package main

import (
	"fmt"
	"strconv"

	"github.com/vaughan0/go-ini"

	"sourcecraft.dev/bigbes/sr-ht-ecore/metapat"

	"sourcecraft.dev/bigbes/sr-ht-spec/authn"
	"sourcecraft.dev/bigbes/sr-ht-spec/graph"
)

// queryRoute is where the GraphQL schema answers. It is core-go's own path,
// because that is where every SourceHut client — hut, api.sr.ht, meta's
// personal-token page — already looks. The file beside it is served by
// sr-ht-ecore's apimeta, at apimeta.Path, because a service that mounts its own
// /query is the one thing core-go does not serve that file for.
const queryRoute = "/query"

// apiScopes is what this service publishes at apimeta.Path: the scopes a
// meta.sr.ht personal access token can be minted for here.
//
// A scope is the part after the service name in a meta.sr.ht personal-token
// grant, and meta builds the checkboxes of /oauth2/personal-token by fetching
// this file from every service it discovers and prefixing each entry with that
// service's own name. So "SPECS" here is what makes "spec.sr.ht/SPECS:RO" a token
// a human can actually obtain.
//
// It published nothing until /query started accepting a PAT, and that empty list
// was not merely an omission. It meant no PAT could be scoped for this service
// even in principle, so the credential api.sr.ht forwards to every service a
// federated query touches could never have been presented here — whatever the
// endpoint's own code said about it.
//
// It is graph.GrantScopes and not a literal, so that what the daemon serves is
// derived from the same authn.ScopeRead the endpoint checks rather than being a
// second spelling of it. apimeta marshals it as [] and never as null; see the
// test for why that distinction is instance-wide.
var apiScopes = graph.GrantScopes

// newMetaPlane builds the meta.sr.ht personal access token plane /query accepts
// beside the tokens.sr.ht working token every other surface takes.
//
// It is built here, at the single call site that may use it, and deliberately not
// on the *authn.Resolver the daemon hands to every surface. Putting it there
// would give it to the REST write plane, /mcp and the push hook as well, which is
// precisely what must not happen: those require a tokens.sr.ht grant, and a
// personal access token — the credential every account on the instance can mint
// for itself, in a vocabulary that cannot spell spec:propose — must not be a way
// around one. Building it at one call site makes the scope of the exception
// something a reader can see rather than something they have to trust.
//
// owner is the same [sr.ht] owner-name the resolver was built with, because the
// single-owner rule belongs to the service and not to one plane: a PAT belonging
// to anybody else is refused exactly as a working token of theirs is.
//
// The validator is metapat's default backend, which is core-go — it mirrors the
// owner's profile and asks meta.sr.ht about revocation through the database and
// config in the request context. /query has both: mountGraphQL puts it in a Group
// carrying core-go's config and database middleware, which the webhook resolvers
// already needed.
//
// Unlike the working-token plane this one needs no configuration and can never be
// legitimately absent: it depends on no per-instance origin. So a failure here is
// fatal to startup rather than a degraded mode — an instance that came up without
// it would answer 401 to every federated query while looking configured.
func newMetaPlane(owner string) (*authn.MetaAuth, error) {
	pats, err := metapat.New(metapat.Options{Service: authn.ConfigSection})
	if err != nil {
		return nil, fmt.Errorf("assemble the meta.sr.ht token plane: %w", err)
	}
	plane, err := authn.NewMetaAuth(pats, owner, authn.ScopeRead)
	if err != nil {
		return nil, fmt.Errorf("assemble the meta.sr.ht token plane: %w", err)
	}
	return plane, nil
}

// defaultMaxComplexity is the bound core-go's server.WithSchema would have
// applied. It is repeated here because this daemon does not call WithSchema —
// /query is mounted on the anonymous router with spec's own credential plane in
// front of it — and the value has a second reader that has nothing to do with
// HTTP: the webhook delivery worker runs a subscriber's stored query through
// corewebhooks.Exec, which compares its complexity against Server.MaxComplexity
// and refuses everything above it. Leaving the field at its zero value would
// therefore not mean "no limit"; it would mean every webhook delivery fails.
const defaultMaxComplexity = 250

// maxComplexity is [spec.sr.ht::api] max-complexity, or defaultMaxComplexity
// when the instance does not set it.
//
// An unparseable value is a configuration error and is reported as one, rather
// than being read as "the operator meant the default": a limit somebody wrote
// down and got wrong must not be silently replaced by a different limit.
func maxComplexity(conf ini.File) (int, error) {
	raw, ok := conf.Get(serviceName+"::api", "max-complexity")
	if !ok || raw == "" {
		return defaultMaxComplexity, nil
	}
	limit, err := strconv.Atoi(raw)
	if err != nil {
		return 0, err
	}
	return limit, nil
}