/*
    * Licensed to the Apache Software Foundation (ASF) under one
    * or more contributor license agreements.  See the NOTICE file
    * distributed with this work for additional information
    * regarding copyright ownership.  The ASF licenses this file
    * to you under the Apache License, Version 2.0 (the
    * "License"); you may not use this file except in compliance
    * with the License.  You may obtain a copy of the License at
    *
   *   http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing,
   * software distributed under the License is distributed on an
   * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
   * KIND, either express or implied.  See the License for the
   * specific language governing permissions and limitations
   * under the License.
   */
  package org.eclipse.aether.internal.impl.checksum;
  
  import javax.inject.Inject;
  import javax.inject.Named;
  import javax.inject.Singleton;
  
  import java.io.BufferedReader;
  import java.io.IOException;
  import java.io.UncheckedIOException;
  import java.nio.charset.StandardCharsets;
  import java.nio.file.Files;
  import java.nio.file.Path;
  import java.util.ArrayList;
  import java.util.HashMap;
  import java.util.List;
  import java.util.Map;
  import java.util.Objects;
  import java.util.concurrent.ConcurrentHashMap;
  import java.util.concurrent.atomic.AtomicBoolean;
  import java.util.function.Function;
  import java.util.stream.Collectors;
  
  import org.eclipse.aether.MultiRuntimeException;
  import org.eclipse.aether.RepositorySystemSession;
  import org.eclipse.aether.artifact.Artifact;
  import org.eclipse.aether.impl.RepositorySystemLifecycle;
  import org.eclipse.aether.internal.impl.LocalPathComposer;
  import org.eclipse.aether.metadata.Metadata;
  import org.eclipse.aether.repository.ArtifactRepository;
  import org.eclipse.aether.spi.connector.checksum.ChecksumAlgorithmFactory;
  import org.eclipse.aether.spi.io.PathProcessor;
  import org.eclipse.aether.spi.remoterepo.RepositoryKeyFunctionFactory;
  import org.eclipse.aether.util.ConfigUtils;
  import org.eclipse.aether.util.PathUtils;
  
  import static java.util.Objects.requireNonNull;
  
  /**
   * Compact file {@link FileTrustedChecksumsSourceSupport} implementation that use specified directory as base
   * directory, where it expects a "summary" file named as "checksums.${checksumExt}" for each checksum algorithm.
   * File format is GNU Coreutils compatible: each line holds checksum followed by two spaces and artifact relative path
   * (from local repository root, without leading "./"). Metadata checksums are covered as well, keyed by the metadata
   * path composed from the origin repository key (for example {@code g/a/v/maven-metadata-central.xml}). This means that trusted checksums summary file can be used to
   * validate artifacts or generate it using standard GNU tools like GNU {@code sha1sum} is (for BSD derivatives same
   * file can be used with {@code -r} switch).
   * <p>
   * The format supports comments "#" (hash) and empty lines for easier structuring the file content, and both are
   * ignored. Also, their presence makes the summary file incompatible with GNU Coreutils format. On save of the
   * summary file, the comments and empty lines are lost, and file is sorted by path names for easier diffing
   * (2nd column in file).
   * <p>
   * The source by default is "origin aware", and it will factor in origin repository ID as well into summary file name,
   * for example "checksums-central.sha256".
   * <p>
   * Example commands for managing summary file (in examples will use repository ID "central"):
   * <ul>
   *     <li>To create summary file: {@code find * -not -name "checksums-central.sha256" -type f -print0 |
   *       xargs -0 sha256sum | sort -k 2 > checksums-central.sha256}</li>
   *     <li>To verify artifacts using summary file: {@code sha256sum --quiet -c checksums-central.sha256}</li>
   * </ul>
   * <p>
   * The checksums summary file is lazily loaded and remains cached during lifetime of the component, so file changes
   * during lifecycle of the component are not picked up. This implementation can be simultaneously used to lookup and
   * also record checksums. The recorded checksums will become visible for every session, and will be flushed
   * at repository system shutdown, merged with existing ones on disk.
   * <p>
   * The name of this implementation is "summaryFile".
   *
   * @see <a href="https://man7.org/linux/man-pages/man1/sha1sum.1.html">sha1sum man page</a>
   * @see <a href="https://www.gnu.org/software/coreutils/manual/coreutils.html#md5sum-invocation">GNU Coreutils: md5sum</a>
   * @since 1.9.0
   */
  @Singleton
  @Named(SummaryFileTrustedChecksumsSource.NAME)
  public final class SummaryFileTrustedChecksumsSource extends FileTrustedChecksumsSourceSupport {
      public static final String NAME = "summaryFile";
  
      private static final String CONFIG_PROPS_PREFIX =
              FileTrustedChecksumsSourceSupport.CONFIG_PROPS_PREFIX + NAME + ".";
  
      /**
      * Is checksum source enabled?
      *
      * @configurationSource {@link RepositorySystemSession#getConfigProperties()}
      * @configurationType {@link java.lang.Boolean}
      * @configurationDefaultValue false
      */
     public static final String CONFIG_PROP_ENABLED = FileTrustedChecksumsSourceSupport.CONFIG_PROPS_PREFIX + NAME;
 
     /**
      * The basedir where checksums are. If relative, is resolved from local repository root.
      *
      * @configurationSource {@link RepositorySystemSession#getConfigProperties()}
      * @configurationType {@link java.lang.String}
      * @configurationDefaultValue {@link #LOCAL_REPO_PREFIX_DIR}
      */
     public static final String CONFIG_PROP_BASEDIR = CONFIG_PROPS_PREFIX + "basedir";
 
     public static final String LOCAL_REPO_PREFIX_DIR = ".checksums";
 
     /**
      * Is source origin aware?
      *
      * @configurationSource {@link RepositorySystemSession#getConfigProperties()}
      * @configurationType {@link java.lang.Boolean}
      * @configurationDefaultValue true
      */
     public static final String CONFIG_PROP_ORIGIN_AWARE = CONFIG_PROPS_PREFIX + "originAware";
 
     public static final String CHECKSUMS_FILE_PREFIX = "checksums";
 
     private final LocalPathComposer localPathComposer;
 
     private final RepositorySystemLifecycle repositorySystemLifecycle;
 
     private final PathProcessor pathProcessor;
 
     private final ConcurrentHashMap<Path, ConcurrentHashMap<String, String>> checksums;
 
     private final ConcurrentHashMap<Path, Boolean> changedChecksums;
 
     private final AtomicBoolean onShutdownHandlerRegistered;
 
     @Inject
     public SummaryFileTrustedChecksumsSource(
             RepositoryKeyFunctionFactory repoKeyFunctionFactory,
             LocalPathComposer localPathComposer,
             RepositorySystemLifecycle repositorySystemLifecycle,
             PathProcessor pathProcessor) {
         super(repoKeyFunctionFactory);
         this.localPathComposer = requireNonNull(localPathComposer);
         this.repositorySystemLifecycle = requireNonNull(repositorySystemLifecycle);
         this.pathProcessor = requireNonNull(pathProcessor);
         this.checksums = new ConcurrentHashMap<>();
         this.changedChecksums = new ConcurrentHashMap<>();
         this.onShutdownHandlerRegistered = new AtomicBoolean(false);
     }
 
     @Override
     protected boolean isEnabled(RepositorySystemSession session) {
         return ConfigUtils.getBoolean(session, false, CONFIG_PROP_ENABLED);
     }
 
     private boolean isOriginAware(RepositorySystemSession session) {
         return ConfigUtils.getBoolean(session, true, CONFIG_PROP_ORIGIN_AWARE);
     }
 
     @Override
     protected Map<String, String> doGetTrustedArtifactChecksums(
             RepositorySystemSession session,
             Artifact artifact,
             ArtifactRepository artifactRepository,
             List<ChecksumAlgorithmFactory> checksumAlgorithmFactories) {
         return doGetTrustedPathChecksums(
                 session,
                 repositoryKey(session, artifactRepository).subList(0, 1),
                 rk -> localPathComposer.getPathForArtifact(artifact, false),
                 checksumAlgorithmFactories);
     }
 
     @Override
     protected Map<String, String> doGetTrustedMetadataChecksums(
             RepositorySystemSession session,
             Metadata metadata,
             ArtifactRepository artifactRepository,
             List<ChecksumAlgorithmFactory> checksumAlgorithmFactories) {
         return doGetTrustedPathChecksums(
                 session,
                 repositoryKey(session, artifactRepository),
                 rk -> localPathComposer.getPathForMetadata(metadata, rk),
                 checksumAlgorithmFactories);
     }
 
     /**
      * Looks up the trusted checksums for given local-repository style path (the summary file 2nd column), be it
      * an artifact or a metadata path.
      */
     private Map<String, String> doGetTrustedPathChecksums(
             RepositorySystemSession session,
             List<String> repoKeys,
             Function<String, String> pathComposer,
             List<ChecksumAlgorithmFactory> checksumAlgorithmFactories) {
         final HashMap<String, String> result = new HashMap<>();
         final Path basedir = getBasedir(session, LOCAL_REPO_PREFIX_DIR, CONFIG_PROP_BASEDIR, false);
         if (Files.isDirectory(basedir)) {
             final boolean originAware = isOriginAware(session);
             for (String repoKey : repoKeys) {
                 for (ChecksumAlgorithmFactory checksumAlgorithmFactory : checksumAlgorithmFactories) {
                     Path summaryFile =
                             summaryFile(basedir, originAware, repoKey, checksumAlgorithmFactory.getFileExtension());
                     ConcurrentHashMap<String, String> algorithmChecksums =
                             checksums.computeIfAbsent(summaryFile, f -> loadProvidedChecksums(summaryFile));
                     String checksum = algorithmChecksums.get(pathComposer.apply(repoKey));
                     if (checksum != null) {
                         result.putIfAbsent(checksumAlgorithmFactory.getName(), checksum);
                     }
                 }
             }
         }
         return result;
     }
 
     @Override
     protected Writer doGetTrustedArtifactChecksumsWriter(RepositorySystemSession session) {
         if (onShutdownHandlerRegistered.compareAndSet(false, true)) {
             repositorySystemLifecycle.addOnSystemEndedHandler(this::saveRecordedLines);
         }
         return new SummaryFileWriter(
                 checksums,
                 getBasedir(session, LOCAL_REPO_PREFIX_DIR, CONFIG_PROP_BASEDIR, true),
                 isOriginAware(session),
                 r -> repositoryKey(session, r).get(0));
     }
 
     /**
      * Returns the summary file path. The file itself and its parent directories may not exist, this method merely
      * calculate the path.
      */
     private Path summaryFile(Path basedir, boolean originAware, String safeRepositoryId, String checksumExtension) {
         String fileName = CHECKSUMS_FILE_PREFIX;
         if (originAware) {
             // defense in depth: the repository key is spliced into the summary file name,
             // so it must be a safe path segment
             PathUtils.validatePathComponent(safeRepositoryId, "repository key");
             fileName += "-" + safeRepositoryId;
         }
         return basedir.resolve(fileName + "." + checksumExtension);
     }
 
     private ConcurrentHashMap<String, String> loadProvidedChecksums(Path summaryFile) {
         ConcurrentHashMap<String, String> result = new ConcurrentHashMap<>();
         if (Files.isRegularFile(summaryFile)) {
             try (BufferedReader reader = Files.newBufferedReader(summaryFile, StandardCharsets.UTF_8)) {
                 String line;
                 while ((line = reader.readLine()) != null) {
                     if (!line.startsWith("#") && !line.isEmpty()) {
                         String[] parts = line.split("  ", 2);
                         if (parts.length == 2) {
                             String newChecksum = parts[0];
                             String artifactPath = parts[1];
                             String oldChecksum = result.put(artifactPath, newChecksum);
                             if (oldChecksum != null) {
                                 if (Objects.equals(oldChecksum, newChecksum)) {
                                     logger.warn(
                                             "Checksums file '{}' contains duplicate checksums for artifact {}: {}",
                                             summaryFile,
                                             artifactPath,
                                             oldChecksum);
                                 } else {
                                     logger.warn(
                                             "Checksums file '{}' contains different checksums for artifact {}: "
                                                     + "old '{}' replaced by new '{}'",
                                             summaryFile,
                                             artifactPath,
                                             oldChecksum,
                                             newChecksum);
                                 }
                             }
                         } else {
                             logger.warn("Checksums file '{}' ignored malformed line '{}'", summaryFile, line);
                         }
                     }
                 }
             } catch (IOException e) {
                 throw new UncheckedIOException(e);
             }
             logger.info("Loaded {} trusted checksums from {}", result.size(), summaryFile);
         }
         return result;
     }
 
     private class SummaryFileWriter implements Writer {
         private final ConcurrentHashMap<Path, ConcurrentHashMap<String, String>> cache;
 
         private final Path basedir;
 
         private final boolean originAware;
 
         private final Function<ArtifactRepository, String> repositoryKeyFunction;
 
         private SummaryFileWriter(
                 ConcurrentHashMap<Path, ConcurrentHashMap<String, String>> cache,
                 Path basedir,
                 boolean originAware,
                 Function<ArtifactRepository, String> repositoryKeyFunction) {
             this.cache = cache;
             this.basedir = basedir;
             this.originAware = originAware;
             this.repositoryKeyFunction = repositoryKeyFunction;
         }
 
         @Override
         public void addTrustedArtifactChecksums(
                 Artifact artifact,
                 ArtifactRepository artifactRepository,
                 List<ChecksumAlgorithmFactory> checksumAlgorithmFactories,
                 Map<String, String> trustedArtifactChecksums) {
             addTrustedPathChecksums(
                     artifact,
                     localPathComposer.getPathForArtifact(artifact, false),
                     artifactRepository,
                     checksumAlgorithmFactories,
                     trustedArtifactChecksums);
         }
 
         @Override
         public void addTrustedMetadataChecksums(
                 Metadata metadata,
                 ArtifactRepository artifactRepository,
                 List<ChecksumAlgorithmFactory> checksumAlgorithmFactories,
                 Map<String, String> trustedMetadataChecksums) {
             addTrustedPathChecksums(
                     metadata,
                     localPathComposer.getPathForMetadata(metadata, repositoryKeyFunction.apply(artifactRepository)),
                     artifactRepository,
                     checksumAlgorithmFactories,
                     trustedMetadataChecksums);
         }
 
         private void addTrustedPathChecksums(
                 Object subject,
                 String path,
                 ArtifactRepository artifactRepository,
                 List<ChecksumAlgorithmFactory> checksumAlgorithmFactories,
                 Map<String, String> trustedChecksums) {
             for (ChecksumAlgorithmFactory checksumAlgorithmFactory : checksumAlgorithmFactories) {
                 Path summaryFile = summaryFile(
                         basedir,
                         originAware,
                         repositoryKeyFunction.apply(artifactRepository),
                         checksumAlgorithmFactory.getFileExtension());
                 String checksum = requireNonNull(trustedChecksums.get(checksumAlgorithmFactory.getName()));
 
                 String oldChecksum = cache.computeIfAbsent(summaryFile, k -> loadProvidedChecksums(summaryFile))
                         .put(path, checksum);
 
                 if (oldChecksum == null) {
                     changedChecksums.put(summaryFile, Boolean.TRUE); // new
                 } else if (!Objects.equals(oldChecksum, checksum)) {
                     changedChecksums.put(summaryFile, Boolean.TRUE); // replaced
                     logger.info("Trusted checksum for {} replaced: old {}, new {}", subject, oldChecksum, checksum);
                 }
             }
         }
     }
 
     /**
      * On-close handler that saves recorded checksums, if any.
      */
     private void saveRecordedLines() {
         if (changedChecksums.isEmpty()) {
             return;
         }
 
         ArrayList<Exception> exceptions = new ArrayList<>();
         for (Map.Entry<Path, ConcurrentHashMap<String, String>> entry : checksums.entrySet()) {
             Path summaryFile = entry.getKey();
             if (changedChecksums.get(summaryFile) != Boolean.TRUE) {
                 continue;
             }
             ConcurrentHashMap<String, String> recordedLines = entry.getValue();
             if (!recordedLines.isEmpty()) {
                 try {
                     ConcurrentHashMap<String, String> result = new ConcurrentHashMap<>();
                     result.putAll(loadProvidedChecksums(summaryFile));
                     result.putAll(recordedLines);
 
                     logger.info("Saving {} checksums to '{}'", result.size(), summaryFile);
                     pathProcessor.writeWithBackup(
                             summaryFile,
                             result.entrySet().stream()
                                     .sorted(Map.Entry.comparingByKey())
                                     .map(e -> e.getValue() + "  " + e.getKey())
                                     .collect(Collectors.joining(System.lineSeparator())));
                 } catch (IOException e) {
                     exceptions.add(e);
                 }
             }
         }
         MultiRuntimeException.mayThrow("session save checksums failure", exceptions);
     }
 }