    async sign(tbsCert) {
      return new Uint8Array(nodeSign('sha256', Buffer.from(tbsCert), { key, dsaEncoding: 'ieee-p1363' }))
    },
  }
}

/** Prefix marking a KMS key ref that is actually an on-disk PEM key path (`file:<path>`). */
const FILE_KEY_REF_PREFIX = 'file:'
/** OpenSSL's name for the P-256 (secp256r1) curve — the ONLY curve the native-tunnel CAs use. */
const P256_CURVE = 'prime256v1'

/** Build a `file:<path>` KMS key ref from an on-disk native-CA private key path. */
export function fileKeyRef(path: string): string {
  return `${FILE_KEY_REF_PREFIX}${path}`
}

/**
 * Load a PKCS#8 PEM P-256 private key from disk and wrap it in the SAME `CaSigner` surface as
 * `inProcessP256CaSigner` (raw P1363 `r||s` over the DER TBS). FAIL-FAST on an unreadable file,
 * malformed PEM, or a non-P-256 key. The raw key stays in-process — NEVER logged/serialised (INV9).
 */
function loadP256FileSigner(path: string): CaSigner {
  let pem: string
  try {
    pem = readFileSync(path, 'utf8')
  } catch {
    // Never echo the path contents — only that the file was unreadable (INV9).
    throw new Error('native-CA private key file is unreadable')
  }
  let key: KeyObject
  try {
    key = createPrivateKey(pem)
  } catch {
    throw new Error('native-CA private key is not a valid PEM private key')
  }
  if (key.asymmetricKeyType !== 'ec' || key.asymmetricKeyDetails?.namedCurve !== P256_CURVE) {
    throw new Error('native-CA private key must be a P-256 (prime256v1) EC key')
  }
  return inProcessP256CaSigner(key)
}

/**
 * FILE-BACKED KmsResolver — the production native-tunnel key custody for the single-owner VPS deploy.
 * Resolves a key ref of the form `file:<path>` (or a bare path) by loading the on-disk PEM P-256 key
 * into an in-process `CaSigner`. `policyRestrictedToServicePrincipal` is TRUE because the on-disk key
 * IS the control-plane's sole custody (documented file-custody reality; a real non-exportable KMS —
 * `KmsResolver` in front of KMS/HSM — is the future upgrade). Throws if the ref cannot be resolved so
 * `buildCaSigner` fails fast at boot. NEVER logs key material (INV9).
 */
export function fileKmsResolver(): KmsResolver {
  return {
    async resolve(keyRef: string) {
      const path = keyRef.startsWith(FILE_KEY_REF_PREFIX) ? keyRef.slice(FILE_KEY_REF_PREFIX.length) : keyRef
      if (path.length === 0) throw new Error('file KMS key ref has an empty path')
      return { signer: loadP256FileSigner(path), policyRestrictedToServicePrincipal: true }
    },
  }
}