// Package sink writes secrets out of the RAM vault. gopass is the live store
// (GPG); openssl produces portable sealed backups. Plaintext flows vault → pipe
// → external tool's stdin, and never touches the filesystem in cleartext.
package sink

import (
	"bytes"
	"context"
	"fmt"
	"os/exec"
	"path"
	"strings"

	"incredigo/internal/discover"
	"incredigo/internal/vault"
)

// Gopass streams secrets into `gopass insert`. The binary path is configurable
// for testing; defaults to "gopass" on PATH.
type Gopass struct {
	Bin    string // default "gopass"
	Prefix string // default "imported/"
}

func (g *Gopass) bin() string {
	if g.Bin == "" {
		return "gopass"
	}
	return g.Bin
}

// Available reports whether gopass is usable.
func (g *Gopass) Available() bool {
	_, err := exec.LookPath(g.bin())
	return err == nil
}

// StorePath is the gopass entry path for a credential: <prefix>/<source>/<slug>.
func (g *Gopass) StorePath(c discover.Credential) string {
	prefix := g.Prefix
	if prefix == "" {
		prefix = "imported/"
	}
	return path.Join(prefix, c.Source, slug(c.Identity))
}

// Insert writes one credential's secret into gopass. The plaintext is taken from
// the locked vault buffer and piped directly to gopass stdin; we never build a
// plaintext string or temp file. `-f` forces overwrite; caller decides dedupe.
func (g *Gopass) Insert(ctx context.Context, v *vault.Vault, c discover.Credential, force bool) error {
	buf, err := v.Open(c.Secret)
	if err != nil {
		return err
	}

	args := []string{"insert", "--multiline=false"}
	if force {
		args = append(args, "-f")
	}
	args = append(args, g.StorePath(c))

	cmd := exec.CommandContext(ctx, g.bin(), args...)
	// buf.Bytes() is the locked memory; gopass reads it from the pipe and GPG-
	// encrypts. The bytes are never copied into a managed Go string.
	cmd.Stdin = bytes.NewReader(buf.Bytes())
	var stderr bytes.Buffer
	cmd.Stderr = &stderr
	if err := cmd.Run(); err != nil {
		return fmt.Errorf("gopass insert %q: %v: %s", g.StorePath(c), err, stderr.String())
	}
	// Shrink the in-memory window: this secret is now safely in gopass.
	v.Forget(c.Secret)
	return nil
}

// Exists reports whether an entry already exists (for --dedupe).
func (g *Gopass) Exists(ctx context.Context, storePath string) bool {
	cmd := exec.CommandContext(ctx, g.bin(), "ls", "--flat")
	out, err := cmd.Output()
	if err != nil {
		return false
	}
	for _, line := range strings.Split(string(out), "\n") {
		if strings.TrimSpace(line) == storePath {
			return true
		}
	}
	return false
}

func slug(s string) string {
	s = strings.ToLower(strings.TrimSpace(s))
	repl := strings.NewReplacer(" / ", "/", " ", "-", "*", "")
	return repl.Replace(s)
}