package gudusoft.gsqlparser.runtime;

import gudusoft.gsqlparser.util.Logger;
import gudusoft.gsqlparser.util.LoggerFactory;

import java.security.SecureRandom;

/**
 * Entry point for activating this GSP runtime with a signed entitlement.
 *
 * <p>Replaces the former {@code TSQLEnv.usedBySqlflow} guard, which was a
 * private boolean a host set by reflection: anyone who read the bytecode knew
 * the secret, and the failure mode for everyone else was silently wrong
 * results. This is a signed, expiring, revocable, auditable grant instead.</p>
 *
 * <h3>Usage</h3>
 * <pre>
 * GspActivation result = GspRuntime.activate(Files.readAllBytes(path));
 * if (!result.isValid()) {
 *     throw new IllegalStateException("GSP entitlement rejected: "
 *             + result.reasonCode() + " audit=" + result.auditId());
 * }
 * </pre>
 *
 * <p>Activate once per process, before the service reports ready, and treat
 * failure as a startup failure rather than a per-request one.</p>
 *
 * <p><b>There is deliberately no {@code setActivated(true)}.</b> The only way
 * to reach {@link GspActivationStatus#ACTIVE} is to present bytes carrying a
 * valid signature from a private key this build does not contain.</p>
 *
 * <h3>What this build does and does not do</h3>
 *
 * <p>{@code activate} performs full verification and reports an accurate
 * verdict. <b>Nothing yet refuses to produce results when the runtime is not
 * activated</b> — wiring enforcement into the result-producing entry points is
 * the next step. Until then this API is observable but not enforcing, and
 * saying otherwise would overstate what the jar protects.</p>
 */
public final class GspRuntime {

    private static final Logger log = LoggerFactory.getLogger(GspRuntime.class);

    private static final SecureRandom AUDIT_IDS = new SecureRandom();

    /**
     * Current activation. Volatile because activation happens on a startup
     * thread while reads come from parsing threads.
     *
     * <p>Never null: before any attempt it reports
     * {@link GspActivationStatus#MISSING}, so a caller that skipped activation
     * and one that failed it are both plainly not activated.</p>
     */
    private static volatile GspActivation current =
            new GspActivation(GspActivationStatus.MISSING, null, null, 0L);

    private GspRuntime() {
        // static entry point only
    }

    /**
     * Verifies a signed entitlement and records the outcome.
     *
     * <p>Every refusal is logged at ERROR with a greppable marker and an audit
     * id matching the returned object. That pairing is a condition of the
     * agreed design: a covert refusal is only acceptable when an operator can
     * still find out why from the host's own logs.</p>
     *
     * @param signedEntitlement compact JWS bytes; null or empty yields
     *                          {@link GspActivationStatus#MISSING}
     * @return the outcome; never null, never throws
     */
    public static GspActivation activate(byte[] signedEntitlement) {
        String auditId = newAuditId();
        GspActivation result;
        try {
            result = EntitlementVerifier.verify(
                    signedEntitlement, System.currentTimeMillis() / 1000L, auditId);
        } catch (Throwable t) {
            // Verification must never propagate. An exception escaping here
            // would be a denial-of-service on the host's startup path, and
            // worse, a caller catching broadly could mistake it for "no
            // entitlement configured" and continue.
            log.error("GSP_ENTITLEMENT_REFUSED reason=MALFORMED audit=" + auditId
                    + " (verifier raised " + t.getClass().getName() + ")", t);
            result = new GspActivation(GspActivationStatus.MALFORMED, auditId, null, 0L);
        }

        if (result.isValid()) {
            log.info("GSP_ENTITLEMENT_ACCEPTED audit=" + result.auditId()
                    + " deployment=" + result.deploymentId()
                    + " expiresAt=" + result.expiresAtEpochSeconds());
        } else {
            log.error("GSP_ENTITLEMENT_REFUSED reason=" + result.reasonCode()
                    + " audit=" + result.auditId());
        }
        current = result;
        return result;
    }

    /**
     * Whether this runtime currently holds a valid entitlement.
     *
     * <p>Re-checks expiry on every call, so a long-running process does not
     * stay activated past {@code exp} just because it started before it.</p>
     */
    public static boolean isActivated() {
        return activationStatus().isValid();
    }

    /**
     * The current activation, re-evaluated for expiry.
     *
     * @return never null; {@link GspActivationStatus#MISSING} before any
     *         {@link #activate} call
     */
    public static GspActivation activationStatus() {
        GspActivation snapshot = current;
        if (snapshot.isValid()
                && snapshot.expiresAtEpochSeconds() > 0L
                && System.currentTimeMillis() / 1000L > snapshot.expiresAtEpochSeconds()) {
            GspActivation expired = new GspActivation(
                    GspActivationStatus.EXPIRED, snapshot.auditId(),
                    snapshot.deploymentId(), snapshot.expiresAtEpochSeconds());
            log.error("GSP_ENTITLEMENT_REFUSED reason=EXPIRED audit=" + expired.auditId()
                    + " (entitlement expired while the process was running)");
            current = expired;
            return expired;
        }
        return snapshot;
    }

    /**
     * Marker resource that makes this build refuse to work without an
     * entitlement. Added by the SQLFlow build profile; absent from the ordinary
     * commercial and trial jars, which must keep working for every existing
     * customer exactly as before.
     */
    private static final String ENFORCEMENT_MARKER = "META-INF/gsp-entitlement-required";

    /** Resolved once. {@code Boolean} rather than boolean so tests can override. */
    private static volatile Boolean enforcementOverride = null;

    private static final boolean MARKER_PRESENT =
            GspRuntime.class.getClassLoader().getResource(ENFORCEMENT_MARKER) != null;

    /**
     * Whether this build refuses to produce results without an entitlement.
     *
     * <p>False for the ordinary jars, so this whole mechanism is invisible to
     * existing users. True only for a build that shipped the marker.</p>
     *
     * <p>Honest about its limits: a marker on the classpath raises the cost of
     * removing the check, it is not a security boundary. An attacker who
     * controls the JVM can strip it, just as they could patch the check out of
     * the bytecode. Obfuscation and this marker buy cost, not impossibility.</p>
     */
    public static boolean isEnforcementEnabled() {
        Boolean override = enforcementOverride;
        return override != null ? override.booleanValue() : MARKER_PRESENT;
    }

    /**
     * Refuses to continue when an entitlement-gated build is not activated.
     *
     * <p>Called from the result-producing entry points. On a build without the
     * marker this is a cheap no-op.</p>
     *
     * @throws GspNotActivatedException explicitly, rather than degrading the
     *         result — see that class for why covert failure was rejected
     */
    public static void requireActivated() {
        if (!isEnforcementEnabled()) {
            return;
        }
        GspActivation state = activationStatus();
        if (!state.isValid()) {
            if (state.auditId() == null) {
                // The never-activated state is a constant and carries no audit
                // id, so a refusal here would log "audit=null" -- useless to
                // the operator who has to explain a failed startup. The agreed
                // design makes the audit id a CONDITION of refusing at all, so
                // mint one at the refusal point rather than log a null.
                state = new GspActivation(state.getStatus(), newAuditId(),
                        state.deploymentId(), state.expiresAtEpochSeconds());
            }
            log.error("GSP_ENTITLEMENT_REFUSED reason=" + state.reasonCode()
                    + " audit=" + state.auditId()
                    + " (refusing to produce a result on an entitlement-gated build)");
            throw new GspNotActivatedException(state);
        }
    }

    /** Test seam: force enforcement on or off; null restores the build default. */
    static void setEnforcementForTesting(Boolean value) {
        enforcementOverride = value;
    }

    /** Test seam: restore the pre-activation state. */
    static void resetForTesting() {
        current = new GspActivation(GspActivationStatus.MISSING, null, null, 0L);
    }

    private static String newAuditId() {
        byte[] raw = new byte[8];
        AUDIT_IDS.nextBytes(raw);
        StringBuilder sb = new StringBuilder(16);
        for (byte b : raw) {
            sb.append(Character.forDigit((b >> 4) & 0xF, 16));
            sb.append(Character.forDigit(b & 0xF, 16));
        }
        return sb.toString();
    }
}